This patchset contains everything needed to integrate KASAN and KUnit.
KUnit will be able to:
(1) Fail tests when an unexpected KASAN error occurs
(2) Pass tests when an expected KASAN error occurs
Convert KASAN tests to KUnit with the exception of copy_user_test
because KUnit is unable to test those.
Add documentation on how to run the KASAN tests with KUnit and what to
expect when running these tests.
Depends on "[PATCH v3 kunit-next 0/2] kunit: extend kunit resources
API" patchset [1]
Changes from v4:
- KASAN no longer will panic on errors if both panic_on_warn and
kasan_multishot are enabled.
- As a result, the KASAN tests will no-longer disable panic_on_warn.
- This also means panic_on_warn no-longer needs to be exported.
- The use of temporary "kasan_data" variables has been cleaned up
somewhat.
- A potential refcount/resource leak should multiple KASAN errors
appear during an assertion was fixed.
- Some wording changes to the KASAN test Kconfig entries.
Changes from v3:
- KUNIT_SET_KASAN_DATA and KUNIT_DO_EXPECT_KASAN_FAIL have been
combined and included in KUNIT_DO_EXPECT_KASAN_FAIL() instead.
- Reordered logic in kasan_update_kunit_status() in report.c to be
easier to read.
- Added comment to not use the name "kasan_data" for any kunit tests
outside of KUNIT_EXPECT_KASAN_FAIL().
Changes since v2:
- Due to Alan's changes in [1], KUnit can be built as a module.
- The name of the tests that could not be run with KUnit has been
changed to be more generic: test_kasan_module.
- Documentation on how to run the new KASAN tests and what to expect
when running them has been added.
- Some variables and functions are now static.
- Now save/restore panic_on_warn in a similar way to kasan_multi_shot
and renamed the init/exit functions to be more generic to accommodate.
- Due to [2] in kasan_strings, kasan_memchr, and
kasan_memcmp will fail if CONFIG_AMD_MEM_ENCRYPT is enabled so return
early and print message explaining this circumstance.
- Changed preprocessor checks to C checks where applicable.
Changes since v1:
- Make use of Alan Maguire's suggestion to use his patch that allows
static resources for integration instead of adding a new attribute to
the kunit struct
- All KUNIT_EXPECT_KASAN_FAIL statements are local to each test
- The definition of KUNIT_EXPECT_KASAN_FAIL is local to the
test_kasan.c file since it seems this is the only place this will
be used.
- Integration relies on KUnit being builtin
- copy_user_test has been separated into its own file since KUnit
is unable to test these. This can be run as a module just as before,
using CONFIG_TEST_KASAN_USER
- The addition to the current task has been separated into its own
patch as this is a significant enough change to be on its own.
[1] https://lore.kernel.org/linux-kselftest/[email protected]/T/#t
[2] https://bugzilla.kernel.org/show_bug.cgi?id=206337
Patricia Alfonso (4):
Add KUnit Struct to Current Task
KUnit: KASAN Integration
KASAN: Port KASAN Tests to KUnit
KASAN: Testing Documentation
Documentation/dev-tools/kasan.rst | 70 ++++
include/kunit/test.h | 5 +
include/linux/kasan.h | 6 +
include/linux/sched.h | 4 +
lib/Kconfig.kasan | 18 +-
lib/Makefile | 3 +-
lib/kunit/test.c | 13 +-
lib/test_kasan.c | 668 +++++++++++++-----------------
lib/test_kasan_module.c | 76 ++++
mm/kasan/report.c | 34 +-
10 files changed, 504 insertions(+), 393 deletions(-)
create mode 100644 lib/test_kasan_module.c
--
2.26.0.110.g2183baf09c-goog
From: Patricia Alfonso <[email protected]>
Integrate KASAN into KUnit testing framework.
- Fail tests when KASAN reports an error that is not expected
- Use KUNIT_EXPECT_KASAN_FAIL to expect a KASAN error in KASAN
tests
- Expected KASAN reports pass tests and are still printed when run
without kunit_tool (kunit_tool still bypasses the report due to the
test passing)
- KUnit struct in current task used to keep track of the current
test from KASAN code
- Also make KASAN no-longer panic when panic_on_warn and
kasan_multi_shot are enabled (as multi-shot does nothing
otherwise)
Make use of "[PATCH v3 kunit-next 1/2] kunit: generalize
kunit_resource API beyond allocated resources" and "[PATCH v3
kunit-next 2/2] kunit: add support for named resources" from Alan
Maguire [1]
- A named resource is added to a test when a KASAN report is
expected
- This resource contains a struct for kasan_data containing
booleans representing if a KASAN report is expected and if a
KASAN report is found
[1] (https://lore.kernel.org/linux-kselftest/[email protected]/T/#t)
Signed-off-by: Patricia Alfonso <[email protected]>
Signed-off-by: David Gow <[email protected]>
Reviewed-by: Dmitry Vyukov <[email protected]>
---
include/kunit/test.h | 5 +++++
include/linux/kasan.h | 6 ++++++
lib/kunit/test.c | 13 ++++++++-----
lib/test_kasan.c | 44 +++++++++++++++++++++++++++++++++++++++----
mm/kasan/report.c | 34 ++++++++++++++++++++++++++++++++-
5 files changed, 92 insertions(+), 10 deletions(-)
diff --git a/include/kunit/test.h b/include/kunit/test.h
index ac59d18e6bab..1dc3d118f64b 100644
--- a/include/kunit/test.h
+++ b/include/kunit/test.h
@@ -225,6 +225,11 @@ struct kunit {
struct list_head resources; /* Protected by lock. */
};
+static inline void kunit_set_failure(struct kunit *test)
+{
+ WRITE_ONCE(test->success, false);
+}
+
void kunit_init_test(struct kunit *test, const char *name, char *log);
int kunit_run_tests(struct kunit_suite *suite);
diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index 5cde9e7c2664..148eaef3e003 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -14,6 +14,12 @@ struct task_struct;
#include <asm/kasan.h>
#include <asm/pgtable.h>
+/* kasan_data struct is used in KUnit tests for KASAN expected failures */
+struct kunit_kasan_expectation {
+ bool report_expected;
+ bool report_found;
+};
+
extern unsigned char kasan_early_shadow_page[PAGE_SIZE];
extern pte_t kasan_early_shadow_pte[PTRS_PER_PTE];
extern pmd_t kasan_early_shadow_pmd[PTRS_PER_PMD];
diff --git a/lib/kunit/test.c b/lib/kunit/test.c
index 2cb7c6220a00..030a3281591e 100644
--- a/lib/kunit/test.c
+++ b/lib/kunit/test.c
@@ -10,16 +10,12 @@
#include <linux/kernel.h>
#include <linux/kref.h>
#include <linux/sched/debug.h>
+#include <linux/sched.h>
#include "debugfs.h"
#include "string-stream.h"
#include "try-catch-impl.h"
-static void kunit_set_failure(struct kunit *test)
-{
- WRITE_ONCE(test->success, false);
-}
-
static void kunit_print_tap_version(void)
{
static bool kunit_has_printed_tap_version;
@@ -288,6 +284,10 @@ static void kunit_try_run_case(void *data)
struct kunit_suite *suite = ctx->suite;
struct kunit_case *test_case = ctx->test_case;
+#if (IS_ENABLED(CONFIG_KASAN) && IS_ENABLED(CONFIG_KUNIT))
+ current->kunit_test = test;
+#endif /* IS_ENABLED(CONFIG_KASAN) && IS_ENABLED(CONFIG_KUNIT) */
+
/*
* kunit_run_case_internal may encounter a fatal error; if it does,
* abort will be called, this thread will exit, and finally the parent
@@ -603,6 +603,9 @@ void kunit_cleanup(struct kunit *test)
spin_unlock(&test->lock);
kunit_remove_resource(test, res);
}
+#if (IS_ENABLED(CONFIG_KASAN) && IS_ENABLED(CONFIG_KUNIT))
+ current->kunit_test = NULL;
+#endif /* IS_ENABLED(CONFIG_KASAN) && IS_ENABLED(CONFIG_KUNIT)*/
}
EXPORT_SYMBOL_GPL(kunit_cleanup);
diff --git a/lib/test_kasan.c b/lib/test_kasan.c
index 3872d250ed2c..7b4cb107b387 100644
--- a/lib/test_kasan.c
+++ b/lib/test_kasan.c
@@ -23,12 +23,48 @@
#include <asm/page.h>
-/*
- * Note: test functions are marked noinline so that their names appear in
- * reports.
+#include <kunit/test.h>
+
+static struct kunit_resource resource;
+static struct kunit_kasan_expectation fail_data;
+static bool multishot;
+
+static int kasan_test_init(struct kunit *test)
+{
+ /*
+ * Temporarily enable multi-shot mode and set panic_on_warn=0.
+ * Otherwise, we'd only get a report for the first case.
+ */
+ multishot = kasan_save_enable_multi_shot();
+
+ return 0;
+}
+
+static void kasan_test_exit(struct kunit *test)
+{
+ kasan_restore_multi_shot(multishot);
+}
+
+/**
+ * KUNIT_EXPECT_KASAN_FAIL() - Causes a test failure when the expression does
+ * not cause a KASAN error. This uses a KUnit resource named "kasan_data." Do
+ * Do not use this name for a KUnit resource outside here.
+ *
*/
+#define KUNIT_EXPECT_KASAN_FAIL(test, condition) do { \
+ fail_data.report_expected = true; \
+ fail_data.report_found = false; \
+ kunit_add_named_resource(test, \
+ NULL, \
+ NULL, \
+ &resource, \
+ "kasan_data", &fail_data); \
+ condition; \
+ KUNIT_EXPECT_EQ(test, \
+ fail_data.report_expected, \
+ fail_data.report_found); \
+} while (0)
-static noinline void __init kmalloc_oob_right(void)
{
char *ptr;
size_t size = 123;
diff --git a/mm/kasan/report.c b/mm/kasan/report.c
index 5ef9f24f566b..a58a9f3b7f2c 100644
--- a/mm/kasan/report.c
+++ b/mm/kasan/report.c
@@ -32,6 +32,8 @@
#include <asm/sections.h>
+#include <kunit/test.h>
+
#include "kasan.h"
#include "../slab.h"
@@ -92,7 +94,7 @@ static void end_report(unsigned long *flags)
pr_err("==================================================================\n");
add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
spin_unlock_irqrestore(&report_lock, *flags);
- if (panic_on_warn)
+ if (panic_on_warn && !test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags))
panic("panic_on_warn set ...\n");
kasan_enable_current();
}
@@ -455,12 +457,37 @@ static bool report_enabled(void)
return !test_and_set_bit(KASAN_BIT_REPORTED, &kasan_flags);
}
+#if IS_ENABLED(CONFIG_KUNIT)
+static void kasan_update_kunit_status(struct kunit *cur_test)
+{
+ struct kunit_resource *resource;
+ struct kunit_kasan_expectation *kasan_data;
+
+ resource = kunit_find_named_resource(cur_test, "kasan_data");
+
+ if (!resource) {
+ kunit_set_failure(cur_test);
+ return;
+ }
+
+ kasan_data = (struct kunit_kasan_expectation *)resource->data;
+ kasan_data->report_found = true;
+ kunit_put_resource(resource);
+}
+#endif /* IS_ENABLED(CONFIG_KUNIT) */
+
void kasan_report_invalid_free(void *object, unsigned long ip)
{
unsigned long flags;
u8 tag = get_tag(object);
object = reset_tag(object);
+
+#if IS_ENABLED(CONFIG_KUNIT)
+ if (current->kunit_test)
+ kasan_update_kunit_status(current->kunit_test);
+#endif /* IS_ENABLED(CONFIG_KUNIT) */
+
start_report(&flags);
pr_err("BUG: KASAN: double-free or invalid-free in %pS\n", (void *)ip);
print_tags(tag, object);
@@ -481,6 +508,11 @@ void __kasan_report(unsigned long addr, size_t size, bool is_write, unsigned lon
if (likely(!report_enabled()))
return;
+#if IS_ENABLED(CONFIG_KUNIT)
+ if (current->kunit_test)
+ kasan_update_kunit_status(current->kunit_test);
+#endif /* IS_ENABLED(CONFIG_KUNIT) */
+
disable_trace_on_warning();
tagged_addr = (void *)addr;
--
2.26.0.110.g2183baf09c-goog
From: Patricia Alfonso <[email protected]>
Include documentation on how to test KASAN using CONFIG_TEST_KASAN and
CONFIG_TEST_KASAN_USER.
Signed-off-by: Patricia Alfonso <[email protected]>
Reviewed-by: Dmitry Vyukov <[email protected]>
Signed-off-by: David Gow <[email protected]>
---
Documentation/dev-tools/kasan.rst | 70 +++++++++++++++++++++++++++++++
1 file changed, 70 insertions(+)
diff --git a/Documentation/dev-tools/kasan.rst b/Documentation/dev-tools/kasan.rst
index c652d740735d..287ba063d9f6 100644
--- a/Documentation/dev-tools/kasan.rst
+++ b/Documentation/dev-tools/kasan.rst
@@ -281,3 +281,73 @@ unmapped. This will require changes in arch-specific code.
This allows ``VMAP_STACK`` support on x86, and can simplify support of
architectures that do not have a fixed module region.
+
+CONFIG_TEST_KASAN & CONFIG_TEST_KASAN_USER
+-------------------------------------------
+
+``CONFIG_TEST_KASAN`` utilizes the KUnit Test Framework for testing.
+This means each test focuses on a small unit of functionality and
+there are a few ways these tests can be run.
+
+Each test will print the KASAN report if an error is detected and then
+print the number of the test and the status of the test:
+
+pass::
+
+ ok 28 - kmalloc_double_kzfree
+or, if kmalloc failed::
+
+ # kmalloc_large_oob_right: ASSERTION FAILED at lib/test_kasan.c:163
+ Expected ptr is not null, but is
+ not ok 4 - kmalloc_large_oob_right
+or, if a KASAN report was expected, but not found::
+
+ # kmalloc_double_kzfree: EXPECTATION FAILED at lib/test_kasan.c:629
+ Expected kasan_data->report_expected == kasan_data->report_found, but
+ kasan_data->report_expected == 1
+ kasan_data->report_found == 0
+ not ok 28 - kmalloc_double_kzfree
+
+All test statuses are tracked as they run and an overall status will
+be printed at the end::
+
+ ok 1 - kasan_kunit_test
+
+or::
+
+ not ok 1 - kasan_kunit_test
+
+(1) Loadable Module
+~~~~~~~~~~~~~~~~~~~~
+
+With ``CONFIG_KUNIT`` built-in, ``CONFIG_TEST_KASAN`` can be built as
+a loadable module and run on any architecture that supports KASAN
+using something like insmod or modprobe.
+
+(2) Built-In
+~~~~~~~~~~~~~
+
+With ``CONFIG_KUNIT`` built-in, ``CONFIG_TEST_KASAN`` can be built-in
+on any architecure that supports KASAN. These and any other KUnit
+tests enabled will run and print the results at boot as a late-init
+call.
+
+(3) Using kunit_tool
+~~~~~~~~~~~~~~~~~~~~~
+
+With ``CONFIG_KUNIT`` and ``CONFIG_TEST_KASAN`` built-in, we can also
+use kunit_tool to see the results of these along with other KUnit
+tests in a more readable way. This will not print the KASAN reports
+of tests that passed. Use `KUnit documentation <https://www.kernel.org/doc/html/latest/dev-tools/kunit/index.html>`_ for more up-to-date
+information on kunit_tool.
+
+.. _KUnit: https://www.kernel.org/doc/html/latest/dev-tools/kunit/index.html
+
+``CONFIG_TEST_KASAN_USER`` is a set of KASAN tests that could not be
+converted to KUnit. These tests can be run only as a module with
+``CONFIG_TEST_KASAN_USER`` built as a loadable module and
+``CONFIG_KASAN`` built-in. The type of error expected and the
+function being run is printed before the expression expected to give
+an error. Then the error is printed, if found, and that test
+should be interpretted to pass only if the error was the one expected
+by the test.
--
2.26.0.110.g2183baf09c-goog
From: Patricia Alfonso <[email protected]>
In order to integrate debugging tools like KASAN into the KUnit
framework, add KUnit struct to the current task to keep track of the
current KUnit test.
Signed-off-by: Patricia Alfonso <[email protected]>
Reviewed-by: Brendan Higgins <[email protected]>
Signed-off-by: David Gow <[email protected]>
---
include/linux/sched.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 04278493bf15..7ca3e5068316 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1180,6 +1180,10 @@ struct task_struct {
unsigned int kasan_depth;
#endif
+#if IS_ENABLED(CONFIG_KUNIT)
+ struct kunit *kunit_test;
+#endif
+
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
/* Index of current stored address in ret_stack: */
int curr_ret_stack;
--
2.26.0.110.g2183baf09c-goog
From: Patricia Alfonso <[email protected]>
Transfer all previous tests for KASAN to KUnit so they can be run
more easily. Using kunit_tool, developers can run these tests with their
other KUnit tests and see "pass" or "fail" with the appropriate KASAN
report instead of needing to parse each KASAN report to test KASAN
functionalities. All KASAN reports are still printed to dmesg.
Stack tests do not work properly when KASAN_STACK is enabled so
those tests use a check for "if IS_ENABLED(CONFIG_KASAN_STACK)" so they
only run if stack instrumentation is enabled. If KASAN_STACK is not
enabled, KUnit will print a statement to let the user know this test
was not run with KASAN_STACK enabled.
copy_user_test cannot be run in KUnit so there is a separate test file
for those tests, which can be run as before as a module.
Signed-off-by: Patricia Alfonso <[email protected]>
Reviewed-by: Dmitry Vyukov <[email protected]>
Reviewed-by: Brendan Higgins <[email protected]>
Signed-off-by: David Gow <[email protected]>
---
lib/Kconfig.kasan | 18 +-
lib/Makefile | 3 +-
lib/test_kasan.c | 622 ++++++++++++++++------------------------
lib/test_kasan_module.c | 76 +++++
4 files changed, 337 insertions(+), 382 deletions(-)
create mode 100644 lib/test_kasan_module.c
diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan
index 81f5464ea9e1..53063dee3f81 100644
--- a/lib/Kconfig.kasan
+++ b/lib/Kconfig.kasan
@@ -158,10 +158,18 @@ config KASAN_VMALLOC
for KASAN to detect more sorts of errors (and to support vmapped
stacks), but at the cost of higher memory usage.
-config TEST_KASAN
- tristate "Module for testing KASAN for bug detection"
- depends on m && KASAN
+config TEST_KASAN_KUNIT
+ tristate "KUnit-compatible tests of KASAN bug detection capabilities"
+ depends on KASAN && KUNIT
help
- This is a test module doing various nasty things like
- out of bounds accesses, use after free. It is useful for testing
+ This is a KUnit test suite doing various nasty things like
+ out of bounds and use after free accesses. It is useful for testing
kernel debugging features like KASAN.
