Re: [PATCH 21/32] kasan: simplify invalid-free reporting

From: Kuan-Ying Lee
Date: Tue Jun 21 2022 - 03:18:04 EST


On Tue, 2022-06-14 at 04:14 +0800, andrey.konovalov@xxxxxxxxx wrote:
> From: Andrey Konovalov <andreyknvl@xxxxxxxxxx>
>
> Right now, KASAN uses the kasan_report_type enum to describe report
> types.
>
> As this enum only has two options, replace it with a bool variable.
>
> Also, unify printing report header for invalid-free and other bug
> types
> in print_error_description().
>
> Signed-off-by: Andrey Konovalov <andreyknvl@xxxxxxxxxx>
> ---
> mm/kasan/kasan.h | 7 +------
> mm/kasan/report.c | 16 +++++++---------
> 2 files changed, 8 insertions(+), 15 deletions(-)
>
> diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
> index e8329935fbfb..f696d50b09fb 100644
> --- a/mm/kasan/kasan.h
> +++ b/mm/kasan/kasan.h
> @@ -146,16 +146,11 @@ static inline bool kasan_requires_meta(void)
> #define META_MEM_BYTES_PER_ROW (META_BYTES_PER_ROW *
> KASAN_GRANULE_SIZE)
> #define META_ROWS_AROUND_ADDR 2
>
> -enum kasan_report_type {
> - KASAN_REPORT_ACCESS,
> - KASAN_REPORT_INVALID_FREE,
> -};
> -
> struct kasan_report_info {
> - enum kasan_report_type type;
> void *access_addr;
> void *first_bad_addr;
> size_t access_size;
> + bool is_free;
> bool is_write;
> unsigned long ip;
> };
> diff --git a/mm/kasan/report.c b/mm/kasan/report.c
> index f951fd39db74..7269b6249488 100644
> --- a/mm/kasan/report.c
> +++ b/mm/kasan/report.c
> @@ -175,14 +175,12 @@ static void end_report(unsigned long *flags,
> void *addr)
>

Hi Andrey,

Do we need to distinguish "double free" case from "invalid free" or
we just print "double-free or invalid-free"?

I sent a patch[1] to separate double free case from invalid
free last week and I saw it has been merged into akpm tree.

[1]
https://lore.kernel.org/linux-mm/20220615062219.22618-1-Kuan-Ying.Lee@xxxxxxxxxxxx/

Thanks,
Kuan-Ying Lee

> static void print_error_description(struct kasan_report_info *info)
> {
> - if (info->type == KASAN_REPORT_INVALID_FREE) {
> - pr_err("BUG: KASAN: double-free or invalid-free in
> %pS\n",
> - (void *)info->ip);
> - return;
> - }
> + const char *bug_type = info->is_free ?
> + "double-free or invalid-free" :
> kasan_get_bug_type(info);
>
> - pr_err("BUG: KASAN: %s in %pS\n",
> - kasan_get_bug_type(info), (void *)info->ip);
> + pr_err("BUG: KASAN: %s in %pS\n", bug_type, (void *)info-
> >ip);
> + if (info->is_free)
> + return;
> if (info->access_size)
> pr_err("%s of size %zu at addr %px by task %s/%d\n",
> info->is_write ? "Write" : "Read", info-
> >access_size,
> @@ -435,11 +433,11 @@ void kasan_report_invalid_free(void *ptr,
> unsigned long ip)
>
> start_report(&flags, true);
>
> - info.type = KASAN_REPORT_INVALID_FREE;
> info.access_addr = ptr;
> info.first_bad_addr = kasan_reset_tag(ptr);
> info.access_size = 0;
> info.is_write = false;
> + info.is_free = true;
> info.ip = ip;
>
> print_report(&info);
> @@ -468,11 +466,11 @@ bool kasan_report(unsigned long addr, size_t
> size, bool is_write,
>
> start_report(&irq_flags, true);
>
> - info.type = KASAN_REPORT_ACCESS;
> info.access_addr = ptr;
> info.first_bad_addr = kasan_find_first_bad_addr(ptr, size);
> info.access_size = size;
> info.is_write = is_write;
> + info.is_free = false;
> info.ip = ip;
>
> print_report(&info);
> --
> 2.25.1
>
>