From patchwork Thu Sep 24 04:03:35 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Walter Wu X-Patchwork-Id: 11796019 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 78D706CA for ; Thu, 24 Sep 2020 04:03:51 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 2621023899 for ; Thu, 24 Sep 2020 04:03:51 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b="KvhTLfP/" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 2621023899 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=mediatek.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 68FA890000A; Thu, 24 Sep 2020 00:03:50 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 63E748E0001; Thu, 24 Sep 2020 00:03:50 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 52E3D90000A; Thu, 24 Sep 2020 00:03:50 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0227.hostedemail.com [216.40.44.227]) by kanga.kvack.org (Postfix) with ESMTP id 392F28E0001 for ; Thu, 24 Sep 2020 00:03:50 -0400 (EDT) Received: from smtpin16.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 014B38249980 for ; Thu, 24 Sep 2020 04:03:50 +0000 (UTC) X-FDA: 77296611420.16.bean03_1e0b98d2715c Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin16.hostedemail.com (Postfix) with ESMTP id D59741014AC3C for ; Thu, 24 Sep 2020 04:03:49 +0000 (UTC) X-Spam-Summary: 1,0,0,0f745528571fc6b6,d41d8cd98f00b204,walter-zh.wu@mediatek.com,,RULES_HIT:41:355:379:541:800:960:966:968:973:988:989:1185:1260:1277:1311:1313:1314:1345:1431:1437:1514:1515:1516:1518:1534:1541:1585:1711:1730:1747:1777:1792:2196:2198:2199:2200:2393:2559:2562:2731:2899:3138:3139:3140:3141:3142:3353:3865:3866:3867:3868:3870:3871:3872:4250:4321:4385:5007:6261:6653:7875:8660:10004:10400:11026:11232:11473:11658:11914:12043:12048:12296:12297:12438:12521:12555:12895:13069:13148:13161:13229:13230:13311:13357:13972:14096:14097:14181:14394:14721:21080:21324:21451:21627:21740:21795:21939:30012:30029:30051:30054,0,RBL:210.61.82.184:@mediatek.com:.lbl8.mailshell.net-62.2.12.100 64.100.201.201;04yfkbteygzmdxbfyo9wcmnmnuic4yc6mic35twf18q1zxpn3at5kbnoirf4p84.fqfrcm1k4ndfbf1rzf7d89a6htrq1hkha3teaqxkswia486bhdbu8b9s6wmtcn6.n-lbl8.mailshell.net-223.238.255.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:none,Custom_rules:0:0:0, LFtime:2 X-HE-Tag: bean03_1e0b98d2715c X-Filterd-Recvd-Size: 4948 Received: from mailgw02.mediatek.com (unknown [210.61.82.184]) by imf46.hostedemail.com (Postfix) with ESMTP for ; Thu, 24 Sep 2020 04:03:48 +0000 (UTC) X-UUID: 031d0cc632804df7b22e8a729a49ec48-20200924 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:Date:Subject:CC:To:From; bh=dMII3+0XheNBeDRCJOnd6NRZNf7iDHcFRVLV7dSXF+k=; b=KvhTLfP/K7dh3HStSf2sbxwwBlNFmP8LjxilGy8Wx8sUimh4QPK6zX5mO1PUxFCvD5CltoNG+XDyn9OS60OO/f64cAagKo19Bg8M4qOG5pAw6w9Qh19k/wfSl/5Wwd7kNMpN20qKKC68GjuJDAUS216Zu2iLw+uRL3Di++Nsh0g=; X-UUID: 031d0cc632804df7b22e8a729a49ec48-20200924 Received: from mtkcas06.mediatek.inc [(172.21.101.30)] by mailgw02.mediatek.com (envelope-from ) (Cellopoint E-mail Firewall v4.1.14 Build 0819 with TLSv1.2 ECDHE-RSA-AES256-SHA384 256/256) with ESMTP id 1673301738; Thu, 24 Sep 2020 12:03:41 +0800 Received: from MTKCAS06.mediatek.inc (172.21.101.30) by mtkmbs01n1.mediatek.inc (172.21.101.68) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Thu, 24 Sep 2020 12:03:38 +0800 Received: from mtksdccf07.mediatek.inc (172.21.84.99) by MTKCAS06.