default value y, and for clang prompt and default value n.
[1]: https://bugzilla.kernel.org/show_bug.cgi?id=210221
Signed-off-by: Walter Wu
Suggested-by: Dmitry Vyukov
Reviewed-by: Nathan Chancellor
Acked-by: Arnd Bergmann
Reviewed-by: Andrey Konovalov
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
/show_bug.cgi?id=198437
[2]https://groups.google.com/forum/#!searchin/kasan-dev/better$20stack$20traces$20for$20rcu%7Csort:date/kasan-dev/KQsjT_88hDE/7rNUZprRBgAJ
Signed-off-by: Walter Wu
Suggested-by: Dmitry Vyukov
Acked-by: Paul E. McKenney
Reviewed-and-tested-by: Dmitry Vyukov
Reviewed-by: Andrey
printing message
- remove descriptions in Kocong.kasan
Changes since v5:
- reuse print_stack() in print_track()
Changes since v6:
- fix typo
- renamed the variable name in testcase
Walter Wu (4):
rcu: kasan: record and print call_rcu() call stack
kasan: record and print the free track
kasan: add tests
Test call_rcu() call stack recording and verify whether it correctly
is printed in KASAN report.
Signed-off-by: Walter Wu
Reviewed-and-tested-by: Dmitry Vyukov
Reviewed-by: Andrey Konovalov
Cc: Andrey Ryabinin
Cc: Alexander Potapenko
Cc: Matthias Brugger
---
Changes since v6:
- renamed the
) Remove the free_track from struct kasan_alloc_meta.
2) Add the free_track into struct kasan_free_meta.
3) Add a macro KASAN_KMALLOC_FREETRACK in order to check whether
it can print free stack in KASAN report.
[1]https://bugzilla.kernel.org/show_bug.cgi?id=198437
Signed-off-by: Walter Wu
Suggested
Generic KASAN will support to record the last two call_rcu() call stacks
and print them in KASAN report. So that need to update documentation.
Signed-off-by: Walter Wu
Reviewed-and-tested-by: Dmitry Vyukov
Reviewed-by: Andrey Konovalov
Cc: Andrey Ryabinin
Cc: Alexander Potapenko
Cc: Jonathan
object slot creation
- modify documentation
Changes since v4:
- change variable name to be more clearly
- remove the redundant condition
- remove init free meta-data and increasing object condition
Walter Wu (4):
rcu/kasan: record and print call_rcu() call stack
kasan: record and print the free
/show_bug.cgi?id=198437
[2]https://groups.google.com/forum/#!searchin/kasan-dev/better$20stack$20traces$20for$20rcu%7Csort:date/kasan-dev/KQsjT_88hDE/7rNUZprRBgAJ
Signed-off-by: Walter Wu
Suggested-by: Dmitry Vyukov
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Andrew Morton
Cc: Paul
and kasan_free_meta:
- remove free track from kasan_alloc_meta.
- add free track into kasan_free_meta.
[1]https://bugzilla.kernel.org/show_bug.cgi?id=198437
Signed-off-by: Walter Wu
Suggested-by: Dmitry Vyukov
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
---
mm/kasan/common.c
Test call_rcu() call stack recording and verify whether it correctly
is printed in KASAN report.
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Matthias Brugger
---
lib/test_kasan.c | 30 ++
1 file changed, 30
Generic KASAN will support to record the last two call_rcu() call
stacks and print them in KASAN report. So need to update documentation.
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Jonathan Corbet
---
Documentation/dev-tools/kasan.rst | 3
Hi Andrey,
On Tue, 2020-05-19 at 16:52 +0200, 'Andrey Konovalov' via kasan-dev
wrote:
> On Tue, May 19, 2020 at 4:24 AM Walter Wu wrote:
> >
> > This feature will record the last two call_rcu() call stacks and
> > prints up to 2 call_rcu() call stacks in KASAN rep
On Tue, 2020-05-19 at 08:48 -0700, Paul E. McKenney wrote:
> On Tue, May 19, 2020 at 10:23:59AM +0800, Walter Wu wrote:
> > This feature will record the last two call_rcu() call stacks and
> > prints up to 2 call_rcu() call stacks in KASAN report.
