• Kuan-Ying Lee's avatar
    kasan, kmemleak: reset tags when scanning block · 6c7a00b8
    Kuan-Ying Lee authored
    Patch series "kasan, slub: reset tag when printing address", v3.
    
    With hardware tag-based kasan enabled, we reset the tag when we access
    metadata to avoid from false alarm.
    
    This patch (of 2):
    
    Kmemleak needs to scan kernel memory to check memory leak.  With hardware
    tag-based kasan enabled, when it scans on the invalid slab and
    dereference, the issue will occur as below.
    
    Hardware tag-based KASAN doesn't use compiler instrumentation, we can not
    use kasan_disable_current() to ignore tag check.
    
    Based on the below report, there are 11 0xf7 granules, which amounts to
    176 bytes, and the object is allocated from the kmalloc-256 cache.  So
    when kmemleak accesses the last 256-176 bytes, it causes faults, as those
    are marked with KASAN_KMALLOC_REDZONE == KASAN_TAG_INVALID == 0xfe.
    
    Thus, we reset tags before accessing metadata to avoid from false positives.
    
      BUG: KASAN: out-of-bounds in scan_block+0x58/0x170
      Read at addr f7ff0000c0074eb0 by task kmemleak/138
      ...
    6c7a00b8
kmemleak.c 56.4 KB