Re: [PATCH 1/9] srcu: Record callback registration stack for KASAN

[KunWu Chan]

On Sat, Oct 24, 2026 at 3:41 AM Paul E. McKenney <paulmck@xxxxxxxxxx> wrote:
>
> On Fri, Oct 23, 2026 at 06:18:33PM +0800, Kunwu Chan wrote:
> > Record the callback registration stack in __call_srcu()
> > for KASAN diagnostics involving SRCU callbacks.
> >
> > Suggested-by: Zqiang <qiang.zhang@xxxxxxxxx>
> > Signed-off-by: Kunwu Chan <chentao@xxxxxxxxxx>
>
> For 1/9-3/9, looks good if there is a kasan_print_aux_stacks() called
> somewhere from 7/9-9/9.  I am not seeing it, but then again, I do not
> claim to be a KASAN expert.
>

Thanks Paul.
kasan_print_aux_stacks() is called by the existing KASAN report path
in mm/kasan/report.c (describe_object_stacks), not by the RCU patches.
Patches 1-3 record the aux stack with kasan_record_aux_stack(),
and KASAN prints it when reporting a use-after-free.

I verified this under QEMU with CONFIG_KASAN_GENERIC=y.
The KASAN report included:

Last potentially related work creation:
 kasan_save_stack+0x33/0x60
 kasan_record_aux_stack+0x8c/0xa0
 call_srcu+0xb2/0x390
 test_init+0x71/0xff0 [kasan_aux_stack_test]

Thanks,
Kunwu

>                                                         Thanx, Paul
>
> > ---
> >  kernel/rcu/srcutree.c | 5 +++++
> >  1 file changed, 5 insertions(+)
> >
> > diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c
> > index 2b0e2b2d2c18..46fe2f0cef85 100644
> > --- a/kernel/rcu/srcutree.c
> > +++ b/kernel/rcu/srcutree.c
> > @@ -20,6 +20,7 @@
> >  #include <linux/percpu.h>
> >  #include <linux/preempt.h>
> >  #include <linux/irq_work.h>
> > +#include <linux/kasan.h>
> >  #include <linux/llist.h>
> >  #include <linux/rcupdate_wait.h>
> >  #include <linux/sched.h>
> > @@ -1530,6 +1531,10 @@ static void __call_srcu(struct srcu_struct *ssp, struct rcu_head *rhp,
> >  {
> >       if (WARN_ON_ONCE(ssp->srcu_reader_flavor == SRCU_READ_FLAVOR_ATOMIC))
> >               return; // Leak the callback rather than corrupt SRCU state.
> > +
> > +     /* Record the caller: the irq_work's stack says nothing about it. */
> > +     kasan_record_aux_stack(rhp);
> > +
> >       if (should_rcu_defer()) {
> >               struct srcu_defer *sndp = this_cpu_ptr(&srcu_defer);
> >               struct srcu_data *sdp;
> > --
> > 2.43.0
> >