]>
Commit | Line | Data |
---|---|---|
d2912cb1 | 1 | // SPDX-License-Identifier: GPL-2.0-only |
3f15801c AR |
2 | /* |
3 | * | |
4 | * Copyright (c) 2014 Samsung Electronics Co., Ltd. | |
5 | * Author: Andrey Ryabinin <a.ryabinin@samsung.com> | |
3f15801c AR |
6 | */ |
7 | ||
19a33ca6 | 8 | #include <linux/bitops.h> |
0386bf38 | 9 | #include <linux/delay.h> |
19a33ca6 | 10 | #include <linux/kasan.h> |
3f15801c | 11 | #include <linux/kernel.h> |
eae08dca | 12 | #include <linux/mm.h> |
19a33ca6 ME |
13 | #include <linux/mman.h> |
14 | #include <linux/module.h> | |
3f15801c AR |
15 | #include <linux/printk.h> |
16 | #include <linux/slab.h> | |
17 | #include <linux/string.h> | |
eae08dca | 18 | #include <linux/uaccess.h> |
b92a953c | 19 | #include <linux/io.h> |
06513916 | 20 | #include <linux/vmalloc.h> |
b92a953c MR |
21 | |
22 | #include <asm/page.h> | |
3f15801c | 23 | |
83c4e7a0 PA |
24 | #include <kunit/test.h> |
25 | ||
f33a0149 WW |
26 | #include "../mm/kasan/kasan.h" |
27 | ||
28 | #define OOB_TAG_OFF (IS_ENABLED(CONFIG_KASAN_GENERIC) ? 0 : KASAN_SHADOW_SCALE_SIZE) | |
29 | ||
adb72ae1 DA |
30 | /* |
31 | * We assign some test results to these globals to make sure the tests | |
32 | * are not eliminated as dead code. | |
33 | */ | |
34 | ||
adb72ae1 | 35 | void *kasan_ptr_result; |
83c4e7a0 PA |
36 | int kasan_int_result; |
37 | ||
38 | static struct kunit_resource resource; | |
39 | static struct kunit_kasan_expectation fail_data; | |
40 | static bool multishot; | |
41 | ||
42 | static int kasan_test_init(struct kunit *test) | |
43 | { | |
44 | /* | |
45 | * Temporarily enable multi-shot mode and set panic_on_warn=0. | |
46 | * Otherwise, we'd only get a report for the first case. | |
47 | */ | |
48 | multishot = kasan_save_enable_multi_shot(); | |
49 | ||
50 | return 0; | |
51 | } | |
52 | ||
53 | static void kasan_test_exit(struct kunit *test) | |
54 | { | |
55 | kasan_restore_multi_shot(multishot); | |
56 | } | |
57 | ||
58 | /** | |
59 | * KUNIT_EXPECT_KASAN_FAIL() - Causes a test failure when the expression does | |
60 | * not cause a KASAN error. This uses a KUnit resource named "kasan_data." Do | |
61 | * Do not use this name for a KUnit resource outside here. | |
62 | * | |
63 | */ | |
64 | #define KUNIT_EXPECT_KASAN_FAIL(test, condition) do { \ | |
65 | fail_data.report_expected = true; \ | |
66 | fail_data.report_found = false; \ | |
67 | kunit_add_named_resource(test, \ | |
68 | NULL, \ | |
69 | NULL, \ | |
70 | &resource, \ | |
71 | "kasan_data", &fail_data); \ | |
72 | condition; \ | |
73 | KUNIT_EXPECT_EQ(test, \ | |
74 | fail_data.report_expected, \ | |
75 | fail_data.report_found); \ | |
76 | } while (0) | |
77 | ||
73228c7e | 78 | static void kmalloc_oob_right(struct kunit *test) |
3f15801c AR |
79 | { |
80 | char *ptr; | |
81 | size_t size = 123; | |
82 | ||
3f15801c | 83 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 84 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
f33a0149 | 85 | |
73228c7e | 86 | KUNIT_EXPECT_KASAN_FAIL(test, ptr[size + OOB_TAG_OFF] = 'x'); |
3f15801c AR |
87 | kfree(ptr); |
88 | } | |
89 | ||
73228c7e | 90 | static void kmalloc_oob_left(struct kunit *test) |
3f15801c AR |
91 | { |
92 | char *ptr; | |
93 | size_t size = 15; | |
94 | ||
3f15801c | 95 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 96 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
3f15801c | 97 | |
73228c7e | 98 | KUNIT_EXPECT_KASAN_FAIL(test, *ptr = *(ptr - 1)); |
3f15801c AR |
99 | kfree(ptr); |
100 | } | |
101 | ||
73228c7e | 102 | static void kmalloc_node_oob_right(struct kunit *test) |
3f15801c AR |
103 | { |
104 | char *ptr; | |
