From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from m16.mail.163.com (m16.mail.163.com [117.135.210.3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D50F723ED6A for ; Sun, 24 May 2026 03:19:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=117.135.210.3 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779592802; cv=none; b=jFt1V0Gd31lL759nPdsX5qYsrh/nP08Z2tN/2VlP1b/sm6JCY/m+K18/qifP9R7j5n9p1BbUqtIJ1ERtwj98qHXJBOYPQLbjA1v+tsaHjmgSII73KFSXnzYxagEQI7odH3NcHF2b1KOCUMN4xDM0yit59ORMzipvJSwNpvkvkh0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779592802; c=relaxed/simple; bh=HlJalf8010W2md3kjSUX3QKPgktrwp+syW2xAHnWxy4=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=idoc+eOSoG3CYqIwDz7mIh7O9YMRlmRalIt28me6peTUJ+/ERsYJd8tViR0lsDbmWjwGf89cynn5W4UXaliMRTauZYgJNd5BhS1AmDmuZ7b8/iUBqGZRdN0LLzJwFi2YnPCK100pr+4Jb/ljqHLwnjbW2zT2BH9Gajf9h6WlaMw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com; spf=pass smtp.mailfrom=163.com; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b=ibquG/4i; arc=none smtp.client-ip=117.135.210.3 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=163.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b="ibquG/4i" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=Message-ID:Date:MIME-Version:Subject:To:From: Content-Type; bh=b0VfTFbLd7nIbvJMxnmz75Fll57iwIRs2X4jpCHwQOQ=; b=ibquG/4iE35dkPfmWRK9MLyFiIMpYWOb8F1vc63MIMmpelonu50hvDadtXFx/J /zPNrBxykEFSWqV7yZb381IlZjWB039saw59GTCtJrHb8JnRuv5escdXjr0tro+Q mV6QjRhDD3jzXgY8gkzIHK6O9kGgKf9Tzw6v6X76ctvTk= Received: from [10.17.219.236] (unknown []) by gzga-smtp-mtada-g1-0 (Coremail) with SMTP id _____wDHXXi+bRJqbXQADA--.20870S2; Sun, 24 May 2026 11:17:19 +0800 (CST) Message-ID: <9ab33234-34ec-473f-83ea-e5607b18b36f@163.com> Date: Sun, 24 May 2026 11:17:18 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] kasan/test: only do kmalloc_double_kzfree for generic mode To: Andrey Konovalov Cc: kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org References: <20260517071713.353579-1-wsw9603@163.com> Content-Language: en-US From: wangwensheng In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-CM-TRANSID:_____wDHXXi+bRJqbXQADA--.20870S2 X-Coremail-Antispam: 1Uf129KBjvJXoW7Kw1fCrykKr4fGr13Jry7KFg_yoW8tr1Dpr Z5tFy8AF4ktr1I93WUJF4q9348Aa97KF10qFyavwsY9Fy3G3WfKFn29ryqqFW8ur48ZF40 y3Z0yry3Xwn8Z3DanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x0zR_HUkUUUUU= X-CM-SenderInfo: pzvzmliqt6il2tof0z/xtbC3QCqsmoSbcCQbgAA3u On 5/21/26 02:19, Andrey Konovalov wrote: > On Sun, May 17, 2026 at 9:17 AM Wang Wensheng wrote: >> kmalloc_double_kzfree() would corrupt kernel memory when the just >> freed memory were allocated by another thread before the second >> call to kfree_sensitive(). >> >> This could not happen in GENERIC mode as it uses quarantine. > Quite unfortunate to disable this test for HW_TAGS, but I don't see an > easy way to resolve the issue otherwise. > >> Signed-off-by: Wang Wensheng >> --- >> mm/kasan/kasan_test_c.c | 6 ++++++ >> 1 file changed, 6 insertions(+) >> >> diff --git a/mm/kasan/kasan_test_c.c b/mm/kasan/kasan_test_c.c >> index 32d06cbf6a31..02e43ccc9f21 100644 >> --- a/mm/kasan/kasan_test_c.c >> +++ b/mm/kasan/kasan_test_c.c >> @@ -874,6 +874,12 @@ static void kmalloc_double_kzfree(struct kunit *test) >> char *ptr; >> size_t size = 16; >> >> + /* >> + * Only generic KASAN uses quarantine, which could prevent the just freed >> + * memory from being allocated soon. >> + */ > Let's reword this to: > > With the tag-based KASAN modes, if the memory happens to be > reallocated between the two frees and the new allocation tag happens > to match the old one, the second free will cause a memory corruption. > Resolving https://bugzilla.kernel.org/show_bug.cgi?id=212177 would > help to deal with this. With Generic KASAN, it's effectively > impossible for the memory to get reallocated due to the quarantine. > Thanks for your nice comment. I have sent a second version. >> + KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); >> + >> ptr = kmalloc(size, GFP_KERNEL); >> KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); >> >> -- >> 2.43.0 >> >> -- >> You received this message because you are subscribed to the Google Groups "kasan-dev" group. >> To unsubscribe from this group and stop receiving emails from it, send an email to kasan-dev+unsubscribe@googlegroups.com. >> To view this discussion visit https://groups.google.com/d/msgid/kasan-dev/20260517071713.353579-1-wsw9603%40163.com. > With the comment rewording: > > Reviewed-by: Andrey Konovalov