[PATCH 0/2] mm/kasan: Detect double-free involving kfree_rcu_sheaf().

[Kuniyuki Iwashima <kuniyu@google.com>]

Recently, syzbot has reported several weird use-after-free splats.

What they have in common is that "Freed by" points to rcu_free_sheaf(),
whereas the object shown in "Call Trace:" and "Allocated by" is never
supposed to be freed via kfree_rcu().

This means the object was a victim of a double-free somewhere else and
was silently poisoned by rcu_free_sheaf() after being reallocated.

This happens because kfree_rcu_sheaf() queues an object into the RCU
sheaf without invoking any KASAN hooks.

This series enables KASAN to detect double-free involving
kfree_rcu_sheaf() immediately and adds KUnit tests for it.


Kuniyuki Iwashima (2):
  mm/kasan: Detect double-free involving kfree_rcu_sheaf().
  mm/kasan/kunit: Add double-free tests involving kfree_rcu_sheaf().

 include/linux/kasan.h   |  13 ++--
 mm/kasan/common.c       |  13 ++--
 mm/kasan/generic.c      |  14 ++++-
 mm/kasan/kasan.h        |  34 ++++++++++-
 mm/kasan/kasan_test_c.c | 131 ++++++++++++++++++++++++++++++++++++++++
 mm/slub.c               |  13 +++-
 6 files changed, 204 insertions(+), 14 deletions(-)

-- 
2.56.0.385.gd3acb90ef8-goog