Why record task_work_add() call stack? Syzbot reports many use-after-free issues for task_work, see [1]. After see the free stack and the current auxiliary stack, we think they are useless, we don't know where register the work, this work may be the free call stack, so that we miss the root cause and don't solve the use-after-free. Add task_work_add() call stack into KASAN auxiliary stack in order to improve KASAN report. It is useful for programmers to solve use-after-free issues. [1]: https://groups.google.com/g/syzkaller-bugs/search?q=kasan%20use-after-free%20task_work_run Signed-off-by: Walter Wu <walter-zh.wu@xxxxxxxxxxxx> Suggested-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx> Cc: Andrey Konovalov <andreyknvl@xxxxxxxxxx> Cc: Andrey Ryabinin <ryabinin.a.a@xxxxxxxxx> Cc: Dmitry Vyukov <dvyukov@xxxxxxxxxx> Cc: Alexander Potapenko <glider@xxxxxxxxxx> Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> Cc: Matthias Brugger <matthias.bgg@xxxxxxxxx> Cc: Jens Axboe <axboe@xxxxxxxxx> Cc: Oleg Nesterov <oleg@xxxxxxxxxx> --- v2: Fix kasan_record_aux_stack() calling sequence issue. Thanks for Dmitry's suggestion --- kernel/task_work.c | 3 +++ mm/kasan/kasan.h | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/task_work.c b/kernel/task_work.c index 9cde961875c0..3d4852891fa8 100644 --- a/kernel/task_work.c +++ b/kernel/task_work.c @@ -34,6 +34,9 @@ int task_work_add(struct task_struct *task, struct callback_head *work, { struct callback_head *head; + /* record the work call stack in order to print it in KASAN reports */ + kasan_record_aux_stack(work); + do { head = READ_ONCE(task->task_works); if (unlikely(head == &work_exited)) diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h index 3436c6bf7c0c..e4629a971a3c 100644 --- a/mm/kasan/kasan.h +++ b/mm/kasan/kasan.h @@ -146,7 +146,7 @@ struct kasan_alloc_meta { struct kasan_track alloc_track; #ifdef CONFIG_KASAN_GENERIC /* - * call_rcu() call stack is stored into struct kasan_alloc_meta. + * The auxiliary stack is stored into struct kasan_alloc_meta. * The free stack is stored into struct kasan_free_meta. */ depot_stack_handle_t aux_stack[2]; -- 2.18.0