+
+config TEST_KASAN_MODULE
+ tristate "KUnit-incompatible tests of KASAN bug detection capabilities"
+ depends on m && KASAN
+ help
+ This is a part of the KASAN test suite that is incompatible with
+ KUnit. Currently includes tests that do bad copy_from/to_user
+ accesses.
diff --git a/lib/Makefile b/lib/Makefile
index 611872c06926..60e125555271 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -59,9 +59,10 @@ obj-$(CONFIG_TEST_FIRMWARE) += test_firmware.o
obj-$(CONFIG_TEST_SYSCTL) += test_sysctl.o
obj-$(CONFIG_TEST_HASH) += test_hash.o test_siphash.o
obj-$(CONFIG_TEST_IDA) += test_ida.o
-obj-$(CONFIG_TEST_KASAN) += test_kasan.o
+obj-$(CONFIG_TEST_KASAN_KUNIT) += test_kasan.o
CFLAGS_test_kasan.o += -fno-builtin
CFLAGS_test_kasan.o += $(call cc-disable-warning, vla)
+obj-$(CONFIG_TEST_KASAN_MODULE) += test_kasan_module.o
obj-$(CONFIG_TEST_UBSAN) += test_ubsan.o
CFLAGS_test_ubsan.o += $(call cc-disable-warning, vla)
UBSAN_SANITIZE_test_ubsan.o := y
diff --git a/lib/test_kasan.c b/lib/test_kasan.c
index 7b4cb107b387..801ef7573da2 100644
--- a/lib/test_kasan.c
+++ b/lib/test_kasan.c
@@ -5,8 +5,6 @@
* Author: Andrey Ryabinin <[email protected]>
*/
-#define pr_fmt(fmt) "kasan test: %s " fmt, __func__
-
#include <linux/bitops.h>
#include <linux/delay.h>
#include <linux/kasan.h>
@@ -65,380 +63,311 @@ static void kasan_test_exit(struct kunit *test)
fail_data.report_found); \
} while (0)
+static void kmalloc_oob_right(struct kunit *test)
{
char *ptr;
size_t size = 123;
- pr_info("out-of-bounds to right\n");
ptr = kmalloc(size, GFP_KERNEL);
- if (!ptr) {
- pr_err("Allocation failed\n");
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
- ptr[size] = 'x';
+ KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 'x');
kfree(ptr);
}
-static noinline void __init kmalloc_oob_left(void)
+static void kmalloc_oob_left(struct kunit *test)
{
char *ptr;
size_t size = 15;
- pr_info("out-of-bounds to left\n");
ptr = kmalloc(size, GFP_KERNEL);
- if (!ptr) {
- pr_err("Allocation failed\n");
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
- *ptr = *(ptr - 1);
+ KUNIT_EXPECT_KASAN_FAIL(test, *ptr = *(ptr - 1));
kfree(ptr);
}
-static noinline void __init kmalloc_node_oob_right(void)
+static void kmalloc_node_oob_right(struct kunit *test)
{
char *ptr;
size_t size = 4096;
- pr_info("kmalloc_node(): out-of-bounds to right\n");
ptr = kmalloc_node(size, GFP_KERNEL, 0);
- if (!ptr) {
- pr_err("Allocation failed\n");
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
- ptr[size] = 0;
+ KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0);
kfree(ptr);
}
-#ifdef CONFIG_SLUB
-static noinline void __init kmalloc_pagealloc_oob_right(void)
+static void kmalloc_pagealloc_oob_right(struct kunit *test)
{
char *ptr;
size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
+ if (!IS_ENABLED(CONFIG_SLUB)) {
+ kunit_info(test, "CONFIG_SLUB is not enabled.");
+ return;
+ }
+
/* Allocate a chunk that does not fit into a SLUB cache to trigger
* the page allocator fallback.
*/
- pr_info("kmalloc pagealloc allocation: out-of-bounds to right\n");
ptr = kmalloc(size, GFP_KERNEL);
- if (!ptr) {
- pr_err("Allocation failed\n");
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
- ptr[size] = 0;
+ KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0);
kfree(ptr);
}
-static noinline void __init kmalloc_pagealloc_uaf(void)
+static void kmalloc_pagealloc_uaf(struct kunit *test)
{
char *ptr;
size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
- pr_info("kmalloc pagealloc allocation: use-after-free\n");
- ptr = kmalloc(size, GFP_KERNEL);
- if (!ptr) {
- pr_err("Allocation failed\n");
+ if (!IS_ENABLED(CONFIG_SLUB)) {
+ kunit_info(test, "CONFIG_SLUB is not enabled.");
return;
}
+ ptr = kmalloc(size, GFP_KERNEL);
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
+
kfree(ptr);
- ptr[0] = 0;
+ KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = 0);
}
-static noinline void __init kmalloc_pagealloc_invalid_free(void)
+static void kmalloc_pagealloc_invalid_free(struct kunit *test)
{
char *ptr;
size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
- pr_info("kmalloc pagealloc allocation: invalid-free\n");
- ptr = kmalloc(size, GFP_KERNEL);
- if (!ptr) {
- pr_err("Allocation failed\n");
+ if (!IS_ENABLED(CONFIG_SLUB)) {
+ kunit_info(test, "CONFIG_SLUB is not enabled.");
return;
}
- kfree(ptr + 1);
+ ptr = kmalloc(size, GFP_KERNEL);
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
+
+ KUNIT_EXPECT_KASAN_FAIL(test, kfree(ptr + 1));
}
-#endif
-static noinline void __init kmalloc_large_oob_right(void)
+static void kmalloc_large_oob_right(struct kunit *test)
{
char *ptr;
size_t size = KMALLOC_MAX_CACHE_SIZE - 256;
/* Allocate a chunk that is large enough, but still fits into a slab
* and does not trigger the page allocator fallback in SLUB.
*/
- pr_info("kmalloc large allocation: out-of-bounds to right\n");
ptr = kmalloc(size, GFP_KERNEL);
- if (!ptr) {
- pr_err("Allocation failed\n");
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
- ptr[size] = 0;
+ KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0);
kfree(ptr);
}
-static noinline void __init kmalloc_oob_krealloc_more(void)
+static void kmalloc_oob_krealloc_more(struct kunit *test)
{
char *ptr1, *ptr2;
size_t size1 = 17;
size_t size2 = 19;
- pr_info("out-of-bounds after krealloc more\n");
ptr1 = kmalloc(size1, GFP_KERNEL);
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
+
ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
- if (!ptr1 || !ptr2) {
- pr_err("Allocation failed\n");
- kfree(ptr1);
- kfree(ptr2);
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
- ptr2[size2] = 'x';
+ KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size2] = 'x');
kfree(ptr2);
}
-static noinline void __init kmalloc_oob_krealloc_less(void)
+static void kmalloc_oob_krealloc_less(struct kunit *test)
{
char *ptr1, *ptr2;
size_t size1 = 17;
size_t size2 = 15;
- pr_info("out-of-bounds after krealloc less\n");
ptr1 = kmalloc(size1, GFP_KERNEL);
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
+
ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
- if (!ptr1 || !ptr2) {
- pr_err("Allocation failed\n");
- kfree(ptr1);
- return;
- }
- ptr2[size2] = 'x';
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
+
+ KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size2] = 'x');
kfree(ptr2);
}
-static noinline void __init kmalloc_oob_16(void)
+static void kmalloc_oob_16(struct kunit *test)
{
struct {
u64 words[2];
} *ptr1, *ptr2;
- pr_info("kmalloc out-of-bounds for 16-bytes access\n");
ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL);
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
+
ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
- if (!ptr1 || !ptr2) {
- pr_err("Allocation failed\n");
- kfree(ptr1);
- kfree(ptr2);
- return;
- }
- *ptr1 = *ptr2;
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
+
+ KUNIT_EXPECT_KASAN_FAIL(test, *ptr1 = *ptr2);
kfree(ptr1);
kfree(ptr2);
}
-static noinline void __init kmalloc_oob_memset_2(void)
+static void kmalloc_oob_memset_2(struct kunit *test)
{
char *ptr;
size_t size = 8;
- pr_info("out-of-bounds in memset2\n");
ptr = kmalloc(size, GFP_KERNEL);
- if (!ptr) {
- pr_err("Allocation failed\n");
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
- memset(ptr+7, 0, 2);
+ KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr+7, 0, 2));
kfree(ptr);
}
-static noinline void __init kmalloc_oob_memset_4(void)
+static void kmalloc_oob_memset_4(struct kunit *test)
{
char *ptr;
size_t size = 8;
- pr_info("out-of-bounds in memset4\n");
ptr = kmalloc(size, GFP_KERNEL);
- if (!ptr) {
- pr_err("Allocation failed\n");
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
- memset(ptr+5, 0, 4);
+ KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr+5, 0, 4));
kfree(ptr);
}
-static noinline void __init kmalloc_oob_memset_8(void)
+static void kmalloc_oob_memset_8(struct kunit *test)
{
char *ptr;
size_t size = 8;
- pr_info("out-of-bounds in memset8\n");
ptr = kmalloc(size, GFP_KERNEL);
- if (!ptr) {
- pr_err("Allocation failed\n");
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
- memset(ptr+1, 0, 8);
+ KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr+1, 0, 8));
kfree(ptr);
}
-static noinline void __init kmalloc_oob_memset_16(void)
+static void kmalloc_oob_memset_16(struct kunit *test)
{
char *ptr;
size_t size = 16;
- pr_info("out-of-bounds in memset16\n");
ptr = kmalloc(size, GFP_KERNEL);
- if (!ptr) {
- pr_err("Allocation failed\n");
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
- memset(ptr+1, 0, 16);
+ KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr+1, 0, 16));
kfree(ptr);
}
-static noinline void __init kmalloc_oob_in_memset(void)
+static void kmalloc_oob_in_memset(struct kunit *test)
{
char *ptr;
size_t size = 666;
- pr_info("out-of-bounds in memset\n");
ptr = kmalloc(size, GFP_KERNEL);
- if (!ptr) {
- pr_err("Allocation failed\n");
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
- memset(ptr, 0, size+5);
+ KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr, 0, size+5));
kfree(ptr);
}
-static noinline void __init kmalloc_uaf(void)
+static void kmalloc_uaf(struct kunit *test)
{
char *ptr;
size_t size = 10;
- pr_info("use-after-free\n");
ptr = kmalloc(size, GFP_KERNEL);
- if (!ptr) {
- pr_err("Allocation failed\n");
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
kfree(ptr);
- *(ptr + 8) = 'x';
+ KUNIT_EXPECT_KASAN_FAIL(test, *(ptr + 8) = 'x');
}
-static noinline void __init kmalloc_uaf_memset(void)
+static void kmalloc_uaf_memset(struct kunit *test)
{
char *ptr;
size_t size = 33;
- pr_info("use-after-free in memset\n");
ptr = kmalloc(size, GFP_KERNEL);
- if (!ptr) {
- pr_err("Allocation failed\n");
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
kfree(ptr);
- memset(ptr, 0, size);
+ KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr, 0, size));
}
-static noinline void __init kmalloc_uaf2(void)
+static void kmalloc_uaf2(struct kunit *test)
{
char *ptr1, *ptr2;
size_t size = 43;
- pr_info("use-after-free after another kmalloc\n");
ptr1 = kmalloc(size, GFP_KERNEL);
- if (!ptr1) {
- pr_err("Allocation failed\n");
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
kfree(ptr1);
+
ptr2 = kmalloc(size, GFP_KERNEL);
- if (!ptr2) {
- pr_err("Allocation failed\n");
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
+
+ KUNIT_EXPECT_KASAN_FAIL(test, ptr1[40] = 'x');
+ KUNIT_EXPECT_PTR_NE(test, ptr1, ptr2);
- ptr1[40] = 'x';
- if (ptr1 == ptr2)
- pr_err("Could not detect use-after-free: ptr1 == ptr2\n");
kfree(ptr2);
}
-static noinline void __init kfree_via_page(void)
+static void kfree_via_page(struct kunit *test)
{
char *ptr;
size_t size = 8;
struct page *page;
unsigned long offset;
- pr_info("invalid-free false positive (via page)\n");
ptr = kmalloc(size, GFP_KERNEL);
- if (!ptr) {
- pr_err("Allocation failed\n");
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
page = virt_to_page(ptr);
offset = offset_in_page(ptr);
kfree(page_address(page) + offset);
}
-static noinline void __init kfree_via_phys(void)
+static void kfree_via_phys(struct kunit *test)
{
char *ptr;
size_t size = 8;
phys_addr_t phys;
- pr_info("invalid-free false positive (via phys)\n");
ptr = kmalloc(size, GFP_KERNEL);
- if (!ptr) {
- pr_err("Allocation failed\n");
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
phys = virt_to_phys(ptr);
kfree(phys_to_virt(phys));
}
-static noinline void __init kmem_cache_oob(void)
+static void kmem_cache_oob(struct kunit *test)
{
char *p;
size_t size = 200;
struct kmem_cache *cache = kmem_cache_create("test_cache",
size, 0,
0, NULL);
- if (!cache) {
- pr_err("Cache allocation failed\n");
- return;
- }
- pr_info("out-of-bounds in kmem_cache_alloc\n");
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
p = kmem_cache_alloc(cache, GFP_KERNEL);
if (!p) {
- pr_err("Allocation failed\n");
+ kunit_err(test, "Allocation failed: %s\n", __func__);
kmem_cache_destroy(cache);
return;
}
- *p = p[size];
+ KUNIT_EXPECT_KASAN_FAIL(test, *p = p[size]);
kmem_cache_free(cache, p);
kmem_cache_destroy(cache);
}
-static noinline void __init memcg_accounted_kmem_cache(void)
+static void memcg_accounted_kmem_cache(struct kunit *test)
{
int i;
char *p;
@@ -446,12 +375,8 @@ static noinline void __init memcg_accounted_kmem_cache(void)
struct kmem_cache *cache;
cache = kmem_cache_create("test_cache", size, 0, SLAB_ACCOUNT, NULL);
- if (!cache) {
- pr_err("Cache allocation failed\n");
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
- pr_info("allocate memcg accounted object\n");
/*
* Several allocations with a delay to allow for lazy per memcg kmem
* cache creation.
@@ -471,134 +396,93 @@ static noinline void __init memcg_accounted_kmem_cache(void)
static char global_array[10];
-static noinline void __init kasan_global_oob(void)
+static void kasan_global_oob(struct kunit *test)
{
volatile int i = 3;
char *p = &global_array[ARRAY_SIZE(global_array) + i];
- pr_info("out-of-bounds global variable\n");
- *(volatile char *)p;
+ KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
}
-static noinline void __init kasan_stack_oob(void)
-{
- char stack_array[10];
- volatile int i = 0;
- char *p = &stack_array[ARRAY_SIZE(stack_array) + i];
-
- pr_info("out-of-bounds on stack\n");
- *(volatile char *)p;
-}
-
-static noinline void __init ksize_unpoisons_memory(void)
+static void ksize_unpoisons_memory(struct kunit *test)
{
char *ptr;
size_t size = 123, real_size;
- pr_info("ksize() unpoisons the whole allocated chunk\n");
ptr = kmalloc(size, GFP_KERNEL);
- if (!ptr) {
- pr_err("Allocation failed\n");
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
real_size = ksize(ptr);
/* This access doesn't trigger an error. */
ptr[size] = 'x';
/* This one does. */
- ptr[real_size] = 'y';
+ KUNIT_EXPECT_KASAN_FAIL(test, ptr[real_size] = 'y');
kfree(ptr);
}
-static noinline void __init copy_user_test(void)
+static void kasan_stack_oob(struct kunit *test)
{
- char *kmem;
- char __user *usermem;
- size_t size = 10;
- int unused;
-
- kmem = kmalloc(size, GFP_KERNEL);
- if (!kmem)
- return;
+ char stack_array[10];
+ volatile int i = 0;
+ char *p = &stack_array[ARRAY_SIZE(stack_array) + i];
- usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE,
- PROT_READ | PROT_WRITE | PROT_EXEC,
- MAP_ANONYMOUS | MAP_PRIVATE, 0);
- if (IS_ERR(usermem)) {
- pr_err("Failed to allocate user memory\n");
- kfree(kmem);
+ if (!IS_ENABLED(CONFIG_KASAN_STACK)) {
+ kunit_info(test, "CONFIG_KASAN_STACK is not enabled");
return;
}
- pr_info("out-of-bounds in copy_from_user()\n");
- unused = copy_from_user(kmem, usermem, size + 1);
-
- pr_info("out-of-bounds in copy_to_user()\n");
- unused = copy_to_user(usermem, kmem, size + 1);
-
- pr_info("out-of-bounds in __copy_from_user()\n");
- unused = __copy_from_user(kmem, usermem, size + 1);
-
- pr_info("out-of-bounds in __copy_to_user()\n");
- unused = __copy_to_user(usermem, kmem, size + 1);
-
- pr_info("out-of-bounds in __copy_from_user_inatomic()\n");
- unused = __copy_from_user_inatomic(kmem, usermem, size + 1);
-
- pr_info("out-of-bounds in __copy_to_user_inatomic()\n");
- unused = __copy_to_user_inatomic(usermem, kmem, size + 1);
-
- pr_info("out-of-bounds in strncpy_from_user()\n");
- unused = strncpy_from_user(kmem, usermem, size + 1);
-
- vm_munmap((unsigned long)usermem, PAGE_SIZE);
- kfree(kmem);
+ KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
}
-static noinline void __init kasan_alloca_oob_left(void)
+static void kasan_alloca_oob_left(struct kunit *test)
{
volatile int i = 10;
char alloca_array[i];
char *p = alloca_array - 1;
- pr_info("out-of-bounds to left on alloca\n");
- *(volatile char *)p;
+ if (!IS_ENABLED(CONFIG_KASAN_STACK)) {
+ kunit_info(test, "CONFIG_KASAN_STACK is not enabled");
+ return;
+ }
+
+ KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
}
-static noinline void __init kasan_alloca_oob_right(void)
+static void kasan_alloca_oob_right(struct kunit *test)
{
volatile int i = 10;
char alloca_array[i];
char *p = alloca_array + i;
- pr_info("out-of-bounds to right on alloca\n");
- *(volatile char *)p;
+ if (!IS_ENABLED(CONFIG_KASAN_STACK)) {
+ kunit_info(test, "CONFIG_KASAN_STACK is not enabled");
+ return;
+ }
+
+ KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
}
-static noinline void __init kmem_cache_double_free(void)
+static void kmem_cache_double_free(struct kunit *test)
{
char *p;
size_t size = 200;
struct kmem_cache *cache;
cache = kmem_cache_create("test_cache", size, 0, 0, NULL);
- if (!cache) {
- pr_err("Cache allocation failed\n");
- return;
- }
- pr_info("double-free on heap object\n");
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
+
p = kmem_cache_alloc(cache, GFP_KERNEL);
if (!p) {
- pr_err("Allocation failed\n");
+ kunit_err(test, "Allocation failed: %s\n", __func__);
kmem_cache_destroy(cache);
return;
}
kmem_cache_free(cache, p);
- kmem_cache_free(cache, p);
+ KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p));
kmem_cache_destroy(cache);
}
-static noinline void __init kmem_cache_invalid_free(void)
+static void kmem_cache_invalid_free(struct kunit *test)
{
char *p;
size_t size = 200;
@@ -606,20 +490,17 @@ static noinline void __init kmem_cache_invalid_free(void)
cache = kmem_cache_create("test_cache", size, 0, SLAB_TYPESAFE_BY_RCU,
NULL);
- if (!cache) {
- pr_err("Cache allocation failed\n");
- return;
- }
- pr_info("invalid-free of heap object\n");
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
+
p = kmem_cache_alloc(cache, GFP_KERNEL);
if (!p) {
- pr_err("Allocation failed\n");
+ kunit_err(test, "Allocation failed: %s\n", __func__);
kmem_cache_destroy(cache);
return;
}
/* Trigger invalid free, the object doesn't get freed */
- kmem_cache_free(cache, p + 1);
+ KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p + 1));
/*
* Properly free the object to prevent the "Objects remaining in
@@ -630,45 +511,60 @@ static noinline void __init kmem_cache_invalid_free(void)
kmem_cache_destroy(cache);
}
-static noinline void __init kasan_memchr(void)
+static void kasan_memchr(struct kunit *test)
{
char *ptr;
size_t size = 24;
- pr_info("out-of-bounds in memchr\n");
- ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
- if (!ptr)
+ // See https://bugzilla.kernel.org/show_bug.cgi?id=206337
+ if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
+ kunit_info(test,
+ "str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT");
return;
+ }
- memchr(ptr, '1', size + 1);
+ ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
+
+ KUNIT_EXPECT_KASAN_FAIL(test, memchr(ptr, '1', size + 1));
kfree(ptr);
}
-static noinline void __init kasan_memcmp(void)
+static void kasan_memcmp(struct kunit *test)
{
char *ptr;
size_t size = 24;
int arr[9];
- pr_info("out-of-bounds in memcmp\n");
- ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
- if (!ptr)
+ // See https://bugzilla.kernel.org/show_bug.cgi?id=206337
+ if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
+ kunit_info(test,
+ "str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT");
return;
+ }
+
+ ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
memset(arr, 0, sizeof(arr));
- memcmp(ptr, arr, size+1);
+ KUNIT_EXPECT_KASAN_FAIL(test, memcmp(ptr, arr, size+1));
kfree(ptr);
}
-static noinline void __init kasan_strings(void)
+static void kasan_strings(struct kunit *test)
{
char *ptr;
size_t size = 24;
- pr_info("use-after-free in strchr\n");
- ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
- if (!ptr)
+ // See https://bugzilla.kernel.org/show_bug.cgi?id=206337
+ if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
+ kunit_info(test,
+ "str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT");
return;
+ }
+
+ ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
kfree(ptr);
@@ -679,188 +575,162 @@ static noinline void __init kasan_strings(void)
* will likely point to zeroed byte.