> >
> > When call_rc
> On Tue, May 19, 2020 at 4:25 AM Walter Wu wrote:
> >
> > Move free track from slub alloc meta-data to slub free meta-data in
> > order to make struct kasan_free_meta size is 16 bytes. It is a good
> > size because it is the minimal redzone size and a good number of
> On Wed, May 20, 2020 at 6:03 AM Walter Wu wrote:
> >
> > > On Tue, May 19, 2020 at 4:25 AM Walter Wu
> > > wrote:
> > > >
> > > > Move free track from slub alloc meta-data to slub free meta-data in
> > > > order to make str
> On Wed, May 20, 2020 at 6:03 AM Walter Wu wrote:
> >
> > > On Tue, May 19, 2020 at 4:25 AM Walter Wu
> > > wrote:
> > > >
> > > > Move free track from slub alloc meta-data to slub free meta-data in
> > > > order to make str
On Wed, 2020-05-20 at 13:14 +0800, Walter Wu wrote:
> > On Wed, May 20, 2020 at 6:03 AM Walter Wu wrote:
> > >
> > > > On Tue, May 19, 2020 at 4:25 AM Walter Wu
> > > > wrote:
> > > > >
> > > > > Move free track from slub all
> On Wed, May 20, 2020 at 8:18 AM Walter Wu wrote:
> >
> > On Wed, 2020-05-20 at 13:14 +0800, Walter Wu wrote:
> > > > On Wed, May 20, 2020 at 6:03 AM Walter Wu
> > > > wrote:
> > > > >
> > > > > > On Tue, May 19, 2020 at
On Wed, 2020-05-20 at 11:44 +0200, 'Dmitry Vyukov' via kasan-dev wrote:
> On Wed, May 20, 2020 at 11:17 AM Walter Wu wrote:
> > > > On Wed, 2020-05-20 at 13:14 +0800, Walter Wu wrote:
> > > > > > On Wed, May 20, 2020 at 6:03 AM Walter Wu
> > >
On Wed, 2020-05-20 at 13:15 +0200, 'Dmitry Vyukov' via kasan-dev wrote:
> On Wed, May 20, 2020 at 12:15 PM Walter Wu wrote:
> >
> > On Wed, 2020-05-20 at 11:44 +0200, 'Dmitry Vyukov' via kasan-dev wrote:
> > > On Wed, May 20, 2020 at 11:17 AM Walter W
- change printing message
- remove descriptions in Kocong.kasan
Walter Wu (4):
rcu/kasan: record and print call_rcu() call stack
kasan: record and print the free track
kasan: add tests for call_rcu stack recording
kasan: update documentation for generic kasan
Documentation/dev-tools/kasan.rst | 3
/show_bug.cgi?id=198437
[2]https://groups.google.com/forum/#!searchin/kasan-dev/better$20stack$20traces$20for$20rcu%7Csort:date/kasan-dev/KQsjT_88hDE/7rNUZprRBgAJ
Signed-off-by: Walter Wu
Suggested-by: Dmitry Vyukov
Acked-by: Paul E. McKenney
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
) Remove the free_track from struct kasan_alloc_meta.
2) Add the free_track into struct kasan_free_meta.
3) Add a macro KASAN_KMALLOC_FREETRACK in order to check whether
print free stack in KASAN report.
[1]https://bugzilla.kernel.org/show_bug.cgi?id=198437
Signed-off-by: Walter Wu
Suggested-by
Test call_rcu() call stack recording and verify whether it correctly
is printed in KASAN report.
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Matthias Brugger
---
lib/test_kasan.c | 30 ++
1 file changed, 30
Generic KASAN will support to record the last two call_rcu() call stacks
and print them in KASAN report. So that need to update documentation.
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Jonathan Corbet
---
Documentation/dev-tools/kasan.rst | 3
> On Wed, May 20, 2020 at 2:34 PM Walter Wu wrote:
> >
> > This feature will record the last two call_rcu() call stacks and
> > prints up to 2 call_rcu() call stacks in KASAN report.
> >
> > When call_rcu() is called, we store the call_rcu() call stack into
>
printing message
- remove descriptions in Kocong.kasan
Changes since v6:
- reuse print_stack() in print_track()
Walter Wu (4):
rcu/kasan: record and print call_rcu() call stack
kasan: record and print the free track
kasan: add tests for call_rcu stack recording
kasan: update documentation for generic
/show_bug.cgi?id=198437
[2]https://groups.google.com/forum/#!searchin/kasan-dev/better$20stack$20traces$20for$20rcu%7Csort:date/kasan-dev/KQsjT_88hDE/7rNUZprRBgAJ
Signed-off-by: Walter Wu
Suggested-by: Dmitry Vyukov
Acked-by: Paul E. McKenney
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Test call_rcu() call stack recording and verify whether it correctly
is printed in KASAN report.
