Syzbot reports many UAF issues for workqueue, see [1]. In some of these access/allocation happened in process_one_work(), we see the free stack is useless in KASAN report, it doesn't help programmers to solve UAF for workqueue issue.
This patchset improves KASAN reports by making them to have workqueue queueing stack. It is useful for programmers to solve use-after-free or double-free memory issue. Generic KASAN also records the last two workqueue stacks and prints them in KASAN report. It is only suitable for generic KASAN. [1]https://groups.google.com/g/syzkaller-bugs/search?q=%22use-after-free%22+process_one_work [2]https://bugzilla.kernel.org/show_bug.cgi?id=198437 Walter Wu (4): workqueue: kasan: record workqueue stack kasan: print workqueue stack lib/test_kasan.c: add workqueue test case kasan: update documentation for generic kasan --- Changes since v4: - Not found timer use case, so that remove timer patch - remove a mention of call_rcu() from the kasan_record_aux_stack() Thanks for Dmitry and Alexander suggestion. Changes since v3: - testcases have merge conflict, so that need to be rebased onto the KASAN-KUNIT. Changes since v2: - modify kasan document to be readable, Thanks for Marco suggestion. Changes since v1: - Thanks for Marco and Thomas suggestion. - Remove unnecessary code and fix commit log - reuse kasan_record_aux_stack() and aux_stack to record timer and workqueue stack. - change the aux stack title for common name. --- Documentation/dev-tools/kasan.rst | 5 +++-- kernel/workqueue.c | 3 +++ lib/test_kasan_module.c | 29 +++++++++++++++++++++++++++++ mm/kasan/generic.c | 4 +--- mm/kasan/report.c | 4 ++-- 5 files changed, 38 insertions(+), 7 deletions(-)