*/
ptr += 16;
- strchr(ptr, '1');
+ KUNIT_EXPECT_KASAN_FAIL(test, strchr(ptr, '1'));
- pr_info("use-after-free in strrchr\n");
- strrchr(ptr, '1');
+ KUNIT_EXPECT_KASAN_FAIL(test, strrchr(ptr, '1'));
- pr_info("use-after-free in strcmp\n");
- strcmp(ptr, "2");
+ KUNIT_EXPECT_KASAN_FAIL(test, strcmp(ptr, "2"));
- pr_info("use-after-free in strncmp\n");
- strncmp(ptr, "2", 1);
+ KUNIT_EXPECT_KASAN_FAIL(test, strncmp(ptr, "2", 1));
- pr_info("use-after-free in strlen\n");
- strlen(ptr);
+ KUNIT_EXPECT_KASAN_FAIL(test, strlen(ptr));
- pr_info("use-after-free in strnlen\n");
- strnlen(ptr, 1);
+ KUNIT_EXPECT_KASAN_FAIL(test, strnlen(ptr, 1));
}
-static noinline void __init kasan_bitops(void)
+static void kasan_bitops(struct kunit *test)
{
/*
* Allocate 1 more byte, which causes kzalloc to round up to 16-bytes;
* this way we do not actually corrupt other memory.
*/
long *bits = kzalloc(sizeof(*bits) + 1, GFP_KERNEL);
- if (!bits)
- return;
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits);
/*
* Below calls try to access bit within allocated memory; however, the
* below accesses are still out-of-bounds, since bitops are defined to
* operate on the whole long the bit is in.
*/
- pr_info("out-of-bounds in set_bit\n");
- set_bit(BITS_PER_LONG, bits);
+ KUNIT_EXPECT_KASAN_FAIL(test, set_bit(BITS_PER_LONG, bits));
- pr_info("out-of-bounds in __set_bit\n");
- __set_bit(BITS_PER_LONG, bits);
+ KUNIT_EXPECT_KASAN_FAIL(test, __set_bit(BITS_PER_LONG, bits));
- pr_info("out-of-bounds in clear_bit\n");
- clear_bit(BITS_PER_LONG, bits);
+ KUNIT_EXPECT_KASAN_FAIL(test, clear_bit(BITS_PER_LONG, bits));
- pr_info("out-of-bounds in __clear_bit\n");
- __clear_bit(BITS_PER_LONG, bits);
+ KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit(BITS_PER_LONG, bits));
- pr_info("out-of-bounds in clear_bit_unlock\n");
- clear_bit_unlock(BITS_PER_LONG, bits);
+ KUNIT_EXPECT_KASAN_FAIL(test, clear_bit_unlock(BITS_PER_LONG, bits));
- pr_info("out-of-bounds in __clear_bit_unlock\n");
- __clear_bit_unlock(BITS_PER_LONG, bits);
+ KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit_unlock(BITS_PER_LONG, bits));
- pr_info("out-of-bounds in change_bit\n");
- change_bit(BITS_PER_LONG, bits);
+ KUNIT_EXPECT_KASAN_FAIL(test, change_bit(BITS_PER_LONG, bits));
- pr_info("out-of-bounds in __change_bit\n");
- __change_bit(BITS_PER_LONG, bits);
+ KUNIT_EXPECT_KASAN_FAIL(test, __change_bit(BITS_PER_LONG, bits));
/*
* Below calls try to access bit beyond allocated memory.
*/
- pr_info("out-of-bounds in test_and_set_bit\n");
- test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
+ KUNIT_EXPECT_KASAN_FAIL(test,
+ test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
- pr_info("out-of-bounds in __test_and_set_bit\n");
- __test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
+ KUNIT_EXPECT_KASAN_FAIL(test,
+ __test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
- pr_info("out-of-bounds in test_and_set_bit_lock\n");
- test_and_set_bit_lock(BITS_PER_LONG + BITS_PER_BYTE, bits);
+ KUNIT_EXPECT_KASAN_FAIL(test,
+ test_and_set_bit_lock(BITS_PER_LONG + BITS_PER_BYTE, bits));
- pr_info("out-of-bounds in test_and_clear_bit\n");
- test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
+ KUNIT_EXPECT_KASAN_FAIL(test,
+ test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
- pr_info("out-of-bounds in __test_and_clear_bit\n");
- __test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
+ KUNIT_EXPECT_KASAN_FAIL(test,
+ __test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
- pr_info("out-of-bounds in test_and_change_bit\n");
- test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
+ KUNIT_EXPECT_KASAN_FAIL(test,
+ test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
- pr_info("out-of-bounds in __test_and_change_bit\n");
- __test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
+ KUNIT_EXPECT_KASAN_FAIL(test,
+ __test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
- pr_info("out-of-bounds in test_bit\n");
- (void)test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
+ KUNIT_EXPECT_KASAN_FAIL(test,
+ (void)test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
#if defined(clear_bit_unlock_is_negative_byte)
- pr_info("out-of-bounds in clear_bit_unlock_is_negative_byte\n");
- clear_bit_unlock_is_negative_byte(BITS_PER_LONG + BITS_PER_BYTE, bits);
+ KUNIT_EXPECT_KASAN_FAIL(test,
+ clear_bit_unlock_is_negative_byte(BITS_PER_LONG + BITS_PER_BYTE,
+ bits));
#endif
kfree(bits);
}
-static noinline void __init kmalloc_double_kzfree(void)
+static void kmalloc_double_kzfree(struct kunit *test)
{
char *ptr;
size_t size = 16;
- pr_info("double-free (kzfree)\n");
ptr = kmalloc(size, GFP_KERNEL);
- if (!ptr) {
- pr_err("Allocation failed\n");
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
kzfree(ptr);
- kzfree(ptr);
+ KUNIT_EXPECT_KASAN_FAIL(test, kzfree(ptr));
}
-#ifdef CONFIG_KASAN_VMALLOC
-static noinline void __init vmalloc_oob(void)
+static void vmalloc_oob(struct kunit *test)
{
void *area;
- pr_info("vmalloc out-of-bounds\n");
+ if (!IS_ENABLED(CONFIG_KASAN_VMALLOC)) {
+ kunit_info(test, "CONFIG_KASAN_VMALLOC is not enabled.");
+ return;
+ }
/*
* We have to be careful not to hit the guard page.
* The MMU will catch that and crash us.
*/
area = vmalloc(3000);
- if (!area) {
- pr_err("Allocation failed\n");
- return;
- }
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, area);
- ((volatile char *)area)[3100];
+ KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)area)[3100]);
vfree(area);
}
-#else
-static void __init vmalloc_oob(void) {}
-#endif
-static int __init kmalloc_tests_init(void)
-{
- /*
- * Temporarily enable multi-shot mode. Otherwise, we'd only get a
- * report for the first case.
- */
- bool multishot = kasan_save_enable_multi_shot();
-
- kmalloc_oob_right();
- kmalloc_oob_left();
- kmalloc_node_oob_right();
-#ifdef CONFIG_SLUB
- kmalloc_pagealloc_oob_right();
- kmalloc_pagealloc_uaf();
- kmalloc_pagealloc_invalid_free();
-#endif
- kmalloc_large_oob_right();
- kmalloc_oob_krealloc_more();
- kmalloc_oob_krealloc_less();
- kmalloc_oob_16();
- kmalloc_oob_in_memset();
- kmalloc_oob_memset_2();
- kmalloc_oob_memset_4();
- kmalloc_oob_memset_8();
- kmalloc_oob_memset_16();
- kmalloc_uaf();
- kmalloc_uaf_memset();
- kmalloc_uaf2();
- kfree_via_page();
- kfree_via_phys();
- kmem_cache_oob();
- memcg_accounted_kmem_cache();
- kasan_stack_oob();
- kasan_global_oob();
- kasan_alloca_oob_left();
- kasan_alloca_oob_right();
- ksize_unpoisons_memory();
- copy_user_test();
- kmem_cache_double_free();
- kmem_cache_invalid_free();
- kasan_memchr();
- kasan_memcmp();
- kasan_strings();
- kasan_bitops();
- kmalloc_double_kzfree();
- vmalloc_oob();
-
- kasan_restore_multi_shot(multishot);
-
- return -EAGAIN;
-}
+static struct kunit_case kasan_kunit_test_cases[] = {
+ KUNIT_CASE(kmalloc_oob_right),
+ KUNIT_CASE(kmalloc_oob_left),
+ KUNIT_CASE(kmalloc_node_oob_right),
+ KUNIT_CASE(kmalloc_pagealloc_oob_right),
+ KUNIT_CASE(kmalloc_pagealloc_uaf),
+ KUNIT_CASE(kmalloc_pagealloc_invalid_free),
+ KUNIT_CASE(kmalloc_large_oob_right),
+ KUNIT_CASE(kmalloc_oob_krealloc_more),
+ KUNIT_CASE(kmalloc_oob_krealloc_less),
+ KUNIT_CASE(kmalloc_oob_16),
+ KUNIT_CASE(kmalloc_oob_in_memset),
+ KUNIT_CASE(kmalloc_oob_memset_2),
+ KUNIT_CASE(kmalloc_oob_memset_4),
+ KUNIT_CASE(kmalloc_oob_memset_8),
+ KUNIT_CASE(kmalloc_oob_memset_16),
+ KUNIT_CASE(kmalloc_uaf),
+ KUNIT_CASE(kmalloc_uaf_memset),
+ KUNIT_CASE(kmalloc_uaf2),
+ KUNIT_CASE(kfree_via_page),
+ KUNIT_CASE(kfree_via_phys),
+ KUNIT_CASE(kmem_cache_oob),
+ KUNIT_CASE(memcg_accounted_kmem_cache),
+ KUNIT_CASE(kasan_global_oob),
+ KUNIT_CASE(kasan_stack_oob),
+ KUNIT_CASE(kasan_alloca_oob_left),
+ KUNIT_CASE(kasan_alloca_oob_right),
+ KUNIT_CASE(ksize_unpoisons_memory),
+ KUNIT_CASE(kmem_cache_double_free),
+ KUNIT_CASE(kmem_cache_invalid_free),
+ KUNIT_CASE(kasan_memchr),
+ KUNIT_CASE(kasan_memcmp),
+ KUNIT_CASE(kasan_strings),
+ KUNIT_CASE(kasan_bitops),
+ KUNIT_CASE(kmalloc_double_kzfree),
+ KUNIT_CASE(vmalloc_oob),
+ {}
+};
+
+static struct kunit_suite kasan_kunit_test_suite = {
+ .name = "kasan_kunit_test",
+ .init = kasan_test_init,
+ .test_cases = kasan_kunit_test_cases,
+ .exit = kasan_test_exit,
+};
+
+kunit_test_suite(kasan_kunit_test_suite);
-module_init(kmalloc_tests_init);
MODULE_LICENSE("GPL");
diff --git a/lib/test_kasan_module.c b/lib/test_kasan_module.c
new file mode 100644
index 000000000000..87d7e4d8fc31
--- /dev/null
+++ b/lib/test_kasan_module.c
@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ *
+ * Copyright (c) 2014 Samsung Electronics Co., Ltd.
+ * Author: Andrey Ryabinin <[email protected]>
+ */
+
+#define pr_fmt(fmt) "kasan test: %s " fmt, __func__
+
+#include <linux/mman.h>
+#include <linux/module.h>
+#include <linux/printk.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+
+static noinline void __init copy_user_test(void)
+{
+ char *kmem;
+ char __user *usermem;
+ size_t size = 10;
+ int unused;
+
+ kmem = kmalloc(size, GFP_KERNEL);
+ if (!kmem)
+ return;
+
+ usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE,
+ PROT_READ | PROT_WRITE | PROT_EXEC,
+ MAP_ANONYMOUS | MAP_PRIVATE, 0);
+ if (IS_ERR(usermem)) {
+ pr_err("Failed to allocate user memory\n");
+ kfree(kmem);
+ return;
+ }
+
+ pr_info("out-of-bounds in copy_from_user()\n");
+ unused = copy_from_user(kmem, usermem, size + 1);
+
+ pr_info("out-of-bounds in copy_to_user()\n");
+ unused = copy_to_user(usermem, kmem, size + 1);
+
+ pr_info("out-of-bounds in __copy_from_user()\n");
+ unused = __copy_from_user(kmem, usermem, size + 1);
+
+ pr_info("out-of-bounds in __copy_to_user()\n");
+ unused = __copy_to_user(usermem, kmem, size + 1);
+
+ pr_info("out-of-bounds in __copy_from_user_inatomic()\n");
+ unused = __copy_from_user_inatomic(kmem, usermem, size + 1);
+
+ pr_info("out-of-bounds in __copy_to_user_inatomic()\n");
+ unused = __copy_to_user_inatomic(usermem, kmem, size + 1);
+
+ pr_info("out-of-bounds in strncpy_from_user()\n");
+ unused = strncpy_from_user(kmem, usermem, size + 1);
+
+ vm_munmap((unsigned long)usermem, PAGE_SIZE);
+ kfree(kmem);
+}
+
+static int __init test_kasan_module_init(void)
+{
+ /*
+ * Temporarily enable multi-shot mode. Otherwise, we'd only get a
+ * report for the first case.
+ */
+ bool multishot = kasan_save_enable_multi_shot();
+
+ copy_user_test();
+
+ kasan_restore_multi_shot(multishot);
+ return -EAGAIN;
+}
+
+module_init(test_kasan_module_init);
+MODULE_LICENSE("GPL");
--
2.26.0.110.g2183baf09c-goog
On Tue, Apr 14, 2020 at 5:17 AM 'David Gow' via kasan-dev
<[email protected]> wrote:
>
> From: Patricia Alfonso <[email protected]>
>
> Integrate KASAN into KUnit testing framework.
> - Fail tests when KASAN reports an error that is not expected
> - Use KUNIT_EXPECT_KASAN_FAIL to expect a KASAN error in KASAN
> tests
> - Expected KASAN reports pass tests and are still printed when run
> without kunit_tool (kunit_tool still bypasses the report due to the
> test passing)
> - KUnit struct in current task used to keep track of the current
> test from KASAN code
> - Also make KASAN no-longer panic when panic_on_warn and
> kasan_multi_shot are enabled (as multi-shot does nothing
> otherwise)
>
> Make use of "[PATCH v3 kunit-next 1/2] kunit: generalize
> kunit_resource API beyond allocated resources" and "[PATCH v3
> kunit-next 2/2] kunit: add support for named resources" from Alan
> Maguire [1]
> - A named resource is added to a test when a KASAN report is
> expected
> - This resource contains a struct for kasan_data containing
> booleans representing if a KASAN report is expected and if a
> KASAN report is found
>
> [1] (https://lore.kernel.org/linux-kselftest/[email protected]/T/#t)
>
> Signed-off-by: Patricia Alfonso <[email protected]>
> Signed-off-by: David Gow <[email protected]>
> Reviewed-by: Dmitry Vyukov <[email protected]>
> ---
> include/kunit/test.h | 5 +++++
> include/linux/kasan.h | 6 ++++++
> lib/kunit/test.c | 13 ++++++++-----
> lib/test_kasan.c | 44 +++++++++++++++++++++++++++++++++++++++----
> mm/kasan/report.c | 34 ++++++++++++++++++++++++++++++++-
> 5 files changed, 92 insertions(+), 10 deletions(-)
>
> diff --git a/include/kunit/test.h b/include/kunit/test.h
> index ac59d18e6bab..1dc3d118f64b 100644
> --- a/include/kunit/test.h
> +++ b/include/kunit/test.h
> @@ -225,6 +225,11 @@ struct kunit {
> struct list_head resources; /* Protected by lock. */
> };
>
> +static inline void kunit_set_failure(struct kunit *test)
> +{
> + WRITE_ONCE(test->success, false);
> +}
> +
> void kunit_init_test(struct kunit *test, const char *name, char *log);
>
> int kunit_run_tests(struct kunit_suite *suite);
> diff --git a/include/linux/kasan.h b/include/linux/kasan.h
> index 5cde9e7c2664..148eaef3e003 100644
> --- a/include/linux/kasan.h
> +++ b/include/linux/kasan.h
> @@ -14,6 +14,12 @@ struct task_struct;
> #include <asm/kasan.h>
> #include <asm/pgtable.h>
>
> +/* kasan_data struct is used in KUnit tests for KASAN expected failures */
> +struct kunit_kasan_expectation {
> + bool report_expected;
> + bool report_found;
> +};
> +
> extern unsigned char kasan_early_shadow_page[PAGE_SIZE];
> extern pte_t kasan_early_shadow_pte[PTRS_PER_PTE];
> extern pmd_t kasan_early_shadow_pmd[PTRS_PER_PMD];
> diff --git a/lib/kunit/test.c b/lib/kunit/test.c
> index 2cb7c6220a00..030a3281591e 100644
> --- a/lib/kunit/test.c
> +++ b/lib/kunit/test.c
> @@ -10,16 +10,12 @@
> #include <linux/kernel.h>
> #include <linux/kref.h>
> #include <linux/sched/debug.h>
> +#include <linux/sched.h>
>
> #include "debugfs.h"
> #include "string-stream.h"
> #include "try-catch-impl.h"
>
> -static void kunit_set_failure(struct kunit *test)
> -{
> - WRITE_ONCE(test->success, false);
> -}
> -
> static void kunit_print_tap_version(void)
> {
> static bool kunit_has_printed_tap_version;
> @@ -288,6 +284,10 @@ static void kunit_try_run_case(void *data)
> struct kunit_suite *suite = ctx->suite;
> struct kunit_case *test_case = ctx->test_case;
>
> +#if (IS_ENABLED(CONFIG_KASAN) && IS_ENABLED(CONFIG_KUNIT))
> + current->kunit_test = test;
> +#endif /* IS_ENABLED(CONFIG_KASAN) && IS_ENABLED(CONFIG_KUNIT) */
> +
> /*
> * kunit_run_case_internal may encounter a fatal error; if it does,
> * abort will be called, this thread will exit, and finally the parent
> @@ -603,6 +603,9 @@ void kunit_cleanup(struct kunit *test)
> spin_unlock(&test->lock);
> kunit_remove_resource(test, res);
> }
> +#if (IS_ENABLED(CONFIG_KASAN) && IS_ENABLED(CONFIG_KUNIT))
> + current->kunit_test = NULL;
> +#endif /* IS_ENABLED(CONFIG_KASAN) && IS_ENABLED(CONFIG_KUNIT)*/
> }
> EXPORT_SYMBOL_GPL(kunit_cleanup);
>
> diff --git a/lib/test_kasan.c b/lib/test_kasan.c
> index 3872d250ed2c..7b4cb107b387 100644
> --- a/lib/test_kasan.c
> +++ b/lib/test_kasan.c
> @@ -23,12 +23,48 @@
>
> #include <asm/page.h>
>
> -/*
> - * Note: test functions are marked noinline so that their names appear in
> - * reports.
> +#include <kunit/test.h>
> +
> +static struct kunit_resource resource;
> +static struct kunit_kasan_expectation fail_data;
> +static bool multishot;
> +
> +static int kasan_test_init(struct kunit *test)
> +{
> + /*
> + * Temporarily enable multi-shot mode and set panic_on_warn=0.
> + * Otherwise, we'd only get a report for the first case.
> + */
> + multishot = kasan_save_enable_multi_shot();
> +
> + return 0;
> +}
> +
> +static void kasan_test_exit(struct kunit *test)
> +{
> + kasan_restore_multi_shot(multishot);
> +}
> +
> +/**
> + * KUNIT_EXPECT_KASAN_FAIL() - Causes a test failure when the expression does
> + * not cause a KASAN error. This uses a KUnit resource named "kasan_data." Do
> + * Do not use this name for a KUnit resource outside here.