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Matthias Brugger
---
lib/test_kasan.c | 30 ++
1 file changed, 30
) Remove the free_track from struct kasan_alloc_meta.
2) Add the free_track into struct kasan_free_meta.
3) Add a macro KASAN_KMALLOC_FREETRACK in order to check whether
it can print free stack in KASAN report.
[1]https://bugzilla.kernel.org/show_bug.cgi?id=198437
Signed-off-by: Walter Wu
Suggested
Generic KASAN will support to record the last two call_rcu() call stacks
and print them in KASAN report. So that need to update documentation.
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Jonathan Corbet
---
Documentation/dev-tools/kasan.rst | 3
On Wed, 2020-08-12 at 16:13 +0200, Marco Elver wrote:
> On Mon, 10 Aug 2020 at 09:23, Walter Wu wrote:
> > This patch records the last two timer queueing stacks and prints
> > up to 2 timer stacks in KASAN report. It is useful for programmers
> > to solve use-after-free
rch?q=%22use-after-free%22%20expire_timers
[3]https://bugzilla.kernel.org/show_bug.cgi?id=198437
Walter Wu (5):
timer: kasan: record and print timer stack
workqueue: kasan: record and print workqueue stack
lib/test_kasan.c: add timer test case
lib/test_kasan.c: add workqueue test case
kasan: u
callback, we store
this call stack in order to print it in KASAN report.
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Thomas Gleixner
Cc: John Stultz
Cc: Stephen Boyd
Cc: Andrew Morton
---
include/linux/kasan.h | 2 ++
kernel/time/timer.c
stack in order to print it in KASAN report.
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Tejun Heo
Cc: Lai Jiangshan
Cc: Andrew Morton
---
include/linux/kasan.h | 2 ++
kernel/workqueue.c| 3 +++
mm/kasan/generic.c| 21
+0x20/0x40
__kasan_slab_free+0x10c/0x170
kasan_slab_free+0x10/0x18
kfree+0x98/0x270
kasan_timer_function+0x1c/0x28
Last timer stack:
kasan_save_stack+0x24/0x50
kasan_record_tmr_stack+0xa8/0xb8
init_timer_key+0xf0/0x248
kasan_timer_uaf+0x5c/0xd8
Signed-off-by: Walter Wu
Cc: Andrey
kasan_workqueue_uaf+0xfc/0x190
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Matthias Brugger
---
lib/test_kasan.c | 30 ++
1 file changed, 30 insertions(+)
diff --git a/lib/test_kasan.c b/lib/test_kasan.c
index
Generic KASAN support to record the last two timer and workqueue
stacks and print them in KASAN report. So that need to update
documentation.
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Jonathan Corbet
---
Documentation/dev-tools/kasan.rst | 4
On Mon, 2020-08-10 at 07:19 -0400, Qian Cai wrote:
>
> > On Aug 10, 2020, at 3:21 AM, Walter Wu wrote:
> >
> > Syzbot reports many UAF issues for workqueue or timer, see [1] and [2].
> > In some of these access/allocation happened in process_one_work(),
> > we
On Mon, 2020-08-10 at 19:50 +0800, Walter Wu wrote:
> On Mon, 2020-08-10 at 07:19 -0400, Qian Cai wrote:
> >
> > > On Aug 10, 2020, at 3:21 AM, Walter Wu wrote:
> > >
> > > Syzbot reports many UAF issues for workqueue or timer, see [1] and [2].
> > >
On Mon, 2020-08-10 at 08:44 -0400, Qian Cai wrote:
> On Mon, Aug 10, 2020 at 07:50:57PM +0800, Walter Wu wrote:
> > On Mon, 2020-08-10 at 07:19 -0400, Qian Cai wrote:
> > >
> > > > On Aug 10, 2020, at 3:21 AM, Walter Wu
> > > > wrote:
> >
On Thu, 2021-01-07 at 14:00 -0700, Nathan Chancellor wrote:
> On Thu, Jan 07, 2021 at 02:21:52PM +0800, Walter Wu wrote:
> > CONFIG_KASAN_STACK and CONFIG_KASAN_STACK_ENABLE both enable KASAN
> > stack instrumentation, but we should only need one config option,
> &
default value y, and for clang prompt and default
value n.
