linux/mm/kasan
Walter Wu 23f61f0fe1 kasan: record task_work_add() call stack
Why record task_work_add() call stack?  Syzbot reports many use-after-free
issues for task_work, see [1].  After seeing the free stack and the
current auxiliary stack, we think they are useless, we don't know where
the work was registered.  This work may be the free call stack, so we miss
the root cause and don't solve the use-after-free.

Add the task_work_add() call stack into the KASAN auxiliary stack in order
to improve KASAN reports.  It helps programmers solve use-after-free
issues.

[1]: https://groups.google.com/g/syzkaller-bugs/search?q=kasan%20use-after-free%20task_work_run

Link: https://lkml.kernel.org/r/20210316024410.19967-1-walter-zh.wu@mediatek.com
Signed-off-by: Walter Wu <walter-zh.wu@mediatek.com>
Suggested-by: Dmitry Vyukov <dvyukov@google.com>
Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Reviewed-by: Jens Axboe <axboe@kernel.dk>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-04-30 11:20:42 -07:00
..
common.c kasan, mm: integrate slab init_on_free with HW_TAGS 2021-04-30 11:20:41 -07:00
generic.c kasan: init memory in kasan_(un)poison for HW_TAGS 2021-04-30 11:20:41 -07:00
hw_tags.c kasan, arm64: tests supports for HW_TAGS async mode 2021-04-11 10:57:45 +01:00
init.c kasan: fix incorrect arguments passing in kasan_add_zero_shadow 2021-01-24 10:34:52 -08:00
kasan.h kasan: record task_work_add() call stack 2021-04-30 11:20:42 -07:00
Makefile kasan, arm64: implement HW_TAGS runtime 2020-12-22 12:55:08 -08:00
quarantine.c kasan: prefix global functions with kasan_ 2021-02-24 13:38:30 -08:00
report_generic.c mm/kasan: switch from strlcpy to strscpy 2021-04-30 11:20:41 -07:00
report_hw_tags.c kasan: prefix global functions with kasan_ 2021-02-24 13:38:30 -08:00
report_sw_tags.c kasan: prefix global functions with kasan_ 2021-02-24 13:38:30 -08:00
report.c kasan, arm64: tests supports for HW_TAGS async mode 2021-04-11 10:57:45 +01:00
shadow.c kasan: init memory in kasan_(un)poison for HW_TAGS 2021-04-30 11:20:41 -07:00
sw_tags.c kasan: init memory in kasan_(un)poison for HW_TAGS 2021-04-30 11:20:41 -07:00