> + *
> */
> +#define KUNIT_EXPECT_KASAN_FAIL(test, condition) do { \
> + fail_data.report_expected = true; \
> + fail_data.report_found = false; \
> + kunit_add_named_resource(test, \
> + NULL, \
> + NULL, \
> + &resource, \
> + "kasan_data", &fail_data); \
> + condition; \
> + KUNIT_EXPECT_EQ(test, \
> + fail_data.report_expected, \
> + fail_data.report_found); \
> +} while (0)
>
> -static noinline void __init kmalloc_oob_right(void)
> {
> char *ptr;
> size_t size = 123;
> diff --git a/mm/kasan/report.c b/mm/kasan/report.c
> index 5ef9f24f566b..a58a9f3b7f2c 100644
> --- a/mm/kasan/report.c
> +++ b/mm/kasan/report.c
> @@ -32,6 +32,8 @@
>
> #include <asm/sections.h>
>
> +#include <kunit/test.h>
> +
> #include "kasan.h"
> #include "../slab.h"
>
> @@ -92,7 +94,7 @@ static void end_report(unsigned long *flags)
> pr_err("==================================================================\n");
> add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
> spin_unlock_irqrestore(&report_lock, *flags);
[...]
> - if (panic_on_warn)
> + if (panic_on_warn && !test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags))
> panic("panic_on_warn set ...\n");
Please move this change into a separate commit.
With that:
Reviewed-by: Andrey Konovalov <[email protected]>
> kasan_enable_current();
> }
> @@ -455,12 +457,37 @@ static bool report_enabled(void)
> return !test_and_set_bit(KASAN_BIT_REPORTED, &kasan_flags);
> }
>
> +#if IS_ENABLED(CONFIG_KUNIT)
> +static void kasan_update_kunit_status(struct kunit *cur_test)
> +{
> + struct kunit_resource *resource;
> + struct kunit_kasan_expectation *kasan_data;
> +
> + resource = kunit_find_named_resource(cur_test, "kasan_data");
> +
> + if (!resource) {
> + kunit_set_failure(cur_test);
> + return;
> + }
> +
> + kasan_data = (struct kunit_kasan_expectation *)resource->data;
> + kasan_data->report_found = true;
> + kunit_put_resource(resource);
> +}
> +#endif /* IS_ENABLED(CONFIG_KUNIT) */
> +
> void kasan_report_invalid_free(void *object, unsigned long ip)
> {
> unsigned long flags;
> u8 tag = get_tag(object);
>
> object = reset_tag(object);
> +
> +#if IS_ENABLED(CONFIG_KUNIT)
> + if (current->kunit_test)
> + kasan_update_kunit_status(current->kunit_test);
> +#endif /* IS_ENABLED(CONFIG_KUNIT) */
> +
> start_report(&flags);
> pr_err("BUG: KASAN: double-free or invalid-free in %pS\n", (void *)ip);
> print_tags(tag, object);
> @@ -481,6 +508,11 @@ void __kasan_report(unsigned long addr, size_t size, bool is_write, unsigned lon
> if (likely(!report_enabled()))
> return;
>
> +#if IS_ENABLED(CONFIG_KUNIT)
> + if (current->kunit_test)
> + kasan_update_kunit_status(current->kunit_test);
> +#endif /* IS_ENABLED(CONFIG_KUNIT) */
> +
> disable_trace_on_warning();
>
> tagged_addr = (void *)addr;
> --
> 2.26.0.110.g2183baf09c-goog
>
> --
> You received this message because you are subscribed to the Google Groups "kasan-dev" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
> To view this discussion on the web visit https://groups.google.com/d/msgid/kasan-dev/20200414031647.124664-3-davidgow%40google.com.
On Tue, Apr 14, 2020 at 5:17 AM 'David Gow' via kasan-dev
<[email protected]> wrote:
>
> From: Patricia Alfonso <[email protected]>
>
> Include documentation on how to test KASAN using CONFIG_TEST_KASAN and
> CONFIG_TEST_KASAN_USER.
This patch needs to be updated to use the new naming, TEST_KASAN_KUNIT
and TEST_KASAN_MODULE.
>
> Signed-off-by: Patricia Alfonso <[email protected]>
> Reviewed-by: Dmitry Vyukov <[email protected]>
> Signed-off-by: David Gow <[email protected]>
> ---
> Documentation/dev-tools/kasan.rst | 70 +++++++++++++++++++++++++++++++
> 1 file changed, 70 insertions(+)
>
> diff --git a/Documentation/dev-tools/kasan.rst b/Documentation/dev-tools/kasan.rst
> index c652d740735d..287ba063d9f6 100644
> --- a/Documentation/dev-tools/kasan.rst
> +++ b/Documentation/dev-tools/kasan.rst
> @@ -281,3 +281,73 @@ unmapped. This will require changes in arch-specific code.
>
> This allows ``VMAP_STACK`` support on x86, and can simplify support of
> architectures that do not have a fixed module region.
> +
> +CONFIG_TEST_KASAN & CONFIG_TEST_KASAN_USER
> +-------------------------------------------
> +
> +``CONFIG_TEST_KASAN`` utilizes the KUnit Test Framework for testing.
> +This means each test focuses on a small unit of functionality and
> +there are a few ways these tests can be run.
> +
> +Each test will print the KASAN report if an error is detected and then
> +print the number of the test and the status of the test:
> +
> +pass::
> +
> + ok 28 - kmalloc_double_kzfree
> +or, if kmalloc failed::
> +
> + # kmalloc_large_oob_right: ASSERTION FAILED at lib/test_kasan.c:163
> + Expected ptr is not null, but is
> + not ok 4 - kmalloc_large_oob_right
> +or, if a KASAN report was expected, but not found::
> +
> + # kmalloc_double_kzfree: EXPECTATION FAILED at lib/test_kasan.c:629
> + Expected kasan_data->report_expected == kasan_data->report_found, but
> + kasan_data->report_expected == 1
> + kasan_data->report_found == 0
> + not ok 28 - kmalloc_double_kzfree
> +
> +All test statuses are tracked as they run and an overall status will
> +be printed at the end::
> +
> + ok 1 - kasan_kunit_test
> +
> +or::
> +
> + not ok 1 - kasan_kunit_test
> +
> +(1) Loadable Module
> +~~~~~~~~~~~~~~~~~~~~
> +
> +With ``CONFIG_KUNIT`` built-in, ``CONFIG_TEST_KASAN`` can be built as
> +a loadable module and run on any architecture that supports KASAN
> +using something like insmod or modprobe.
> +
> +(2) Built-In
> +~~~~~~~~~~~~~
> +
> +With ``CONFIG_KUNIT`` built-in, ``CONFIG_TEST_KASAN`` can be built-in
> +on any architecure that supports KASAN. These and any other KUnit
> +tests enabled will run and print the results at boot as a late-init
> +call.
> +
> +(3) Using kunit_tool
> +~~~~~~~~~~~~~~~~~~~~~
> +
> +With ``CONFIG_KUNIT`` and ``CONFIG_TEST_KASAN`` built-in, we can also
> +use kunit_tool to see the results of these along with other KUnit
> +tests in a more readable way. This will not print the KASAN reports
> +of tests that passed. Use `KUnit documentation <https://www.kernel.org/doc/html/latest/dev-tools/kunit/index.html>`_ for more up-to-date
> +information on kunit_tool.
> +
> +.. _KUnit: https://www.kernel.org/doc/html/latest/dev-tools/kunit/index.html
> +
> +``CONFIG_TEST_KASAN_USER`` is a set of KASAN tests that could not be
> +converted to KUnit. These tests can be run only as a module with
> +``CONFIG_TEST_KASAN_USER`` built as a loadable module and
> +``CONFIG_KASAN`` built-in. The type of error expected and the
> +function being run is printed before the expression expected to give
> +an error. Then the error is printed, if found, and that test
> +should be interpretted to pass only if the error was the one expected
> +by the test.
> --
> 2.26.0.110.g2183baf09c-goog
>
> --
> You received this message because you are subscribed to the Google Groups "kasan-dev" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
> To view this discussion on the web visit https://groups.google.com/d/msgid/kasan-dev/20200414031647.124664-5-davidgow%40google.com.
On Tue, Apr 14, 2020 at 5:17 AM 'David Gow' via kasan-dev
<[email protected]> wrote:
>
> From: Patricia Alfonso <[email protected]>
>
> Integrate KASAN into KUnit testing framework.
> - Fail tests when KASAN reports an error that is not expected
> - Use KUNIT_EXPECT_KASAN_FAIL to expect a KASAN error in KASAN
> tests
> - Expected KASAN reports pass tests and are still printed when run
> without kunit_tool (kunit_tool still bypasses the report due to the
> test passing)
> - KUnit struct in current task used to keep track of the current
> test from KASAN code
> - Also make KASAN no-longer panic when panic_on_warn and
> kasan_multi_shot are enabled (as multi-shot does nothing
> otherwise)
>
> Make use of "[PATCH v3 kunit-next 1/2] kunit: generalize
> kunit_resource API beyond allocated resources" and "[PATCH v3
> kunit-next 2/2] kunit: add support for named resources" from Alan
> Maguire [1]
> - A named resource is added to a test when a KASAN report is
> expected
> - This resource contains a struct for kasan_data containing
> booleans representing if a KASAN report is expected and if a
> KASAN report is found
>
> [1] (https://lore.kernel.org/linux-kselftest/[email protected]/T/#t)
>
> Signed-off-by: Patricia Alfonso <[email protected]>
> Signed-off-by: David Gow <[email protected]>
> Reviewed-by: Dmitry Vyukov <[email protected]>
> ---
> include/kunit/test.h | 5 +++++
> include/linux/kasan.h | 6 ++++++
> lib/kunit/test.c | 13 ++++++++-----
> lib/test_kasan.c | 44 +++++++++++++++++++++++++++++++++++++++----
> mm/kasan/report.c | 34 ++++++++++++++++++++++++++++++++-
> 5 files changed, 92 insertions(+), 10 deletions(-)
>
> diff --git a/include/kunit/test.h b/include/kunit/test.h
> index ac59d18e6bab..1dc3d118f64b 100644
> --- a/include/kunit/test.h
> +++ b/include/kunit/test.h
> @@ -225,6 +225,11 @@ struct kunit {
> struct list_head resources; /* Protected by lock. */
> };
>
> +static inline void kunit_set_failure(struct kunit *test)
> +{
> + WRITE_ONCE(test->success, false);
> +}
> +
> void kunit_init_test(struct kunit *test, const char *name, char *log);
>
> int kunit_run_tests(struct kunit_suite *suite);
> diff --git a/include/linux/kasan.h b/include/linux/kasan.h
> index 5cde9e7c2664..148eaef3e003 100644
> --- a/include/linux/kasan.h
> +++ b/include/linux/kasan.h
> @@ -14,6 +14,12 @@ struct task_struct;
> #include <asm/kasan.h>
> #include <asm/pgtable.h>
>
> +/* kasan_data struct is used in KUnit tests for KASAN expected failures */
> +struct kunit_kasan_expectation {
> + bool report_expected;
> + bool report_found;
> +};
> +
> extern unsigned char kasan_early_shadow_page[PAGE_SIZE];
> extern pte_t kasan_early_shadow_pte[PTRS_PER_PTE];
> extern pmd_t kasan_early_shadow_pmd[PTRS_PER_PMD];
> diff --git a/lib/kunit/test.c b/lib/kunit/test.c
> index 2cb7c6220a00..030a3281591e 100644
> --- a/lib/kunit/test.c
> +++ b/lib/kunit/test.c
> @@ -10,16 +10,12 @@
> #include <linux/kernel.h>
> #include <linux/kref.h>
> #include <linux/sched/debug.h>
> +#include <linux/sched.h>
>
> #include "debugfs.h"
> #include "string-stream.h"
> #include "try-catch-impl.h"
>
> -static void kunit_set_failure(struct kunit *test)
> -{
> - WRITE_ONCE(test->success, false);
> -}
> -
> static void kunit_print_tap_version(void)
> {
> static bool kunit_has_printed_tap_version;
> @@ -288,6 +284,10 @@ static void kunit_try_run_case(void *data)
> struct kunit_suite *suite = ctx->suite;
> struct kunit_case *test_case = ctx->test_case;
>
> +#if (IS_ENABLED(CONFIG_KASAN) && IS_ENABLED(CONFIG_KUNIT))
> + current->kunit_test = test;
> +#endif /* IS_ENABLED(CONFIG_KASAN) && IS_ENABLED(CONFIG_KUNIT) */
> +
> /*
> * kunit_run_case_internal may encounter a fatal error; if it does,
> * abort will be called, this thread will exit, and finally the parent
> @@ -603,6 +603,9 @@ void kunit_cleanup(struct kunit *test)
> spin_unlock(&test->lock);
> kunit_remove_resource(test, res);
> }
> +#if (IS_ENABLED(CONFIG_KASAN) && IS_ENABLED(CONFIG_KUNIT))
> + current->kunit_test = NULL;
> +#endif /* IS_ENABLED(CONFIG_KASAN) && IS_ENABLED(CONFIG_KUNIT)*/
> }
> EXPORT_SYMBOL_GPL(kunit_cleanup);
>
> diff --git a/lib/test_kasan.c b/lib/test_kasan.c
> index 3872d250ed2c..7b4cb107b387 100644
> --- a/lib/test_kasan.c
> +++ b/lib/test_kasan.c
> @@ -23,12 +23,48 @@
>
> #include <asm/page.h>
>
> -/*
> - * Note: test functions are marked noinline so that their names appear in
> - * reports.
> +#include <kunit/test.h>
> +
> +static struct kunit_resource resource;
> +static struct kunit_kasan_expectation fail_data;
> +static bool multishot;
> +
> +static int kasan_test_init(struct kunit *test)
> +{
> + /*
> + * Temporarily enable multi-shot mode and set panic_on_warn=0.
> + * Otherwise, we'd only get a report for the first case.
> + */
> + multishot = kasan_save_enable_multi_shot();
> +
> + return 0;
> +}
> +
> +static void kasan_test_exit(struct kunit *test)
> +{
> + kasan_restore_multi_shot(multishot);
> +}
> +
> +/**
> + * KUNIT_EXPECT_KASAN_FAIL() - Causes a test failure when the expression does
> + * not cause a KASAN error. This uses a KUnit resource named "kasan_data." Do
> + * Do not use this name for a KUnit resource outside here.
> + *
> */
> +#define KUNIT_EXPECT_KASAN_FAIL(test, condition) do { \
> + fail_data.report_expected = true; \
> + fail_data.report_found = false; \
> + kunit_add_named_resource(test, \
> + NULL, \
> + NULL, \
> + &resource, \
> + "kasan_data", &fail_data); \
> + condition; \
> + KUNIT_EXPECT_EQ(test, \
> + fail_data.report_expected, \
> + fail_data.report_found); \
> +} while (0)
>
[...]
> -static noinline void __init kmalloc_oob_right(void)
Actually this also needs to be fixed. You remove this line in this
patch and add it back in the next one. Please test that the kernel
builds with your patches applied one by one.
> {
> char *ptr;
> size_t size = 123;
> diff --git a/mm/kasan/report.c b/mm/kasan/report.c
> index 5ef9f24f566b..a58a9f3b7f2c 100644
> --- a/mm/kasan/report.c
> +++ b/mm/kasan/report.c
> @@ -32,6 +32,8 @@
>
> #include <asm/sections.h>
>
> +#include <kunit/test.h>
> +
> #include "kasan.h"
> #include "../slab.h"
>
> @@ -92,7 +94,7 @@ static void end_report(unsigned long *flags)
> pr_err("==================================================================\n");
> add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
> spin_unlock_irqrestore(&report_lock, *flags);
> - if (panic_on_warn)
> + if (panic_on_warn && !test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags))
> panic("panic_on_warn set ...\n");
> kasan_enable_current();
> }
> @@ -455,12 +457,37 @@ static bool report_enabled(void)
> return !test_and_set_bit(KASAN_BIT_REPORTED, &kasan_flags);
> }
>
> +#if IS_ENABLED(CONFIG_KUNIT)
> +static void kasan_update_kunit_status(struct kunit *cur_test)
> +{
> + struct kunit_resource *resource;
> + struct kunit_kasan_expectation *kasan_data;
> +
> + resource = kunit_find_named_resource(cur_test, "kasan_data");
> +
> + if (!resource) {
> + kunit_set_failure(cur_test);
> + return;
> + }
> +
> + kasan_data = (struct kunit_kasan_expectation *)resource->data;
> + kasan_data->report_found = true;
> + kunit_put_resource(resource);
> +}
> +#endif /* IS_ENABLED(CONFIG_KUNIT) */
> +
> void kasan_report_invalid_free(void *object, unsigned long ip)
> {
> unsigned long flags;
> u8 tag = get_tag(object);
>
> object = reset_tag(object);
> +
> +#if IS_ENABLED(CONFIG_KUNIT)
> + if (current->kunit_test)
> + kasan_update_kunit_status(current->kunit_test);
> +#endif /* IS_ENABLED(CONFIG_KUNIT) */
> +
> start_report(&flags);
> pr_err("BUG: KASAN: double-free or invalid-free in %pS\n", (void *)ip);
> print_tags(tag, object);
> @@ -481,6 +508,11 @@ void __kasan_report(unsigned long addr, size_t size, bool is_write, unsigned lon
> if (likely(!report_enabled()))
> return;
>
> +#if IS_ENABLED(CONFIG_KUNIT)
> + if (current->kunit_test)
> + kasan_update_kunit_status(current->kunit_test);
> +#endif /* IS_ENABLED(CONFIG_KUNIT) */
> +
> disable_trace_on_warning();
>
> tagged_addr = (void *)addr;
> --
> 2.26.0.110.g2183baf09c-goog
>
> --
> You received this message because you are subscribed to the Google Groups "kasan-dev" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
> To view this discussion on the web visit https://groups.google.com/d/msgid/kasan-dev/20200414031647.124664-3-davidgow%40google.com.
On Tue, Apr 14, 2020 at 5:17 AM 'David Gow' via kasan-dev
<[email protected]> wrote:
>
> From: Patricia Alfonso <[email protected]>
>
> Transfer all previous tests for KASAN to KUnit so they can be run
> more easily. Using kunit_tool, developers can run these tests with their
> other KUnit tests and see "pass" or "fail" with the appropriate KASAN
> report instead of needing to parse each KASAN report to test KASAN
> functionalities. All KASAN reports are still printed to dmesg.
>
> Stack tests do not work properly when KASAN_STACK is enabled so
> those tests use a check for "if IS_ENABLED(CONFIG_KASAN_STACK)" so they
> only run if stack instrumentation is enabled. If KASAN_STACK is not
> enabled, KUnit will print a statement to let the user know this test
> was not run with KASAN_STACK enabled.
>
> copy_user_test cannot be run in KUnit so there is a separate test file
> for those tests, which can be run as before as a module.
>
> Signed-off-by: Patricia Alfonso <[email protected]>
> Reviewed-by: Dmitry Vyukov <[email protected]>
> Reviewed-by: Brendan Higgins <[email protected]>
> Signed-off-by: David Gow <[email protected]>
> ---
> lib/Kconfig.kasan | 18 +-
> lib/Makefile | 3 +-
> lib/test_kasan.c | 622 ++++++++++++++++------------------------
> lib/test_kasan_module.c | 76 +++++
> 4 files changed, 337 insertions(+), 382 deletions(-)
> create mode 100644 lib/test_kasan_module.c
>
> diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan
> index 81f5464ea9e1..53063dee3f81 100644
> --- a/lib/Kconfig.kasan
> +++ b/lib/Kconfig.kasan
> @@ -158,10 +158,18 @@ config KASAN_VMALLOC
> for KASAN to detect more sorts of errors (and to support vmapped
> stacks), but at the cost of higher memory usage.
>
> -config TEST_KASAN
> - tristate "Module for testing KASAN for bug detection"
> - depends on m && KASAN
> +config TEST_KASAN_KUNIT
> + tristate "KUnit-compatible tests of KASAN bug detection capabilities"
> + depends on KASAN && KUNIT
> help
> - This is a test module doing various nasty things like
> - out of bounds accesses, use after free. It is useful for testing
> + This is a KUnit test suite doing various nasty things like
> + out of bounds and use after free accesses. It is useful for testing
> kernel debugging features like KASAN.
> +
> +config TEST_KASAN_MODULE
> + tristate "KUnit-incompatible tests of KASAN bug detection capabilities"
> + depends on m && KASAN
> + help
> + This is a part of the KASAN test suite that is incompatible with
> + KUnit. Currently includes tests that do bad copy_from/to_user
> + accesses.