[1]: https://bugzilla.kernel.org/show_bug.cgi?id=210221
Signed-off-by: Walter Wu
Suggested-by: Dmitry Vyukov
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Andrey Konovalov
Cc: Alexander Potapenko
Cc: Andrew Morton
Cc: Nathan Chancellor
On Sun, 2020-12-27 at 20:51 +0100, Dmitry Vyukov wrote:
> /\/\/\/\On Sun, Dec 27, 2020 at 8:45 PM Andrew Morton
> wrote:
> >
> > (cc KASAN developers)
> >
> > On Sat, 26 Dec 2020 15:25:14 -0800 syzbot
> > wrote:
> >
> > > Hello,
> > >
> > > syzbot found the following issue on:
> > >
> > > HEAD c
dereference.
[1] https://syzkaller.appspot.com/x/log.txt?x=10a82a50d0
Signed-off-by: Walter Wu
Suggested-by: Dmitry Vyukov
Cc: Andrey Ryabinin
CC: Dmitry Vyukov
CC: Andrey Konovalov
Cc: Alexander Potapenko
Cc: Andrew Morton
---
mm/kasan/generic.c | 2 ++
1 file changed, 2 insertions(+)
diff
On Fri, 2021-02-26 at 09:25 +0800, Walter Wu wrote:
> CONFIG_KASAN_STACK and CONFIG_KASAN_STACK_ENABLE both enable KASAN stack
> instrumentation, but we should only need one config, so that we remove
> CONFIG_KASAN_STACK_ENABLE and make CONFIG_KASAN_STACK workable. see [1].
>
> Wh
Signed-off-by: Walter Wu
Suggested-by: Dmitry Vyukov
Cc: Andrey Konovalov
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Andrew Morton
Cc: Matthias Brugger
Cc: Jens Axboe
Cc: Oleg Nesterov
---
v2: Fix kasan_record_aux_stack() calling sequence issue.
Thanks fo
Hi Dmitry,
On Tue, 2020-12-01 at 08:59 +0100, 'Dmitry Vyukov' via kasan-dev wrote:
> On Wed, Sep 30, 2020 at 5:29 PM Thomas Gleixner wrote:
> >
> > On Thu, Sep 24 2020 at 12:01, Walter Wu wrote:
> > > Syzbot reports many UAF issues for workqueue or timer, see [
On Thu, 2020-12-03 at 11:29 +0100, Marco Elver wrote:
> On Thu, 3 Dec 2020 at 03:27, Walter Wu wrote:
> >
> > Adds a test to verify workqueue stack recording and print it in
> > KASAN report.
> >
> > The KASAN report was as follows(cleaned up slightly):
>
On Tue, 2020-12-01 at 15:02 +0100, 'Dmitry Vyukov' via kasan-dev wrote:
> On Tue, Dec 1, 2020 at 12:17 PM Walter Wu wrote:
> >
> > Hi Dmitry,
> >
> > On Tue, 2020-12-01 at 08:59 +0100, 'Dmitry Vyukov' via kasan-dev wrote:
> > > On We
22use-after-free%22+process_one_work
[2]https://bugzilla.kernel.org/show_bug.cgi?id=198437
Walter Wu (4):
workqueue: kasan: record workqueue stack
kasan: print workqueue stack
lib/test_kasan.c: add workqueue test case
kasan: update documentation for generic kasan
---
Changes since v4:
- Not found
report to determine
whether it is root cause. They don't need to enable debugobjects,
but they have a chance to find out the root cause.
Signed-off-by: Walter Wu
Suggested-by: Marco Elver
Acked-by: Marco Elver
Acked-by: Tejun Heo
Reviewed-by: Dmitry Vyukov
Reviewed-by: Andrey Konovalov
Cc: A
kasan_workqueue_uaf+0xfc/0x190
Signed-off-by: Walter Wu
Acked-by: Marco Elver
Reviewed-by: Dmitry Vyukov
Reviewed-by: Andrey Konovalov
Cc: Andrey Ryabinin
Cc: Alexander Potapenko
Cc: Matthias Brugger
---
v4:
- testcase has merge conflict, so that rebase onto the KASAN-KUNIT
---
lib
The aux_stack[2] is reused to record the call_rcu() call stack
and enqueuing work call stacks. So that we need to change the
auxiliary stack title for common title, print them in KASAN report.