105 | size_t size = 4096; | |
106 | ||
3f15801c | 107 | ptr = kmalloc_node(size, GFP_KERNEL, 0); |
73228c7e | 108 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
3f15801c | 109 | |
73228c7e | 110 | KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0); |
3f15801c AR |
111 | kfree(ptr); |
112 | } | |
113 | ||
73228c7e | 114 | static void kmalloc_pagealloc_oob_right(struct kunit *test) |
3f15801c AR |
115 | { |
116 | char *ptr; | |
117 | size_t size = KMALLOC_MAX_CACHE_SIZE + 10; | |
118 | ||
73228c7e PA |
119 | if (!IS_ENABLED(CONFIG_SLUB)) { |
120 | kunit_info(test, "CONFIG_SLUB is not enabled."); | |
121 | return; | |
122 | } | |
123 | ||
e6e8379c AP |
124 | /* Allocate a chunk that does not fit into a SLUB cache to trigger |
125 | * the page allocator fallback. | |
126 | */ | |
e6e8379c | 127 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 128 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
f33a0149 | 129 | |
73228c7e | 130 | KUNIT_EXPECT_KASAN_FAIL(test, ptr[size + OOB_TAG_OFF] = 0); |
e6e8379c AP |
131 | kfree(ptr); |
132 | } | |
47adccce | 133 | |
73228c7e | 134 | static void kmalloc_pagealloc_uaf(struct kunit *test) |
47adccce DV |
135 | { |
136 | char *ptr; | |
137 | size_t size = KMALLOC_MAX_CACHE_SIZE + 10; | |
138 | ||
73228c7e PA |
139 | if (!IS_ENABLED(CONFIG_SLUB)) { |
140 | kunit_info(test, "CONFIG_SLUB is not enabled."); | |
47adccce DV |
141 | return; |
142 | } | |
143 | ||
73228c7e PA |
144 | ptr = kmalloc(size, GFP_KERNEL); |
145 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
146 | ||
47adccce | 147 | kfree(ptr); |
73228c7e | 148 | KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = 0); |
47adccce DV |
149 | } |
150 | ||
73228c7e | 151 | static void kmalloc_pagealloc_invalid_free(struct kunit *test) |
47adccce DV |
152 | { |
153 | char *ptr; | |
154 | size_t size = KMALLOC_MAX_CACHE_SIZE + 10; | |
155 | ||
73228c7e PA |
156 | if (!IS_ENABLED(CONFIG_SLUB)) { |
157 | kunit_info(test, "CONFIG_SLUB is not enabled."); | |
47adccce DV |
158 | return; |
159 | } | |
160 | ||
73228c7e PA |
161 | ptr = kmalloc(size, GFP_KERNEL); |
162 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
163 | ||
164 | KUNIT_EXPECT_KASAN_FAIL(test, kfree(ptr + 1)); | |
47adccce | 165 | } |
e6e8379c | 166 | |
73228c7e | 167 | static void kmalloc_large_oob_right(struct kunit *test) |
e6e8379c AP |
168 | { |
169 | char *ptr; | |
170 | size_t size = KMALLOC_MAX_CACHE_SIZE - 256; | |
171 | /* Allocate a chunk that is large enough, but still fits into a slab | |
172 | * and does not trigger the page allocator fallback in SLUB. | |
173 | */ | |
3f15801c | 174 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 175 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
3f15801c | 176 | |
73228c7e | 177 | KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0); |
3f15801c AR |
178 | kfree(ptr); |
179 | } | |
180 | ||
73228c7e | 181 | static void kmalloc_oob_krealloc_more(struct kunit *test) |
3f15801c AR |
182 | { |
183 | char *ptr1, *ptr2; | |
184 | size_t size1 = 17; | |
185 | size_t size2 = 19; | |
186 | ||
3f15801c | 187 | ptr1 = kmalloc(size1, GFP_KERNEL); |
73228c7e | 188 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); |
3f15801c | 189 | |
73228c7e PA |
190 | ptr2 = krealloc(ptr1, size2, GFP_KERNEL); |
191 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); | |
f33a0149 | 192 | |
73228c7e | 193 | KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size2 + OOB_TAG_OFF] = 'x'); |
3f15801c AR |
194 | kfree(ptr2); |
195 | } | |
196 | ||
73228c7e | 197 | static void kmalloc_oob_krealloc_less(struct kunit *test) |
3f15801c AR |
198 | { |