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Thu, 24 Sep 2020 12:03:37 +0800 From: Walter Wu To: Andrew Morton , Thomas Gleixner , John Stultz , Stephen Boyd , Marco Elver , Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , Andrey Konovalov , Matthias Brugger CC: , , , , wsd_upstream , , Walter Wu Subject: [PATCH v4 1/6] timer: kasan: record timer stack Date: Thu, 24 Sep 2020 12:03:35 +0800 Message-ID: <20200924040335.30934-1-walter-zh.wu@mediatek.com> X-Mailer: git-send-email 2.18.0 MIME-Version: 1.0 X-MTK: N X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: When analyze use-after-free or double-free issue, recording the timer stacks is helpful to preserve usage history which potentially gives a hint about the affected code. Record the most recent two timer init calls in KASAN which are printed on failure in the KASAN report. For timers it has turned out to be useful to record the stack trace of the timer init call. Because if the UAF root cause is in timer init, then user can see KASAN report to get where it is registered and find out the root cause. It don't need to enable DEBUG_OBJECTS_TIMERS, but they have a chance to find out the root cause. Signed-off-by: Walter Wu Suggested-by: Marco Elver Suggested-by: Thomas Gleixner Acked-by: Marco Elver Reviewed-by: Dmitry Vyukov Reviewed-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: John Stultz Cc: Thomas Gleixner Cc: Stephen Boyd --- v2: - Thanks for Marco and Thomas suggestion. - Remove unnecessary code and fix commit log - reuse kasan_record_aux_stack() and aux_stack to record timer and workqueue stack. --- kernel/time/timer.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/time/timer.c b/kernel/time/timer.c index a16764b0116e..1ed8f8aca7f5 100644 --- a/kernel/time/timer.c +++ b/kernel/time/timer.c @@ -796,6 +796,9 @@ static void do_init_timer(struct timer_list *timer, timer->function = func; timer->flags = flags | raw_smp_processor_id(); lockdep_init_map(&timer->lockdep_map, name, key, 0); + + /* record the timer stack in order to print it in KASAN report */ + kasan_record_aux_stack(timer); } /** From patchwork Thu Sep 24 04:04:22 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Walter Wu X-Patchwork-Id: 11796025 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id F36E259D for ; Thu, 24 Sep 2020 04:04:40 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id A93FA23899 for ; Thu, 24 Sep 2020 04:04:40 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b="Abc3bR3E" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A93FA23899 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=mediatek.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id E7CA0900012; Thu, 24 Sep 2020 00:04:39 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id E2BCB8E0001; Thu, 24 Sep 2020 00:04:39 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D1B72900012; Thu, 24 Sep 2020 00:04:39 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0097.hostedemail.com [216.40.44.97]) by kanga.kvack.org (Postfix) with ESMTP id B7A498E0001 for ; Thu, 24 Sep 2020 00:04:39 -0400 (EDT) Received: from smtpin04.