// SPDX-License-Identifier: GPL-2.0-only /* * * Copyright ( c ) 2014 Samsung Electronics Co . , Ltd . * Author : Andrey Ryabinin < a . ryabinin @ samsung . com > #define pr_fmt(fmt) "kasan: test: " fmt#include <kunit/test.h>#include <linux/bitops.h>#include <linux/delay.h>#include <linux/io.h>#include <linux/kasan.h>#include <linux/kernel.h>#include <linux/mempool.h>#include <linux/mm.h>#include <linux/mman.h>#include <linux/module.h>#include <linux/printk.h>#include <linux/random.h>#include <linux/set_memory.h>#include <linux/slab.h>#include <linux/string.h>#include <linux/tracepoint.h>#include <linux/uaccess.h>#include <linux/vmalloc.h>#include <trace/events/printk.h>#include <asm /page.h>#include "kasan.h" #define OOB_TAG_OFF (IS_ENABLED(CONFIG_KASAN_GENERIC) ? 0 : KASAN_GRANULE_SIZE)"EXPORTED_FOR_KUNIT_TESTING" );static bool multishot;/* Fields set based on lines observed in the console. */ static struct {bool report_found;bool async_fault;/* * Some tests use these global variables to store return values from function * calls that could otherwise be eliminated by the compiler as dead code . static void *volatile kasan_ptr_result;static volatile int kasan_int_result;/* Probe for console output: obtains test_status lines of interest. */ static void probe_console(void *ignore, const char *buf, size_t len)if (strnstr(buf, "BUG: KASAN: " , len))true );else if (strnstr(buf, "Asynchronous fault: " , len))true );static int kasan_suite_init(struct kunit_suite *suite)if (!kasan_enabled()) {"Can't run KASAN tests with KASAN disabled" );return -1 ;/* Stop failing KUnit tests on KASAN reports. */ /* * Temporarily enable multi - shot mode . Otherwise , KASAN would only * report the first detected bug and panic the kernel if panic_on_warn * is enabled . return 0 ;static void kasan_suite_exit(struct kunit_suite *suite)static void kasan_test_exit(struct kunit *test)/** * KUNIT_EXPECT_KASAN_FAIL - check that the executed expression produces a * KASAN report ; causes a KUnit test failure otherwise . * * @ test : Currently executing KUnit test . * @ expression : Expression that must produce a KASAN report . * * For hardware tag - based KASAN , when a synchronous tag fault happens , tag * checking is auto - disabled . When this happens , this test handler reenables * tag checking . As tag checking can be only disabled or enabled per CPU , * this handler disables migration ( preemption ) . * * Since the compiler doesn ' t see that the expression can change the test_status * fields , it can reorder or optimize away the accesses to those fields . * Use READ / WRITE_ONCE ( ) for the accesses and compiler barriers around the * expression to prevent that . * * In between KUNIT_EXPECT_KASAN_FAIL checks , test_status . report_found is kept * as false . This allows detecting KASAN reports that happen outside of the * checks by asserting ! test_status . report_found at the start of * KUNIT_EXPECT_KASAN_FAIL and in kasan_test_exit . #define KUNIT_EXPECT_KASAN_FAIL(test, expression) do { \if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) && \if (kasan_async_fault_possible()) \if (!READ_ONCE(test_status.report_found)) { \"KASAN failure " \"expected in \" " #expression \ "\" , but none occurred"); \ if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) && \if (READ_ONCE(test_status.report_found) && \false ); \false ); \while (0 )#define KASAN_TEST_NEEDS_CONFIG_ON(test, config) do { \if (!IS_ENABLED(config)) \"Test requires " #config "=y" ); \while (0 )#define KASAN_TEST_NEEDS_CONFIG_OFF(test, config) do { \if (IS_ENABLED(config)) \"Test requires " #config "=n" ); \while (0 )#define KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test) do { \if (IS_ENABLED(CONFIG_KASAN_HW_TAGS)) \break ; /* No compiler instrumentation. */ \ if (IS_ENABLED(CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX)) \break ; /* Should always be instrumented! */ \ if (IS_ENABLED(CONFIG_GENERIC_ENTRY)) \"Test requires checked mem*()" ); \while (0 )static void kmalloc_oob_right(struct kunit *test)char *ptr;128 - KASAN_GRANULE_SIZE - 5 ;/* * An unaligned access past the requested kmalloc size . * Only generic KASAN can precisely detect these . if (IS_ENABLED(CONFIG_KASAN_GENERIC))'x' );/* * An aligned access into the first out - of - bounds granule that falls * within the aligned kmalloc object . 5 ] = 'y' );/* Out-of-bounds access past the aligned kmalloc object. */ 0 ] =5 ]);static void kmalloc_oob_left(struct kunit *test)char *ptr;15 ;1 ));static void kmalloc_node_oob_right(struct kunit *test)char *ptr;4096 ;0 );0 ] = ptr[size]);static void kmalloc_track_caller_oob_right(struct kunit *test)char *ptr;128 - KASAN_GRANULE_SIZE;/* * Check that KASAN detects out - of - bounds access for object allocated via * kmalloc_track_caller ( ) . 'y' );/* * Check that KASAN detects out - of - bounds access for object allocated via * kmalloc_node_track_caller ( ) . 