audit: require race refcount budget on both sides before claiming UAF - #8
Open
rikvanriel wants to merge 1 commit into
Open
rikvanriel wants to merge 1 commit into
rikvanriel wants to merge 1 commit into
Conversation
For any suspected race claiming use-after-free via async work, RCU callback, or workqueue, require tracing reference counts on both sides back far enough to prove with certainty that one side lacks the reference needed to keep the object alive. Enumerate every acquire that pins the shared pointer and every release, build the reference budget at the claimed free point. If the cached pointer itself holds a pinning reference, free is blocked until that reference is dropped — at most a prompt-reclaim or cgroup-removal stall, not a use-after-free. Distinguish storage-free vs logical free (pool return): for permanently mapped or pooled storage, return-to-pool is a logical free even though reads do not fault; a read is reportable only when stale value drives a decision, a write is always reportable because it corrupts the next owner's reuse. Mirrors review-prompts kernel/technical-patterns, false-positive- guide 8.2, callstack resource.4b, mm-reclaim, and kernel-style CL-30 fix/race-refcount-budget. Prevents memcg per-CPU stock false positives while preserving hugetlb bare-pointer waits as true positives.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
For any suspected race claiming use-after-free via async work, RCU callback, or workqueue, require tracing reference counts on both sides back far enough to prove with certainty that one side lacks the reference needed to keep the object alive. Enumerate every acquire that pins the shared pointer and every release, build the reference budget at the claimed free point.
If the cached pointer itself holds a pinning reference, free is blocked until that reference is dropped — at most a prompt-reclaim or cgroup-removal stall, not a use-after-free. Distinguish storage-free vs logical free (pool return): for permanently mapped or pooled storage, return-to-pool is a logical free even though reads do not fault; a read is reportable only when stale value drives a decision, a write is always reportable because it corrupts the next owner's reuse.
Mirrors review-prompts kernel/technical-patterns, false-positive- guide 8.2, callstack resource.4b, mm-reclaim, and kernel-style CL-30 fix/race-refcount-budget. Prevents memcg per-CPU stock false positives while preserving hugetlb bare-pointer waits as true positives.