[PATCH v3 0/2] mm/kasan: Detect double-free involving kfree_rcu_sheaf().

[Kuniyuki Iwashima <kuniyu@google.com>]

Recently, syzbot has reported several weird use-after-free splats.

What they have in common is that "Freed by" points to rcu_free_sheaf(),
whereas the object shown in "Call Trace:" and "Allocated by" is never
supposed to be freed via kfree_rcu().

This means the object was a victim of a double-free somewhere else and
was silently poisoned by rcu_free_sheaf() after being reallocated.

This happens because kfree_rcu_sheaf() queues an object into the RCU
sheaf without invoking any KASAN hooks.

This series enables KASAN to detect double-free involving
kfree_rcu_sheaf() immediately and adds KUnit tests for it.


Changes:
  v3:
    * Collect Alexander and Andrey tags
    * Patch 2
      * Move migrate_disable() before p = kmem_cache_alloc()
      * add KASAN_TEST_NEEDS_CONFIG_OFF() for PREEMPT_RT

  v2: https://lore.kernel.org/linux-mm/20261027222557.1072105-1-kuniyu@google.com/
    * Patch 1
      * Collect Vlastimil and Alexander tags
      * Add Fixes tag
      * Add kdoc for @after_rcu_delay of kasan_slab_pre_free()
      * Rename s/kasan_record_aux_stack_rcu/kasan_mark_rcu_free_pending/g
      * Add comment for __kasan_record_aux_stack()
    * Patch 2
      * Move kasan_byte_accessible() check and
        kvfree_rcu_barrier_on_cache() after switch

  v1: https://lore.kernel.org/linux-mm/20261009214639.2878857-1-kuniyu@google.com/


Kuniyuki Iwashima (2):
  mm/kasan: Detect double-free involving kfree_rcu_sheaf().
  mm/kasan/kunit: Add double-free tests involving kfree_rcu_sheaf().

 include/linux/kasan.h   |  15 +++--
 mm/kasan/common.c       |  13 ++--
 mm/kasan/generic.c      |  17 ++++-
 mm/kasan/kasan.h        |  34 +++++++++-
 mm/kasan/kasan_test_c.c | 139 ++++++++++++++++++++++++++++++++++++++++
 mm/slub.c               |  13 +++-
 6 files changed, 217 insertions(+), 14 deletions(-)

-- 
2.56.0.313.g2479322e68-goog