199 | char *ptr1, *ptr2; | |
200 | size_t size1 = 17; | |
201 | size_t size2 = 15; | |
202 | ||
3f15801c | 203 | ptr1 = kmalloc(size1, GFP_KERNEL); |
73228c7e | 204 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); |
f33a0149 | 205 | |
73228c7e PA |
206 | ptr2 = krealloc(ptr1, size2, GFP_KERNEL); |
207 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); | |
f33a0149 | 208 | |
73228c7e | 209 | KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size2 + OOB_TAG_OFF] = 'x'); |
3f15801c AR |
210 | kfree(ptr2); |
211 | } | |
212 | ||
73228c7e | 213 | static void kmalloc_oob_16(struct kunit *test) |
3f15801c AR |
214 | { |
215 | struct { | |
216 | u64 words[2]; | |
217 | } *ptr1, *ptr2; | |
218 | ||
3f15801c | 219 | ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL); |
73228c7e PA |
220 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); |
221 | ||
3f15801c | 222 | ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL); |
73228c7e PA |
223 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); |
224 | ||
225 | KUNIT_EXPECT_KASAN_FAIL(test, *ptr1 = *ptr2); | |
3f15801c AR |
226 | kfree(ptr1); |
227 | kfree(ptr2); | |
228 | } | |
229 | ||
73228c7e | 230 | static void kmalloc_oob_memset_2(struct kunit *test) |
f523e737 WL |
231 | { |
232 | char *ptr; | |
233 | size_t size = 8; | |
234 | ||
f523e737 | 235 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 236 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
f33a0149 | 237 | |
73228c7e | 238 | KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + 7 + OOB_TAG_OFF, 0, 2)); |
f523e737 WL |
239 | kfree(ptr); |
240 | } | |
241 | ||
73228c7e | 242 | static void kmalloc_oob_memset_4(struct kunit *test) |
f523e737 WL |
243 | { |
244 | char *ptr; | |
245 | size_t size = 8; | |
246 | ||
f523e737 | 247 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 248 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
f33a0149 | 249 | |
73228c7e | 250 | KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + 5 + OOB_TAG_OFF, 0, 4)); |
f523e737 WL |
251 | kfree(ptr); |
252 | } | |
253 | ||
254 | ||
73228c7e | 255 | static void kmalloc_oob_memset_8(struct kunit *test) |
f523e737 WL |
256 | { |
257 | char *ptr; | |
258 | size_t size = 8; | |
259 | ||
f523e737 | 260 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 261 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
f33a0149 | 262 | |
73228c7e | 263 | KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + 1 + OOB_TAG_OFF, 0, 8)); |
f523e737 WL |
264 | kfree(ptr); |
265 | } | |
266 | ||
73228c7e | 267 | static void kmalloc_oob_memset_16(struct kunit *test) |
f523e737 WL |
268 | { |
269 | char *ptr; | |
270 | size_t size = 16; | |
271 | ||
f523e737 | 272 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 273 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
f33a0149 | 274 | |
73228c7e | 275 | KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + 1 + OOB_TAG_OFF, 0, 16)); |
f523e737 WL |
276 | kfree(ptr); |
277 | } | |
278 | ||
73228c7e | 279 | static void kmalloc_oob_in_memset(struct kunit *test) |
3f15801c AR |
280 | { |
281 | char *ptr; | |
282 | size_t size = 666; | |
283 | ||
3f15801c | 284 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 285 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
f33a0149 | 286 | |
73228c7e | 287 | KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr, 0, size + 5 + OOB_TAG_OFF)); |
3f15801c AR |
288 | kfree(ptr); |
289 | } | |
290 | ||
73228c7e | 291 | static void kmalloc_memmove_invalid_size(struct kunit *test) |
98f3b56f WW |
292 | { |
293 | char *ptr; | |
294 | size_t size = 64; | |
295 | volatile size_t invalid_size = -2; | |
