Syzbot reports many UAF issues for workqueue, see [1].
In some of these access/allocation happened in process_one_work(),
we see the free stack is useless in KASAN report, it doesn't help
programmers to solve UAF for workqueue issue.
This patchset improves KASAN reports by making them to have workqueue
queueing stack. It is useful for programmers to solve use-after-free
or double-free memory issue.
Generic KASAN also records the last two workqueue stacks and prints
them in KASAN report. It is only suitable for generic KASAN.
[1]https://groups.google.com/g/syzkaller-bugs/search?q=%22use-after-free%22+process_one_work
[2]https://bugzilla.kernel.org/show_bug.cgi?id=198437
Walter Wu (4):
workqueue: kasan: record workqueue stack
kasan: print workqueue stack
lib/test_kasan.c: add workqueue test case
kasan: update documentation for generic kasan
---
Changes since v4:
- Not found timer use case, so that remove timer patch
- remove a mention of call_rcu() from the kasan_record_aux_stack()
Thanks for Dmitry and Alexander suggestion.
Changes since v3:
- testcases have merge conflict, so that need to
be rebased onto the KASAN-KUNIT.
Changes since v2:
- modify kasan document to be readable,
Thanks for Marco suggestion.
Changes since v1:
- Thanks for Marco and Thomas suggestion.
- Remove unnecessary code and fix commit log
- reuse kasan_record_aux_stack() and aux_stack
to record timer and workqueue stack.
- change the aux stack title for common name.
---
Documentation/dev-tools/kasan.rst | 5 +++--
kernel/workqueue.c | 3 +++
lib/test_kasan_module.c | 29 +++++++++++++++++++++++++++++
mm/kasan/generic.c | 4 +---
mm/kasan/report.c | 4 ++--
5 files changed, 38 insertions(+), 7 deletions(-)
On Thu, Dec 3, 2020 at 3:21 AM Walter Wu <[email protected]> wrote:
>
> Syzbot reports many UAF issues for workqueue, see [1].
> In some of these access/allocation happened in process_one_work(),
> we see the free stack is useless in KASAN report, it doesn't help
> programmers to solve UAF for workqueue issue.
>
> This patchset improves KASAN reports by making them to have workqueue
> queueing stack. It is useful for programmers to solve use-after-free
> or double-free memory issue.
>
> Generic KASAN also records the last two workqueue stacks and prints
> them in KASAN report. It is only suitable for generic KASAN.
>
> [1]https://groups.google.com/g/syzkaller-bugs/search?q=%22use-after-free%22+process_one_work
> [2]https://bugzilla.kernel.org/show_bug.cgi?id=198437
>
> Walter Wu (4):
> workqueue: kasan: record workqueue stack
> kasan: print workqueue stack
> lib/test_kasan.c: add workqueue test case
> kasan: update documentation for generic kasan
>
> ---
> Changes since v4:
> - Not found timer use case, so that remove timer patch
> - remove a mention of call_rcu() from the kasan_record_aux_stack()
> Thanks for Dmitry and Alexander suggestion.
>
> Changes since v3:
> - testcases have merge conflict, so that need to
> be rebased onto the KASAN-KUNIT.
>
> Changes since v2:
> - modify kasan document to be readable,
> Thanks for Marco suggestion.
>
> Changes since v1:
> - Thanks for Marco and Thomas suggestion.
> - Remove unnecessary code and fix commit log
> - reuse kasan_record_aux_stack() and aux_stack
> to record timer and workqueue stack.
> - change the aux stack title for common name.
>
> ---
> Documentation/dev-tools/kasan.rst | 5 +++--
> kernel/workqueue.c | 3 +++
> lib/test_kasan_module.c | 29 +++++++++++++++++++++++++++++
> mm/kasan/generic.c | 4 +---
> mm/kasan/report.c | 4 ++--
> 5 files changed, 38 insertions(+), 7 deletions(-)
Hi Walter,
Thanks for the update.
The series still looks good to me. I see patches already have my
Reviewed-by, so I will not resend them.