[PATCH 4/5] rcu: Add KASAN aux-stack verification test

[Kunwu Chan]

Add a test module that verifies kasan_record_aux_stack()
recording for RCU callbacks.  The flavor to test is selected at
build time by a Kconfig choice.  The test enqueues a callback from
a noinline helper, drains it while the rcu_head is still allocated,
then frees the rcu_head and triggers a use-after-free report.  The
report should list the enqueue helper under "Last potentially
related work creation:".

Draining before the free keeps the callback from ever running on
freed memory, and the post-call statement in the helper prevents
GCC from tail-calling the enqueue API, which would drop the
helper's frame from the recorded stack.

Suggested-by: Zqiang <qiang.zhang@xxxxxxxxx>
Cc: Kunwu Chan <kunwu.chan@xxxxxxxxx>
Signed-off-by: Kunwu Chan <chentao@xxxxxxxxxx>
---
 kernel/rcu/Kconfig.debug        |  38 ++++++++++++
 kernel/rcu/Makefile             |   1 +
 kernel/rcu/rcu_kasan_aux_test.c | 107 ++++++++++++++++++++++++++++++++
 3 files changed, 146 insertions(+)
 create mode 100644 kernel/rcu/rcu_kasan_aux_test.c

diff --git a/kernel/rcu/Kconfig.debug b/kernel/rcu/Kconfig.debug
index 7c3c6017b266..5c6c07d36157 100644
--- a/kernel/rcu/Kconfig.debug
+++ b/kernel/rcu/Kconfig.debug
@@ -53,6 +53,44 @@ config RCU_TORTURE_TEST
 	  Say M if you want the RCU torture tests to build as a module.
 	  Say N if you are unsure.
 