> diff --git a/lib/Makefile b/lib/Makefile
> index 611872c06926..60e125555271 100644
> --- a/lib/Makefile
> +++ b/lib/Makefile
> @@ -59,9 +59,10 @@ obj-$(CONFIG_TEST_FIRMWARE) += test_firmware.o
> obj-$(CONFIG_TEST_SYSCTL) += test_sysctl.o
> obj-$(CONFIG_TEST_HASH) += test_hash.o test_siphash.o
> obj-$(CONFIG_TEST_IDA) += test_ida.o
> -obj-$(CONFIG_TEST_KASAN) += test_kasan.o
> +obj-$(CONFIG_TEST_KASAN_KUNIT) += test_kasan.o
> CFLAGS_test_kasan.o += -fno-builtin
> CFLAGS_test_kasan.o += $(call cc-disable-warning, vla)
> +obj-$(CONFIG_TEST_KASAN_MODULE) += test_kasan_module.o
> obj-$(CONFIG_TEST_UBSAN) += test_ubsan.o
> CFLAGS_test_ubsan.o += $(call cc-disable-warning, vla)
> UBSAN_SANITIZE_test_ubsan.o := y
> diff --git a/lib/test_kasan.c b/lib/test_kasan.c
> index 7b4cb107b387..801ef7573da2 100644
> --- a/lib/test_kasan.c
> +++ b/lib/test_kasan.c
> @@ -5,8 +5,6 @@
> * Author: Andrey Ryabinin <[email protected]>
> */
>
> -#define pr_fmt(fmt) "kasan test: %s " fmt, __func__
> -
> #include <linux/bitops.h>
> #include <linux/delay.h>
> #include <linux/kasan.h>
> @@ -65,380 +63,311 @@ static void kasan_test_exit(struct kunit *test)
> fail_data.report_found); \
> } while (0)
>
> +static void kmalloc_oob_right(struct kunit *test)
> {
> char *ptr;
> size_t size = 123;
>
> - pr_info("out-of-bounds to right\n");
> ptr = kmalloc(size, GFP_KERNEL);
> - if (!ptr) {
> - pr_err("Allocation failed\n");
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> - ptr[size] = 'x';
> + KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 'x');
> kfree(ptr);
> }
>
> -static noinline void __init kmalloc_oob_left(void)
> +static void kmalloc_oob_left(struct kunit *test)
> {
> char *ptr;
> size_t size = 15;
>
> - pr_info("out-of-bounds to left\n");
> ptr = kmalloc(size, GFP_KERNEL);
> - if (!ptr) {
> - pr_err("Allocation failed\n");
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> - *ptr = *(ptr - 1);
> + KUNIT_EXPECT_KASAN_FAIL(test, *ptr = *(ptr - 1));
> kfree(ptr);
> }
>
> -static noinline void __init kmalloc_node_oob_right(void)
> +static void kmalloc_node_oob_right(struct kunit *test)
> {
> char *ptr;
> size_t size = 4096;
>
> - pr_info("kmalloc_node(): out-of-bounds to right\n");
> ptr = kmalloc_node(size, GFP_KERNEL, 0);
> - if (!ptr) {
> - pr_err("Allocation failed\n");
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> - ptr[size] = 0;
> + KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0);
> kfree(ptr);
> }
>
> -#ifdef CONFIG_SLUB
> -static noinline void __init kmalloc_pagealloc_oob_right(void)
> +static void kmalloc_pagealloc_oob_right(struct kunit *test)
> {
> char *ptr;
> size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
>
> + if (!IS_ENABLED(CONFIG_SLUB)) {
> + kunit_info(test, "CONFIG_SLUB is not enabled.");
> + return;
> + }
> +
> /* Allocate a chunk that does not fit into a SLUB cache to trigger
> * the page allocator fallback.
> */
> - pr_info("kmalloc pagealloc allocation: out-of-bounds to right\n");
> ptr = kmalloc(size, GFP_KERNEL);
> - if (!ptr) {
> - pr_err("Allocation failed\n");
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> - ptr[size] = 0;
> + KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0);
> kfree(ptr);
> }
>
> -static noinline void __init kmalloc_pagealloc_uaf(void)
> +static void kmalloc_pagealloc_uaf(struct kunit *test)
> {
> char *ptr;
> size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
>
> - pr_info("kmalloc pagealloc allocation: use-after-free\n");
> - ptr = kmalloc(size, GFP_KERNEL);
> - if (!ptr) {
> - pr_err("Allocation failed\n");
> + if (!IS_ENABLED(CONFIG_SLUB)) {
> + kunit_info(test, "CONFIG_SLUB is not enabled.");
> return;
> }
>
> + ptr = kmalloc(size, GFP_KERNEL);
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> +
> kfree(ptr);
> - ptr[0] = 0;
> + KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = 0);
> }
>
> -static noinline void __init kmalloc_pagealloc_invalid_free(void)
> +static void kmalloc_pagealloc_invalid_free(struct kunit *test)
> {
> char *ptr;
> size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
>
> - pr_info("kmalloc pagealloc allocation: invalid-free\n");
> - ptr = kmalloc(size, GFP_KERNEL);
> - if (!ptr) {
> - pr_err("Allocation failed\n");
> + if (!IS_ENABLED(CONFIG_SLUB)) {
> + kunit_info(test, "CONFIG_SLUB is not enabled.");
> return;
> }
>
> - kfree(ptr + 1);
> + ptr = kmalloc(size, GFP_KERNEL);
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> +
> + KUNIT_EXPECT_KASAN_FAIL(test, kfree(ptr + 1));
> }
> -#endif
>
> -static noinline void __init kmalloc_large_oob_right(void)
> +static void kmalloc_large_oob_right(struct kunit *test)
> {
> char *ptr;
> size_t size = KMALLOC_MAX_CACHE_SIZE - 256;
> /* Allocate a chunk that is large enough, but still fits into a slab
> * and does not trigger the page allocator fallback in SLUB.
> */
> - pr_info("kmalloc large allocation: out-of-bounds to right\n");
> ptr = kmalloc(size, GFP_KERNEL);
> - if (!ptr) {
> - pr_err("Allocation failed\n");
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> - ptr[size] = 0;
> + KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0);
> kfree(ptr);
> }
>
> -static noinline void __init kmalloc_oob_krealloc_more(void)
> +static void kmalloc_oob_krealloc_more(struct kunit *test)
> {
> char *ptr1, *ptr2;
> size_t size1 = 17;
> size_t size2 = 19;
>
> - pr_info("out-of-bounds after krealloc more\n");
> ptr1 = kmalloc(size1, GFP_KERNEL);
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
> +
> ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
> - if (!ptr1 || !ptr2) {
> - pr_err("Allocation failed\n");
> - kfree(ptr1);
> - kfree(ptr2);
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
>
> - ptr2[size2] = 'x';
> + KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size2] = 'x');
> kfree(ptr2);
> }
>
> -static noinline void __init kmalloc_oob_krealloc_less(void)
> +static void kmalloc_oob_krealloc_less(struct kunit *test)
> {
> char *ptr1, *ptr2;
> size_t size1 = 17;
> size_t size2 = 15;
>
> - pr_info("out-of-bounds after krealloc less\n");
> ptr1 = kmalloc(size1, GFP_KERNEL);
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
> +
> ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
> - if (!ptr1 || !ptr2) {
> - pr_err("Allocation failed\n");
> - kfree(ptr1);
> - return;
> - }
> - ptr2[size2] = 'x';
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
> +
> + KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size2] = 'x');
> kfree(ptr2);
> }
>
> -static noinline void __init kmalloc_oob_16(void)
> +static void kmalloc_oob_16(struct kunit *test)
> {
> struct {
> u64 words[2];
> } *ptr1, *ptr2;
>
> - pr_info("kmalloc out-of-bounds for 16-bytes access\n");
> ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL);
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
> +
> ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
> - if (!ptr1 || !ptr2) {
> - pr_err("Allocation failed\n");
> - kfree(ptr1);
> - kfree(ptr2);
> - return;
> - }
> - *ptr1 = *ptr2;
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
> +
> + KUNIT_EXPECT_KASAN_FAIL(test, *ptr1 = *ptr2);
> kfree(ptr1);
> kfree(ptr2);
> }
>
> -static noinline void __init kmalloc_oob_memset_2(void)
> +static void kmalloc_oob_memset_2(struct kunit *test)
> {
> char *ptr;
> size_t size = 8;
>
> - pr_info("out-of-bounds in memset2\n");
> ptr = kmalloc(size, GFP_KERNEL);
> - if (!ptr) {
> - pr_err("Allocation failed\n");
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> - memset(ptr+7, 0, 2);
> + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr+7, 0, 2));
> kfree(ptr);
> }
>
> -static noinline void __init kmalloc_oob_memset_4(void)
> +static void kmalloc_oob_memset_4(struct kunit *test)
> {
> char *ptr;
> size_t size = 8;
>
> - pr_info("out-of-bounds in memset4\n");
> ptr = kmalloc(size, GFP_KERNEL);
> - if (!ptr) {
> - pr_err("Allocation failed\n");
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> - memset(ptr+5, 0, 4);
> + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr+5, 0, 4));
> kfree(ptr);
> }
>
>
> -static noinline void __init kmalloc_oob_memset_8(void)
> +static void kmalloc_oob_memset_8(struct kunit *test)
> {
> char *ptr;
> size_t size = 8;
>
> - pr_info("out-of-bounds in memset8\n");
> ptr = kmalloc(size, GFP_KERNEL);
> - if (!ptr) {
> - pr_err("Allocation failed\n");
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> - memset(ptr+1, 0, 8);
> + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr+1, 0, 8));
> kfree(ptr);
> }
>
> -static noinline void __init kmalloc_oob_memset_16(void)
> +static void kmalloc_oob_memset_16(struct kunit *test)
> {
> char *ptr;
> size_t size = 16;
>
> - pr_info("out-of-bounds in memset16\n");
> ptr = kmalloc(size, GFP_KERNEL);
> - if (!ptr) {
> - pr_err("Allocation failed\n");
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> - memset(ptr+1, 0, 16);
> + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr+1, 0, 16));
> kfree(ptr);
> }
>
> -static noinline void __init kmalloc_oob_in_memset(void)
> +static void kmalloc_oob_in_memset(struct kunit *test)
> {
> char *ptr;
> size_t size = 666;
>
> - pr_info("out-of-bounds in memset\n");
> ptr = kmalloc(size, GFP_KERNEL);
> - if (!ptr) {
> - pr_err("Allocation failed\n");
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> - memset(ptr, 0, size+5);
> + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr, 0, size+5));
> kfree(ptr);
> }
>
> -static noinline void __init kmalloc_uaf(void)
> +static void kmalloc_uaf(struct kunit *test)
> {
> char *ptr;
> size_t size = 10;
>
> - pr_info("use-after-free\n");
> ptr = kmalloc(size, GFP_KERNEL);
> - if (!ptr) {
> - pr_err("Allocation failed\n");
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> kfree(ptr);
> - *(ptr + 8) = 'x';
> + KUNIT_EXPECT_KASAN_FAIL(test, *(ptr + 8) = 'x');
> }
>
> -static noinline void __init kmalloc_uaf_memset(void)
> +static void kmalloc_uaf_memset(struct kunit *test)
> {
> char *ptr;
> size_t size = 33;
>
> - pr_info("use-after-free in memset\n");
> ptr = kmalloc(size, GFP_KERNEL);
> - if (!ptr) {
> - pr_err("Allocation failed\n");
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> kfree(ptr);
> - memset(ptr, 0, size);
> + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr, 0, size));
> }
>
> -static noinline void __init kmalloc_uaf2(void)
> +static void kmalloc_uaf2(struct kunit *test)
> {
> char *ptr1, *ptr2;
> size_t size = 43;
>
> - pr_info("use-after-free after another kmalloc\n");
> ptr1 = kmalloc(size, GFP_KERNEL);
> - if (!ptr1) {
> - pr_err("Allocation failed\n");
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
>
> kfree(ptr1);
> +
> ptr2 = kmalloc(size, GFP_KERNEL);
> - if (!ptr2) {
> - pr_err("Allocation failed\n");
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
> +
> + KUNIT_EXPECT_KASAN_FAIL(test, ptr1[40] = 'x');
> + KUNIT_EXPECT_PTR_NE(test, ptr1, ptr2);
>
> - ptr1[40] = 'x';
> - if (ptr1 == ptr2)
> - pr_err("Could not detect use-after-free: ptr1 == ptr2\n");
> kfree(ptr2);
> }
>
> -static noinline void __init kfree_via_page(void)
> +static void kfree_via_page(struct kunit *test)
> {
> char *ptr;
> size_t size = 8;
> struct page *page;
> unsigned long offset;
>
> - pr_info("invalid-free false positive (via page)\n");
> ptr = kmalloc(size, GFP_KERNEL);
> - if (!ptr) {
> - pr_err("Allocation failed\n");
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> page = virt_to_page(ptr);
> offset = offset_in_page(ptr);
> kfree(page_address(page) + offset);
> }
>
> -static noinline void __init kfree_via_phys(void)
> +static void kfree_via_phys(struct kunit *test)
> {
> char *ptr;
> size_t size = 8;
> phys_addr_t phys;
>
> - pr_info("invalid-free false positive (via phys)\n");
> ptr = kmalloc(size, GFP_KERNEL);
> - if (!ptr) {
> - pr_err("Allocation failed\n");
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> phys = virt_to_phys(ptr);
> kfree(phys_to_virt(phys));
> }
>
> -static noinline void __init kmem_cache_oob(void)
> +static void kmem_cache_oob(struct kunit *test)
> {
> char *p;
> size_t size = 200;
> struct kmem_cache *cache = kmem_cache_create("test_cache",
> size, 0,
> 0, NULL);
> - if (!cache) {
> - pr_err("Cache allocation failed\n");
> - return;
> - }
> - pr_info("out-of-bounds in kmem_cache_alloc\n");
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
> p = kmem_cache_alloc(cache, GFP_KERNEL);
> if (!p) {
> - pr_err("Allocation failed\n");
> + kunit_err(test, "Allocation failed: %s\n", __func__);
Any reason why this is a kunit_err() instead of
KUNIT_ASSERT_NOT_ERR_OR_NULL()? It seems inconsistent to use
KUNIT_ASSERT_NOT_ERR_OR_NULL() for kmalloc() and kmem_cache_create(),
but not for kmem_cache_alloc(). Unless there's a reason for it.
> kmem_cache_destroy(cache);
> return;
> }
>
> - *p = p[size];
> + KUNIT_EXPECT_KASAN_FAIL(test, *p = p[size]);
> kmem_cache_free(cache, p);
> kmem_cache_destroy(cache);
> }
>
> -static noinline void __init memcg_accounted_kmem_cache(void)
> +static void memcg_accounted_kmem_cache(struct kunit *test)
> {
> int i;
> char *p;
> @@ -446,12 +375,8 @@ static noinline void __init memcg_accounted_kmem_cache(void)
> struct kmem_cache *cache;
>
> cache = kmem_cache_create("test_cache", size, 0, SLAB_ACCOUNT, NULL);
> - if (!cache) {
> - pr_err("Cache allocation failed\n");
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
>
> - pr_info("allocate memcg accounted object\n");
> /*
> * Several allocations with a delay to allow for lazy per memcg kmem
> * cache creation.
> @@ -471,134 +396,93 @@ static noinline void __init memcg_accounted_kmem_cache(void)
>
> static char global_array[10];
>
> -static noinline void __init kasan_global_oob(void)
> +static void kasan_global_oob(struct kunit *test)
> {
> volatile int i = 3;
> char *p = &global_array[ARRAY_SIZE(global_array) + i];
>
> - pr_info("out-of-bounds global variable\n");
> - *(volatile char *)p;
> + KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
> }
>
> -static noinline void __init kasan_stack_oob(void)
> -{
> - char stack_array[10];
> - volatile int i = 0;
> - char *p = &stack_array[ARRAY_SIZE(stack_array) + i];
> -
> - pr_info("out-of-bounds on stack\n");
> - *(volatile char *)p;
> -}
> -
> -static noinline void __init ksize_unpoisons_memory(void)
> +static void ksize_unpoisons_memory(struct kunit *test)
> {
> char *ptr;
> size_t size = 123, real_size;
>
> - pr_info("ksize() unpoisons the whole allocated chunk\n");
> ptr = kmalloc(size, GFP_KERNEL);
> - if (!ptr) {
> - pr_err("Allocation failed\n");
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> real_size = ksize(ptr);
> /* This access doesn't trigger an error. */
> ptr[size] = 'x';
> /* This one does. */
> - ptr[real_size] = 'y';
> + KUNIT_EXPECT_KASAN_FAIL(test, ptr[real_size] = 'y');
> kfree(ptr);
> }
>
> -static noinline void __init copy_user_test(void)
> +static void kasan_stack_oob(struct kunit *test)
> {
> - char *kmem;
> - char __user *usermem;
> - size_t size = 10;
> - int unused;
> -
> - kmem = kmalloc(size, GFP_KERNEL);
> - if (!kmem)
> - return;
> + char stack_array[10];
> + volatile int i = 0;
> + char *p = &stack_array[ARRAY_SIZE(stack_array) + i];
>
> - usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE,
> - PROT_READ | PROT_WRITE | PROT_EXEC,
> - MAP_ANONYMOUS | MAP_PRIVATE, 0);
> - if (IS_ERR(usermem)) {
> - pr_err("Failed to allocate user memory\n");
> - kfree(kmem);
> + if (!IS_ENABLED(CONFIG_KASAN_STACK)) {
> + kunit_info(test, "CONFIG_KASAN_STACK is not enabled");
> return;
> }
>
> - pr_info("out-of-bounds in copy_from_user()\n");
> - unused = copy_from_user(kmem, usermem, size + 1);
> -
> - pr_info("out-of-bounds in copy_to_user()\n");
> - unused = copy_to_user(usermem, kmem, size + 1);
> -
> - pr_info("out-of-bounds in __copy_from_user()\n");
> - unused = __copy_from_user(kmem, usermem, size + 1);
> -
> - pr_info("out-of-bounds in __copy_to_user()\n");
> - unused = __copy_to_user(usermem, kmem, size + 1);
> -
> - pr_info("out-of-bounds in __copy_from_user_inatomic()\n");
> - unused = __copy_from_user_inatomic(kmem, usermem, size + 1);
> -
> - pr_info("out-of-bounds in __copy_to_user_inatomic()\n");
> - unused = __copy_to_user_inatomic(usermem, kmem, size + 1);
> -
> - pr_info("out-of-bounds in strncpy_from_user()\n");
> - unused = strncpy_from_user(kmem, usermem, size + 1);
> -
> - vm_munmap((unsigned long)usermem, PAGE_SIZE);
> - kfree(kmem);
> + KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
> }
>
> -static noinline void __init kasan_alloca_oob_left(void)
> +static void kasan_alloca_oob_left(struct kunit *test)
> {
> volatile int i = 10;
> char alloca_array[i];
> char *p = alloca_array - 1;
>
> - pr_info("out-of-bounds to left on alloca\n");
> - *(volatile char *)p;
> + if (!IS_ENABLED(CONFIG_KASAN_STACK)) {
> + kunit_info(test, "CONFIG_KASAN_STACK is not enabled");
> + return;
> + }
> +
> + KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
> }
>
> -static noinline void __init kasan_alloca_oob_right(void)
> +static void kasan_alloca_oob_right(struct kunit *test)
> {
> volatile int i = 10;
> char alloca_array[i];
> char *p = alloca_array + i;
>
> - pr_info("out-of-bounds to right on alloca\n");
> - *(volatile char *)p;
> + if (!IS_ENABLED(CONFIG_KASAN_STACK)) {
> + kunit_info(test, "CONFIG_KASAN_STACK is not enabled");
> + return;
> + }
> +
> + KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
> }
>
> -static noinline void __init kmem_cache_double_free(void)
> +static void kmem_cache_double_free(struct kunit *test)
> {
> char *p;
> size_t size = 200;
> struct kmem_cache *cache;
>
> cache = kmem_cache_create("test_cache", size, 0, 0, NULL);
> - if (!cache) {
> - pr_err("Cache allocation failed\n");
> - return;
> - }
> - pr_info("double-free on heap object\n");
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
> +
> p = kmem_cache_alloc(cache, GFP_KERNEL);
> if (!p) {
> - pr_err("Allocation failed\n");
> + kunit_err(test, "Allocation failed: %s\n", __func__);
Same here.
