From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-23.2 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2376DC64E8A for ; Thu, 3 Dec 2020 10:29:49 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 8BACE21D1A for ; Thu, 3 Dec 2020 10:29:48 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 8BACE21D1A Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id AB4D76B005D; Thu, 3 Dec 2020 05:29:47 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id A3DD56B0068; Thu, 3 Dec 2020 05:29:47 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 904B56B006C; Thu, 3 Dec 2020 05:29:47 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0192.hostedemail.com [216.40.44.192]) by kanga.kvack.org (Postfix) with ESMTP id 762136B005D for ; Thu, 3 Dec 2020 05:29:47 -0500 (EST) Received: from smtpin19.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 3C4408249980 for ; Thu, 3 Dec 2020 10:29:47 +0000 (UTC) X-FDA: 77551600014.19.news16_3e0ed49273bb Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin19.hostedemail.com (Postfix) with ESMTP id 2EF0B1AD31E for ; Thu, 3 Dec 2020 10:29:47 +0000 (UTC) X-HE-Tag: news16_3e0ed49273bb X-Filterd-Recvd-Size: 5826 Received: from mail-ot1-f68.google.com (mail-ot1-f68.google.com [209.85.210.68]) by imf49.hostedemail.com (Postfix) with ESMTP for ; Thu, 3 Dec 2020 10:29:46 +0000 (UTC) Received: by mail-ot1-f68.google.com with SMTP id y24so1279890otk.3 for ; Thu, 03 Dec 2020 02:29:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=dD/UF3nKA/vHAeqLilY0XbqwU9Dd3XarhmvDlCA55tM=; b=sNAUb/6EpXsXZLgScT2nBxmPy0qJ8cz5eUI+26eOvpwQ34r3z4nNCosaC5QHGRCTTv ooKyyAGZP4PiQA2DsJyROx/nzT8LgObcMWN7pHC4vIVt9wVl16nEueIrXK3EPyr4wYDx igu1H3z1STu2hP/BAMzv8BB7kcmC0wT/PcFZW4Xx18MJA/F150Z8JWiGW3NFVJF+fpEW W7IRu+4ah0axnhkYH2zOKap3cVSCsnWpPTLkMsWn3iEHCFshS7yRkWWsQiLvKbMc9SLU jodXExiQPL0dd1K16UWOU1xbH7sJesNfY+8hEtJ9AQpsgbcVdAwtCCMm/kPqCyuxLSmL lDXA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=dD/UF3nKA/vHAeqLilY0XbqwU9Dd3XarhmvDlCA55tM=; b=LmIo4fWzQaCVVBM16dvefUdG3yNPe2D9A4kL8QtOJyPnq1J3ArqyHyw3a5PSXwfQxE bdzpM5jGLzOr5IsiHRkgJk0sMeW/zzX+KzZaDxk39zn+kVxkdTAV3KTyth8lo/LN15Tg ONiss53vO3c5JfjLo9kX93Ha9PhNFEwCbeY7Ffyt8O8AVJeriXNt6uRZiDXJk18NaTno a9S8n60aGx2I6EseXvFOZ2iYMFyBWkTx4Wnq+z+Tf+G6rZCLasKHOOh904TDrWvVGxHz kFZdBFIH/baVoF9Uhl36GgdbUyWlH30g4H5hkjq3Xw+OJFFY6bYuM0qWo38bzLHjeWBm vKgw== X-Gm-Message-State: AOAM5325WBdYqHdHZlNx6Yj+SB+IYKnRKht3qG06p/oNzKFLWQ8h2nvR DouvhXOXZX5DyMy8M70CGwfcJCQKF/xjgrWFIX9peA== X-Google-Smtp-Source: ABdhPJydGvdWaYJOm+Ie12Lw3ZJQHjW/6RDf4PUUEjAcJRpmJDcB86vOtH+sjygI7l3Ka0hhovq+moKy+jtukv+vr9A= X-Received: by 2002:a9d:7cc8:: with SMTP id r8mr1563625otn.233.1606991385992; Thu, 03 Dec 2020 02:29:45 -0800 (PST) MIME-Version: 1.0 References: <20201203022748.30681-1-walter-zh.wu@mediatek.com> In-Reply-To: <20201203022748.30681-1-walter-zh.wu@mediatek.com> From: Marco Elver Date: Thu, 3 Dec 2020 11:29:34 +0100 Message-ID: Subject: Re: [PATCH v5 3/4] lib/test_kasan.c: add workqueue test case To: Walter Wu Cc: Andrew Morton , Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , Andrey Konovalov , Matthias Brugger , kasan-dev , Linux Memory Management List , LKML , Linux ARM , wsd_upstream , linux-mediatek@lists.infradead.org Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, 3 Dec 2020 at 03:27, Walter Wu wrote: > > Adds a test to verify workqueue stack recording and print it in > KASAN report. > > The KASAN report was as follows(cleaned up slightly): > > BUG: KASAN: use-after-free in kasan_workqueue_uaf > > Freed by task 54: > kasan_save_stack+0x24/0x50 > kasan_set_track+0x24/0x38 > kasan_set_free_info+0x20/0x40 > __kasan_slab_free+0x10c/0x170 > kasan_slab_free+0x10/0x18 > kfree+0x98/0x270 > kasan_workqueue_work+0xc/0x18 > > Last potentially related work creation: > kasan_save_stack+0x24/0x50 > kasan_record_wq_stack+0xa8/0xb8 > insert_work+0x48/0x288 > __queue_work+0x3e8/0xc40 > queue_work_on+0xf4/0x118 > kasan_workqueue_uaf+0xfc/0x190 > > Signed-off-by: Walter Wu > Acked-by: Marco Elver > Reviewed-by: Dmitry Vyukov > Reviewed-by: Andrey Konovalov > Cc: Andrey Ryabinin > Cc: Alexander Potapenko > Cc: Matthias Brugger > --- > > v4: > - testcase has merge conflict, so that rebase onto the KASAN-KUNIT > > --- > lib/test_kasan_module.c | 29 +++++++++++++++++++++++++++++ > 1 file changed, 29 insertions(+) > > diff --git a/lib/test_kasan_module.c b/lib/test_kasan_module.c > index 2d68db6ae67b..62a87854b120 100644 > --- a/lib/test_kasan_module.c > +++ b/lib/test_kasan_module.c > @@ -91,6 +91,34 @@ static noinline void __init kasan_rcu_uaf(void) > call_rcu(&global_rcu_ptr->rcu, kasan_rcu_reclaim); > } > > +static noinline void __init kasan_workqueue_work(struct work_struct *work) > +{ > + kfree(work); > +} > + > +static noinline void __init kasan_workqueue_uaf(void) > +{ > + struct workqueue_struct *workqueue; > + struct work_struct *work; > + > + workqueue = create_workqueue("kasan_wq_test"); > + if (!workqueue) { > + pr_err("Allocation failed\n"); > + return; > + } > + work = kmalloc(sizeof(struct work_struct), GFP_KERNEL); > + if (!work) { > + pr_err("Allocation failed\n"); > + return; > + } > + > + INIT_WORK(work, kasan_workqueue_work); > + queue_work(workqueue, work); > + destroy_workqueue(workqueue); > + > + pr_info("use-after-free on workqueue\n"); > + ((volatile struct work_struct *)work)->data; > +} > > static int __init test_kasan_module_init(void) > { > @@ -102,6 +130,7 @@ static int __init test_kasan_module_init(void) > > copy_user_test(); > kasan_rcu_uaf(); > + kasan_workqueue_uaf(); Why can't this go into the KUnit based KASAN test?