Skip to contentSkip to conversation

kasan-better-identify-bug-types-for-tag-based-modes.patch removed from -mm tree

merged mm-stable Andrew Morton 1 participant 1 message Oct 3, 2022

lore
Share & tools
lore

Andrew Morton

author tree notice Applied
#0 lore raw

The quilt patch titled
Subject: kasan: better identify bug types for tag-based modes
has been removed from the -mm tree. Its filename was
kasan-better-identify-bug-types-for-tag-based-modes.patch

This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

------------------------------------------------------
From: Andrey Konovalov <[email protected]>
Subject: kasan: better identify bug types for tag-based modes
Date: Mon, 5 Sep 2022 23:05:48 +0200

Identify the bug type for the tag-based modes based on the stack trace entries found in the stack ring.

If a free entry is found first (meaning that it was added last), mark the bug as use-after-free. If an alloc entry is found first, mark the bug as slab-out-of-bounds. Otherwise, assign the common bug type.

This change returns the functionalify of the previously dropped CONFIG_KASAN_TAGS_IDENTIFY.

Link https://lkml.kernel.org/r/13ce7fa07d9d995caedd1439dfae4d51401842f2.1662411800.git.andreyknvl@google.com open here
Signed-off-by Andrey Konovalov <[email protected]>
Reviewed-by Marco Elver <[email protected]>
Cc Alexander Potapenko <[email protected]>
Cc Andrey Ryabinin <[email protected]>
Cc Dmitry Vyukov <[email protected]>
Cc Evgenii Stepanov <[email protected]>
Cc Peter Collingbourne <[email protected]>
Signed-off-by Andrew Morton <[email protected]>

---

 mm/kasan/report_tags.c |   25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)
mm/kasan/report_tags.c renamed from mm/kasan/report_tags.c~kasan-better-identify-bug-types-for-tag-based-modes +21 -4
@@ -10,7 +10,7 @@
 
 extern struct kasan_stack_ring stack_ring;
 
-static const char *get_bug_type(struct kasan_report_info *info)
+static const char *get_common_bug_type(struct kasan_report_info *info)
 {
 	/*
 	 * If access_size is a negative number, then it has reason to be

@@ -37,9 +37,8 @@ void kasan_complete_mode_report_info(str
 	bool is_free;
 	bool alloc_found = false, free_found = false;
 
-	info->bug_type = get_bug_type(info);
-
-	if (!info->cache || !info->object)
+	if (!info->cache || !info->object) {
+		info->bug_type = get_common_bug_type(info);
 		return;
 	}
 

@@ -84,6 +83,13 @@ void kasan_complete_mode_report_info(str
 			info->free_track.pid = pid;
 			info->free_track.stack = stack;
 			free_found = true;
+
+			/*
+			 * If a free entry is found first, the bug is likely
+			 * a use-after-free.
+			 */
+			if (!info->bug_type)
+				info->bug_type = "use-after-free";
 		} else {
 			/* Second alloc of the same object. Give up. */
 			if (alloc_found)

@@ -92,8 +98,19 @@ void kasan_complete_mode_report_info(str
 			info->alloc_track.pid = pid;
 			info->alloc_track.stack = stack;
 			alloc_found = true;
+
+			/*
+			 * If an alloc entry is found first, the bug is likely
+			 * an out-of-bounds.
+			 */
+			if (!info->bug_type)
+				info->bug_type = "slab-out-of-bounds";
 		}
 	}
 
 	write_unlock_irqrestore(&stack_ring.lock, flags);
+
+	/* Assign the common bug type if no entries were found. */
+	if (!info->bug_type)
+		info->bug_type = get_common_bug_type(info);
 }

_

Patches currently in -mm which might be from [email protected] are

kasan-fix-array-bounds-warnings-in-tests.patch