296 | ||
98f3b56f | 297 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 298 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
98f3b56f WW |
299 | |
300 | memset((char *)ptr, 0, 64); | |
73228c7e PA |
301 | |
302 | KUNIT_EXPECT_KASAN_FAIL(test, | |
303 | memmove((char *)ptr, (char *)ptr + 4, invalid_size)); | |
98f3b56f WW |
304 | kfree(ptr); |
305 | } | |
306 | ||
73228c7e | 307 | static void kmalloc_uaf(struct kunit *test) |
3f15801c AR |
308 | { |
309 | char *ptr; | |
310 | size_t size = 10; | |
311 | ||
3f15801c | 312 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 313 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
3f15801c AR |
314 | |
315 | kfree(ptr); | |
73228c7e | 316 | KUNIT_EXPECT_KASAN_FAIL(test, *(ptr + 8) = 'x'); |
3f15801c AR |
317 | } |
318 | ||
73228c7e | 319 | static void kmalloc_uaf_memset(struct kunit *test) |
3f15801c AR |
320 | { |
321 | char *ptr; | |
322 | size_t size = 33; | |
323 | ||
3f15801c | 324 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 325 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
3f15801c AR |
326 | |
327 | kfree(ptr); | |
73228c7e | 328 | KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr, 0, size)); |
3f15801c AR |
329 | } |
330 | ||
73228c7e | 331 | static void kmalloc_uaf2(struct kunit *test) |
3f15801c AR |
332 | { |
333 | char *ptr1, *ptr2; | |
334 | size_t size = 43; | |
335 | ||
3f15801c | 336 | ptr1 = kmalloc(size, GFP_KERNEL); |
73228c7e | 337 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); |
3f15801c AR |
338 | |
339 | kfree(ptr1); | |
73228c7e | 340 | |
3f15801c | 341 | ptr2 = kmalloc(size, GFP_KERNEL); |
73228c7e PA |
342 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); |
343 | ||
344 | KUNIT_EXPECT_KASAN_FAIL(test, ptr1[40] = 'x'); | |
345 | KUNIT_EXPECT_PTR_NE(test, ptr1, ptr2); | |
3f15801c | 346 | |
3f15801c AR |
347 | kfree(ptr2); |
348 | } | |
349 | ||
73228c7e | 350 | static void kfree_via_page(struct kunit *test) |
b92a953c MR |
351 | { |
352 | char *ptr; | |
353 | size_t size = 8; | |
354 | struct page *page; | |
355 | unsigned long offset; | |
356 | ||
b92a953c | 357 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 358 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
b92a953c MR |
359 | |
360 | page = virt_to_page(ptr); | |
361 | offset = offset_in_page(ptr); | |
362 | kfree(page_address(page) + offset); | |
363 | } | |
364 | ||
73228c7e | 365 | static void kfree_via_phys(struct kunit *test) |
b92a953c MR |
366 | { |
367 | char *ptr; | |
368 | size_t size = 8; | |
369 | phys_addr_t phys; | |
370 | ||
b92a953c | 371 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 372 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
b92a953c MR |
373 | |
374 | phys = virt_to_phys(ptr); | |
375 | kfree(phys_to_virt(phys)); | |
376 | } | |
377 | ||
73228c7e | 378 | static void kmem_cache_oob(struct kunit *test) |
3f15801c AR |
379 | { |
380 | char *p; | |
381 | size_t size = 200; | |
382 | struct kmem_cache *cache = kmem_cache_create("test_cache", | |
383 | size, 0, | |
384 | 0, NULL); | |
73228c7e | 385 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); |
3f15801c AR |
386 | p = kmem_cache_alloc(cache, GFP_KERNEL); |
387 | if (!p) { | |
73228c7e | 388 | kunit_err(test, "Allocation failed: %s\n", __func__); |
3f15801c AR |
389 | kmem_cache_destroy(cache); |
390 | return; | |
391 | } | |
392 | ||
73228c7e | 393 | KUNIT_EXPECT_KASAN_FAIL(test, *p = p[size + OOB_TAG_OFF]); |
3f15801c AR |
394 | kmem_cache_free(cache, p); |
395 | kmem_cache_destroy(cache); | |
396 | } | |
397 | ||
73228c7e | 398 | static void memcg_accounted_kmem_cache(struct kunit *test) |