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 845C2180AD802 for ; Thu, 24 Sep 2020 04:04:39 +0000 (UTC) X-FDA: 77296613478.04.army61_250fd912715c Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin04.hostedemail.com (Postfix) with ESMTP id 651D3800CD14 for ; Thu, 24 Sep 2020 04:04:39 +0000 (UTC) X-Spam-Summary: 1,0,0,a35c50582444fd7d,d41d8cd98f00b204,walter-zh.wu@mediatek.com,,RULES_HIT:41:355:379:541:800:960:966:968:973:988:989:1185:1260:1277:1311:1313:1314:1345:1431:1437:1514:1515:1516:1518:1534:1541:1585:1711:1730:1747:1777:1792:2196:2198:2199:2200:2393:2559:2562:2731:2902:2907:3138:3139:3140:3141:3142:3352:3865:3867:3868:3870:3871:3872:4250:4385:5007:6261:6653:7514:7875:8660:9707:10004:10400:11026:11232:11658:11914:12048:12296:12297:12438:12521:12555:12895:13069:13148:13230:13311:13357:14096:14097:14181:14394:14721:21080:21324:21451:21627:21740:21795:21939:30012:30051:30054,0,RBL:210.61.82.184:@mediatek.com:.lbl8.mailshell.net-64.100.201.201 62.2.12.100;04yfcex5qngcf5rmqcdbaupidr9toopijp18xyu3uztdo8g148ayz7j9685qinh.gsbn4tsd4zq6k63icwas5bewi8jsw4babjn6wgk3wcs67ocjm3mrwo8wygpd361.q-lbl8.mailshell.net-223.238.255.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:none,Custom_rules:0:0:0,LFtime:25,LUA_SUMMARY:none X-HE-Tag: army61_250fd912715c X-Filterd-Recvd-Size: 4577 Received: from mailgw02.mediatek.com (unknown [210.61.82.184]) by imf38.hostedemail.com (Postfix) with ESMTP for ; Thu, 24 Sep 2020 04:04:38 +0000 (UTC) X-UUID: 2c4428be2c694ba0a92af8d06a46805c-20200924 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:Date:Subject:CC:To:From; bh=yih98KEkzJLkFoWBf8Qw3xVcaUYkPNvBrd8fXNNVY9A=; b=Abc3bR3E6jmrqWBRfsFdGr4CWrwilzbkqUjO0RC7VWu4+N40YxKvJ2hymgZ1YIM2IG7g2XU8PmnfcR4SN45mKMBI62piRxnjTfH5Gd/MUL3p+S2LvL10bCNqaOMjY94WBk9qDSkqxh0IPNiI4cG2iJBVYKzyx/g/ErcSU79elnc=; X-UUID: 2c4428be2c694ba0a92af8d06a46805c-20200924 Received: from mtkcas10.mediatek.inc [(172.21.101.39)] by mailgw02.mediatek.com (envelope-from ) (Cellopoint E-mail Firewall v4.1.14 Build 0819 with TLSv1.2 ECDHE-RSA-AES256-SHA384 256/256) with ESMTP id 1562696609; Thu, 24 Sep 2020 12:04:31 +0800 Received: from MTKCAS06.mediatek.inc (172.21.101.30) by mtkmbs06n1.mediatek.inc (172.21.101.129) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Thu, 24 Sep 2020 12:04:30 +0800 Received: from mtksdccf07.mediatek.inc (172.21.84.99) by MTKCAS06.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Thu, 24 Sep 2020 12:04:22 +0800 From: Walter Wu To: Andrew Morton , Tejun Heo , Lai Jiangshan , Marco Elver , Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , Andrey Konovalov , Matthias Brugger CC: , , , , wsd_upstream , , Walter Wu Subject: [PATCH v4 2/6] workqueue: kasan: record workqueue stack Date: Thu, 24 Sep 2020 12:04:22 +0800 Message-ID: <20200924040422.30995-1-walter-zh.wu@mediatek.com> X-Mailer: git-send-email 2.18.0 MIME-Version: 1.0 X-MTK: N X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Records the last two enqueuing work call stacks in order to print them in KASAN report. It is useful for programmers to solve use-after-free or double-free memory workqueue issue. For workqueue it has turned out to be useful to record the enqueuing work call stacks. Because user can see KASAN report to determine whether it is root cause. They don't need to enable debugobjects, but they have a chance to find out the root cause. Signed-off-by: Walter Wu Suggested-by: Marco Elver Acked-by: Marco Elver Acked-by: Tejun Heo Reviewed-by: Dmitry Vyukov Reviewed-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Lai Jiangshan --- v2: - Thanks for Marco suggestion. - Remove unnecessary code - reuse kasan_record_aux_stack() and aux_stack to record timer and workqueue stack --- kernel/workqueue.