> > const char *get_bug_type(struct kasan_access_info *info)
> > {
> > +#ifdef CONFIG_KASAN_SW_TAGS_IDENTIFY
> > + struct kasan_alloc_meta *alloc_meta;
> > + struct kmem_cache *cache;
> > + struct page *page;
> > + const void *addr;
> > + void *object;
> > + u8 tag;
> > + int i;
> > +
> > + tag = get_tag(info->access_addr);
> > + addr = reset_tag(info->access_addr);
> > + page = kasan_addr_to_page(addr);
> > + if (page && PageSlab(page)) {
> > + cache = page->slab_cache;
> > + object = nearest_obj(cache, page, (void *)addr);
> > + alloc_meta = get_alloc_info(cache, object);
> > +
> > + for (i = 0; i < KASAN_NR_FREE_STACKS; i++)
> > + if (alloc_meta->free_pointer_tag[i] == tag)
> > + return "use-after-free";
> > + return "out-of-bounds";
>
> I think we should keep the "invalid-access" bug type here if we failed
> to identify the bug as a "use-after-free" (and change the patch
> description accordingly).
>
> Other than that:
>
> Acked-by: Andrey Konovalov <andreyknvl@xxxxxxxxxx>
>
Thanks your suggestion.
If slab records is not found, it may be use-after-free or out-of-bounds.
Maybe We can think how to avoid the situation(check object range or
other?), if possible, I will send patch or adopt your suggestion
modification.
regards,
Walter
