Re: [PATCH 2/2] mm/kasan/kunit: Add double-free tests involving kfree_rcu_sheaf().

[Kuniyuki Iwashima <kuniyu@google.com>]

On Tue, 27 Oct 2026 13:48:05 +0100, Alexander Potapenko wrote:
> >                                           ^
> >   ...
> >       ok 2 kmem_cache_double_free_rcu_2
> >
> > Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
> Tested-by: Alexander Potapenko <glider@google.com>
> 
> > +       case 3:
> > +               migrate_disable();
> > +               kfree_rcu(p, rcu);
> > +
> > +               for (i = 0; i < cache->sheaf_capacity - 1; i++) {
> > +                       objs[i] = kmem_cache_alloc(cache, GFP_KERNEL);
> > +                       kfree_rcu(objs[i], rcu);
> > +               }
> > +
> > +               KUNIT_EXPECT_KASAN_FAIL(test, kfree_rcu(p, rcu));
> > +               migrate_enable();
> > +
> > +               /*
> > +                * Move the 1st full sheaf to quarantine, keeping the
> > +                * 2nd in pcs->rcu_free.
> > +                */
> > +               rcu_barrier();
> > +               break;
> > +       }
> 
> Unlike the existing double-free tests, this one can misfire on a
> healthy kernel: __kfree_rcu_sheaf() may decline (local_trylock()
> contention,
> alloc_empty_sheaf() failing under memory pressure), and
> kvfree_call_rcu() then falls back to call_rcu(kvfree_rcu_cb), which
> never sets rcu_free and
> ends in a plain kfree().
> 
> Could you drain pending frees unconditionally
> (kvfree_rcu_barrier_on_cache() + rcu_barrier()) right before
> kasan_quarantine_remove_cache()?
> In the good case it's a no-op and the victim check keeps its meaning;
> in the fallback case the stray kfree() hits p while it is still
> poisoned in
> quarantine and is reported as a double-free instead of corrupting the victim.
> 

Calling kvfree_rcu_barrier_on_cache() unconditionally before
kasan_quarantine_remove_cache() would also flush the 2nd sheaf in
pcs->rcu_free while p is still in quarantine, making the victim
check a no-op if the 2nd kfree_rcu() wasn't rejected (e.g. without
patch 1).

Instead, I'll move the kasan_byte_accessible(p) check out of
case 2 like below in v2.  This keeps the 2nd sheaf for the victim
check in the normal case, while draining pending frees if p
hasn't reached quarantine yet due to the fallback path.

This keeps the false-positive UAF w/o patch 1 and double-free
w/ patch 1.

---8<---
diff --git a/mm/kasan/kasan_test_c.c b/mm/kasan/kasan_test_c.c
index 60d25eb7cb01..83c418c0ef87 100644
--- a/mm/kasan/kasan_test_c.c
+++ b/mm/kasan/kasan_test_c.c
@@ -1112,10 +1112,6 @@ static void __kmem_cache_double_free_rcu(struct kunit *test, int mode)
 		/* The actual free order is inverse. */
 		kfree_rcu(p, rcu);
 		KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p));
-
-		/* Move p to quarantine if kmem_cache_free() was rejected. */
-		if (kasan_byte_accessible(p))
-			kvfree_rcu_barrier_on_cache(cache);
 		break;
 	case 3:
 		migrate_disable();
@@ -1137,6 +1133,13 @@ static void __kmem_cache_double_free_rcu(struct kunit *test, int mode)
 		break;
 	}
 
+	/*
+	 * Move p to quarantine if not poisoned yet (case 2,
+	 * or fallback in case 3).
+	 */
+	if (kasan_byte_accessible(p))
+		kvfree_rcu_barrier_on_cache(cache);
+
 	/*
 	 * Evict p from quarantine and reallocate it as a live victim object
 	 * before the RCU sheaf is flushed.
---8<---