mirror of
https://github.com/torvalds/linux.git
synced 2026-11-06 21:58:01 +01:00
22ab064776
CPU resume and BPF exception handling can discard stack frames without running their compiler-generated epilogues. Generic KASAN needs kasan_unpoison_task_stack_below() to clear the redzones left behind by those frames before the stack is reused. CONFIG_KASAN_STACK also enables this helper for SW_TAGS. The helper derives the stack base from an untagged stack pointer, so kasan_unpoison() writes KASAN_TAG_KERNEL (0xff) into the shadow for [base, watermark). For a vmapped task stack, vm_area->addr still carries the original random allocation tag. This creates a tag mismatch at the stack base even if that memory has never held an instrumented stack object. When the task exits and its stack is not cached, thread_stack_free_rcu() passes vm_area->addr to vfree(). In RCU callback context this reaches vfree_atomic(), whose llist_add() writes to the allocation base through the tagged pointer and triggers a false KASAN invalid-access report: BUG: KASAN: invalid-access in vfree_atomic+0x90/0x150 Write of size 8 at addr c2ffffc0a8f70000 by task rcuop/7/75 Pointer tag: [c2], memory tag: [ff] Call trace: __hwasan_store8_noabort+0xe8/0xf8 vfree_atomic+0x90/0x150 vfree+0x220/0x298 thread_stack_free_rcu+0x3c/0x4c rcu_do_batch+0x308/0xaf0 rcu_nocb_cb_kthread+0x33c/0x708 The deferred-free path started using the tagged vm_area->addr in commit |
||
|---|---|---|
| .. | ||
| common.c | ||
| generic.c | ||
| hw_tags.c | ||
| init.c | ||
| kasan_test_c.c | ||
| kasan_test_rust.rs | ||
| kasan.h | ||
| Makefile | ||
| quarantine.c | ||
| report_generic.c | ||
| report_hw_tags.c | ||
| report_sw_tags.c | ||
| report_tags.c | ||
| report.c | ||
| shadow.c | ||
| sw_tags.c | ||
| tags.c | ||