On Fri, Oct 24, 2025 at 03:19:57AM +0200, Andrey Konovalov wrote:
On Fri, Oct 24, 2025 at 2:41 AM Harry Yoo harry.yoo@oracle.com wrote:
Adding more details on how I discovered this and why I care:
I was developing a feature that uses unused bytes in s->size as the slabobj_ext metadata. Unlike other metadata where slab disables KASAN when accessing it, this should be unpoisoned to avoid adding complexity and overhead when accessing it.
Generally, unpoisoining parts of slabs that should not be accessed by non-slab code is undesirable - this would prevent KASAN from detecting OOB accesses into that memory.
An alternative to unpoisoning or disabling KASAN could be to add helper functions annotated with __no_sanitize_address that do the required accesses. And make them inlined when KASAN is disabled to avoid the performance hit.
This sounds reasonable, let me try this instead of unpoisoning metadata. Thanks.
On a side note, you might also need to check whether SW_TAGS KASAN and KMSAN would be unhappy with your changes:
- When we do kasan_disable_current() or metadata_access_enable(), we
also do kasan_reset_tag();
- In metadata_access_enable(), we disable KMSAN as well.
Thanks for pointing this out!
Just to clarify, by calling kasan_reset_tag() we clear tag from the address so that SW or HW tag based KASAN won't report access violation? (because there is no valid tag in the address?)