pkg/report: split crash.KASAN into parts

We want to prioritize KASAN bugs differently.

4 files changed, 96 insertions, 32 deletions

diff --git a/pkg/bisect/bisect_test.go b/pkg/bisect/bisect_test.go
index d09e6804e..11d14d4fc 100644
--- a/pkg/bisect/bisect_test.go
+++ b/pkg/bisect/bisect_test.go
@@ -918,47 +918,47 @@ func TestMostFrequentReport(t *testing.T) {
 		{
 			name: "one infrequent",
 			reports: []*report.Report{
-				{Title: "A", Type: crash.KASAN},
-				{Title: "B", Type: crash.KASAN},
+				{Title: "A", Type: crash.KASANOther},
+				{Title: "B", Type: crash.KASANOther},
 				{Title: "C", Type: crash.Bug},
-				{Title: "D", Type: crash.KASAN},
+				{Title: "D", Type: crash.KASANOther},
 				{Title: "E", Type: crash.Bug},
-				{Title: "F", Type: crash.KASAN},
+				{Title: "F", Type: crash.KASANOther},
 				{Title: "G", Type: crash.LockdepBug},
 			},
 			// LockdepBug was too infrequent.
-			types:  []crash.Type{crash.KASAN, crash.Bug},
+			types:  []crash.Type{crash.KASANOther, crash.Bug},
 			report: "A",
 			other:  true,
 		},
 		{
 			name: "ignore hangs",
 			reports: []*report.Report{
-				{Title: "A", Type: crash.KASAN},
-				{Title: "B", Type: crash.KASAN},
+				{Title: "A", Type: crash.KASANOther},
+				{Title: "B", Type: crash.KASANOther},
 				{Title: "C", Type: crash.Hang},
-				{Title: "D", Type: crash.KASAN},
+				{Title: "D", Type: crash.KASANOther},
 				{Title: "E", Type: crash.Hang},
 				{Title: "F", Type: crash.Hang},
 				{Title: "G", Type: crash.Warning},
 			},
 			// Hang is not a preferred report type.
-			types:  []crash.Type{crash.KASAN, crash.Warning},
+			types:  []crash.Type{crash.KASANOther, crash.Warning},
 			report: "A",
 			other:  true,
 		},
 		{
 			name: "take hangs",
 			reports: []*report.Report{
-				{Title: "A", Type: crash.KASAN},
-				{Title: "B", Type: crash.KASAN},
+				{Title: "A", Type: crash.KASANOther},
+				{Title: "B", Type: crash.KASANOther},
 				{Title: "C", Type: crash.Hang},
 				{Title: "D", Type: crash.Hang},
 				{Title: "E", Type: crash.Hang},
 				{Title: "F", Type: crash.Hang},
 			},
 			// There are so many Hangs that we can't ignore it.
-			types:  []crash.Type{crash.Hang, crash.KASAN},
+			types:  []crash.Type{crash.Hang, crash.KASANOther},
 			report: "C",
 		},
 		{
diff --git a/pkg/report/crash/types.go b/pkg/report/crash/types.go
index ad550fa08..161950415 100644
--- a/pkg/report/crash/types.go
+++ b/pkg/report/crash/types.go
@@ -3,27 +3,34 @@
 
 package crash
 
+import "slices"
+
 type Type string
 
 const (
 	UnknownType = Type("")
 	// keep-sorted start
-	AtomicSleep         = Type("ATOMIC_SLEEP")
-	Bug                 = Type("BUG")
-	DoS                 = Type("DoS")
-	Hang                = Type("HANG")
-	KASAN               = Type("KASAN")
-	KCSAN               = Type("KCSAN")
-	KCSANDataRace       = Type("DATARACE")
-	KFENCE              = Type("KFENCE")
-	KMSAN               = Type("KMSAN")
-	LockdepBug          = Type("LOCKDEP")
-	MemoryLeak          = Type("LEAK")
-	MemorySafetyBUG     = Type("MEMORY_SAFETY_BUG")
-	MemorySafetyUBSAN   = Type("MEMORY_SAFETY_UBSAN")
-	MemorySafetyWARNING = Type("MEMORY_SAFETY_WARNING")
-	UBSAN               = Type("UBSAN")
-	Warning             = Type("WARNING")
+	AtomicSleep            = Type("ATOMIC_SLEEP")
+	Bug                    = Type("BUG")
+	DoS                    = Type("DoS")
+	Hang                   = Type("HANG")
+	KASANInvalidFree       = Type("KASAN-INVALID-FREE")
+	KASANOther             = Type("KASAN-OTHER")
+	KASANRead              = Type("KASAN-READ")
+	KASANUseAfterFreeRead  = Type("KASAN-USE-AFTER-FREE-READ")
+	KASANUseAfterFreeWrite = Type("KASAN-USE-AFTER-FREE-WRITE")
+	KASANWrite             = Type("KASAN-WRITE")
+	KCSAN                  = Type("KCSAN")
+	KCSANDataRace          = Type("DATARACE")
+	KFENCE                 = Type("KFENCE")
+	KMSAN                  = Type("KMSAN")
+	LockdepBug             = Type("LOCKDEP")
+	MemoryLeak             = Type("LEAK")
+	MemorySafetyBUG        = Type("MEMORY_SAFETY_BUG")
+	MemorySafetyUBSAN      = Type("MEMORY_SAFETY_UBSAN")
+	MemorySafetyWARNING    = Type("MEMORY_SAFETY_WARNING")
+	UBSAN                  = Type("UBSAN")
+	Warning                = Type("WARNING")
 	// keep-sorted end
 	LostConnection   = Type("LOST_CONNECTION")
 	SyzFailure       = Type("SYZ_FAILURE")
@@ -40,7 +47,8 @@ func (t Type) String() string {
 type TypeGroupPred func(Type) bool
 
