The patch titled
Subject: kasan: add memory corruption identification support for hardware tag-based mode
has been added to the -mm tree. Its filename is
kasan-add-memory-corruption-identification-support-for-hardware-tag-based-mode.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/kasan-add-memory-corruption-identification-support-for-hardware-tag-based-mode.patch
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/kasan-add-memory-corruption-identification-support-for-hardware-tag-based-mode.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Kuan-Ying Lee <Kuan-Ying.Lee@xxxxxxxxxxxx>
Subject: kasan: add memory corruption identification support for hardware tag-based mode
Add memory corruption identification support for hardware tag-based mode.
We store one old free pointer tag and free backtrace instead of five
because hardware tag-based kasan only has 16 different tags.
If we store as many stacks as SW tag-based kasan does(5 stacks), there is
high probability to find the same tag in the stacks when out-of-bound
issues happened and we will mistake out-of-bound issue for use-after-free.
Link: https://lkml.kernel.org/r/20210626100931.22794-4-Kuan-Ying.Lee@xxxxxxxxxxxx
Signed-off-by: Kuan-Ying Lee <Kuan-Ying.Lee@xxxxxxxxxxxx>
Suggested-by: Marco Elver <elver@xxxxxxxxxx>
Reviewed-by: Alexander Potapenko <glider@xxxxxxxxxx>
Reviewed-by: Andrey Konovalov <andreyknvl@xxxxxxxxx>
Cc: Andrey Ryabinin <ryabinin.a.a@xxxxxxxxx>
Cc: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
Cc: Chinwen Chang <chinwen.chang@xxxxxxxxxxxx>
Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Cc: Matthias Brugger <matthias.bgg@xxxxxxxxx>
Cc: Nicholas Tang <nicholas.tang@xxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
lib/Kconfig.kasan | 2 +-
mm/kasan/kasan.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/lib/Kconfig.kasan~kasan-add-memory-corruption-identification-support-for-hardware-tag-based-mode
+++ a/lib/Kconfig.kasan
@@ -169,7 +169,7 @@ config KASAN_STACK
config KASAN_TAGS_IDENTIFY
bool "Enable memory corruption identification"
- depends on KASAN_SW_TAGS
+ depends on KASAN_SW_TAGS || KASAN_HW_TAGS
help
This option enables best-effort identification of bug type
(use-after-free or out-of-bounds) at the cost of increased
--- a/mm/kasan/kasan.h~kasan-add-memory-corruption-identification-support-for-hardware-tag-based-mode
+++ a/mm/kasan/kasan.h
@@ -153,7 +153,7 @@ struct kasan_track {
depot_stack_handle_t stack;
};
-#ifdef CONFIG_KASAN_TAGS_IDENTIFY
+#if defined(CONFIG_KASAN_TAGS_IDENTIFY) && defined(CONFIG_KASAN_SW_TAGS)
#define KASAN_NR_FREE_STACKS 5
#else
#define KASAN_NR_FREE_STACKS 1
_
Patches currently in -mm which might be from Kuan-Ying.Lee@xxxxxxxxxxxx are
kasan-rename-config_kasan_sw_tags_identify-to-config_kasan_tags_identify.patch
kasan-integrate-the-common-part-of-two-kasan-tag-based-modes.patch
kasan-add-memory-corruption-identification-support-for-hardware-tag-based-mode.patch