> kmem_cache_destroy(cache);
> return;
> }
>
> kmem_cache_free(cache, p);
> - kmem_cache_free(cache, p);
> + KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p));
> kmem_cache_destroy(cache);
> }
>
> -static noinline void __init kmem_cache_invalid_free(void)
> +static void kmem_cache_invalid_free(struct kunit *test)
> {
> char *p;
> size_t size = 200;
> @@ -606,20 +490,17 @@ static noinline void __init kmem_cache_invalid_free(void)
>
> cache = kmem_cache_create("test_cache", size, 0, SLAB_TYPESAFE_BY_RCU,
> NULL);
> - if (!cache) {
> - pr_err("Cache allocation failed\n");
> - return;
> - }
> - pr_info("invalid-free of heap object\n");
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
> +
> p = kmem_cache_alloc(cache, GFP_KERNEL);
> if (!p) {
> - pr_err("Allocation failed\n");
> + kunit_err(test, "Allocation failed: %s\n", __func__);
And here.
> kmem_cache_destroy(cache);
> return;
> }
>
> /* Trigger invalid free, the object doesn't get freed */
> - kmem_cache_free(cache, p + 1);
> + KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p + 1));
>
> /*
> * Properly free the object to prevent the "Objects remaining in
> @@ -630,45 +511,60 @@ static noinline void __init kmem_cache_invalid_free(void)
> kmem_cache_destroy(cache);
> }
>
> -static noinline void __init kasan_memchr(void)
> +static void kasan_memchr(struct kunit *test)
> {
> char *ptr;
> size_t size = 24;
>
> - pr_info("out-of-bounds in memchr\n");
> - ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
> - if (!ptr)
> + // See https://bugzilla.kernel.org/show_bug.cgi?id=206337
Wrong comment style here and below. Please use scripts/checkpatch.pl
to check your patches.
> + if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
> + kunit_info(test,
> + "str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT");
> return;
> + }
>
> - memchr(ptr, '1', size + 1);
> + ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> +
> + KUNIT_EXPECT_KASAN_FAIL(test, memchr(ptr, '1', size + 1));
> kfree(ptr);
> }
>
> -static noinline void __init kasan_memcmp(void)
> +static void kasan_memcmp(struct kunit *test)
> {
> char *ptr;
> size_t size = 24;
> int arr[9];
>
> - pr_info("out-of-bounds in memcmp\n");
> - ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
> - if (!ptr)
> + // See https://bugzilla.kernel.org/show_bug.cgi?id=206337
> + if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
> + kunit_info(test,
> + "str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT");
> return;
> + }
> +
> + ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> memset(arr, 0, sizeof(arr));
> - memcmp(ptr, arr, size+1);
> + KUNIT_EXPECT_KASAN_FAIL(test, memcmp(ptr, arr, size+1));
> kfree(ptr);
> }
>
> -static noinline void __init kasan_strings(void)
> +static void kasan_strings(struct kunit *test)
> {
> char *ptr;
> size_t size = 24;
>
> - pr_info("use-after-free in strchr\n");
> - ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
> - if (!ptr)
> + // See https://bugzilla.kernel.org/show_bug.cgi?id=206337
> + if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
> + kunit_info(test,
> + "str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT");
> return;
> + }
> +
> + ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> kfree(ptr);
>
> @@ -679,188 +575,162 @@ static noinline void __init kasan_strings(void)
> * will likely point to zeroed byte.
> */
> ptr += 16;
> - strchr(ptr, '1');
> + KUNIT_EXPECT_KASAN_FAIL(test, strchr(ptr, '1'));
>
> - pr_info("use-after-free in strrchr\n");
> - strrchr(ptr, '1');
> + KUNIT_EXPECT_KASAN_FAIL(test, strrchr(ptr, '1'));
>
> - pr_info("use-after-free in strcmp\n");
> - strcmp(ptr, "2");
> + KUNIT_EXPECT_KASAN_FAIL(test, strcmp(ptr, "2"));
>
> - pr_info("use-after-free in strncmp\n");
> - strncmp(ptr, "2", 1);
> + KUNIT_EXPECT_KASAN_FAIL(test, strncmp(ptr, "2", 1));
>
> - pr_info("use-after-free in strlen\n");
> - strlen(ptr);
> + KUNIT_EXPECT_KASAN_FAIL(test, strlen(ptr));
>
> - pr_info("use-after-free in strnlen\n");
> - strnlen(ptr, 1);
> + KUNIT_EXPECT_KASAN_FAIL(test, strnlen(ptr, 1));
> }
>
> -static noinline void __init kasan_bitops(void)
> +static void kasan_bitops(struct kunit *test)
> {
> /*
> * Allocate 1 more byte, which causes kzalloc to round up to 16-bytes;
> * this way we do not actually corrupt other memory.
> */
> long *bits = kzalloc(sizeof(*bits) + 1, GFP_KERNEL);
> - if (!bits)
> - return;
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits);
>
> /*
> * Below calls try to access bit within allocated memory; however, the
> * below accesses are still out-of-bounds, since bitops are defined to
> * operate on the whole long the bit is in.
> */
> - pr_info("out-of-bounds in set_bit\n");
> - set_bit(BITS_PER_LONG, bits);
> + KUNIT_EXPECT_KASAN_FAIL(test, set_bit(BITS_PER_LONG, bits));
>
> - pr_info("out-of-bounds in __set_bit\n");
> - __set_bit(BITS_PER_LONG, bits);
> + KUNIT_EXPECT_KASAN_FAIL(test, __set_bit(BITS_PER_LONG, bits));
>
> - pr_info("out-of-bounds in clear_bit\n");
> - clear_bit(BITS_PER_LONG, bits);
> + KUNIT_EXPECT_KASAN_FAIL(test, clear_bit(BITS_PER_LONG, bits));
>
> - pr_info("out-of-bounds in __clear_bit\n");
> - __clear_bit(BITS_PER_LONG, bits);
> + KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit(BITS_PER_LONG, bits));
>
> - pr_info("out-of-bounds in clear_bit_unlock\n");
> - clear_bit_unlock(BITS_PER_LONG, bits);
> + KUNIT_EXPECT_KASAN_FAIL(test, clear_bit_unlock(BITS_PER_LONG, bits));
>
> - pr_info("out-of-bounds in __clear_bit_unlock\n");
> - __clear_bit_unlock(BITS_PER_LONG, bits);
> + KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit_unlock(BITS_PER_LONG, bits));
>
> - pr_info("out-of-bounds in change_bit\n");
> - change_bit(BITS_PER_LONG, bits);
> + KUNIT_EXPECT_KASAN_FAIL(test, change_bit(BITS_PER_LONG, bits));
>
> - pr_info("out-of-bounds in __change_bit\n");
> - __change_bit(BITS_PER_LONG, bits);
> + KUNIT_EXPECT_KASAN_FAIL(test, __change_bit(BITS_PER_LONG, bits));
>
> /*
> * Below calls try to access bit beyond allocated memory.
> */
> - pr_info("out-of-bounds in test_and_set_bit\n");
> - test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
> + KUNIT_EXPECT_KASAN_FAIL(test,
> + test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
>
> - pr_info("out-of-bounds in __test_and_set_bit\n");
> - __test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
> + KUNIT_EXPECT_KASAN_FAIL(test,
> + __test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
>
> - pr_info("out-of-bounds in test_and_set_bit_lock\n");
> - test_and_set_bit_lock(BITS_PER_LONG + BITS_PER_BYTE, bits);
> + KUNIT_EXPECT_KASAN_FAIL(test,
> + test_and_set_bit_lock(BITS_PER_LONG + BITS_PER_BYTE, bits));
>
> - pr_info("out-of-bounds in test_and_clear_bit\n");
> - test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
> + KUNIT_EXPECT_KASAN_FAIL(test,
> + test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
>
> - pr_info("out-of-bounds in __test_and_clear_bit\n");
> - __test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
> + KUNIT_EXPECT_KASAN_FAIL(test,
> + __test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
>
> - pr_info("out-of-bounds in test_and_change_bit\n");
> - test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
> + KUNIT_EXPECT_KASAN_FAIL(test,
> + test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
>
> - pr_info("out-of-bounds in __test_and_change_bit\n");
> - __test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
> + KUNIT_EXPECT_KASAN_FAIL(test,
> + __test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
>
> - pr_info("out-of-bounds in test_bit\n");
> - (void)test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
> + KUNIT_EXPECT_KASAN_FAIL(test,
> + (void)test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
>
> #if defined(clear_bit_unlock_is_negative_byte)
> - pr_info("out-of-bounds in clear_bit_unlock_is_negative_byte\n");
> - clear_bit_unlock_is_negative_byte(BITS_PER_LONG + BITS_PER_BYTE, bits);
> + KUNIT_EXPECT_KASAN_FAIL(test,
> + clear_bit_unlock_is_negative_byte(BITS_PER_LONG + BITS_PER_BYTE,
> + bits));
> #endif
> kfree(bits);
> }
>
> -static noinline void __init kmalloc_double_kzfree(void)
> +static void kmalloc_double_kzfree(struct kunit *test)
> {
> char *ptr;
> size_t size = 16;
>
> - pr_info("double-free (kzfree)\n");
> ptr = kmalloc(size, GFP_KERNEL);
> - if (!ptr) {
> - pr_err("Allocation failed\n");
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> kzfree(ptr);
> - kzfree(ptr);
> + KUNIT_EXPECT_KASAN_FAIL(test, kzfree(ptr));
> }
>
> -#ifdef CONFIG_KASAN_VMALLOC
> -static noinline void __init vmalloc_oob(void)
> +static void vmalloc_oob(struct kunit *test)
> {
> void *area;
>
> - pr_info("vmalloc out-of-bounds\n");
> + if (!IS_ENABLED(CONFIG_KASAN_VMALLOC)) {
> + kunit_info(test, "CONFIG_KASAN_VMALLOC is not enabled.");
> + return;
> + }
>
> /*
> * We have to be careful not to hit the guard page.
> * The MMU will catch that and crash us.
> */
> area = vmalloc(3000);
> - if (!area) {
> - pr_err("Allocation failed\n");
> - return;
> - }
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, area);
>
> - ((volatile char *)area)[3100];
> + KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)area)[3100]);
> vfree(area);
> }
> -#else
> -static void __init vmalloc_oob(void) {}
> -#endif
>
> -static int __init kmalloc_tests_init(void)
> -{
> - /*
> - * Temporarily enable multi-shot mode. Otherwise, we'd only get a
> - * report for the first case.
> - */
> - bool multishot = kasan_save_enable_multi_shot();
> -
> - kmalloc_oob_right();
> - kmalloc_oob_left();
> - kmalloc_node_oob_right();
> -#ifdef CONFIG_SLUB
> - kmalloc_pagealloc_oob_right();
> - kmalloc_pagealloc_uaf();
> - kmalloc_pagealloc_invalid_free();
> -#endif
> - kmalloc_large_oob_right();
> - kmalloc_oob_krealloc_more();
> - kmalloc_oob_krealloc_less();
> - kmalloc_oob_16();
> - kmalloc_oob_in_memset();
> - kmalloc_oob_memset_2();
> - kmalloc_oob_memset_4();
> - kmalloc_oob_memset_8();
> - kmalloc_oob_memset_16();
> - kmalloc_uaf();
> - kmalloc_uaf_memset();
> - kmalloc_uaf2();
> - kfree_via_page();
> - kfree_via_phys();
> - kmem_cache_oob();
> - memcg_accounted_kmem_cache();
> - kasan_stack_oob();
> - kasan_global_oob();
> - kasan_alloca_oob_left();
> - kasan_alloca_oob_right();
> - ksize_unpoisons_memory();
> - copy_user_test();
> - kmem_cache_double_free();
> - kmem_cache_invalid_free();
> - kasan_memchr();
> - kasan_memcmp();
> - kasan_strings();
> - kasan_bitops();
> - kmalloc_double_kzfree();
> - vmalloc_oob();
> -
> - kasan_restore_multi_shot(multishot);
> -
> - return -EAGAIN;
> -}
> +static struct kunit_case kasan_kunit_test_cases[] = {
> + KUNIT_CASE(kmalloc_oob_right),
> + KUNIT_CASE(kmalloc_oob_left),
> + KUNIT_CASE(kmalloc_node_oob_right),
> + KUNIT_CASE(kmalloc_pagealloc_oob_right),
> + KUNIT_CASE(kmalloc_pagealloc_uaf),
> + KUNIT_CASE(kmalloc_pagealloc_invalid_free),
> + KUNIT_CASE(kmalloc_large_oob_right),
> + KUNIT_CASE(kmalloc_oob_krealloc_more),
> + KUNIT_CASE(kmalloc_oob_krealloc_less),
> + KUNIT_CASE(kmalloc_oob_16),
> + KUNIT_CASE(kmalloc_oob_in_memset),
> + KUNIT_CASE(kmalloc_oob_memset_2),
> + KUNIT_CASE(kmalloc_oob_memset_4),
> + KUNIT_CASE(kmalloc_oob_memset_8),
> + KUNIT_CASE(kmalloc_oob_memset_16),
> + KUNIT_CASE(kmalloc_uaf),
> + KUNIT_CASE(kmalloc_uaf_memset),
> + KUNIT_CASE(kmalloc_uaf2),
> + KUNIT_CASE(kfree_via_page),
> + KUNIT_CASE(kfree_via_phys),
> + KUNIT_CASE(kmem_cache_oob),
> + KUNIT_CASE(memcg_accounted_kmem_cache),
> + KUNIT_CASE(kasan_global_oob),
> + KUNIT_CASE(kasan_stack_oob),
> + KUNIT_CASE(kasan_alloca_oob_left),
> + KUNIT_CASE(kasan_alloca_oob_right),
> + KUNIT_CASE(ksize_unpoisons_memory),
> + KUNIT_CASE(kmem_cache_double_free),
> + KUNIT_CASE(kmem_cache_invalid_free),
> + KUNIT_CASE(kasan_memchr),
> + KUNIT_CASE(kasan_memcmp),
> + KUNIT_CASE(kasan_strings),
> + KUNIT_CASE(kasan_bitops),
> + KUNIT_CASE(kmalloc_double_kzfree),
> + KUNIT_CASE(vmalloc_oob),
> + {}
> +};
> +
> +static struct kunit_suite kasan_kunit_test_suite = {
> + .name = "kasan_kunit_test",
> + .init = kasan_test_init,
> + .test_cases = kasan_kunit_test_cases,
> + .exit = kasan_test_exit,
> +};
> +
> +kunit_test_suite(kasan_kunit_test_suite);
>
> -module_init(kmalloc_tests_init);
> MODULE_LICENSE("GPL");
> diff --git a/lib/test_kasan_module.c b/lib/test_kasan_module.c
> new file mode 100644
> index 000000000000..87d7e4d8fc31
> --- /dev/null
> +++ b/lib/test_kasan_module.c
> @@ -0,0 +1,76 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/*
> + *
> + * Copyright (c) 2014 Samsung Electronics Co., Ltd.
> + * Author: Andrey Ryabinin <[email protected]>
> + */
> +
> +#define pr_fmt(fmt) "kasan test: %s " fmt, __func__
> +
> +#include <linux/mman.h>
> +#include <linux/module.h>
> +#include <linux/printk.h>
> +#include <linux/slab.h>
> +#include <linux/uaccess.h>
> +
> +static noinline void __init copy_user_test(void)
> +{
> + char *kmem;
> + char __user *usermem;
> + size_t size = 10;
> + int unused;
> +
> + kmem = kmalloc(size, GFP_KERNEL);
> + if (!kmem)
> + return;
> +
> + usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE,
> + PROT_READ | PROT_WRITE | PROT_EXEC,
> + MAP_ANONYMOUS | MAP_PRIVATE, 0);
> + if (IS_ERR(usermem)) {
> + pr_err("Failed to allocate user memory\n");
> + kfree(kmem);
> + return;
> + }
> +
> + pr_info("out-of-bounds in copy_from_user()\n");
> + unused = copy_from_user(kmem, usermem, size + 1);
> +
> + pr_info("out-of-bounds in copy_to_user()\n");
> + unused = copy_to_user(usermem, kmem, size + 1);
> +
> + pr_info("out-of-bounds in __copy_from_user()\n");
> + unused = __copy_from_user(kmem, usermem, size + 1);
> +
> + pr_info("out-of-bounds in __copy_to_user()\n");
> + unused = __copy_to_user(usermem, kmem, size + 1);
> +
> + pr_info("out-of-bounds in __copy_from_user_inatomic()\n");
> + unused = __copy_from_user_inatomic(kmem, usermem, size + 1);
> +
> + pr_info("out-of-bounds in __copy_to_user_inatomic()\n");
> + unused = __copy_to_user_inatomic(usermem, kmem, size + 1);
> +
> + pr_info("out-of-bounds in strncpy_from_user()\n");
> + unused = strncpy_from_user(kmem, usermem, size + 1);
> +
> + vm_munmap((unsigned long)usermem, PAGE_SIZE);
> + kfree(kmem);
> +}
> +
> +static int __init test_kasan_module_init(void)
> +{
> + /*
> + * Temporarily enable multi-shot mode. Otherwise, we'd only get a
> + * report for the first case.
> + */
> + bool multishot = kasan_save_enable_multi_shot();
> +
> + copy_user_test();
> +
> + kasan_restore_multi_shot(multishot);
> + return -EAGAIN;
> +}
> +
> +module_init(test_kasan_module_init);
> +MODULE_LICENSE("GPL");
> --
> 2.26.0.110.g2183baf09c-goog
>
> --
> You received this message because you are subscribed to the Google Groups "kasan-dev" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
> To view this discussion on the web visit https://groups.google.com/d/msgid/kasan-dev/20200414031647.124664-4-davidgow%40google.com.
On Tue, Apr 14, 2020 at 10:29 PM Andrey Konovalov <[email protected]> wrote:
>
> On Tue, Apr 14, 2020 at 5:17 AM 'David Gow' via kasan-dev
> <[email protected]> wrote:
> >
> > From: Patricia Alfonso <[email protected]>
> >
> > Transfer all previous tests for KASAN to KUnit so they can be run
> > more easily. Using kunit_tool, developers can run these tests with their
> > other KUnit tests and see "pass" or "fail" with the appropriate KASAN
> > report instead of needing to parse each KASAN report to test KASAN
> > functionalities. All KASAN reports are still printed to dmesg.
> >
> > Stack tests do not work properly when KASAN_STACK is enabled so
> > those tests use a check for "if IS_ENABLED(CONFIG_KASAN_STACK)" so they
> > only run if stack instrumentation is enabled. If KASAN_STACK is not
> > enabled, KUnit will print a statement to let the user know this test
> > was not run with KASAN_STACK enabled.
> >
> > copy_user_test cannot be run in KUnit so there is a separate test file
> > for those tests, which can be run as before as a module.
> >
> > Signed-off-by: Patricia Alfonso <[email protected]>
> > Reviewed-by: Dmitry Vyukov <[email protected]>
> > Reviewed-by: Brendan Higgins <[email protected]>
> > Signed-off-by: David Gow <[email protected]>
> > ---
> > lib/Kconfig.kasan | 18 +-
> > lib/Makefile | 3 +-
> > lib/test_kasan.c | 622 ++++++++++++++++------------------------
> > lib/test_kasan_module.c | 76 +++++
> > 4 files changed, 337 insertions(+), 382 deletions(-)
> > create mode 100644 lib/test_kasan_module.c
> >
> > diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan
> > index 81f5464ea9e1..53063dee3f81 100644
> > --- a/lib/Kconfig.kasan
> > +++ b/lib/Kconfig.kasan
> > @@ -158,10 +158,18 @@ config KASAN_VMALLOC
> > for KASAN to detect more sorts of errors (and to support vmapped
> > stacks), but at the cost of higher memory usage.
> >
> > -config TEST_KASAN
> > - tristate "Module for testing KASAN for bug detection"
> > - depends on m && KASAN
> > +config TEST_KASAN_KUNIT
> > + tristate "KUnit-compatible tests of KASAN bug detection capabilities"
> > + depends on KASAN && KUNIT
> > help
> > - This is a test module doing various nasty things like
> > - out of bounds accesses, use after free. It is useful for testing
> > + This is a KUnit test suite doing various nasty things like
> > + out of bounds and use after free accesses. It is useful for testing
> > kernel debugging features like KASAN.