Signed-off-by: Walter Wu
Suggested-by: Marco Elver
Acked-by: Marco Elver
Reviewed-by: Dmitry Vyukov
Generic KASAN also supports to record the last two workqueue
stacks and print them in KASAN report. So that need to update
documentation.
Signed-off-by: Walter Wu
Suggested-by: Marco Elver
Acked-by: Marco Elver
Reviewed-by: Dmitry Vyukov
Reviewed-by: Andrey Konovalov
Cc: Andrey Ryabinin
Cc
Signed-off-by: Walter Wu
Suggested-by: Dmitry Vyukov
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Andrey Konovalov
Cc: Alexander Potapenko
Cc: Andrew Morton
Cc: Matthias Brugger
Cc: Jens Axboe
Cc: Oleg Nesterov
---
kernel/task_work.c | 3 +++
mm/kasan/kasan.h | 2 +-
2 files changed, 4
On Mon, 2021-03-15 at 07:58 +0100, 'Dmitry Vyukov' via kasan-dev wrote:
> On Mon, Mar 15, 2021 at 3:00 AM Walter Wu wrote:
> >
> > Why record task_work_add() call stack?
> > Syzbot reports many use-after-free issues for task_work, see [1].
> > After see the
On Mon, 2021-03-15 at 11:03 +0100, 'Dmitry Vyukov' via kasan-dev wrote:
> On Mon, Mar 15, 2021 at 10:38 AM Walter Wu wrote:
> >
> > On Mon, 2021-03-15 at 07:58 +0100, 'Dmitry Vyukov' via kasan-dev wrote:
> > > On Mon, Mar 15, 2021 at 3:00 AM Walter
On Wed, 2021-03-03 at 19:48 +0800, Walter Wu wrote:
> On Fri, 2021-02-26 at 09:25 +0800, Walter Wu wrote:
> > CONFIG_KASAN_STACK and CONFIG_KASAN_STACK_ENABLE both enable KASAN stack
> > instrumentation, but we should only need one config, so that we remove
> > CONFIG_KASAN_
://bugzilla.kernel.org/show_bug.cgi?id=210221
Signed-off-by: Walter Wu
Suggested-by: Dmitry Vyukov
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Andrey Konovalov
Cc: Alexander Potapenko
Cc: Andrew Morton
---
arch/arm64/kernel/sleep.S| 2 +-
arch/x86/kernel/acpi/wakeup_64.S | 2 +-
include
default value y, and for clang prompt and default value n.
[1]: https://bugzilla.kernel.org/show_bug.cgi?id=210221
Signed-off-by: Walter Wu
Suggested-by: Dmitry Vyukov
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Andrey Konovalov
Cc: Alexander Potapenko
Cc: Andrew Morton
---
v2: make commit
: Walter Wu
---
mm/page_ext.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/mm/page_ext.c b/mm/page_ext.c
index 5f5769c7db3b..7ca33dcd9ffa 100644
--- a/mm/page_ext.c
+++ b/mm/page_ext.c
@@ -65,6 +65,9 @@ static struct page_ext_operations *page_ext_ops[] = {
#if defined
On Mon, 2019-09-09 at 12:57 +0200, David Hildenbrand wrote:
> On 09.09.19 10:53, Walter Wu wrote:
> > KASAN will record last stack of page in order to help programmer
> > to see memory corruption caused by page.
> >
> > What is difference between page_owner and our pa
On Tue, 2019-09-10 at 12:31 +0300, Kirill A. Shutemov wrote:
> On Tue, Sep 10, 2019 at 09:07:49AM +0800, Walter Wu wrote:
> > On Mon, 2019-09-09 at 12:57 +0200, David Hildenbrand wrote:
> > > On 09.09.19 10:53, Walter Wu wrote:
> > > > KASAN will record last
On Mon, 2019-09-09 at 16:24 +0800, walter-zh...@mediatek.com wrote:
> From: Walter Wu
>
> This patch is KASAN report adds the alloc/free stacks for page allocator
> in order to help programmer to see memory corruption caused by page.
