RE: [PATCH] kasan: improve double-free detection

From: Luruo, Kuthonuzo
Date: Tue May 03 2016 - 05:25:00 EST

> We can use per-header lock by setting status to KASAN_STATE_LOCKED. A
> thread can CAS any status to KASAN_STATE_LOCKED which means that it
> locked the header. If any thread tried to modify/read the status and
> the status is KASAN_STATE_LOCKED, then the thread waits.

Thanks, Dmitry. I've successfully tested with the concurrent free slab_test test
(alloc on cpu 0; then concurrent frees on all other cpus on a 12-vcpu KVM) using:

static inline bool kasan_alloc_state_lock(struct kasan_alloc_meta *alloc_info)
if (cmpxchg(&alloc_info->state, KASAN_STATE_ALLOC,
return true;
return false;

static inline void kasan_alloc_state_unlock_wait(struct kasan_alloc_meta
while (alloc_info->state == KASAN_STATE_LOCKED)

Race "winner" sets state to quarantine as the last step:

if (kasan_alloc_state_lock(alloc_info)) {
free_info = get_free_info(cache, object);
quarantine_put(free_info, cache);
set_track(&free_info->track, GFP_NOWAIT);
kasan_poison_slab_free(cache, object);
alloc_info->state = KASAN_STATE_QUARANTINE;
return true;
} else

Now, I'm not sure whether on current KASAN-supported archs, state byte load in
the busy-wait loop is atomic wrt the KASAN_STATE_QUARANTINE byte store.
Would you advise using CAS primitives for load/store here too?

> >
> > Sure, a new test can be added for test_kasan.ko. Unlike the other tests, a
> > double-free would likely panic the system due to slab corruption. Would it still
> > be "KASANic" for kasan_slab_free() to return true after reporting double-free
> > attempt error so thread will not call into __cache_free()? How does ASAN
> > handle this?
> Yes, sure, it is OK to return true from kasan_slab_free() in such case.
> Use-space ASAN terminates the process after the first report. We've
> decided that in kernel we better continue in best-effort manner. But
> after the first report all bets are mostly off (leaking an object is
> definitely OK).

sounds good; I'm also "promoting" double-free pr_err() to kasan_report().