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/workqueue.c b/kernel/workqueue.c index c41c3c17b86a..5fea7dc9180f 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -1324,6 +1324,9 @@ static void insert_work(struct pool_workqueue *pwq, struct work_struct *work, { struct worker_pool *pool = pwq->pool; + /* record the work call stack in order to print it in KASAN reports */ + kasan_record_aux_stack(work); + /* we own @work, set data and link */ set_work_pwq(work, pwq, extra_flags); list_add_tail(&work->entry, head); From patchwork Thu Sep 24 04:05:13 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Walter Wu X-Patchwork-Id: 11796031 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 0181C59D for ; Thu, 24 Sep 2020 04:05:26 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id A7F6B23899 for ; Thu, 24 Sep 2020 04:05:25 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b="Tvu1auoU" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A7F6B23899 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=mediatek.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id E5255900015; Thu, 24 Sep 2020 00:05:24 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id E03508E0001; Thu, 24 Sep 2020 00:05:24 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CF1EF900015; Thu, 24 Sep 2020 00:05:24 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0107.hostedemail.com [216.40.44.107]) by kanga.kvack.org (Postfix) with ESMTP id B6C1D8E0001 for ; Thu, 24 Sep 2020 00:05:24 -0400 (EDT) Received: from smtpin26.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 8028F249A for ; Thu, 24 Sep 2020 04:05:24 +0000 (UTC) X-FDA: 77296615368.26.walk53_4b0f2f72715c Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin26.hostedemail.com (Postfix) with ESMTP id 5C1F41804B669 for ; Thu, 24 Sep 2020 04:05:24 +0000 (UTC) X-Spam-Summary: 1,0,0,597fb42c9341f3ff,d41d8cd98f00b204,walter-zh.wu@mediatek.com,,RULES_HIT:41:355:379:541:800:960:973:988:989:1185:1260:1277:1311:1313:1314:1345:1431:1437:1514:1515:1516:1518:1534:1541:1585:1711:1730:1747:1777:1792:1981:2194:2198:2199:2200:2393:2559:2562:2731:3138:3139:3140:3141:3142:3352:3865:3867:3868:3870:3871:3874:4250:5007:6261:6653:7875:8660:9707:10004:10400:11026:11232:11473:11658:11914:12043:12048:12296:12297:12438:12521:12555:12895:13069:13148:13161:13229:13230:13311:13357:14181:14394:14721:21080:21451:21627:21740:21939:30029:30054:30070,0,RBL:210.61.82.184:@mediatek.com:.lbl8.mailshell.net-64.100.201.201 62.2.12.100;04yfcsqj8cksu8absp39smzqtw41hophzzndec6yujjhbaez8e5sexg7d1tya1o.wgwfq8sdd9azduph34mhad4ompyrft998p89omr5zoweujrrpwxbqaa1oyitcwz.o-lbl8.mailshell.net-223.238.255.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:ft,MSBL:0,DNSBL:neutral,Custom_rules:0:0:0,LFtime:25,LUA_SUMMARY:none X-HE-Tag: walk53_4b0f2f72715c X-Filterd-Recvd-Size: 4316 Received: from mailgw02.mediatek.com (unknown [210.61.82.184]) by imf27.hostedemail.com (Postfix) with ESMTP for ; Thu, 24 Sep 2020 04:05:23 +0000 (UTC) X-UUID: fa50f555e6b14c81bb6e9d5d0fea0074-20200924 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:Date:Subject:CC:To:From; bh=jERA97XeyBTxK9uRT3LHVudEGcqfyQoFzaVX3v1wRNo=; b=Tvu1auoUk0g9FYSf6jotBbJKeVSRyb9lnVgpl3AH/erIGOKbm45KiBMwLXr9UAJG1RAcGQcY2UcVUx57ozW/RymS+D+RkCmOGUyNWtgWh7Ry85R7gTw4kmqM9ufzf4MW5tVFlTFSTC3iib9BseEagCxFpABmdcsVceRpeF/d05A=; X-UUID: fa50f555e6b14c81bb6e9d5d0fea0074-20200924 Received: from mtkcas06.mediatek.inc [(172.21.101.30)] by mailgw02.mediatek.com (envelope-from ) (Cellopoint E-mail Firewall v4.1.14 Build 0819 with TLSv1.2 ECDHE-RSA-AES256-SHA384 256/256) with ESMTP id 221699063; Thu, 24 Sep 2020 12:05:16 +0800 Received: from MTKCAS06.mediatek.inc (172.21.101.30) by mtkmbs01n1.mediatek.inc (172.21.101.68) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Thu, 24 Sep 2020 12:05:13 +0800 Received: from mtksdccf07.mediatek.inc (172.21.84.99) by MTKCAS06.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Thu, 24 Sep 2020 12:05:13 +0800 From: Walter Wu To: Andrew Morton , Marco Elver , Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , Andrey Konovalov , Matthias Brugger CC: , , , , wsd_upstream , , Walter Wu Subject: [PATCH v4 3/6] kasan: print timer and workqueue stack Date: Thu, 24 Sep 2020 12:05:13 +0800 Message-ID: <20200924040513.31051-1-walter-zh.wu@mediatek.com> X-Mailer: git-send-email 2.18.0 MIME-Version: 1.0 X-MTK: N X-Bogosity: Ham, tests=bogofilter, spamicity=0.000245, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: The aux_stack[2] is reused to record the call_rcu() call stack, timer init call stack, and enqueuing work call stacks. So that we need to change the auxiliary stack title for common title, print them in KASAN report. Signed-off-by: Walter Wu Suggested-by: Marco Elver Acked-by: Marco Elver Reviewed-by: Dmitry Vyukov Reviewed-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Alexander Potapenko --- v2: - Thanks for Marco suggestion. - We modify aux stack title name in KASAN report in order to print call_rcu()/timer/workqueue stack. --- mm/kasan/report.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mm/kasan/report.c b/mm/kasan/report.c index 4f49fa6cd1aa..886809d0a8dd 100644 --- a/mm/kasan/report.c +++ b/mm/kasan/report.c @@ -183,12 +183,12 @@ static void describe_object(struct kmem_cache *cache, void *object, #ifdef CONFIG_KASAN_GENERIC if (alloc_info->aux_stack[0]) { - pr_err("Last call_rcu():\n"); + pr_err("Last potentially related work creation:\n"); print_stack(alloc_info->aux_stack[0]); pr_err("\n"); } if (alloc_info->aux_stack[1]) { - pr_err("Second to last call_rcu():\n"); + pr_err("Second to last potentially related work creation:\n"); print_stack(alloc_info->aux_stack[1]); pr_err("\n"); } From patchwork Thu Sep 24 04:05:48 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Walter Wu X-Patchwork-Id: 11796035 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 140A959D for ; Thu, 24 Sep 2020 04:06:02 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id C4F0E238A1 for ; Thu, 24 Sep 2020 04:06:01 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b="rzaNtTpR" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org C4F0E238A1 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=mediatek.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id E7AD4900016; Thu, 24 Sep 2020 00:06:00 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id DDA488E0001; Thu, 24 Sep 2020 00:06:00 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CC9EE900016; Thu, 24 Sep 2020 00:06:00 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0047.hostedemail.com [216.40.44.47]) by kanga.kvack.org (Postfix) with ESMTP id B256A8E0001 for ; Thu, 24 Sep 2020 00:06:00 -0400 (EDT) Received: from smtpin06.