0386bf38 GT |
399 | { |
400 | int i; | |
401 | char *p; | |
402 | size_t size = 200; | |
403 | struct kmem_cache *cache; | |
404 | ||
405 | cache = kmem_cache_create("test_cache", size, 0, SLAB_ACCOUNT, NULL); | |
73228c7e | 406 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); |
0386bf38 | 407 | |
0386bf38 GT |
408 | /* |
409 | * Several allocations with a delay to allow for lazy per memcg kmem | |
410 | * cache creation. | |
411 | */ | |
412 | for (i = 0; i < 5; i++) { | |
413 | p = kmem_cache_alloc(cache, GFP_KERNEL); | |
dc2bf000 | 414 | if (!p) |
0386bf38 | 415 | goto free_cache; |
dc2bf000 | 416 | |
0386bf38 GT |
417 | kmem_cache_free(cache, p); |
418 | msleep(100); | |
419 | } | |
420 | ||
421 | free_cache: | |
422 | kmem_cache_destroy(cache); | |
423 | } | |
424 | ||
3f15801c AR |
425 | static char global_array[10]; |
426 | ||
73228c7e | 427 | static void kasan_global_oob(struct kunit *test) |
3f15801c AR |
428 | { |
429 | volatile int i = 3; | |
430 | char *p = &global_array[ARRAY_SIZE(global_array) + i]; | |
431 | ||
73228c7e | 432 | KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); |
3f15801c AR |
433 | } |
434 | ||
73228c7e | 435 | static void ksize_unpoisons_memory(struct kunit *test) |
96fe805f AP |
436 | { |
437 | char *ptr; | |
48c23239 | 438 | size_t size = 123, real_size; |
96fe805f | 439 | |
96fe805f | 440 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 441 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
96fe805f AP |
442 | real_size = ksize(ptr); |
443 | /* This access doesn't trigger an error. */ | |
444 | ptr[size] = 'x'; | |
445 | /* This one does. */ | |
73228c7e | 446 | KUNIT_EXPECT_KASAN_FAIL(test, ptr[real_size] = 'y'); |
96fe805f AP |
447 | kfree(ptr); |
448 | } | |
449 | ||
73228c7e | 450 | static void kasan_stack_oob(struct kunit *test) |
eae08dca | 451 | { |
73228c7e PA |
452 | char stack_array[10]; |
453 | volatile int i = OOB_TAG_OFF; | |
454 | char *p = &stack_array[ARRAY_SIZE(stack_array) + i]; | |
eae08dca | 455 | |
73228c7e PA |
456 | if (!IS_ENABLED(CONFIG_KASAN_STACK)) { |
457 | kunit_info(test, "CONFIG_KASAN_STACK is not enabled"); | |
eae08dca AR |
458 | return; |
459 | } | |
460 | ||
73228c7e | 461 | KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); |
eae08dca AR |
462 | } |
463 | ||
73228c7e | 464 | static void kasan_alloca_oob_left(struct kunit *test) |
00a14294 PL |
465 | { |
466 | volatile int i = 10; | |
467 | char alloca_array[i]; | |
468 | char *p = alloca_array - 1; | |
469 | ||
73228c7e PA |
470 | if (!IS_ENABLED(CONFIG_KASAN_STACK)) { |
471 | kunit_info(test, "CONFIG_KASAN_STACK is not enabled"); | |
472 | return; | |
473 | } | |
474 | ||
475 | KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); | |
00a14294 PL |
476 | } |
477 | ||
73228c7e | 478 | static void kasan_alloca_oob_right(struct kunit *test) |
00a14294 PL |
479 | { |
480 | volatile int i = 10; | |
481 | char alloca_array[i]; | |
482 | char *p = alloca_array + i; | |
483 | ||
73228c7e PA |
484 | if (!IS_ENABLED(CONFIG_KASAN_STACK)) { |
485 | kunit_info(test, "CONFIG_KASAN_STACK is not enabled"); | |
486 | return; | |
487 | } | |
488 | ||
489 | KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); | |
00a14294 PL |
490 | } |
491 | ||
73228c7e | 492 | static void kmem_cache_double_free(struct kunit *test) |
b1d57289 DV |
493 | { |
494 | char *p; | |
495 | size_t size = 200; | |
496 | struct kmem_cache *cache; | |
497 | ||
498 | cache = kmem_cache_create("test_cache", size, 0, 0, NULL); | |
73228c7e PA |
499 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); |
500 | ||
b1d57289 DV |
501 | p = kmem_cache_alloc(cache, GFP_KERNEL); |
