Re: [PATCH RFC v3 08/12] kcov: log freeing of SLUB objects and pages

[Jann Horn]

On Tue, Sep 8, 2026 at 6:55 PM Jann Horn <jannh@xxxxxxxxxx> wrote:
> To help with using CONFIG_KCOV_MEMORY for detecting use-after-free issues,
> log when memory (SLUB objects or page allocations) is being freed.
>
> This should happen after KASAN has already marked the memory as freed;
> this will become important if we allow driving delay injection off this
> in the future.

Oops, I should include the page allocator and SLUB people on this one
patch in the series, since I'm adding a hook in their code.

> Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
> ---
>  include/uapi/linux/kcov.h | 1 +
>  mm/kasan/common.c         | 2 ++
>  mm/page_alloc.c           | 3 +++
>  3 files changed, 6 insertions(+)
>
> diff --git a/include/uapi/linux/kcov.h b/include/uapi/linux/kcov.h
> index 7d7147e7b427..76822d1c119a 100644
> --- a/include/uapi/linux/kcov.h
> +++ b/include/uapi/linux/kcov.h
> @@ -90,6 +90,7 @@ static inline __u64 kcov_remote_handle(__u64 subsys, __u64 inst)
>  #define MEMORY_ACCESS_RECORD_WRITE 0x10
>  #define MEMORY_ACCESS_RECORD_RMW 0x20
>  #define MEMORY_ACCESS_RECORD_ATOMIC 0x40
> +#define MEMORY_ACCESS_RECORD_FREE 0x80
>  struct memory_access_record {
>         __aligned_u64 ip_address_and_kcov_flags;
>         __aligned_u64 data_address;
> diff --git a/mm/kasan/common.c b/mm/kasan/common.c
> index 1ab77ac9719c..3a648eaad024 100644
> --- a/mm/kasan/common.c
> +++ b/mm/kasan/common.c
> @@ -283,6 +283,8 @@ bool __kasan_slab_free(struct kmem_cache *cache, void *object, bool init,
>                 return false;
>
>         poison_slab_object(cache, object, init);
> +       _kcov_handle_memaccess(object, cache->object_size,
> +                                   MEMORY_ACCESS_RECORD_WRITE|MEMORY_ACCESS_RECORD_FREE);
>
>         if (no_quarantine)
>                 return false;
> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> index 083cbcb5bdde..910d14925b84 100644
> --- a/mm/page_alloc.c
> +++ b/mm/page_alloc.c
> @@ -1446,6 +1446,9 @@ static __always_inline bool __free_pages_prepare(struct page *page,
>         if (init)
>                 clear_highpages_kasan_tagged(page, 1 << order);
>
> +       _kcov_handle_memaccess(page_address(page), (1 << order)*PAGE_SIZE,
> +                                   MEMORY_ACCESS_RECORD_WRITE|MEMORY_ACCESS_RECORD_FREE);
> +
>         /*
>          * arch_free_page() can make the page's contents inaccessible.  s390
>          * does this.  So nothing which can access the page's contents should
>
> --
> 2.55.0.979.g7e5102b832-goog
>