+config RCU_KASAN_AUX_TEST
+	tristate "KASAN aux-stack verification test for RCU callbacks"
+	depends on DEBUG_KERNEL && KASAN_GENERIC
+	help
+	  This option builds a test that verifies that the selected
+	  RCU flavor's callback-enqueueing path records the
+	  enqueueing call path via kasan_record_aux_stack().
+	  The test intentionally triggers a single KASAN
+	  use-after-free report at init time.  The report should
+	  list the enqueue helper under "Last potentially related
+	  work creation:".  Check the kernel log for the report.
+	  Select the RCU flavor to test below.
+
+choice
+	prompt "RCU flavor"
+	depends on RCU_KASAN_AUX_TEST
+
+config RCU_KASAN_AUX_TEST_FLAVOR_TREE
+	bool "Tree RCU (call_rcu)"
+	depends on TREE_RCU
+
+config RCU_KASAN_AUX_TEST_FLAVOR_TINY
+	bool "Tiny RCU (call_rcu)"
+	depends on TINY_RCU
+
+config RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TREE
+	bool "Tree SRCU (call_srcu)"
+	depends on TREE_SRCU
+
+config RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TINY
+	bool "Tiny SRCU (call_srcu)"
+	depends on TINY_SRCU
+
+config RCU_KASAN_AUX_TEST_FLAVOR_TASKS
+	bool "RCU Tasks (call_rcu_tasks)"
+	depends on TASKS_RCU
+endchoice
+
 config RCU_TORTURE_TEST_CHK_RDR_STATE
 	bool "Check rcutorture reader state"
 	depends on RCU_TORTURE_TEST
diff --git a/kernel/rcu/Makefile b/kernel/rcu/Makefile
index 478ef2237fee..bca05ac9c4cc 100644
--- a/kernel/rcu/Makefile
+++ b/kernel/rcu/Makefile
@@ -12,6 +12,7 @@ obj-$(CONFIG_TREE_SRCU) += srcutree.o
 obj-$(CONFIG_TINY_SRCU) += srcutiny.o
 obj-$(CONFIG_HAZPTR_TORTURE_TEST) += hazptrtorture.o
 obj-$(CONFIG_RCU_TORTURE_TEST) += rcutorture.o
+obj-$(CONFIG_RCU_KASAN_AUX_TEST) += rcu_kasan_aux_test.o
 obj-$(CONFIG_RCU_SCALE_TEST) += rcuscale.o
 obj-$(CONFIG_RCU_REF_SCALE_TEST) += refscale.o
 obj-$(CONFIG_TREE_RCU) += tree.o
diff --git a/kernel/rcu/rcu_kasan_aux_test.c b/kernel/rcu/rcu_kasan_aux_test.c
new file mode 100644
index 000000000000..df3169ac39b0
--- /dev/null
+++ b/kernel/rcu/rcu_kasan_aux_test.c
@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * KASAN auxiliary-stack verification test for RCU callbacks.
+ *
+ * Copyright (C) 2026 Kunwu Chan <kunwu.chan@xxxxxxxxx>
+ *
+ * For each supported RCU flavor, this module enqueues a callback
+ * from a noinline helper, drains it while the rcu_head is still
+ * allocated, then frees the rcu_head and immediately reads the
+ * freed memory.  The resulting KASAN use-after-free report should
+ * list the enqueue helper under "Last potentially related work
+ * creation:", which verifies that the flavor's enqueue path called
+ * kasan_record_aux_stack().  Check the kernel log for the report.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/rcupdate.h>
+#include <linux/slab.h>
+#include <linux/srcu.h>
+
+static void aux_test_cb(struct rcu_head *rhp)
+{
+	/* Empty: runs while the rcu_head is still live. */
+}
+
+#ifdef CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TREE
+static noinline void aux_test_call_rcu_tree(struct rcu_head *rhp,
+					    rcu_callback_t func)
+{
+	call_rcu(rhp, func);
+
+	/*
+	 * Prevent tail-call optimization so that this function remains
+	 * in the stack recorded by kasan_record_aux_stack().
+	 */
+	pr_info("Tree RCU: callback enqueued\n");
+}
+#endif
+
+#ifdef CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TINY
+static noinline void aux_test_call_rcu_tiny(struct rcu_head *rhp,
+					    rcu_callback_t func)
+{
+	call_rcu(rhp, func);
+	pr_info("Tiny RCU: callback enqueued\n");
+}
+#endif
+
+#if defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TREE) || \
+	defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TINY)
+DEFINE_STATIC_SRCU(test_srcu);
+static noinline void aux_test_call_srcu(struct rcu_head *rhp,
+					rcu_callback_t func)
+{
+	call_srcu(&test_srcu, rhp, func);
+	pr_info("SRCU: callback enqueued\n");
+}
+#endif
+
+#ifdef CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TASKS
+static noinline void aux_test_call_rcu_tasks(struct rcu_head *rhp,
+					     rcu_callback_t func)
+{
+	call_rcu_tasks(rhp, func);
+	pr_info("RCU Tasks: callback enqueued\n");
+}
+#endif
+
+static int __init aux_test_init(void)
+{
+	struct rcu_head *rhp = kmalloc(sizeof(*rhp), GFP_KERNEL);
+
+	if (!rhp)
+		return -ENOMEM;
+
+#if defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TREE)
+	aux_test_call_rcu_tree(rhp, aux_test_cb);
+	rcu_barrier();
+#elif defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TINY)
+	aux_test_call_rcu_tiny(rhp, aux_test_cb);
+	rcu_barrier();
+#elif defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TREE) || \
+	defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_SRCU_TINY)
+	aux_test_call_srcu(rhp, aux_test_cb);
+	srcu_barrier(&test_srcu);
+#elif defined(CONFIG_RCU_KASAN_AUX_TEST_FLAVOR_TASKS)
+	aux_test_call_rcu_tasks(rhp, aux_test_cb);
+	rcu_barrier_tasks();
+#else
+#error "No RCU flavor selected for KASAN aux-stack test"
+#endif
+
+	kfree(rhp);
+
+	/* Immediate read of the freed memory to trigger the report. */
+	(void)READ_ONCE(*(u8 *)rhp);
+
+	pr_info("done, see kernel log for the KASAN report\n");
+	return 0;
+}
+
+module_init(aux_test_init);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Kunwu Chan <kunwu.chan@xxxxxxxxx>");
+MODULE_DESCRIPTION("KASAN aux-stack verification for RCU callbacks");
-- 
2.43.0