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 7514D8249980 for ; Thu, 24 Sep 2020 04:06:00 +0000 (UTC) X-FDA: 77296616880.06.year83_5b0d8002715c Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin06.hostedemail.com (Postfix) with ESMTP id 4F0A61013DB96 for ; Thu, 24 Sep 2020 04:06:00 +0000 (UTC) X-Spam-Summary: 1,0,0,ce467bb09fa0c21a,d41d8cd98f00b204,walter-zh.wu@mediatek.com,,RULES_HIT:41:355:379:541:800:960:966:973:988:989:1185:1260:1277:1311:1313:1314:1345:1431:1437:1514:1515:1516:1518:1535:1542:1585:1711:1730:1747:1777:1792:2196:2198:2199:2200:2393:2559:2562:2915:3138:3139:3140:3141:3142:3353:3865:3867:3868:3870:3872:3874:4250:4321:4385:5007:6261:6653:7514:7875:7903:10004:10400:10450:10455:11026:11658:11914:12043:12048:12291:12296:12297:12438:12521:12555:12679:12895:13161:13229:14181:14394:14721:19904:19999:21080:21451:21611:21627:21740:21990:30054,0,RBL:210.61.82.183:@mediatek.com:.lbl8.mailshell.net-62.2.12.100 64.100.201.201;04yg1yh11iajrib61s3fj8814f8oeopotw9nf3gsexe6z4abxgwt4app8hu9nqw.4oko9hj1upjnmmes3zyojk8iksdyfp19c99eo4aa8c54schdeuz88hd68jizhzo.6-lbl8.mailshell.net-223.238.255.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:none,Custom_rules:0:0:0,LFtime:23,LUA_SUMMARY:none X-HE-Tag: year83_5b0d8002715c X-Filterd-Recvd-Size: 5509 Received: from mailgw01.mediatek.com (unknown [210.61.82.183]) by imf26.hostedemail.com (Postfix) with ESMTP for ; Thu, 24 Sep 2020 04:05:59 +0000 (UTC) X-UUID: 4f037dcdbe284f00a0fd594db2bdaf24-20200924 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:Date:Subject:CC:To:From; bh=PimmuaElZUMsgbQjwJ8de8rcFyaYrVbSXAmqAq7D2xA=; b=rzaNtTpRz2b66QfQkp+d00sFmLYUTxrf4XZqzY99dEM1uCJaiK/bM1iAr3NgYm3rKxxDMCi5VntKi+bt5mdLm6Z6F4FgZOtxm+5DLc/0AVHPJWdyYDZ9LTETxcJ/GygoLL4urp8WGmiqNl9Vqg4MzjNOQB2/6NjMmAvHp4A50kA=; X-UUID: 4f037dcdbe284f00a0fd594db2bdaf24-20200924 Received: from mtkcas08.mediatek.inc [(172.21.101.126)] by mailgw01.mediatek.com (envelope-from ) (Cellopoint E-mail Firewall v4.1.14 Build 0819 with TLSv1.2 ECDHE-RSA-AES256-SHA384 256/256) with ESMTP id 1895011425; Thu, 24 Sep 2020 12:05:50 +0800 Received: from MTKCAS06.mediatek.inc (172.21.101.30) by mtkmbs06n1.mediatek.inc (172.21.101.129) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Thu, 24 Sep 2020 12:05:49 +0800 Received: from mtksdccf07.mediatek.inc (172.21.84.99) by MTKCAS06.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Thu, 24 Sep 2020 12:05:47 +0800 From: Walter Wu To: Andrew Morton , Marco Elver , Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , Andrey Konovalov , Matthias Brugger CC: , , , , wsd_upstream , , Walter Wu Subject: [PATCH v4 4/6] kasan: add tests for timer stack recording Date: Thu, 24 Sep 2020 12:05:48 +0800 Message-ID: <20200924040548.31112-1-walter-zh.wu@mediatek.com> X-Mailer: git-send-email 2.18.0 MIME-Version: 1.0 X-MTK: N X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Adds a test to verify timer stack recording and print it in KASAN report. The KASAN report was as follows(cleaned up slightly): BUG: KASAN: use-after-free in kasan_timer_uaf Freed by task 0: kasan_save_stack+0x24/0x50 kasan_set_track+0x24/0x38 kasan_set_free_info+0x20/0x40 __kasan_slab_free+0x10c/0x170 kasan_slab_free+0x10/0x18 kfree+0x98/0x270 kasan_timer_function+0x1c/0x28 Last potentially related work creation: kasan_save_stack+0x24/0x50 kasan_record_tmr_stack+0xa8/0xb8 init_timer_key+0xf0/0x248 kasan_timer_uaf+0x5c/0xd8 Signed-off-by: Walter Wu Acked-by: Marco Elver Reviewed-by: Dmitry Vyukov Reviewed-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Matthias Brugger --- v4: - testcase has merge conflict, so that rebase onto the KASAN-KUNIT --- lib/test_kasan_module.