502 | if (!p) { | |
73228c7e | 503 | kunit_err(test, "Allocation failed: %s\n", __func__); |
b1d57289 DV |
504 | kmem_cache_destroy(cache); |
505 | return; | |
506 | } | |
507 | ||
508 | kmem_cache_free(cache, p); | |
73228c7e | 509 | KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p)); |
b1d57289 DV |
510 | kmem_cache_destroy(cache); |
511 | } | |
512 | ||
73228c7e | 513 | static void kmem_cache_invalid_free(struct kunit *test) |
b1d57289 DV |
514 | { |
515 | char *p; | |
516 | size_t size = 200; | |
517 | struct kmem_cache *cache; | |
518 | ||
519 | cache = kmem_cache_create("test_cache", size, 0, SLAB_TYPESAFE_BY_RCU, | |
520 | NULL); | |
73228c7e PA |
521 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); |
522 | ||
b1d57289 DV |
523 | p = kmem_cache_alloc(cache, GFP_KERNEL); |
524 | if (!p) { | |
73228c7e | 525 | kunit_err(test, "Allocation failed: %s\n", __func__); |
b1d57289 DV |
526 | kmem_cache_destroy(cache); |
527 | return; | |
528 | } | |
529 | ||
91c93ed0 | 530 | /* Trigger invalid free, the object doesn't get freed */ |
73228c7e | 531 | KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p + 1)); |
91c93ed0 AK |
532 | |
533 | /* | |
534 | * Properly free the object to prevent the "Objects remaining in | |
535 | * test_cache on __kmem_cache_shutdown" BUG failure. | |
536 | */ | |
537 | kmem_cache_free(cache, p); | |
538 | ||
b1d57289 DV |
539 | kmem_cache_destroy(cache); |
540 | } | |
541 | ||
73228c7e | 542 | static void kasan_memchr(struct kunit *test) |
0c96350a AR |
543 | { |
544 | char *ptr; | |
545 | size_t size = 24; | |
546 | ||
73228c7e PA |
547 | /* See https://bugzilla.kernel.org/show_bug.cgi?id=206337 */ |
548 | if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) { | |
549 | kunit_info(test, | |
550 | "str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT"); | |
0c96350a | 551 | return; |
73228c7e PA |
552 | } |
553 | ||
554 | ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO); | |
555 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
556 | ||
557 | KUNIT_EXPECT_KASAN_FAIL(test, | |
558 | kasan_ptr_result = memchr(ptr, '1', size + 1)); | |
0c96350a | 559 | |
0c96350a AR |
560 | kfree(ptr); |
561 | } | |
562 | ||
73228c7e | 563 | static void kasan_memcmp(struct kunit *test) |
0c96350a AR |
564 | { |
565 | char *ptr; | |
566 | size_t size = 24; | |
567 | int arr[9]; | |
568 | ||
73228c7e PA |
569 | /* See https://bugzilla.kernel.org/show_bug.cgi?id=206337 */ |
570 | if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) { | |
571 | kunit_info(test, | |
572 | "str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT"); | |
0c96350a | 573 | return; |
73228c7e | 574 | } |
0c96350a | 575 | |
73228c7e PA |
576 | ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO); |
577 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
0c96350a | 578 | memset(arr, 0, sizeof(arr)); |
73228c7e PA |
579 | |
580 | KUNIT_EXPECT_KASAN_FAIL(test, | |
581 | kasan_int_result = memcmp(ptr, arr, size+1)); | |
0c96350a AR |
582 | kfree(ptr); |
583 | } | |
584 | ||
73228c7e | 585 | static void kasan_strings(struct kunit *test) |
0c96350a AR |
586 | { |
587 | char *ptr; | |
588 | size_t size = 24; | |
589 | ||
73228c7e PA |
590 | /* See https://bugzilla.kernel.org/show_bug.cgi?id=206337 */ |
591 | if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) { | |
592 | kunit_info(test, | |
593 | "str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT"); | |
0c96350a | 594 | return; |
73228c7e PA |
595 | } |
596 | ||
597 | ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO); | |
598 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