>
> By default, KASAN doesn't record a
On Tue, 2019-09-10 at 13:53 +0200, Vlastimil Babka wrote:
> On 9/10/19 12:50 PM, Andrey Ryabinin wrote:
> >
> >
> > For slab objects we memorize both alloc and free stacks. You'll never know
> > in advance what information will be usefull
> > to fix an issue, so it usually better to provide more
On Tue, 2019-09-10 at 13:50 +0300, Andrey Ryabinin wrote:
>
> On 9/9/19 4:07 PM, Vlastimil Babka wrote:
> > On 9/9/19 10:24 AM, walter-zh...@mediatek.com wrote:
> >> From: Walter Wu
> >>
> >> This patch is KASAN report adds the alloc/free stacks f
On Wed, 2019-08-21 at 20:52 +0300, Andrey Ryabinin wrote:
>
> On 8/20/19 8:37 AM, Walter Wu wrote:
> > On Tue, 2019-08-06 at 13:43 +0800, Walter Wu wrote:
> >> This patch adds memory corruption identification at bug report for
> >> software tag-based mode, the report
> > const char *get_bug_type(struct kasan_access_info *info)
> > {
> > +#ifdef CONFIG_KASAN_SW_TAGS_IDENTIFY
> > + struct kasan_alloc_meta *alloc_meta;
> > + struct kmem_cache *cache;
> > + struct page *page;
> > + const void *addr;
> > + void *object;
> > + u8
page:
kasan_free_pages+0x68/0x70
__free_pages_ok+0x3c0/0x1328
__free_pages+0x50/0x78
kfree+0x1c4/0x250
kmalloc_pagealloc_uaf+0x38/0x80
This has been discussed, please refer below link.
https://bugzilla.kernel.org/show_bug.cgi?id=203967
Signed-off-by: Walter Wu
---
lib/Kconfig.kasan | 9 +
mm/
When enable CONFIG_KASAN_DUMP_PAGE, then page_owner will record last stack,
So we need to know the last stack is allocation or free state.
Signed-off-by: Walter Wu
---
mm/page_owner.c | 6 ++
1 file changed, 6 insertions(+)
diff --git a/mm/page_owner.c b/mm/page_owner.c
index addcbb2ae4e4
On Wed, 2019-09-04 at 14:49 +0200, Vlastimil Babka wrote:
> On 9/4/19 8:51 AM, Walter Wu wrote:
> > This patch is KASAN report adds the alloc/free stacks for page allocator
> > in order to help programmer to see memory corruption caused by page.
> >
> > By default, KASA
On Wed, 2019-09-04 at 15:44 +0200, Andrey Konovalov wrote:
> On Wed, Sep 4, 2019 at 8:51 AM Walter Wu wrote:
> > +config KASAN_DUMP_PAGE
> > + bool "Dump the page last stack information"
> > + depends on KASAN && PAGE_OWNER
> > +
On Wed, 2019-09-04 at 16:13 +0200, Vlastimil Babka wrote:
> On 9/4/19 4:06 PM, Walter Wu wrote:
> > On Wed, 2019-09-04 at 14:49 +0200, Vlastimil Babka wrote:
> >> On 9/4/19 8:51 AM, Walter Wu wrote:
> >> > This patch is KASAN report adds the alloc/free stacks for pag
On Wed, 2019-09-04 at 10:37 -0400, Qian Cai wrote:
> On Wed, 2019-09-04 at 22:16 +0800, Walter Wu wrote:
> > On Wed, 2019-09-04 at 15:44 +0200, Andrey Konovalov wrote:
> > > On Wed, Sep 4, 2019 at 8:51 AM Walter Wu
> > > wrote:
> > > > +config KASAN_DUMP_P
On Thu, 2019-09-05 at 10:03 +0200, Vlastimil Babka wrote:
> On 9/4/19 4:24 PM, Walter Wu wrote:
> > On Wed, 2019-09-04 at 16:13 +0200, Vlastimil Babka wrote:
> >> On 9/4/19 4:06 PM, Walter Wu wrote:
> >>
> >> The THP fix is not required for the rest of the
ree+0x1c4/0x250
kmalloc_pagealloc_uaf+0x38/0x80
Changes since v1:
- slim page_owner and move it into kasan
- enable the feature by default
Changes since v2:
- enable PAGE_OWNER by default
- use DEBUG_PAGEALLOC to get page information
cc: Andrey Ryabinin
cc: Vlastimil Babka
cc: Andrey Konovalov
Signed-of
bka
cc: Andrey Konovalov
Signed-off-by: Walter Wu
---
lib/Kconfig.kasan | 15 +++
1 file changed, 15 insertions(+)
diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan
index 4fafba1a923b..a3683e952b10 100644
--- a/lib/Kconfig.kasan
+++ b/lib/Kconfig.kasan
@@ -41,6 +41,7 @@ confi
> extern void __reset_page_owner(struct page *page, unsigned int order);
> diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan
> index 6c9682ce0254..dc560c7562e8 100644
> --- a/lib/Kconfig.kasan
> +++ b/lib/Kconfig.kasan
> @@ -41,6 +41,8 @@ config KASAN_GENERIC
> select SLUB_DEBUG if SLUB
>
On Thu, 2019-09-12 at 16:31 +0200, Vlastimil Babka wrote:
> On 9/12/19 4:08 PM, Walter Wu wrote:
> >
> >> extern void __reset_page_owner(struct page *page, unsigned int order);
> >> diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan
> >> index 6c9682ce0254
On Mon, 2019-09-30 at 12:36 +0800, Walter Wu wrote:
> On Fri, 2019-09-27 at 21:41 +0200, Dmitry Vyukov wrote:
> > On Fri, Sep 27, 2019 at 4:22 PM Walter Wu wrote:
> > >
> > > On Fri, 2019-09-27 at 15:07 +0200, Dmitry Vyukov wrote:
> > > > On Fri, Sep 27, 20
On Wed, 2019-10-02 at 15:57 +0200, Dmitry Vyukov wrote:
> On Wed, Oct 2, 2019 at 2:15 PM Walter Wu wrote:
> >
> > On Mon, 2019-09-30 at 12:36 +0800, Walter Wu wrote:
> > > On Fri, 2019-09-27 at 21:41 +0200, Dmitry Vyukov wrote:
> > > > On Fri, Sep 27, 2019
On Thu, 2019-10-03 at 08:26 +0200, Dmitry Vyukov wrote:
> On Thu, Oct 3, 2019 at 4:18 AM Walter Wu wrote:
> >
> > On Wed, 2019-10-02 at 15:57 +0200, Dmitry Vyukov wrote:
> > > On Wed, Oct 2, 2019 at 2:15 PM Walter Wu
> > > wrote:
> > > >
> &g
On Thu, 2019-10-03 at 17:38 +0800, Walter Wu wrote:
> On Thu, 2019-10-03 at 08:26 +0200, Dmitry Vyukov wrote:
> > On Thu, Oct 3, 2019 at 4:18 AM Walter Wu wrote:
> > >
> > > On Wed, 2019-10-02 at 15:57 +0200, Dmitry Vyukov wrote:
> > > > On Wed, Oct 2, 20
On Thu, 2019-10-03 at 16:53 +0200, Dmitry Vyukov wrote:
> On Thu, Oct 3, 2019 at 3:51 PM Walter Wu wrote:>
> > how about this?
> >
> > commit fd64691026e7ccb8d2946d0804b0621ac177df38
> > Author: Walter Wu
> > Date: Fri Sep 27 09:54:18 2019 +0800
> >
&g
On Fri, 2019-10-04 at 12:42 +0800, Walter Wu wrote:
> On Thu, 2019-10-03 at 16:53 +0200, Dmitry Vyukov wrote:
> > On Thu, Oct 3, 2019 at 3:51 PM Walter Wu wrote:>
> > >
> > > static void print_error_description(struct kasan_access_info *info)
> > > {
>
On Fri, 2019-09-27 at 21:41 +0200, Dmitry Vyukov wrote:
> On Fri, Sep 27, 2019 at 4:22 PM Walter Wu wrote:
> >
> > On Fri, 2019-09-27 at 15:07 +0200, Dmitry Vyukov wrote:
> > > On Fri, Sep 27, 2019 at 5:43 AM Walter Wu
> > > wrote:
> > > >
> >
On Mon, 2019-09-30 at 10:57 +0200, Marc Gonzalez wrote:
> On 30/09/2019 06:36, Walter Wu wrote:
>
> > bool check_memory_region(unsigned long addr, size_t size, bool write,
> > unsigned long ret_ip)
> > {
> &
On Tue, 2019-10-01 at 05:01 +0200, Dmitry Vyukov wrote:
> On Tue, Oct 1, 2019 at 4:36 AM Walter Wu wrote:
> >
> > On Mon, 2019-09-30 at 10:57 +0200, Marc Gonzalez wrote:
> > > On 30/09/2019 06:36, Walter Wu wrote:
> > >
> > > > bool check_memory_regio
On Mon, 2019-10-07 at 15:33 +0200, Dmitry Vyukov wrote:
> On Mon, Oct 7, 2019 at 2:33 PM Walter Wu wrote:
> > On Mon, 2019-10-07 at 14:19 +0200, Dmitry Vyukov wrote:
> > > On Mon, Oct 7, 2019 at 2:03 PM Walter Wu
> > > wrote:
> > > My idea was just to always
On Tue, 2019-10-08 at 05:47 -0400, Qian Cai wrote:
>
> > On Oct 8, 2019, at 2:16 AM, Walter Wu wrote:
> >
> > It is an undefined behavior to pass a negative numbers to
> >memset()/memcpy()/memmove(), so need to be detected by KASAN.
