[PATCH RFC v3 08/12] kcov: log freeing of SLUB objects and pages

[Jann Horn <jannh@google.com>]

To help with using CONFIG_KCOV_MEMORY for detecting use-after-free issues,
log when memory (SLUB objects or page allocations) is being freed.

This should happen after KASAN has already marked the memory as freed;
this will become important if we allow driving delay injection off this
in the future.

Signed-off-by: Jann Horn <jannh@google.com>
---
 include/uapi/linux/kcov.h | 1 +
 mm/kasan/common.c         | 2 ++
 mm/page_alloc.c           | 3 +++
 3 files changed, 6 insertions(+)

diff --git a/include/uapi/linux/kcov.h b/include/uapi/linux/kcov.h
index 7d7147e7b427..76822d1c119a 100644
--- a/include/uapi/linux/kcov.h
+++ b/include/uapi/linux/kcov.h
@@ -90,6 +90,7 @@ static inline __u64 kcov_remote_handle(__u64 subsys, __u64 inst)
 #define MEMORY_ACCESS_RECORD_WRITE 0x10
 #define MEMORY_ACCESS_RECORD_RMW 0x20
 #define MEMORY_ACCESS_RECORD_ATOMIC 0x40
+#define MEMORY_ACCESS_RECORD_FREE 0x80
 struct memory_access_record {
 	__aligned_u64 ip_address_and_kcov_flags;
 	__aligned_u64 data_address;
diff --git a/mm/kasan/common.c b/mm/kasan/common.c
index 1ab77ac9719c..3a648eaad024 100644
--- a/mm/kasan/common.c
+++ b/mm/kasan/common.c
@@ -283,6 +283,8 @@ bool __kasan_slab_free(struct kmem_cache *cache, void *object, bool init,
 		return false;
 
 	poison_slab_object(cache, object, init);
+	_kcov_handle_memaccess(object, cache->object_size,
+				    MEMORY_ACCESS_RECORD_WRITE|MEMORY_ACCESS_RECORD_FREE);
 
 	if (no_quarantine)
 		return false;
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 083cbcb5bdde..910d14925b84 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1446,6 +1446,9 @@ static __always_inline bool __free_pages_prepare(struct page *page,
 	if (init)
 		clear_highpages_kasan_tagged(page, 1 << order);
 
+	_kcov_handle_memaccess(page_address(page), (1 << order)*PAGE_SIZE,
+				    MEMORY_ACCESS_RECORD_WRITE|MEMORY_ACCESS_RECORD_FREE);
+
 	/*
 	 * arch_free_page() can make the page's contents inaccessible.  s390
 	 * does this.  So nothing which can access the page's contents should

-- 
2.55.0.979.g7e5102b832-goog