On Fri, Aug 2, 2024 at 10:54 PM Andrey Konovalov <andreyknvl@xxxxxxxxx> wrote:
> On Fri, Aug 2, 2024 at 10:32 PM Jann Horn <jannh@xxxxxxxxxx> wrote:
> >
> > Currently, KASAN is unable to catch use-after-free in SLAB_TYPESAFE_BY_RCU
> > slabs because use-after-free is allowed within the RCU grace period by
> > design.
> >
> > Add a SLUB debugging feature which RCU-delays every individual
> > kmem_cache_free() before either actually freeing the object or handing it
> > off to KASAN, and change KASAN to poison freed objects as normal when this
> > option is enabled.
[...]
> > diff --git a/mm/kasan/kasan_test.c b/mm/kasan/kasan_test.c
[...]
> > +static void kmem_cache_rcu_uaf(struct kunit *test)
> > +{
> > + char *p;
> > + size_t size = 200;
> > + struct kmem_cache *cache;
> > +
> > + KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB_RCU_DEBUG);
>
> Ah, notice another thing: this test might fail of someone enables
> CONFIG_SLUB_RCU_DEBUG with HW_TAGS, right? I think we need another
> check here.
Why? I realize that HW_TAGS can't detect UAF in a TYPESAFE_BY_RCU slab
after an object has been reused, but here we do no other allocations,
so the object should still be free. And the kmalloc_uaf test also
doesn't check for HW_TAGS.
The one thing I know of that could make this test spuriously fail
would be an allocation failure in the SLUB code for delayed freeing
(but that'd only happen under memory pressure, which I think normally
doesn't exist when kunit tests run).
