[PATCH v5 0/4] kasan: add workqueue stack for generic KASAN

Walter Wu walter-zh.wu at mediatek.com
Wed Dec 2 21:21:48 EST 2020

Syzbot reports many UAF issues for workqueue, see [1].
In some of these access/allocation happened in process_one_work(),
we see the free stack is useless in KASAN report, it doesn't help
programmers to solve UAF for workqueue issue.

This patchset improves KASAN reports by making them to have workqueue
queueing stack. It is useful for programmers to solve use-after-free
or double-free memory issue.

Generic KASAN also records the last two workqueue stacks and prints
them in KASAN report. It is only suitable for generic KASAN.


Walter Wu (4):
workqueue: kasan: record workqueue stack
kasan: print workqueue stack
lib/test_kasan.c: add workqueue test case
kasan: update documentation for generic kasan

Changes since v4:
- Not found timer use case, so that remove timer patch
- remove a mention of call_rcu() from the kasan_record_aux_stack()
  Thanks for Dmitry and Alexander suggestion.

Changes since v3:
- testcases have merge conflict, so that need to
  be rebased onto the KASAN-KUNIT.

Changes since v2:
- modify kasan document to be readable,
  Thanks for Marco suggestion.

Changes since v1:
- Thanks for Marco and Thomas suggestion.
- Remove unnecessary code and fix commit log
- reuse kasan_record_aux_stack() and aux_stack
  to record timer and workqueue stack.
- change the aux stack title for common name.

Documentation/dev-tools/kasan.rst |  5 +++--
kernel/workqueue.c                |  3 +++
lib/test_kasan_module.c           | 29 +++++++++++++++++++++++++++++
mm/kasan/generic.c                |  4 +---
mm/kasan/report.c                 |  4 ++--
5 files changed, 38 insertions(+), 7 deletions(-)

More information about the linux-arm-kernel mailing list