All of lore.kernel.org
 help / color / mirror / Atom feed
From: Joel Fernandes <jfern@kernel.org>
To: linux-kernel@vger.kernel.org,
	"Paul E . McKenney" <paulmck@kernel.org>,
	Frederic Weisbecker <frederic@kernel.org>,
	Neeraj Upadhyay <neeraj.upadhyay@kernel.org>,
	Joel Fernandes <jfern@kernel.org>,
	Josh Triplett <josh@joshtriplett.org>,
	Boqun Feng <boqun@kernel.org>,
	Uladzislau Rezki <urezki@gmail.com>,
	Steven Rostedt <rostedt@goodmis.org>,
	Mathieu Desnoyers <mathieu.desnoyers@efficios.com>,
	Lai Jiangshan <jiangshanlai@gmail.com>,
	Zqiang <qiang.zhang@linux.dev>,
	Andrey Ryabinin <ryabinin.a.a@gmail.com>,
	Alexander Potapenko <glider@google.com>,
	Andrey Konovalov <andreyknvl@gmail.com>,
	Dmitry Vyukov <dvyukov@google.com>,
	Vincenzo Frascino <vincenzo.frascino@arm.com>,
	Andrew Morton <akpm@linux-foundation.org>
Cc: rcu@vger.kernel.org, kasan-dev@googlegroups.com, linux-mm@kvack.org
Subject: [PATCH for-v7.5 03/14] kasan: Avoid an unrelated RCU warning in the callback test
Date: Thu, 12 Nov 2026 19:57:30 -0500	[thread overview]
Message-ID: <20261113005747.2977123-4-jfern@kernel.org> (raw)
In-Reply-To: <20261113005747.2977123-1-jfern@kernel.org>

rcu_uaf() passes a false protection condition to
rcu_dereference_protected(), which produces a suspicious-RCU-usage
warning before the intended KASAN failure occurs.

The pointer refers to a fresh allocation that has not been published to
readers. State that protection condition explicitly, leaving the intended
tests intact.

Test:
Built with CONFIG_KASAN_KUNIT_TEST=m
Booted Qemu guest (8 CPUs), ran modprobe kasan_test filtered to kasan.*rcu_uaf*

Signed-off-by: Joel Fernandes <jfern@kernel.org>
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
---
 mm/kasan/kasan_test_c.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/kasan/kasan_test_c.c b/mm/kasan/kasan_test_c.c
index b9e167ed5be3..4e23765d722c 100644
--- a/mm/kasan/kasan_test_c.c
+++ b/mm/kasan/kasan_test_c.c
@@ -967,8 +967,9 @@ static void rcu_uaf(struct kunit *test)
 	ptr = kmalloc_obj(struct kasan_rcu_info);
 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
 
+	/* The freshly allocated object has not been published to readers. */
 	global_rcu_ptr = rcu_dereference_protected(
-				(struct kasan_rcu_info __rcu *)ptr, NULL);
+				(struct kasan_rcu_info __rcu *)ptr, true);
 
 	KUNIT_EXPECT_KASAN_FAIL_READ(test,
 			call_rcu(&global_rcu_ptr->rcu, rcu_uaf_reclaim);
-- 
2.54.0


  parent reply	other threads:[~2026-11-13  0:57 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-11-13  0:57 [PATCH for-v7.5 00/14] RCU tests patches for v7.5 Joel Fernandes
2026-11-13  0:57 ` [PATCH for-v7.5 01/14] Documentation/litmus-tests: Add SRCU fastpath anchor-before-scan test Joel Fernandes
2026-11-13  0:57 ` [PATCH for-v7.5 02/14] Documentation/litmus-tests: Add SRCU fastpath scan-before-anchor test Joel Fernandes
2026-11-13  0:57 ` Joel Fernandes [this message]
2026-11-13  0:57 ` [PATCH for-v7.5 04/14] rcutorture: Fix busted_srcud crash on module unload Joel Fernandes
2026-11-13  0:57 ` [PATCH for-v7.5 05/14] rcutorture: Fix suspicious rcu_dereference_check() usage for trivial-preempt Joel Fernandes
2026-11-13  0:57 ` [PATCH for-v7.5 06/14] rcutorture: Make tasks-tracing support duplicate call testing Joel Fernandes
2026-11-13  0:57 ` [PATCH for-v7.5 07/14] rcutorture: Avoid create fwd_prog_tasks for tasks-rude and srcu-atomic Joel Fernandes
2026-11-13  0:57 ` [PATCH for-v7.5 08/14] rcuscale: Consolidate per-writer arrays into struct writer_state Joel Fernandes
2026-11-13  0:57 ` [PATCH for-v7.5 09/14] rcuscale: Add srcua scale type Joel Fernandes
2026-11-13  0:57 ` [PATCH for-v7.5 10/14] scftorture: Reject empty workloads before starting helpers Joel Fernandes
2026-11-13  0:57 ` [PATCH for-v7.5 11/14] scftorture: Protect the initial affinity check from hotplug Joel Fernandes
2026-11-13  0:57 ` [PATCH for-v7.5 12/14] rcutorture: Enable RCU_BOOST where supported Joel Fernandes
2026-11-13  0:57 ` [PATCH for-v7.5 13/14] rcutorture: Disable RCU priority boost testing on non-TREE03 scenarios Joel Fernandes
2026-11-13  0:57 ` [PATCH for-v7.5 14/14] torture: Forgive SMT-control failures in CPU-hotplug testing Joel Fernandes
2026-11-13  7:28 ` [PATCH for-v7.5 00/14] RCU tests patches for v7.5 Bradley Morgan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261113005747.2977123-4-jfern@kernel.org \
    --to=jfern@kernel.org \
    --cc=akpm@linux-foundation.org \
    --cc=andreyknvl@gmail.com \
    --cc=boqun@kernel.org \
    --cc=dvyukov@google.com \
    --cc=frederic@kernel.org \
    --cc=glider@google.com \
    --cc=jiangshanlai@gmail.com \
    --cc=josh@joshtriplett.org \
    --cc=kasan-dev@googlegroups.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=mathieu.desnoyers@efficios.com \
    --cc=neeraj.upadhyay@kernel.org \
    --cc=paulmck@kernel.org \
    --cc=qiang.zhang@linux.dev \
    --cc=rcu@vger.kernel.org \
    --cc=rostedt@goodmis.org \
    --cc=ryabinin.a.a@gmail.com \
    --cc=urezki@gmail.com \
    --cc=vincenzo.frascino@arm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.