>
> Why can’t this be
On Tue, 2019-10-08 at 07:42 -0400, Qian Cai wrote:
>
> > On Oct 8, 2019, at 7:02 AM, Walter Wu wrote:
> >
> > I don't know very well in UBSAN, but I try to build ubsan kernel and
> > test a negative number in memset and kmalloc_memmove_invalid_size(), it
> &
On Fri, 2019-10-04 at 11:18 +0200, Dmitry Vyukov wrote:
> On Fri, Oct 4, 2019 at 10:02 AM Walter Wu wrote:
> >
> > On Fri, 2019-10-04 at 12:42 +0800, Walter Wu wrote:
> > > On Thu, 2019-10-03 at 16:53 +0200, Dmitry Vyukov wrote:
> > > > On Thu, Oct 3, 2019
ugzilla.kernel.org/show_bug.cgi?id=199341
[2]https://lore.kernel.org/linux-arm-kernel/20190927034338.15813-1-walter-zh...@mediatek.com/
Walter Wu (2):
kasan: detect invalid size in memory operation function
kasan: add test for invalid size in memmove
lib/test_kasan.c | 18 +
On Fri, 2019-10-04 at 15:52 +0200, Dmitry Vyukov wrote:
> On Fri, Oct 4, 2019 at 2:05 PM Walter Wu wrote:
> >
> > On Fri, 2019-10-04 at 11:54 +0200, Dmitry Vyukov wrote:
> > > > > "out-of-bounds" is the _least_ frequent KASAN bug type. So saying
> &g
stems, e.g. syzbot."
>
> Looks good to me. I think it should provide enough hooks for future
> readers to understand why we do this.
>
Thanks for your review and suggestion again.
If no other questions, We will send this patchset.
The patchsets help to produce KASAN report whe
On Mon, 2019-10-07 at 10:24 +0200, Dmitry Vyukov wrote:
> On Mon, Oct 7, 2019 at 10:18 AM Walter Wu wrote:
> > The patchsets help to produce KASAN report when size is negative numbers
> > in memory operation function. It is helpful for programmer to solve the
> > undefined be
On Mon, 2019-10-07 at 10:54 +0200, Dmitry Vyukov wrote:
> On Mon, Oct 7, 2019 at 10:52 AM Walter Wu wrote:
> >
> > On Mon, 2019-10-07 at 10:24 +0200, Dmitry Vyukov wrote:
> > > On Mon, Oct 7, 2019 at 10:18 AM Walter Wu
> > > wrote:
> > > > The patchs
On Mon, 2019-10-07 at 11:10 +0200, Dmitry Vyukov wrote:
> On Mon, Oct 7, 2019 at 11:03 AM Walter Wu wrote:
> >
> > On Mon, 2019-10-07 at 10:54 +0200, Dmitry Vyukov wrote:
> > > On Mon, Oct 7, 2019 at 10:52 AM Walter Wu
> > > wrote:
> > > >
>
On Mon, 2019-10-07 at 17:28 +0800, Walter Wu wrote:
> On Mon, 2019-10-07 at 11:10 +0200, Dmitry Vyukov wrote:
> > On Mon, Oct 7, 2019 at 11:03 AM Walter Wu wrote:
> > >
> > > On Mon, 2019-10-07 at 10:54 +0200, Dmitry Vyukov wrote:
> > > > On Mon, Oct 7, 201
1 - 100 of 209 matches
Mail list logo