> > +
> > +config TEST_KASAN_MODULE
> > + tristate "KUnit-incompatible tests of KASAN bug detection capabilities"
> > + depends on m && KASAN
> > + help
> > + This is a part of the KASAN test suite that is incompatible with
> > + KUnit. Currently includes tests that do bad copy_from/to_user
> > + accesses.
> > diff --git a/lib/Makefile b/lib/Makefile
> > index 611872c06926..60e125555271 100644
> > --- a/lib/Makefile
> > +++ b/lib/Makefile
> > @@ -59,9 +59,10 @@ obj-$(CONFIG_TEST_FIRMWARE) += test_firmware.o
> > obj-$(CONFIG_TEST_SYSCTL) += test_sysctl.o
> > obj-$(CONFIG_TEST_HASH) += test_hash.o test_siphash.o
> > obj-$(CONFIG_TEST_IDA) += test_ida.o
> > -obj-$(CONFIG_TEST_KASAN) += test_kasan.o
> > +obj-$(CONFIG_TEST_KASAN_KUNIT) += test_kasan.o
> > CFLAGS_test_kasan.o += -fno-builtin
> > CFLAGS_test_kasan.o += $(call cc-disable-warning, vla)
> > +obj-$(CONFIG_TEST_KASAN_MODULE) += test_kasan_module.o
> > obj-$(CONFIG_TEST_UBSAN) += test_ubsan.o
> > CFLAGS_test_ubsan.o += $(call cc-disable-warning, vla)
> > UBSAN_SANITIZE_test_ubsan.o := y
> > diff --git a/lib/test_kasan.c b/lib/test_kasan.c
> > index 7b4cb107b387..801ef7573da2 100644
> > --- a/lib/test_kasan.c
> > +++ b/lib/test_kasan.c
> > @@ -5,8 +5,6 @@
> > * Author: Andrey Ryabinin <[email protected]>
> > */
> >
> > -#define pr_fmt(fmt) "kasan test: %s " fmt, __func__
> > -
> > #include <linux/bitops.h>
> > #include <linux/delay.h>
> > #include <linux/kasan.h>
> > @@ -65,380 +63,311 @@ static void kasan_test_exit(struct kunit *test)
> > fail_data.report_found); \
> > } while (0)
> >
> > +static void kmalloc_oob_right(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = 123;
> >
> > - pr_info("out-of-bounds to right\n");
> > ptr = kmalloc(size, GFP_KERNEL);
> > - if (!ptr) {
> > - pr_err("Allocation failed\n");
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> >
> > - ptr[size] = 'x';
> > + KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 'x');
> > kfree(ptr);
> > }
> >
> > -static noinline void __init kmalloc_oob_left(void)
> > +static void kmalloc_oob_left(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = 15;
> >
> > - pr_info("out-of-bounds to left\n");
> > ptr = kmalloc(size, GFP_KERNEL);
> > - if (!ptr) {
> > - pr_err("Allocation failed\n");
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> >
> > - *ptr = *(ptr - 1);
> > + KUNIT_EXPECT_KASAN_FAIL(test, *ptr = *(ptr - 1));
> > kfree(ptr);
> > }
> >
> > -static noinline void __init kmalloc_node_oob_right(void)
> > +static void kmalloc_node_oob_right(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = 4096;
> >
> > - pr_info("kmalloc_node(): out-of-bounds to right\n");
> > ptr = kmalloc_node(size, GFP_KERNEL, 0);
> > - if (!ptr) {
> > - pr_err("Allocation failed\n");
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> >
> > - ptr[size] = 0;
> > + KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0);
> > kfree(ptr);
> > }
> >
> > -#ifdef CONFIG_SLUB
> > -static noinline void __init kmalloc_pagealloc_oob_right(void)
> > +static void kmalloc_pagealloc_oob_right(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
> >
> > + if (!IS_ENABLED(CONFIG_SLUB)) {
> > + kunit_info(test, "CONFIG_SLUB is not enabled.");
> > + return;
> > + }
> > +
> > /* Allocate a chunk that does not fit into a SLUB cache to trigger
> > * the page allocator fallback.
> > */
> > - pr_info("kmalloc pagealloc allocation: out-of-bounds to right\n");
> > ptr = kmalloc(size, GFP_KERNEL);
> > - if (!ptr) {
> > - pr_err("Allocation failed\n");
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> >
> > - ptr[size] = 0;
> > + KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0);
> > kfree(ptr);
> > }
> >
> > -static noinline void __init kmalloc_pagealloc_uaf(void)
> > +static void kmalloc_pagealloc_uaf(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
> >
> > - pr_info("kmalloc pagealloc allocation: use-after-free\n");
> > - ptr = kmalloc(size, GFP_KERNEL);
> > - if (!ptr) {
> > - pr_err("Allocation failed\n");
> > + if (!IS_ENABLED(CONFIG_SLUB)) {
> > + kunit_info(test, "CONFIG_SLUB is not enabled.");
> > return;
> > }
> >
> > + ptr = kmalloc(size, GFP_KERNEL);
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> > +
> > kfree(ptr);
> > - ptr[0] = 0;
> > + KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = 0);
> > }
> >
> > -static noinline void __init kmalloc_pagealloc_invalid_free(void)
> > +static void kmalloc_pagealloc_invalid_free(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
> >
> > - pr_info("kmalloc pagealloc allocation: invalid-free\n");
> > - ptr = kmalloc(size, GFP_KERNEL);
> > - if (!ptr) {
> > - pr_err("Allocation failed\n");
> > + if (!IS_ENABLED(CONFIG_SLUB)) {
> > + kunit_info(test, "CONFIG_SLUB is not enabled.");
> > return;
> > }
> >
> > - kfree(ptr + 1);
> > + ptr = kmalloc(size, GFP_KERNEL);
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> > +
> > + KUNIT_EXPECT_KASAN_FAIL(test, kfree(ptr + 1));
> > }
> > -#endif
> >
> > -static noinline void __init kmalloc_large_oob_right(void)
> > +static void kmalloc_large_oob_right(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = KMALLOC_MAX_CACHE_SIZE - 256;
> > /* Allocate a chunk that is large enough, but still fits into a slab
> > * and does not trigger the page allocator fallback in SLUB.
> > */
> > - pr_info("kmalloc large allocation: out-of-bounds to right\n");
> > ptr = kmalloc(size, GFP_KERNEL);
> > - if (!ptr) {
> > - pr_err("Allocation failed\n");
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> >
> > - ptr[size] = 0;
> > + KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0);
> > kfree(ptr);
> > }
> >
> > -static noinline void __init kmalloc_oob_krealloc_more(void)
> > +static void kmalloc_oob_krealloc_more(struct kunit *test)
> > {
> > char *ptr1, *ptr2;
> > size_t size1 = 17;
> > size_t size2 = 19;
> >
> > - pr_info("out-of-bounds after krealloc more\n");
> > ptr1 = kmalloc(size1, GFP_KERNEL);
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
> > +
> > ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
> > - if (!ptr1 || !ptr2) {
> > - pr_err("Allocation failed\n");
> > - kfree(ptr1);
> > - kfree(ptr2);
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
> >
> > - ptr2[size2] = 'x';
> > + KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size2] = 'x');
> > kfree(ptr2);
> > }
> >
> > -static noinline void __init kmalloc_oob_krealloc_less(void)
> > +static void kmalloc_oob_krealloc_less(struct kunit *test)
> > {
> > char *ptr1, *ptr2;
> > size_t size1 = 17;
> > size_t size2 = 15;
> >
> > - pr_info("out-of-bounds after krealloc less\n");
> > ptr1 = kmalloc(size1, GFP_KERNEL);
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
> > +
> > ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
> > - if (!ptr1 || !ptr2) {
> > - pr_err("Allocation failed\n");
> > - kfree(ptr1);
> > - return;
> > - }
> > - ptr2[size2] = 'x';
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
> > +
> > + KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size2] = 'x');
> > kfree(ptr2);
> > }
> >
> > -static noinline void __init kmalloc_oob_16(void)
> > +static void kmalloc_oob_16(struct kunit *test)
> > {
> > struct {
> > u64 words[2];
> > } *ptr1, *ptr2;
> >
> > - pr_info("kmalloc out-of-bounds for 16-bytes access\n");
> > ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL);
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
> > +
> > ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
> > - if (!ptr1 || !ptr2) {
> > - pr_err("Allocation failed\n");
> > - kfree(ptr1);
> > - kfree(ptr2);
> > - return;
> > - }
> > - *ptr1 = *ptr2;
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
> > +
> > + KUNIT_EXPECT_KASAN_FAIL(test, *ptr1 = *ptr2);
> > kfree(ptr1);
> > kfree(ptr2);
> > }
> >
> > -static noinline void __init kmalloc_oob_memset_2(void)
> > +static void kmalloc_oob_memset_2(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = 8;
> >
> > - pr_info("out-of-bounds in memset2\n");
> > ptr = kmalloc(size, GFP_KERNEL);
> > - if (!ptr) {
> > - pr_err("Allocation failed\n");
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> >
> > - memset(ptr+7, 0, 2);
> > + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr+7, 0, 2));
> > kfree(ptr);
> > }
> >
> > -static noinline void __init kmalloc_oob_memset_4(void)
> > +static void kmalloc_oob_memset_4(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = 8;
> >
> > - pr_info("out-of-bounds in memset4\n");
> > ptr = kmalloc(size, GFP_KERNEL);
> > - if (!ptr) {
> > - pr_err("Allocation failed\n");
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> >
> > - memset(ptr+5, 0, 4);
> > + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr+5, 0, 4));
> > kfree(ptr);
> > }
> >
> >
> > -static noinline void __init kmalloc_oob_memset_8(void)
> > +static void kmalloc_oob_memset_8(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = 8;
> >
> > - pr_info("out-of-bounds in memset8\n");
> > ptr = kmalloc(size, GFP_KERNEL);
> > - if (!ptr) {
> > - pr_err("Allocation failed\n");
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> >
> > - memset(ptr+1, 0, 8);
> > + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr+1, 0, 8));
> > kfree(ptr);
> > }
> >
> > -static noinline void __init kmalloc_oob_memset_16(void)
> > +static void kmalloc_oob_memset_16(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = 16;
> >
> > - pr_info("out-of-bounds in memset16\n");
> > ptr = kmalloc(size, GFP_KERNEL);
> > - if (!ptr) {
> > - pr_err("Allocation failed\n");
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> >
> > - memset(ptr+1, 0, 16);
> > + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr+1, 0, 16));
> > kfree(ptr);
> > }
> >
> > -static noinline void __init kmalloc_oob_in_memset(void)
> > +static void kmalloc_oob_in_memset(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = 666;
> >
> > - pr_info("out-of-bounds in memset\n");
> > ptr = kmalloc(size, GFP_KERNEL);
> > - if (!ptr) {
> > - pr_err("Allocation failed\n");
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> >
> > - memset(ptr, 0, size+5);
> > + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr, 0, size+5));
> > kfree(ptr);
> > }
> >
> > -static noinline void __init kmalloc_uaf(void)
> > +static void kmalloc_uaf(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = 10;
> >
> > - pr_info("use-after-free\n");
> > ptr = kmalloc(size, GFP_KERNEL);
> > - if (!ptr) {
> > - pr_err("Allocation failed\n");
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> >
> > kfree(ptr);
> > - *(ptr + 8) = 'x';
> > + KUNIT_EXPECT_KASAN_FAIL(test, *(ptr + 8) = 'x');
> > }
> >
> > -static noinline void __init kmalloc_uaf_memset(void)
> > +static void kmalloc_uaf_memset(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = 33;
> >
> > - pr_info("use-after-free in memset\n");
> > ptr = kmalloc(size, GFP_KERNEL);
> > - if (!ptr) {
> > - pr_err("Allocation failed\n");
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> >
> > kfree(ptr);
> > - memset(ptr, 0, size);
> > + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr, 0, size));
> > }
> >
> > -static noinline void __init kmalloc_uaf2(void)
> > +static void kmalloc_uaf2(struct kunit *test)
> > {
> > char *ptr1, *ptr2;
> > size_t size = 43;
> >
> > - pr_info("use-after-free after another kmalloc\n");
> > ptr1 = kmalloc(size, GFP_KERNEL);
> > - if (!ptr1) {
> > - pr_err("Allocation failed\n");
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
> >
> > kfree(ptr1);
> > +
> > ptr2 = kmalloc(size, GFP_KERNEL);
> > - if (!ptr2) {
> > - pr_err("Allocation failed\n");
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
> > +
> > + KUNIT_EXPECT_KASAN_FAIL(test, ptr1[40] = 'x');
> > + KUNIT_EXPECT_PTR_NE(test, ptr1, ptr2);
> >
> > - ptr1[40] = 'x';
> > - if (ptr1 == ptr2)
> > - pr_err("Could not detect use-after-free: ptr1 == ptr2\n");
> > kfree(ptr2);
> > }
> >
> > -static noinline void __init kfree_via_page(void)
> > +static void kfree_via_page(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = 8;
> > struct page *page;
> > unsigned long offset;
> >
> > - pr_info("invalid-free false positive (via page)\n");
> > ptr = kmalloc(size, GFP_KERNEL);
> > - if (!ptr) {
> > - pr_err("Allocation failed\n");
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> >
> > page = virt_to_page(ptr);
> > offset = offset_in_page(ptr);
> > kfree(page_address(page) + offset);
> > }
> >
> > -static noinline void __init kfree_via_phys(void)
> > +static void kfree_via_phys(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = 8;
> > phys_addr_t phys;
> >
> > - pr_info("invalid-free false positive (via phys)\n");
> > ptr = kmalloc(size, GFP_KERNEL);
> > - if (!ptr) {
> > - pr_err("Allocation failed\n");
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> >
> > phys = virt_to_phys(ptr);
> > kfree(phys_to_virt(phys));
> > }
> >
> > -static noinline void __init kmem_cache_oob(void)
> > +static void kmem_cache_oob(struct kunit *test)
> > {
> > char *p;
> > size_t size = 200;
> > struct kmem_cache *cache = kmem_cache_create("test_cache",
> > size, 0,
> > 0, NULL);
> > - if (!cache) {
> > - pr_err("Cache allocation failed\n");
> > - return;
> > - }
> > - pr_info("out-of-bounds in kmem_cache_alloc\n");
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
> > p = kmem_cache_alloc(cache, GFP_KERNEL);
> > if (!p) {
> > - pr_err("Allocation failed\n");
> > + kunit_err(test, "Allocation failed: %s\n", __func__);
>
> Any reason why this is a kunit_err() instead of
> KUNIT_ASSERT_NOT_ERR_OR_NULL()? It seems inconsistent to use
> KUNIT_ASSERT_NOT_ERR_OR_NULL() for kmalloc() and kmem_cache_create(),
> but not for kmem_cache_alloc(). Unless there's a reason for it.
>
This was because we need to clean up the kmem_cache before the test
ends. KUNIT_ASSERT_NOT_ERR_OR_NULL() would kill the test immediately,
before the kmem_cache_destroy() line could execute.
There are other things we could do to make this a bit more consistent
though: we could use IS_ERR_OR_NULL() rather than just checking !, or
we could set up the kmem_cache as a kunit resource, which would
automatically be cleaned up. For a simple test like this, though, it
may be overkill.
> > kmem_cache_destroy(cache);
> > return;
> > }
> >
> > - *p = p[size];
> > + KUNIT_EXPECT_KASAN_FAIL(test, *p = p[size]);
> > kmem_cache_free(cache, p);
> > kmem_cache_destroy(cache);
> > }
> >
> > -static noinline void __init memcg_accounted_kmem_cache(void)
> > +static void memcg_accounted_kmem_cache(struct kunit *test)
> > {
> > int i;
> > char *p;
> > @@ -446,12 +375,8 @@ static noinline void __init memcg_accounted_kmem_cache(void)
> > struct kmem_cache *cache;
> >
> > cache = kmem_cache_create("test_cache", size, 0, SLAB_ACCOUNT, NULL);
> > - if (!cache) {
> > - pr_err("Cache allocation failed\n");
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
> >
> > - pr_info("allocate memcg accounted object\n");
> > /*
> > * Several allocations with a delay to allow for lazy per memcg kmem
> > * cache creation.
> > @@ -471,134 +396,93 @@ static noinline void __init memcg_accounted_kmem_cache(void)
> >
> > static char global_array[10];
> >
> > -static noinline void __init kasan_global_oob(void)
> > +static void kasan_global_oob(struct kunit *test)
> > {
> > volatile int i = 3;
> > char *p = &global_array[ARRAY_SIZE(global_array) + i];
> >
> > - pr_info("out-of-bounds global variable\n");
> > - *(volatile char *)p;
> > + KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
> > }
> >
> > -static noinline void __init kasan_stack_oob(void)
> > -{
> > - char stack_array[10];
> > - volatile int i = 0;
> > - char *p = &stack_array[ARRAY_SIZE(stack_array) + i];
> > -
> > - pr_info("out-of-bounds on stack\n");
> > - *(volatile char *)p;
> > -}
> > -
> > -static noinline void __init ksize_unpoisons_memory(void)
> > +static void ksize_unpoisons_memory(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = 123, real_size;
> >
> > - pr_info("ksize() unpoisons the whole allocated chunk\n");
> > ptr = kmalloc(size, GFP_KERNEL);
> > - if (!ptr) {
> > - pr_err("Allocation failed\n");
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> > real_size = ksize(ptr);
> > /* This access doesn't trigger an error. */
> > ptr[size] = 'x';
> > /* This one does. */
> > - ptr[real_size] = 'y';
> > + KUNIT_EXPECT_KASAN_FAIL(test, ptr[real_size] = 'y');
> > kfree(ptr);
> > }
> >
> > -static noinline void __init copy_user_test(void)
> > +static void kasan_stack_oob(struct kunit *test)
> > {
> > - char *kmem;
> > - char __user *usermem;
> > - size_t size = 10;
> > - int unused;
> > -
> > - kmem = kmalloc(size, GFP_KERNEL);
> > - if (!kmem)
> > - return;
> > + char stack_array[10];
> > + volatile int i = 0;
> > + char *p = &stack_array[ARRAY_SIZE(stack_array) + i];
> >
> > - usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE,
> > - PROT_READ | PROT_WRITE | PROT_EXEC,
> > - MAP_ANONYMOUS | MAP_PRIVATE, 0);
> > - if (IS_ERR(usermem)) {
> > - pr_err("Failed to allocate user memory\n");
> > - kfree(kmem);
> > + if (!IS_ENABLED(CONFIG_KASAN_STACK)) {
> > + kunit_info(test, "CONFIG_KASAN_STACK is not enabled");
> > return;
> > }
> >
> > - pr_info("out-of-bounds in copy_from_user()\n");
> > - unused = copy_from_user(kmem, usermem, size + 1);
> > -
> > - pr_info("out-of-bounds in copy_to_user()\n");
> > - unused = copy_to_user(usermem, kmem, size + 1);
> > -
> > - pr_info("out-of-bounds in __copy_from_user()\n");
> > - unused = __copy_from_user(kmem, usermem, size + 1);
> > -
> > - pr_info("out-of-bounds in __copy_to_user()\n");
> > - unused = __copy_to_user(usermem, kmem, size + 1);
> > -
> > - pr_info("out-of-bounds in __copy_from_user_inatomic()\n");
> > - unused = __copy_from_user_inatomic(kmem, usermem, size + 1);
> > -
> > - pr_info("out-of-bounds in __copy_to_user_inatomic()\n");
> > - unused = __copy_to_user_inatomic(usermem, kmem, size + 1);
> > -
> > - pr_info("out-of-bounds in strncpy_from_user()\n");
> > - unused = strncpy_from_user(kmem, usermem, size + 1);
> > -
> > - vm_munmap((unsigned long)usermem, PAGE_SIZE);
> > - kfree(kmem);
> > + KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
> > }
> >
> > -static noinline void __init kasan_alloca_oob_left(void)
> > +static void kasan_alloca_oob_left(struct kunit *test)
> > {
> > volatile int i = 10;
> > char alloca_array[i];
> > char *p = alloca_array - 1;
> >
> > - pr_info("out-of-bounds to left on alloca\n");
> > - *(volatile char *)p;
> > + if (!IS_ENABLED(CONFIG_KASAN_STACK)) {
> > + kunit_info(test, "CONFIG_KASAN_STACK is not enabled");
> > + return;
> > + }
> > +
> > + KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
> > }
> >
> > -static noinline void __init kasan_alloca_oob_right(void)
> > +static void kasan_alloca_oob_right(struct kunit *test)
> > {
> > volatile int i = 10;
> > char alloca_array[i];
> > char *p = alloca_array + i;
> >
> > - pr_info("out-of-bounds to right on alloca\n");
> > - *(volatile char *)p;
> > + if (!IS_ENABLED(CONFIG_KASAN_STACK)) {
> > + kunit_info(test, "CONFIG_KASAN_STACK is not enabled");
> > + return;
> > + }
> > +
> > + KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
> > }
> >
> > -static noinline void __init kmem_cache_double_free(void)
> > +static void kmem_cache_double_free(struct kunit *test)
> > {
> > char *p;
> > size_t size = 200;
> > struct kmem_cache *cache;
> >
> > cache = kmem_cache_create("test_cache", size, 0, 0, NULL);
> > - if (!cache) {
> > - pr_err("Cache allocation failed\n");
> > - return;
> > - }
> > - pr_info("double-free on heap object\n");
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
> > +
> > p = kmem_cache_alloc(cache, GFP_KERNEL);
> > if (!p) {
> > - pr_err("Allocation failed\n");
> > + kunit_err(test, "Allocation failed: %s\n", __func__);
>
> Same here.
