kasan: record task_work_add() call stack

Why record task_work_add() call stack?  Syzbot reports many use-after-free
issues for task_work, see [1].  After seeing the free stack and the
current auxiliary stack, we think they are useless, we don't know where
the work was registered.  This work may be the free call stack, so we miss
the root cause and don't solve the use-after-free.

Add the task_work_add() call stack into the KASAN auxiliary stack in order
to improve KASAN reports.  It helps programmers solve use-after-free
issues.

[1]: https://groups.google.com/g/syzkaller-bugs/search?q=kasan%20use-after-free%20task_work_run

Link: https://lkml.kernel.org/r/20210316024410.19967-1-walter-zh.wu@mediatek.com
Signed-off-by: Walter Wu <walter-zh.wu@mediatek.com>
Suggested-by: Dmitry Vyukov <dvyukov@google.com>
Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Reviewed-by: Jens Axboe <axboe@kernel.dk>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/kernel/task_work.c b/kernel/task_work.c
index e9316198c64bf5acf8fd1d32b88bf4cc3276492f..1698fbe6f0e134ac2a2ab3e9357b44af99c71f83 100644 (file)
--- a/kernel/task_work.c
+++ b/kernel/task_work.c
@@ -34,6 +34,9 @@ int task_work_add(struct task_struct *task, struct callback_head *work,
 {
        struct callback_head *head;
 
+       /* record the work call stack in order to print it in KASAN reports */
+       kasan_record_aux_stack(work);
+
        do {
                head = READ_ONCE(task->task_works);
                if (unlikely(head == &work_exited))

diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
index 071c456a3579533d99cd9d2f759b61dcbb66a9c4..3820ca54743b54ecefbdc042cf65f2c1f7cec325 100644 (file)
--- a/mm/kasan/kasan.h
+++ b/mm/kasan/kasan.h
@@ -163,7 +163,7 @@ struct kasan_alloc_meta {
        struct kasan_track alloc_track;
 #ifdef CONFIG_KASAN_GENERIC
        /*
-        * call_rcu() call stack is stored into struct kasan_alloc_meta.
+        * The auxiliary stack is stored into struct kasan_alloc_meta.
         * The free stack is stored into struct kasan_free_meta.
         */
        depot_stack_handle_t aux_stack[2];