 func (t Type) IsKASAN() bool {
-	return t == KASAN
+	return slices.Contains([]Type{
+		KASANRead, KASANWrite, KASANUseAfterFreeRead, KASANUseAfterFreeWrite, KASANInvalidFree, KASANOther}, t)
 }
 
 func (t Type) IsKMSAN() bool {
diff --git a/pkg/report/title_to_type.go b/pkg/report/title_to_type.go
index 61c7b6d9d..5dc332cd2 100644
--- a/pkg/report/title_to_type.go
+++ b/pkg/report/title_to_type.go
@@ -14,6 +14,62 @@ var titleToType = []struct {
 	{
 		includePrefixes: []string{
 			// keep-sorting start
+			"KASAN: global-out-of-bounds Write",
+			"KASAN: null-ptr-deref Write",
+			"KASAN: out-of-bounds Write",
+			"KASAN: slab-out-of-bounds Write",
+			"KASAN: stack-out-of-bounds Write",
+			"KASAN: user-memory-access Write",
+			"KASAN: vmalloc-out-of-bounds Write",
+			"KASAN: wild-memory-access Write",
+			// keep-sorting end
+		},
+		crashType: crash.KASANWrite,
+	},
+	{
+		includePrefixes: []string{
+			// keep-sorting start
+			"KASAN: global-out-of-bounds Read",
+			"KASAN: invalid-access Read",
+			"KASAN: null-ptr-deref Read",
+			"KASAN: out-of-bounds Read",
+			"KASAN: slab-out-of-bounds Read",
+			"KASAN: slab-out-of-bounds", // Read/Write is not clear. It is at least Read.
+			"KASAN: stack-out-of-bounds Read",
+			"KASAN: stack-out-of-bounds", // Read/Write is not clear. It is at least Read.
+			"KASAN: unknown-crash Read",
+			"KASAN: user-memory-access Read",
+			"KASAN: vmalloc-out-of-bounds Read",
+			"KASAN: wild-memory-access Read",
+			// keep-sorting end
+		},
+		crashType: crash.KASANRead,
+	},
+	{
+		includePrefixes: []string{
+			"KASAN: double-free or invalid-free",
+			"KASAN: invalid-free",
+		},
+		crashType: crash.KASANInvalidFree,
+	},
+
+	{
+		includePrefixes: []string{
+			"KASAN: slab-use-after-free Read",
+			"KASAN: use-after-free Read",
+		},
+		crashType: crash.KASANUseAfterFreeRead,
+	},
+	{
+		includePrefixes: []string{
+			"KASAN: slab-use-after-free Write",
+			"KASAN: use-after-free Write",
+		},
+		crashType: crash.KASANUseAfterFreeWrite,
+	},
+	{
+		includePrefixes: []string{
+			// keep-sorting start
 			"BUG: corrupted list",
 			"BUG: unable to handle kernel paging request",
 			// keep-sorting end
@@ -158,7 +214,7 @@ var titleToType = []struct {
 	},
 	{
 		includePrefixes: []string{"KASAN: "},
-		crashType:       crash.KASAN,
+		crashType:       crash.KASANOther,
 	},
 	{
 		includePrefixes: []string{"KFENCE: "},
diff --git a/pkg/vcs/linux_configs_test.go b/pkg/vcs/linux_configs_test.go
index 93449ca8b..c5ccb9ed3 100644
--- a/pkg/vcs/linux_configs_test.go
+++ b/pkg/vcs/linux_configs_test.go
@@ -31,14 +31,14 @@ func TestDropLinuxSanitizerConfigs(t *testing.T) {
 		},
 		{
 			name:  "kasan bug",
-			types: []crash.Type{crash.KASAN},
+			types: []crash.Type{crash.KASANOther},
 			test: func(t *testing.T, cf *kconfig.ConfigFile) {
 				assertConfigs(t, cf, "KASAN")
 			},
 		},
 		{
 			name:  "warning & kasan bug",
-			types: []crash.Type{crash.Warning, crash.KASAN},
+			types: []crash.Type{crash.Warning, crash.KASANOther},
 			test: func(t *testing.T, cf *kconfig.ConfigFile) {
 				assertConfigs(t, cf, "KASAN", "BUG")
 			},