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/lib/test_kasan_module.c b/lib/test_kasan_module.c index 2d68db6ae67b..d8234a1db8c9 100644 --- a/lib/test_kasan_module.c +++ b/lib/test_kasan_module.c @@ -12,6 +12,7 @@ #include #include #include +#include #include "../mm/kasan/kasan.h" @@ -91,6 +92,29 @@ static noinline void __init kasan_rcu_uaf(void) call_rcu(&global_rcu_ptr->rcu, kasan_rcu_reclaim); } +static noinline void __init kasan_timer_function(struct timer_list *timer) +{ + del_timer(timer); + kfree(timer); +} + +static noinline void __init kasan_timer_uaf(void) +{ + struct timer_list *timer; + + timer = kmalloc(sizeof(struct timer_list), GFP_KERNEL); + if (!timer) { + pr_err("Allocation failed\n"); + return; + } + + timer_setup(timer, kasan_timer_function, 0); + add_timer(timer); + msleep(100); + + pr_info("use-after-free on timer\n"); + ((volatile struct timer_list *)timer)->expires; +} static int __init test_kasan_module_init(void) { @@ -102,6 +126,7 @@ static int __init test_kasan_module_init(void) copy_user_test(); kasan_rcu_uaf(); + kasan_timer_uaf(); kasan_restore_multi_shot(multishot); return -EAGAIN; From patchwork Thu Sep 24 04:06:49 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Walter Wu X-Patchwork-Id: 11796049 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id CA2E56CA for ; Thu, 24 Sep 2020 04:06:59 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 83602238A1 for ; Thu, 24 Sep 2020 04:06:59 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b="ZWXXixq7" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 83602238A1 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=mediatek.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id C29B2900018; Thu, 24 Sep 2020 00:06:58 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id C02338E0001; Thu, 24 Sep 2020 00:06:58 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B3ED1900018; Thu, 24 Sep 2020 00:06:58 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0026.hostedemail.com [216.40.44.26]) by kanga.kvack.org (Postfix) with ESMTP id 9F4B48E0001 for ; Thu, 24 Sep 2020 00:06:58 -0400 (EDT) Received: from smtpin18.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 6CC123636 for ; Thu, 24 Sep 2020 04:06:58 +0000 (UTC) X-FDA: 77296619316.18.fire57_18098372715c Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin18.hostedemail.com (Postfix) with ESMTP id 4C22B1014F782 for ; Thu, 24 Sep 2020 04:06:58 +0000 (UTC) X-Spam-Summary: 1,0,0,133c8bf1f408d2f7,d41d8cd98f00b204,walter-zh.wu@mediatek.com,,RULES_HIT:41:355:379:421:541:800:960:973:988:989:1042:1185:1260:1277:1311:1313:1314:1345:1431:1437:1514:1515:1516:1518:1534:1541:1585:1711:1730:1747:1777:1792:1978:1981:2194:2198:2199:2200:2393:2559:2562:2895:2901:3138:3139:3140:3141:3142:3352:3865:3866:3867:3868:3870:3872:3874:4250:4321:5007:6119:6261:6653:7875:8660:10004:10400:11232:11658:11914:12043:12048:12198:12297:12521:12555:12895:12986:13069:13148:13200:13229:13230:13311:13357:14181:14394:14721:21080:21451:21627:21740:21772:21939:30012:30054:30070,0,RBL:210.61.82.184:@mediatek.com:.lbl8.mailshell.net-64.100.201.201 62.2.12.100;04yg8axqbgpdoxgupsu1ojc9ieh5jypyqgqrkq1zhq3ezyh9zastec417kc5jb9.x9yg5g1e4aigpycc5wij5tnbqhy1yd1j1r5oqm5byqdxhaqn71h64z4y97oc4ms.4-lbl8.mailshell.net-223.238.255.