Andrey Ryabinin 22ab064776 kasan: unpoison task stack below watermark only in generic mode ... CPU resume and BPF exception handling can discard stack frames without running their compiler-generated epilogues. Generic KASAN needs kasan_unpoison_task_stack_below() to clear the redzones left behind by those frames before the stack is reused. CONFIG_KASAN_STACK also enables this helper for SW_TAGS. The helper derives the stack base from an untagged stack pointer, so kasan_unpoison() writes KASAN_TAG_KERNEL (0xff) into the shadow for [base, watermark). For a vmapped task stack, vm_area->addr still carries the original random allocation tag. This creates a tag mismatch at the stack base even if that memory has never held an instrumented stack object. When the task exits and its stack is not cached, thread_stack_free_rcu() passes vm_area->addr to vfree(). In RCU callback context this reaches vfree_atomic(), whose llist_add() writes to the allocation base through the tagged pointer and triggers a false KASAN invalid-access report: BUG: KASAN: invalid-access in vfree_atomic+0x90/0x150 Write of size 8 at addr c2ffffc0a8f70000 by task rcuop/7/75 Pointer tag: [c2], memory tag: [ff] Call trace: __hwasan_store8_noabort+0xe8/0xf8 vfree_atomic+0x90/0x150 vfree+0x220/0x298 thread_stack_free_rcu+0x3c/0x4c rcu_do_batch+0x308/0xaf0 rcu_nocb_cb_kthread+0x33c/0x708 The deferred-free path started using the tagged vm_area->addr in commit 449e0b4ed5 ("fork: clean-up naming of vm_stack/vm_struct variables in vmap stacks code"). Previously it freed the untagged pointer derived from tsk->stack, so the write was never tag-checked. SW_TAGS does not need the blanket shadow reset to make subsequent stack accesses valid: untagged kernel pointers have the match-all 0xff tag, and the compiler initializes the shadow tags of instrumented stack objects before use. Return early unless CONFIG_KASAN_GENERIC is enabled. Keep the mode check in the common helper so it covers both resume and bpf_throw(). Link: https://lore.kernel.org/20260916175113.1327454-1-ryabinin.a.a@gmail.com Fixes: 449e0b4ed5 ("fork: clean-up naming of vm_stack/vm_struct variables in vmap stacks code") Signed-off-by: Andrey Ryabinin <ryabinin.a.a@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Reported-by: Shaobo Huang <huangshaobo3@xiaomi.com> Closes: https://lore.kernel.org/all/20260806123020.90869-1-huangshaobo3@xiaomi.com/ Assisted-by: LLM Cc: Alexander Potapenko <glider@google.com> Cc: Andrey Konovalov <andreyknvl@gmail.com> Cc: David Hildenbrand <david@kernel.org> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Vincenzo Frascino <vincenzo.frascino@arm.com> Cc: <stable@vger.kernel.org>		2026-09-26 13:55:10 -07:00
..
common.c	kasan: unpoison task stack below watermark only in generic mode	2026-09-26 13:55:10 -07:00
generic.c	kasan: cleanup of kasan_enabled() checks	2025-11-16 17:28:01 -08:00
hw_tags.c	mm/kasan: remove redundant initialization for kasan_flag_write_only	2026-07-28 21:11:44 -07:00
init.c	kasan: Move generic KASAN page tables out of BSS too	2026-06-05 11:44:10 +01:00
kasan_test_c.c	mm.git review status for mm-hotfixes-stable..mm-stable	2026-06-19 10:14:34 -07:00
kasan_test_rust.rs	rust: treewide: switch to the kernel Vec type	2024-10-15 23:10:32 +02:00
kasan.h	kasan: remove __kasan_save_free_info wrapper	2025-11-16 17:28:01 -08:00
Makefile	kbuild: Switch from -Wvla to -Wvla-larger-than=1	2025-05-08 09:42:06 -07:00
quarantine.c	kasan: fix quarantine_size accounting during cache removal	2026-08-24 18:43:21 -07:00
report_generic.c	kasan: stop leaking stack trace handles	2024-01-05 10:17:45 -08:00
report_hw_tags.c
report_sw_tags.c
report_tags.c
report.c	kasan: fix bug type classification for SW_TAGS mode	2026-04-05 13:53:18 -07:00
shadow.c	mm: introduce generic lazy_mmu helpers	2026-01-20 19:24:33 -08:00
sw_tags.c	kasan: introduce ARCH_DEFER_KASAN and unify static key across modes	2025-09-21 14:21:58 -07:00
tags.c	kasan: remove __kasan_save_free_info wrapper	2025-11-16 17:28:01 -08:00