0c96350a AR |
599 | |
600 | kfree(ptr); | |
601 | ||
602 | /* | |
603 | * Try to cause only 1 invalid access (less spam in dmesg). | |
604 | * For that we need ptr to point to zeroed byte. | |
605 | * Skip metadata that could be stored in freed object so ptr | |
606 | * will likely point to zeroed byte. | |
607 | */ | |
608 | ptr += 16; | |
73228c7e | 609 | KUNIT_EXPECT_KASAN_FAIL(test, kasan_ptr_result = strchr(ptr, '1')); |
0c96350a | 610 | |
73228c7e | 611 | KUNIT_EXPECT_KASAN_FAIL(test, kasan_ptr_result = strrchr(ptr, '1')); |
0c96350a | 612 | |
73228c7e | 613 | KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strcmp(ptr, "2")); |
0c96350a | 614 | |
73228c7e | 615 | KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strncmp(ptr, "2", 1)); |
0c96350a | 616 | |
73228c7e | 617 | KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strlen(ptr)); |
0c96350a | 618 | |
73228c7e | 619 | KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strnlen(ptr, 1)); |
0c96350a AR |
620 | } |
621 | ||
73228c7e | 622 | static void kasan_bitops(struct kunit *test) |
19a33ca6 ME |
623 | { |
624 | /* | |
625 | * Allocate 1 more byte, which causes kzalloc to round up to 16-bytes; | |
626 | * this way we do not actually corrupt other memory. | |
627 | */ | |
628 | long *bits = kzalloc(sizeof(*bits) + 1, GFP_KERNEL); | |
73228c7e | 629 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits); |
19a33ca6 ME |
630 | |
631 | /* | |
632 | * Below calls try to access bit within allocated memory; however, the | |
633 | * below accesses are still out-of-bounds, since bitops are defined to | |
634 | * operate on the whole long the bit is in. | |
635 | */ | |
73228c7e | 636 | KUNIT_EXPECT_KASAN_FAIL(test, set_bit(BITS_PER_LONG, bits)); |
19a33ca6 | 637 | |
73228c7e | 638 | KUNIT_EXPECT_KASAN_FAIL(test, __set_bit(BITS_PER_LONG, bits)); |
19a33ca6 | 639 | |
73228c7e | 640 | KUNIT_EXPECT_KASAN_FAIL(test, clear_bit(BITS_PER_LONG, bits)); |
19a33ca6 | 641 | |
73228c7e | 642 | KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit(BITS_PER_LONG, bits)); |
19a33ca6 | 643 | |
73228c7e | 644 | KUNIT_EXPECT_KASAN_FAIL(test, clear_bit_unlock(BITS_PER_LONG, bits)); |
19a33ca6 | 645 | |
73228c7e | 646 | KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit_unlock(BITS_PER_LONG, bits)); |
19a33ca6 | 647 | |
73228c7e | 648 | KUNIT_EXPECT_KASAN_FAIL(test, change_bit(BITS_PER_LONG, bits)); |
19a33ca6 | 649 | |
73228c7e | 650 | KUNIT_EXPECT_KASAN_FAIL(test, __change_bit(BITS_PER_LONG, bits)); |
19a33ca6 ME |
651 | |
652 | /* | |
653 | * Below calls try to access bit beyond allocated memory. | |
654 | */ | |
73228c7e PA |
655 | KUNIT_EXPECT_KASAN_FAIL(test, |
656 | test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits)); | |
19a33ca6 | 657 | |
73228c7e PA |
658 | KUNIT_EXPECT_KASAN_FAIL(test, |
659 | __test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits)); | |
19a33ca6 | 660 | |
73228c7e PA |
661 | KUNIT_EXPECT_KASAN_FAIL(test, |
662 | test_and_set_bit_lock(BITS_PER_LONG + BITS_PER_BYTE, bits)); | |
19a33ca6 | 663 | |
73228c7e PA |
664 | KUNIT_EXPECT_KASAN_FAIL(test, |
665 | test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits)); | |
19a33ca6 | 666 | |
73228c7e PA |
667 | KUNIT_EXPECT_KASAN_FAIL(test, |
668 | __test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits)); | |
19a33ca6 | 669 | |
73228c7e PA |
670 | KUNIT_EXPECT_KASAN_FAIL(test, |
671 | test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits)); | |
19a33ca6 | 672 | |
73228c7e PA |
673 | KUNIT_EXPECT_KASAN_FAIL(test, |
674 | __test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits)); | |
19a33ca6 | 675 | |
