From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-173.mta0.migadu.com (out-173.mta0.migadu.com [91.218.175.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A87C1DDAB for ; Wed, 3 Dec 2025 01:29:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764725392; cv=none; b=dDOXPJRLg6rb/H/plMS12E8jpNW5EU5zzvrfDp6ES0Gc5H+3toEMEF3BffeqE44/5n7lfpRBRn3ffW8P3Erlcfc43effwha3T3sEKdGZ0kiXN/XGbpF5sTRQc2TqBIEDXRAIg2Oo3N32V/ulY11EjT3Tn0FWx239Z+dtOuPFDh4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764725392; c=relaxed/simple; bh=nhO4k3KdC03Z6Xa/Ue+NvRwuBqgvyH2I1nPdb6XYpyk=; h=MIME-Version:Date:Content-Type:From:Message-ID:Subject:To:Cc: In-Reply-To:References; b=PaldnetnDAoaOu1Ey7neZupXnk6XCTYGxw3sJwMAPFGdbOSTNAgksIslj5stMPUQQCnab+oDpitv4k3UuoiRaFafgu/kNI1PSTvk2H63tq4zlW3awVxN6TRz2NMoEv1JDwK9ZoxpXEMu5HWhPEm6oYvwss8W8riIaP0rCyXeXVo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=grU07+R6; arc=none smtp.client-ip=91.218.175.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="grU07+R6" Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1764725387; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=pTga2TAwNScG/3kVeor5h8KiVEoB630/ynsQmQFDxGs=; b=grU07+R66tQWTudKxjuJrjV0MqznBwqRktZIsP40MY//R1tW1KaoBOXYQvn+qjXW6ahtjY h7bzYUAxwwXES071fBPRlZzCn3xf/UJYEdr60FoYqgr0RMvfY9HKf6UgHTUTYJvxvLSPQ/ WpfOo8sCVlsEOsX+c3UZxuSctWTLboM= Date: Wed, 03 Dec 2025 01:29:36 +0000 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: "Jiayuan Chen" Message-ID: TLS-Required: No Subject: Re: [PATCH v1] mm/kasan: Fix incorrect unpoisoning in vrealloc for KASAN To: "Kees Cook" Cc: linux-mm@kvack.org, syzbot+997752115a851cb0cf36@syzkaller.appspotmail.com, "Andrey Ryabinin" , "Alexander Potapenko" , "Andrey Konovalov" , "Dmitry Vyukov" , "Vincenzo Frascino" , "Andrew Morton" , "Uladzislau Rezki" , "Danilo Krummrich" , kasan-dev@googlegroups.com, linux-kernel@vger.kernel.org In-Reply-To: <202512021522.7888E2B6@keescook> References: <20251128111516.244497-1-jiayuan.chen@linux.dev> <202512021522.7888E2B6@keescook> X-Migadu-Flow: FLOW_OUT 2025/12/3 07:23, "Kees Cook" wrote: >=20 >=20On Fri, Nov 28, 2025 at 07:15:14PM +0800, Jiayuan Chen wrote: >=20 >=20>=20 >=20> Syzkaller reported a memory out-of-bounds bug [1]. This patch fixes= two > > issues: > >=20=20 >=20> 1. In vrealloc, we were missing the KASAN_VMALLOC_VM_ALLOC flag wh= en > > unpoisoning the extended region. This flag is required to correctly > > associate the allocation with KASAN's vmalloc tracking. > >=20=20 >=20> Note: In contrast, vzalloc (via __vmalloc_node_range_noprof) expli= citly > > sets KASAN_VMALLOC_VM_ALLOC and calls kasan_unpoison_vmalloc() with = it. > > vrealloc must behave consistently =E2=80=94 especially when reusing = existing > > vmalloc regions =E2=80=94 to ensure KASAN can track allocations corr= ectly. > >=20=20 >=20> 2. When vrealloc reuses an existing vmalloc region (without alloca= ting new > > pages), KASAN previously generated a new tag, which broke tag-based > > memory access tracking. We now add a 'reuse_tag' parameter to > > __kasan_unpoison_vmalloc() to preserve the original tag in such case= s. > >=20=20 >=20> A new helper kasan_unpoison_vralloc() is introduced to handle this= reuse > > scenario, ensuring consistent tag behavior during reallocation. > >=20=20 >=20> [1]: https://syzkaller.appspot.com/bug?extid=3D997752115a851cb0cf3= 6 > >=20=20 >=20> Fixes: a0309faf1cb0 ("mm: vmalloc: support more granular vrealloc(= ) sizing") > >=20 >=20Is this the right Fixes tag? I didn't change the kasan logic meaningf= ully > in the above patch, perhaps it should be commit d699440f58ce ("mm: > fix vrealloc()'s KASAN poisoning logic") The tag you provide is about shrinking but the issue I encountered was ab= out expanding(Grow the vm_area) and kasan_unpoison_vmalloc() didn't work well= with expanding. Thanks.