RE: [PATCH] kasan: improve double-free detection

[Luruo, Kuthonuzo]

> 
> We can use per-header lock by setting status to KASAN_STATE_LOCKED.  A
> thread can CAS any status to KASAN_STATE_LOCKED which means that it
> locked the header. If any thread tried to modify/read the status and
> the status is KASAN_STATE_LOCKED, then the thread waits.

Thanks, Dmitry. I've successfully tested with the concurrent free slab_test test
(alloc on cpu 0; then concurrent frees on all other cpus on a 12-vcpu KVM) using:

static inline bool kasan_alloc_state_lock(struct kasan_alloc_meta *alloc_info)
{
        if (cmpxchg(&alloc_info->state, KASAN_STATE_ALLOC,
                                KASAN_STATE_LOCKED) == KASAN_STATE_ALLOC)
                return true;
        return false;
}

static inline void kasan_alloc_state_unlock_wait(struct kasan_alloc_meta
                *alloc_info)
{
        while (alloc_info->state == KASAN_STATE_LOCKED)
                cpu_relax();
}

Race "winner" sets state to quarantine as the last step:

        if (kasan_alloc_state_lock(alloc_info)) {
                free_info = get_free_info(cache, object);
                quarantine_put(free_info, cache);
                set_track(&free_info->track, GFP_NOWAIT);
                kasan_poison_slab_free(cache, object);
                alloc_info->state = KASAN_STATE_QUARANTINE;
                return true;
        } else
                kasan_alloc_state_unlock_wait(alloc_info);

Now, I'm not sure whether on current KASAN-supported archs, state byte load in
the busy-wait loop is atomic wrt the KASAN_STATE_QUARANTINE byte store.
Would you advise using CAS primitives for load/store here too?

> >
> > Sure, a new test can be added for test_kasan.ko. Unlike the other tests, a
> > double-free would likely panic the system due to slab corruption. Would it still
> > be "KASANic" for kasan_slab_free() to return true after reporting double-free
> > attempt error so thread will not call into __cache_free()? How does ASAN
> > handle this?
> 
> Yes, sure, it is OK to return true from kasan_slab_free() in such case.
> Use-space ASAN terminates the process after the first report. We've
> decided that in kernel we better continue in best-effort manner. But
> after the first report all bets are mostly off (leaking an object is
> definitely OK).

sounds good; I'm also "promoting" double-free pr_err() to kasan_report().

Kuthonuzo