73228c7e PA |
676 | KUNIT_EXPECT_KASAN_FAIL(test, |
677 | kasan_int_result = | |
678 | test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits)); | |
19a33ca6 ME |
679 | |
680 | #if defined(clear_bit_unlock_is_negative_byte) | |
73228c7e PA |
681 | KUNIT_EXPECT_KASAN_FAIL(test, |
682 | kasan_int_result = clear_bit_unlock_is_negative_byte( | |
683 | BITS_PER_LONG + BITS_PER_BYTE, bits)); | |
19a33ca6 ME |
684 | #endif |
685 | kfree(bits); | |
686 | } | |
687 | ||
73228c7e | 688 | static void kmalloc_double_kzfree(struct kunit *test) |
bb104ed7 ME |
689 | { |
690 | char *ptr; | |
691 | size_t size = 16; | |
692 | ||
bb104ed7 | 693 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 694 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
bb104ed7 | 695 | |
453431a5 | 696 | kfree_sensitive(ptr); |
73228c7e | 697 | KUNIT_EXPECT_KASAN_FAIL(test, kfree_sensitive(ptr)); |
bb104ed7 ME |
698 | } |
699 | ||
73228c7e | 700 | static void vmalloc_oob(struct kunit *test) |
06513916 DA |
701 | { |
702 | void *area; | |
703 | ||
73228c7e PA |
704 | if (!IS_ENABLED(CONFIG_KASAN_VMALLOC)) { |
705 | kunit_info(test, "CONFIG_KASAN_VMALLOC is not enabled."); | |
706 | return; | |
707 | } | |
06513916 DA |
708 | |
709 | /* | |
710 | * We have to be careful not to hit the guard page. | |
711 | * The MMU will catch that and crash us. | |
712 | */ | |
713 | area = vmalloc(3000); | |
73228c7e | 714 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, area); |
06513916 | 715 | |
73228c7e | 716 | KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)area)[3100]); |
06513916 DA |
717 | vfree(area); |
718 | } | |
387d6e46 | 719 | |
73228c7e PA |
720 | static struct kunit_case kasan_kunit_test_cases[] = { |
721 | KUNIT_CASE(kmalloc_oob_right), | |
722 | KUNIT_CASE(kmalloc_oob_left), | |
723 | KUNIT_CASE(kmalloc_node_oob_right), | |
724 | KUNIT_CASE(kmalloc_pagealloc_oob_right), | |
725 | KUNIT_CASE(kmalloc_pagealloc_uaf), | |
726 | KUNIT_CASE(kmalloc_pagealloc_invalid_free), | |
727 | KUNIT_CASE(kmalloc_large_oob_right), | |
728 | KUNIT_CASE(kmalloc_oob_krealloc_more), | |
729 | KUNIT_CASE(kmalloc_oob_krealloc_less), | |
730 | KUNIT_CASE(kmalloc_oob_16), | |
731 | KUNIT_CASE(kmalloc_oob_in_memset), | |
732 | KUNIT_CASE(kmalloc_oob_memset_2), | |
733 | KUNIT_CASE(kmalloc_oob_memset_4), | |
734 | KUNIT_CASE(kmalloc_oob_memset_8), | |
735 | KUNIT_CASE(kmalloc_oob_memset_16), | |
736 | KUNIT_CASE(kmalloc_memmove_invalid_size), | |
737 | KUNIT_CASE(kmalloc_uaf), | |
738 | KUNIT_CASE(kmalloc_uaf_memset), | |
739 | KUNIT_CASE(kmalloc_uaf2), | |
740 | KUNIT_CASE(kfree_via_page), | |
741 | KUNIT_CASE(kfree_via_phys), | |
742 | KUNIT_CASE(kmem_cache_oob), | |
743 | KUNIT_CASE(memcg_accounted_kmem_cache), | |
744 | KUNIT_CASE(kasan_global_oob), | |
745 | KUNIT_CASE(kasan_stack_oob), | |
746 | KUNIT_CASE(kasan_alloca_oob_left), | |
747 | KUNIT_CASE(kasan_alloca_oob_right), | |
748 | KUNIT_CASE(ksize_unpoisons_memory), | |
749 | KUNIT_CASE(kmem_cache_double_free), | |
750 | KUNIT_CASE(kmem_cache_invalid_free), | |
751 | KUNIT_CASE(kasan_memchr), | |
752 | KUNIT_CASE(kasan_memcmp), | |
753 | KUNIT_CASE(kasan_strings), | |
754 | KUNIT_CASE(kasan_bitops), | |
755 | KUNIT_CASE(kmalloc_double_kzfree), | |
756 | KUNIT_CASE(vmalloc_oob), | |
757 | {} | |
758 | }; | |
759 | ||
760 | static struct kunit_suite kasan_kunit_test_suite = { | |
761 | .name = "kasan", | |
762 | .init = kasan_test_init, | |
763 | .test_cases = kasan_kunit_test_cases, | |
764 | .exit = kasan_test_exit, | |
765 | }; | |
766 | ||
767 | kunit_test_suite(kasan_kunit_test_suite); | |
3f15801c | 768 | |
3f15801c | 769 | MODULE_LICENSE("GPL"); |