Re: [PATCH] fork: reset pointer tag of vmapped thread stack before vfree

[David Hildenbrand (Arm)]

On 8/7/26 12:41, sparkhuang wrote:
> On 2026-08-07  9:27 UTC, David wrote:
>> Were you able to reproduce this more than once?
> 
> Still trying to reproduce it. So far it has only occurred this once.
> 
>> Does this relate to CONFIG_KASAN_STACK?
> 
> I'm not entirely sure if it's related.
> The configs relevant to this path are:
> 	CONFIG_KASAN_SHADOW_OFFSET=0xefffffc000000000
> 	CONFIG_HAVE_ARCH_KASAN=y
> 	CONFIG_HAVE_ARCH_KASAN_SW_TAGS=y
> 	CONFIG_HAVE_ARCH_KASAN_HW_TAGS=y
> 	CONFIG_HAVE_ARCH_KASAN_VMALLOC=y
> 	CONFIG_CC_HAS_KASAN_GENERIC=y
> 	CONFIG_CC_HAS_KASAN_SW_TAGS=y
> 	CONFIG_KASAN=y
> 	CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX=y
> 	# CONFIG_KASAN_GENERIC is not set
> 	CONFIG_KASAN_SW_TAGS=y
> 	# CONFIG_KASAN_HW_TAGS is not set
> 	CONFIG_KASAN_OUTLINE=y
> 	# CONFIG_KASAN_INLINE is not set
> 	CONFIG_KASAN_STACK=y

The KASAN_STACK might be the relevant bit. We will get the stack retagged, so
when we free the memory, the stored tag and the memory tag will differ.

At least that's my understanding from a quick peek :)

-- 
Cheers,

David