>
> > kmem_cache_destroy(cache);
> > return;
> > }
> >
> > kmem_cache_free(cache, p);
> > - kmem_cache_free(cache, p);
> > + KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p));
> > kmem_cache_destroy(cache);
> > }
> >
> > -static noinline void __init kmem_cache_invalid_free(void)
> > +static void kmem_cache_invalid_free(struct kunit *test)
> > {
> > char *p;
> > size_t size = 200;
> > @@ -606,20 +490,17 @@ static noinline void __init kmem_cache_invalid_free(void)
> >
> > cache = kmem_cache_create("test_cache", size, 0, SLAB_TYPESAFE_BY_RCU,
> > NULL);
> > - if (!cache) {
> > - pr_err("Cache allocation failed\n");
> > - return;
> > - }
> > - pr_info("invalid-free of heap object\n");
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
> > +
> > p = kmem_cache_alloc(cache, GFP_KERNEL);
> > if (!p) {
> > - pr_err("Allocation failed\n");
> > + kunit_err(test, "Allocation failed: %s\n", __func__);
>
> And here.
>
As above, this is due to needing to clean up the kmem_cache.
> > kmem_cache_destroy(cache);
> > return;
> > }
> >
> > /* Trigger invalid free, the object doesn't get freed */
> > - kmem_cache_free(cache, p + 1);
> > + KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p + 1));
> >
> > /*
> > * Properly free the object to prevent the "Objects remaining in
> > @@ -630,45 +511,60 @@ static noinline void __init kmem_cache_invalid_free(void)
> > kmem_cache_destroy(cache);
> > }
> >
> > -static noinline void __init kasan_memchr(void)
> > +static void kasan_memchr(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = 24;
> >
> > - pr_info("out-of-bounds in memchr\n");
> > - ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
> > - if (!ptr)
> > + // See https://bugzilla.kernel.org/show_bug.cgi?id=206337
>
> Wrong comment style here and below. Please use scripts/checkpatch.pl
> to check your patches.
>
Huh. Checkpatch didn't pick up on this. I've fixed it (here and below)
for the next revision.
> > + if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
> > + kunit_info(test,
> > + "str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT");
> > return;
> > + }
> >
> > - memchr(ptr, '1', size + 1);
> > + ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> > +
> > + KUNIT_EXPECT_KASAN_FAIL(test, memchr(ptr, '1', size + 1));
> > kfree(ptr);
> > }
> >
> > -static noinline void __init kasan_memcmp(void)
> > +static void kasan_memcmp(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = 24;
> > int arr[9];
> >
> > - pr_info("out-of-bounds in memcmp\n");
> > - ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
> > - if (!ptr)
> > + // See https://bugzilla.kernel.org/show_bug.cgi?id=206337
> > + if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
> > + kunit_info(test,
> > + "str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT");
> > return;
> > + }
> > +
> > + ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> >
> > memset(arr, 0, sizeof(arr));
> > - memcmp(ptr, arr, size+1);
> > + KUNIT_EXPECT_KASAN_FAIL(test, memcmp(ptr, arr, size+1));
> > kfree(ptr);
> > }
> >
> > -static noinline void __init kasan_strings(void)
> > +static void kasan_strings(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = 24;
> >
> > - pr_info("use-after-free in strchr\n");
> > - ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
> > - if (!ptr)
> > + // See https://bugzilla.kernel.org/show_bug.cgi?id=206337
> > + if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
> > + kunit_info(test,
> > + "str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT");
> > return;
> > + }
> > +
> > + ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> >
> > kfree(ptr);
> >
> > @@ -679,188 +575,162 @@ static noinline void __init kasan_strings(void)
> > * will likely point to zeroed byte.
> > */
> > ptr += 16;
> > - strchr(ptr, '1');
> > + KUNIT_EXPECT_KASAN_FAIL(test, strchr(ptr, '1'));
> >
> > - pr_info("use-after-free in strrchr\n");
> > - strrchr(ptr, '1');
> > + KUNIT_EXPECT_KASAN_FAIL(test, strrchr(ptr, '1'));
> >
> > - pr_info("use-after-free in strcmp\n");
> > - strcmp(ptr, "2");
> > + KUNIT_EXPECT_KASAN_FAIL(test, strcmp(ptr, "2"));
> >
> > - pr_info("use-after-free in strncmp\n");
> > - strncmp(ptr, "2", 1);
> > + KUNIT_EXPECT_KASAN_FAIL(test, strncmp(ptr, "2", 1));
> >
> > - pr_info("use-after-free in strlen\n");
> > - strlen(ptr);
> > + KUNIT_EXPECT_KASAN_FAIL(test, strlen(ptr));
> >
> > - pr_info("use-after-free in strnlen\n");
> > - strnlen(ptr, 1);
> > + KUNIT_EXPECT_KASAN_FAIL(test, strnlen(ptr, 1));
> > }
> >
> > -static noinline void __init kasan_bitops(void)
> > +static void kasan_bitops(struct kunit *test)
> > {
> > /*
> > * Allocate 1 more byte, which causes kzalloc to round up to 16-bytes;
> > * this way we do not actually corrupt other memory.
> > */
> > long *bits = kzalloc(sizeof(*bits) + 1, GFP_KERNEL);
> > - if (!bits)
> > - return;
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits);
> >
> > /*
> > * Below calls try to access bit within allocated memory; however, the
> > * below accesses are still out-of-bounds, since bitops are defined to
> > * operate on the whole long the bit is in.
> > */
> > - pr_info("out-of-bounds in set_bit\n");
> > - set_bit(BITS_PER_LONG, bits);
> > + KUNIT_EXPECT_KASAN_FAIL(test, set_bit(BITS_PER_LONG, bits));
> >
> > - pr_info("out-of-bounds in __set_bit\n");
> > - __set_bit(BITS_PER_LONG, bits);
> > + KUNIT_EXPECT_KASAN_FAIL(test, __set_bit(BITS_PER_LONG, bits));
> >
> > - pr_info("out-of-bounds in clear_bit\n");
> > - clear_bit(BITS_PER_LONG, bits);
> > + KUNIT_EXPECT_KASAN_FAIL(test, clear_bit(BITS_PER_LONG, bits));
> >
> > - pr_info("out-of-bounds in __clear_bit\n");
> > - __clear_bit(BITS_PER_LONG, bits);
> > + KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit(BITS_PER_LONG, bits));
> >
> > - pr_info("out-of-bounds in clear_bit_unlock\n");
> > - clear_bit_unlock(BITS_PER_LONG, bits);
> > + KUNIT_EXPECT_KASAN_FAIL(test, clear_bit_unlock(BITS_PER_LONG, bits));
> >
> > - pr_info("out-of-bounds in __clear_bit_unlock\n");
> > - __clear_bit_unlock(BITS_PER_LONG, bits);
> > + KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit_unlock(BITS_PER_LONG, bits));
> >
> > - pr_info("out-of-bounds in change_bit\n");
> > - change_bit(BITS_PER_LONG, bits);
> > + KUNIT_EXPECT_KASAN_FAIL(test, change_bit(BITS_PER_LONG, bits));
> >
> > - pr_info("out-of-bounds in __change_bit\n");
> > - __change_bit(BITS_PER_LONG, bits);
> > + KUNIT_EXPECT_KASAN_FAIL(test, __change_bit(BITS_PER_LONG, bits));
> >
> > /*
> > * Below calls try to access bit beyond allocated memory.
> > */
> > - pr_info("out-of-bounds in test_and_set_bit\n");
> > - test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
> > + KUNIT_EXPECT_KASAN_FAIL(test,
> > + test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
> >
> > - pr_info("out-of-bounds in __test_and_set_bit\n");
> > - __test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
> > + KUNIT_EXPECT_KASAN_FAIL(test,
> > + __test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
> >
> > - pr_info("out-of-bounds in test_and_set_bit_lock\n");
> > - test_and_set_bit_lock(BITS_PER_LONG + BITS_PER_BYTE, bits);
> > + KUNIT_EXPECT_KASAN_FAIL(test,
> > + test_and_set_bit_lock(BITS_PER_LONG + BITS_PER_BYTE, bits));
> >
> > - pr_info("out-of-bounds in test_and_clear_bit\n");
> > - test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
> > + KUNIT_EXPECT_KASAN_FAIL(test,
> > + test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
> >
> > - pr_info("out-of-bounds in __test_and_clear_bit\n");
> > - __test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
> > + KUNIT_EXPECT_KASAN_FAIL(test,
> > + __test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
> >
> > - pr_info("out-of-bounds in test_and_change_bit\n");
> > - test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
> > + KUNIT_EXPECT_KASAN_FAIL(test,
> > + test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
> >
> > - pr_info("out-of-bounds in __test_and_change_bit\n");
> > - __test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
> > + KUNIT_EXPECT_KASAN_FAIL(test,
> > + __test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
> >
> > - pr_info("out-of-bounds in test_bit\n");
> > - (void)test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
> > + KUNIT_EXPECT_KASAN_FAIL(test,
> > + (void)test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
> >
> > #if defined(clear_bit_unlock_is_negative_byte)
> > - pr_info("out-of-bounds in clear_bit_unlock_is_negative_byte\n");
> > - clear_bit_unlock_is_negative_byte(BITS_PER_LONG + BITS_PER_BYTE, bits);
> > + KUNIT_EXPECT_KASAN_FAIL(test,
> > + clear_bit_unlock_is_negative_byte(BITS_PER_LONG + BITS_PER_BYTE,
> > + bits));
> > #endif
> > kfree(bits);
> > }
> >
> > -static noinline void __init kmalloc_double_kzfree(void)
> > +static void kmalloc_double_kzfree(struct kunit *test)
> > {
> > char *ptr;
> > size_t size = 16;
> >
> > - pr_info("double-free (kzfree)\n");
> > ptr = kmalloc(size, GFP_KERNEL);
> > - if (!ptr) {
> > - pr_err("Allocation failed\n");
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> >
> > kzfree(ptr);
> > - kzfree(ptr);
> > + KUNIT_EXPECT_KASAN_FAIL(test, kzfree(ptr));
> > }
> >
> > -#ifdef CONFIG_KASAN_VMALLOC
> > -static noinline void __init vmalloc_oob(void)
> > +static void vmalloc_oob(struct kunit *test)
> > {
> > void *area;
> >
> > - pr_info("vmalloc out-of-bounds\n");
> > + if (!IS_ENABLED(CONFIG_KASAN_VMALLOC)) {
> > + kunit_info(test, "CONFIG_KASAN_VMALLOC is not enabled.");
> > + return;
> > + }
> >
> > /*
> > * We have to be careful not to hit the guard page.
> > * The MMU will catch that and crash us.
> > */
> > area = vmalloc(3000);
> > - if (!area) {
> > - pr_err("Allocation failed\n");
> > - return;
> > - }
> > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, area);
> >
> > - ((volatile char *)area)[3100];
> > + KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)area)[3100]);
> > vfree(area);
> > }
> > -#else
> > -static void __init vmalloc_oob(void) {}
> > -#endif
> >
> > -static int __init kmalloc_tests_init(void)
> > -{
> > - /*
> > - * Temporarily enable multi-shot mode. Otherwise, we'd only get a
> > - * report for the first case.
> > - */
> > - bool multishot = kasan_save_enable_multi_shot();
> > -
> > - kmalloc_oob_right();
> > - kmalloc_oob_left();
> > - kmalloc_node_oob_right();
> > -#ifdef CONFIG_SLUB
> > - kmalloc_pagealloc_oob_right();
> > - kmalloc_pagealloc_uaf();
> > - kmalloc_pagealloc_invalid_free();
> > -#endif
> > - kmalloc_large_oob_right();
> > - kmalloc_oob_krealloc_more();
> > - kmalloc_oob_krealloc_less();
> > - kmalloc_oob_16();
> > - kmalloc_oob_in_memset();
> > - kmalloc_oob_memset_2();
> > - kmalloc_oob_memset_4();
> > - kmalloc_oob_memset_8();
> > - kmalloc_oob_memset_16();
> > - kmalloc_uaf();
> > - kmalloc_uaf_memset();
> > - kmalloc_uaf2();
> > - kfree_via_page();
> > - kfree_via_phys();
> > - kmem_cache_oob();
> > - memcg_accounted_kmem_cache();
> > - kasan_stack_oob();
> > - kasan_global_oob();
> > - kasan_alloca_oob_left();
> > - kasan_alloca_oob_right();
> > - ksize_unpoisons_memory();
> > - copy_user_test();
> > - kmem_cache_double_free();
> > - kmem_cache_invalid_free();
> > - kasan_memchr();
> > - kasan_memcmp();
> > - kasan_strings();
> > - kasan_bitops();
> > - kmalloc_double_kzfree();
> > - vmalloc_oob();
> > -
> > - kasan_restore_multi_shot(multishot);
> > -
> > - return -EAGAIN;
> > -}
> > +static struct kunit_case kasan_kunit_test_cases[] = {
> > + KUNIT_CASE(kmalloc_oob_right),
> > + KUNIT_CASE(kmalloc_oob_left),
> > + KUNIT_CASE(kmalloc_node_oob_right),
> > + KUNIT_CASE(kmalloc_pagealloc_oob_right),
> > + KUNIT_CASE(kmalloc_pagealloc_uaf),
> > + KUNIT_CASE(kmalloc_pagealloc_invalid_free),
> > + KUNIT_CASE(kmalloc_large_oob_right),
> > + KUNIT_CASE(kmalloc_oob_krealloc_more),
> > + KUNIT_CASE(kmalloc_oob_krealloc_less),
> > + KUNIT_CASE(kmalloc_oob_16),
> > + KUNIT_CASE(kmalloc_oob_in_memset),
> > + KUNIT_CASE(kmalloc_oob_memset_2),
> > + KUNIT_CASE(kmalloc_oob_memset_4),
> > + KUNIT_CASE(kmalloc_oob_memset_8),
> > + KUNIT_CASE(kmalloc_oob_memset_16),
> > + KUNIT_CASE(kmalloc_uaf),
> > + KUNIT_CASE(kmalloc_uaf_memset),
> > + KUNIT_CASE(kmalloc_uaf2),
> > + KUNIT_CASE(kfree_via_page),
> > + KUNIT_CASE(kfree_via_phys),
> > + KUNIT_CASE(kmem_cache_oob),
> > + KUNIT_CASE(memcg_accounted_kmem_cache),
> > + KUNIT_CASE(kasan_global_oob),
> > + KUNIT_CASE(kasan_stack_oob),
> > + KUNIT_CASE(kasan_alloca_oob_left),
> > + KUNIT_CASE(kasan_alloca_oob_right),
> > + KUNIT_CASE(ksize_unpoisons_memory),
> > + KUNIT_CASE(kmem_cache_double_free),
> > + KUNIT_CASE(kmem_cache_invalid_free),
> > + KUNIT_CASE(kasan_memchr),
> > + KUNIT_CASE(kasan_memcmp),
> > + KUNIT_CASE(kasan_strings),
> > + KUNIT_CASE(kasan_bitops),
> > + KUNIT_CASE(kmalloc_double_kzfree),
> > + KUNIT_CASE(vmalloc_oob),
> > + {}
> > +};
> > +
> > +static struct kunit_suite kasan_kunit_test_suite = {
> > + .name = "kasan_kunit_test",
> > + .init = kasan_test_init,
> > + .test_cases = kasan_kunit_test_cases,
> > + .exit = kasan_test_exit,
> > +};
> > +
> > +kunit_test_suite(kasan_kunit_test_suite);
> >
> > -module_init(kmalloc_tests_init);
> > MODULE_LICENSE("GPL");
> > diff --git a/lib/test_kasan_module.c b/lib/test_kasan_module.c
> > new file mode 100644
> > index 000000000000..87d7e4d8fc31
> > --- /dev/null
> > +++ b/lib/test_kasan_module.c
> > @@ -0,0 +1,76 @@
> > +// SPDX-License-Identifier: GPL-2.0-only
> > +/*
> > + *
> > + * Copyright (c) 2014 Samsung Electronics Co., Ltd.
> > + * Author: Andrey Ryabinin <[email protected]>
> > + */
> > +
> > +#define pr_fmt(fmt) "kasan test: %s " fmt, __func__
> > +
> > +#include <linux/mman.h>
> > +#include <linux/module.h>
> > +#include <linux/printk.h>
> > +#include <linux/slab.h>
> > +#include <linux/uaccess.h>
> > +
> > +static noinline void __init copy_user_test(void)
> > +{
> > + char *kmem;
> > + char __user *usermem;
> > + size_t size = 10;
> > + int unused;
> > +
> > + kmem = kmalloc(size, GFP_KERNEL);
> > + if (!kmem)
> > + return;
> > +
> > + usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE,
> > + PROT_READ | PROT_WRITE | PROT_EXEC,
> > + MAP_ANONYMOUS | MAP_PRIVATE, 0);
> > + if (IS_ERR(usermem)) {
> > + pr_err("Failed to allocate user memory\n");
> > + kfree(kmem);
> > + return;
> > + }
> > +
> > + pr_info("out-of-bounds in copy_from_user()\n");
> > + unused = copy_from_user(kmem, usermem, size + 1);
> > +
> > + pr_info("out-of-bounds in copy_to_user()\n");
> > + unused = copy_to_user(usermem, kmem, size + 1);
> > +
> > + pr_info("out-of-bounds in __copy_from_user()\n");
> > + unused = __copy_from_user(kmem, usermem, size + 1);
> > +
> > + pr_info("out-of-bounds in __copy_to_user()\n");
> > + unused = __copy_to_user(usermem, kmem, size + 1);
> > +
> > + pr_info("out-of-bounds in __copy_from_user_inatomic()\n");
> > + unused = __copy_from_user_inatomic(kmem, usermem, size + 1);
> > +
> > + pr_info("out-of-bounds in __copy_to_user_inatomic()\n");
> > + unused = __copy_to_user_inatomic(usermem, kmem, size + 1);
> > +
> > + pr_info("out-of-bounds in strncpy_from_user()\n");
> > + unused = strncpy_from_user(kmem, usermem, size + 1);
> > +
> > + vm_munmap((unsigned long)usermem, PAGE_SIZE);
> > + kfree(kmem);
> > +}
> > +
> > +static int __init test_kasan_module_init(void)
> > +{
> > + /*
> > + * Temporarily enable multi-shot mode. Otherwise, we'd only get a
> > + * report for the first case.
> > + */
> > + bool multishot = kasan_save_enable_multi_shot();
> > +
> > + copy_user_test();
> > +
> > + kasan_restore_multi_shot(multishot);
> > + return -EAGAIN;
> > +}
> > +
> > +module_init(test_kasan_module_init);
> > +MODULE_LICENSE("GPL");
> > --
> > 2.26.0.110.g2183baf09c-goog
> >
> > --
> > You received this message because you are subscribed to the Google Groups "kasan-dev" group.
> > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
> > To view this discussion on the web visit https://groups.google.com/d/msgid/kasan-dev/20200414031647.124664-4-davidgow%40google.com.
Thanks for looking over this (and the other patches). I've made the
suggested changes, and will send out a v6 with in the next day or so.
Cheers,
-- David