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:none,Custom_rules:0:0:0,LFtime:23,LUA_SUMMARY:none X-HE-Tag: fire57_18098372715c X-Filterd-Recvd-Size: 4425 Received: from mailgw02.mediatek.com (unknown [210.61.82.184]) by imf25.hostedemail.com (Postfix) with ESMTP for ; Thu, 24 Sep 2020 04:06:57 +0000 (UTC) X-UUID: b2f4419533d24dd5a6cdbfe760e02c2e-20200924 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:Date:Subject:CC:To:From; bh=kgEyV8GPi8LIdYi4bGI7Bw0WJs3ADwMNIObdnpyN9FA=; b=ZWXXixq7rSJUSraPKalbboCZ2cqPFkrDQGYHnAEn9+ewEcf0CdmtuG7f0Lpn79M6eyquXqhiU/JhfOYjBYDXLPqYVOuZ2SlGsaIX0QRF/3yOlohiR8ifiCNRn4HXhzIN0HyxVEZcx+WGUgzvSWokui2iiWDMfXkrmlydcEngxFA=; X-UUID: b2f4419533d24dd5a6cdbfe760e02c2e-20200924 Received: from mtkcas06.mediatek.inc [(172.21.101.30)] by mailgw02.mediatek.com (envelope-from ) (Cellopoint E-mail Firewall v4.1.14 Build 0819 with TLSv1.2 ECDHE-RSA-AES256-SHA384 256/256) with ESMTP id 1917049134; Thu, 24 Sep 2020 12:06:52 +0800 Received: from MTKCAS06.mediatek.inc (172.21.101.30) by mtkmbs01n2.mediatek.inc (172.21.101.79) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Thu, 24 Sep 2020 12:06:49 +0800 Received: from mtksdccf07.mediatek.inc (172.21.84.99) by MTKCAS06.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Thu, 24 Sep 2020 12:06:49 +0800 From: Walter Wu To: Andrew Morton , Jonathan Corbet , Marco Elver , Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , Andrey Konovalov , Matthias Brugger CC: , , , , wsd_upstream , , Walter Wu Subject: [PATCH v4 6/6] kasan: update documentation for generic kasan Date: Thu, 24 Sep 2020 12:06:49 +0800 Message-ID: <20200924040650.31221-1-walter-zh.wu@mediatek.com> X-Mailer: git-send-email 2.18.0 MIME-Version: 1.0 X-TM-SNTS-SMTP: CD7E561389D179394336201CEA174E7F8D7E06FE8F5E04C5B1D4AD0B5E80F0E02000:8 X-MTK: N X-Bogosity: Ham, tests=bogofilter, spamicity=0.000015, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Generic KASAN also supports to record the last two timer and workqueue stacks and print them in KASAN report. So that need to update documentation. Signed-off-by: Walter Wu Suggested-by: Marco Elver Acked-by: Marco Elver Reviewed-by: Dmitry Vyukov Reviewed-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Jonathan Corbet --- v3: - Thanks for Marco suggestion --- Documentation/dev-tools/kasan.rst | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/Documentation/dev-tools/kasan.rst b/Documentation/dev-tools/kasan.rst index 38fd5681fade..698ccb65e634 100644 --- a/Documentation/dev-tools/kasan.rst +++ b/Documentation/dev-tools/kasan.rst @@ -190,8 +190,9 @@ function calls GCC directly inserts the code to check the shadow memory. This option significantly enlarges kernel but it gives x1.1-x2 performance boost over outline instrumented kernel. -Generic KASAN prints up to 2 call_rcu() call stacks in reports, the last one -and the second to last. +Generic KASAN also reports the last 2 call stacks to creation of work that +potentially has access to an object. Call stacks for the following are shown: +call_rcu(), timer and workqueue queuing. Software tag-based KASAN ~~~~~~~~~~~~~~~~~~~~~~~~