The patch titled Subject: mm/kasan: fix false positive invalid-free reports with CONFIG_KASAN_SW_TAGS=y has been added to the -mm tree. Its filename is mm-kasan-fix-false-positive-invalid-free-reports-with-config_kasan_sw_tags=y.patch

This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/mm-kasan-fix-false-positive-invalid... and later at http://ozlabs.org/~akpm/mmotm/broken-out/mm-kasan-fix-false-positive-invalid...

Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next and is updated there every 3-4 working days

------------------------------------------------------ From: Andrey Ryabinin aryabinin@virtuozzo.com Subject: mm/kasan: fix false positive invalid-free reports with CONFIG_KASAN_SW_TAGS=y

The code like this:

ptr = kmalloc(size, GFP_KERNEL); page = virt_to_page(ptr); offset = offset_in_page(ptr); kfree(page_address(page) + offset);

may produce false-positive invalid-free reports on the kernel with CONFIG_KASAN_SW_TAGS=y.

In the example above we lose the original tag assigned to 'ptr', so kfree() gets the pointer with 0xFF tag. In kfree() we check that 0xFF tag is different from the tag in shadow hence print false report.

Instead of just comparing tags, do the following:

1) Check that shadow doesn't contain KASAN_TAG_INVALID. Otherwise it's double-free and it doesn't matter what tag the pointer have.

2) If pointer tag is different from 0xFF, make sure that tag in the shadow is the same as in the pointer.

Link: http://lkml.kernel.org/r/20190819172540.19581-1-aryabinin@virtuozzo.com Fixes: 7f94ffbc4c6a ("kasan: add hooks implementation for tag-based mode") Signed-off-by: Andrey Ryabinin aryabinin@virtuozzo.com Reported-by: Walter Wu walter-zh.wu@mediatek.com Reported-by: Mark Rutland mark.rutland@arm.com Reviewed-by: Andrey Konovalov andreyknvl@google.com Cc: Alexander Potapenko glider@google.com Cc: Dmitry Vyukov dvyukov@google.com Cc: Catalin Marinas catalin.marinas@arm.com Cc: Will Deacon will.deacon@arm.com Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org ---

mm/kasan/common.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)

--- a/mm/kasan/common.c~mm-kasan-fix-false-positive-invalid-free-reports-with-config_kasan_sw_tags=y +++ a/mm/kasan/common.c @@ -407,8 +407,14 @@ static inline bool shadow_invalid(u8 tag if (IS_ENABLED(CONFIG_KASAN_GENERIC)) return shadow_byte < 0 || shadow_byte >= KASAN_SHADOW_SCALE_SIZE; - else - return tag != (u8)shadow_byte; + + /* else CONFIG_KASAN_SW_TAGS: */ + if ((u8)shadow_byte == KASAN_TAG_INVALID) + return true; + if ((tag != KASAN_TAG_KERNEL) && (tag != (u8)shadow_byte)) + return true; + + return false; }

static bool __kasan_slab_free(struct kmem_cache *cache, void *object, _

Patches currently in -mm which might be from aryabinin@virtuozzo.com are

mm-kasan-fix-false-positive-invalid-free-reports-with-config_kasan_sw_tags=y.patch mm-vmscan-remove-unused-lru_pages-argument.patch