Re: [PATCH v2 4/5] kasan: Avoid an unrelated RCU warning in the callback test

[Paul E. McKenney]

On Sun, Nov 08, 2026 at 07:02:40PM -0500, Joel Fernandes wrote:
> rcu_uaf() passes a false protection condition to
> rcu_dereference_protected(), which produces a suspicious-RCU-usage
> warning before the intended KASAN failure occurs.
> 
> The pointer refers to a fresh allocation that has not been published to
> readers. State that protection condition explicitly, leaving the intended
> tests intact.
> 
> Test:
> Built with CONFIG_KASAN_KUNIT_TEST=m
> Booted Qemu guest (8 CPUs), ran modprobe kasan_test filtered to kasan.*rcu_uaf*
> 
> Signed-off-by: Joel Fernandes <joelagnelf@xxxxxxxxxx>

Reviewed-by: Paul E. McKenney <paulmck@xxxxxxxxxx>

And yes, the second argument to rcu_dereference_protected() is a boolean,
not a pointer.  Good catch!

> ---
>  mm/kasan/kasan_test_c.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/kasan/kasan_test_c.c b/mm/kasan/kasan_test_c.c
> index b9e167ed5be3..4e23765d722c 100644
> --- a/mm/kasan/kasan_test_c.c
> +++ b/mm/kasan/kasan_test_c.c
> @@ -967,8 +967,9 @@ static void rcu_uaf(struct kunit *test)
>  	ptr = kmalloc_obj(struct kasan_rcu_info);
>  	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>  
> +	/* The freshly allocated object has not been published to readers. */
>  	global_rcu_ptr = rcu_dereference_protected(
> -				(struct kasan_rcu_info __rcu *)ptr, NULL);
> +				(struct kasan_rcu_info __rcu *)ptr, true);
>  
>  	KUNIT_EXPECT_KASAN_FAIL_READ(test,
>  			call_rcu(&global_rcu_ptr->rcu, rcu_uaf_reclaim);
> -- 
> 2.54.0
> 
>