0 );'y' );/* * Check that KASAN detects an out - of - bounds access for a big object allocated * via kmalloc ( ) . But not as big as to trigger the page_alloc fallback . static void kmalloc_big_oob_right(struct kunit *test)char *ptr;256 ;0 );/* * The kmalloc_large_ * tests below use kmalloc ( ) to allocate a memory chunk * that does not fit into the largest slab cache and therefore is allocated via * the page_alloc fallback . static void kmalloc_large_oob_right(struct kunit *test)char *ptr;10 ;0 );static void kmalloc_large_uaf(struct kunit *test)char *ptr;10 ;volatile char *)ptr)[0 ]);static void kmalloc_large_invalid_free(struct kunit *test)char *ptr;10 ;1 ));static void page_alloc_oob_right(struct kunit *test)char *ptr;struct page *pages;4 ;1 UL << (PAGE_SHIFT + order));/* * With generic KASAN page allocations have no redzones , thus * out - of - bounds detection is not guaranteed . * See https : //bugzilla.kernel.org/show_bug.cgi?id=210503. 0 ] = ptr[size]);unsigned long )ptr, order);static void page_alloc_uaf(struct kunit *test)char *ptr;struct page *pages;4 ;unsigned long )ptr, order);volatile char *)ptr)[0 ]);static void krealloc_more_oob_helper(struct kunit *test,char *ptr1, *ptr2;2 ;/* Suppress -Warray-bounds warnings. */ /* All offsets up to size2 must be accessible. */ 1 ] = 'x' ;'x' ;'x' ;1 ] = 'x' ;/* Generic mode is precise, so unaligned size2 must be inaccessible. */ if (IS_ENABLED(CONFIG_KASAN_GENERIC))'x' );/* For all modes first aligned offset after size2 must be inaccessible. */ 'x' );static void krealloc_less_oob_helper(struct kunit *test,char *ptr1, *ptr2;2 ;/* Suppress -Warray-bounds warnings. */ /* Must be accessible for all modes. */ 1 ] = 'x' ;/* Generic mode is precise, so unaligned size2 must be inaccessible. */ if (IS_ENABLED(CONFIG_KASAN_GENERIC))'x' );/* For all modes first aligned offset after size2 must be inaccessible. */ 'x' );/* * For all modes all size2 , middle , and size1 should land in separate * granules and thus the latter two offsets should be inaccessible . 'x' );1 ] = 'x' );'x' );static void krealloc_more_oob(struct kunit *test)201 , 235 );static void krealloc_less_oob(struct kunit *test)235 , 201 );static void krealloc_large_more_oob(struct kunit *test)201 ,235 );static void krealloc_large_less_oob(struct kunit *test)235 ,201 );/* * Check that krealloc ( ) detects a use - after - free , returns NULL , * and doesn ' t unpoison the freed object . static void krealloc_uaf(struct kunit *test)char *ptr1, *ptr2;int size1 = 201 ;int size2 = 235 ;volatile char *)ptr1);static void kmalloc_oob_16(struct kunit *test)struct {2 ];/* This test is specifically crafted for the generic mode. */ /* RELOC_HIDE to prevent gcc from warning about short alloc */ sizeof (*ptr1) - 3 , GFP_KERNEL), 0 );sizeof (*ptr2), GFP_KERNEL);static void kmalloc_uaf_16(struct kunit *test)struct {2 ];sizeof (*ptr1), GFP_KERNEL);sizeof (*ptr2), GFP_KERNEL);/* * Note : in the memset tests below , the written range touches both valid and * invalid memory . This makes sure that the instrumentation does not only check * the starting address but the whole range . static void kmalloc_oob_memset_2(struct kunit *test)char *ptr;128 - KASAN_GRANULE_SIZE;2 ;1 , 0 , memset_size));static void kmalloc_oob_memset_4(struct kunit *test)char *ptr;128 - KASAN_GRANULE_SIZE;4 ;3 , 0 , memset_size));static void kmalloc_oob_memset_8(struct kunit *test)char *ptr;128 - KASAN_GRANULE_SIZE;8 ;7 , 0 , memset_size));static void kmalloc_oob_memset_16(struct kunit *test)char *ptr;128 - KASAN_GRANULE_SIZE;16 ;15 , 0 , memset_size));static void kmalloc_oob_in_memset(struct kunit *test)char *ptr;128 - KASAN_GRANULE_SIZE;0 , size + KASAN_GRANULE_SIZE));static void kmalloc_memmove_negative_size(struct kunit *test)char *ptr;64 ;2 ;/* * Hardware tag - based mode doesn ' t check memmove for negative size . * As a result , this test introduces a side - effect memory corruption , * which can result in a crash . char *)ptr, 0 , 64 );char *)ptr, (char *)ptr + 4 , invalid_size));static void kmalloc_memmove_invalid_size(struct kunit *test)char *ptr;64 ;char *)ptr, 0 , 64 );char *)ptr, (char *)ptr + 4 , invalid_size));static void kmalloc_uaf(struct kunit *test)char *ptr;10 ;volatile char *)ptr)[8 ]);static void kmalloc_uaf_memset(struct kunit *test)char *ptr;33 ;/* * Only generic KASAN uses quarantine , which is required to avoid a * kernel memory corruption this test causes . 0 , size));static void kmalloc_uaf2(struct kunit *test)char *ptr1, *ptr2;43 ;int counter = 0 ;/* * For tag - based KASAN ptr1 and ptr2 tags might happen to be the same . * Allow up to 16 attempts at generating different tags . if (!IS_ENABLED(CONFIG_KASAN_GENERIC) && ptr1 == ptr2 && counter++ < 16 ) {goto again;volatile char *)ptr1)[40 ]);/* * Check that KASAN detects use - after - free when another object was allocated in * the same slot . Relevant for the tag - based modes , which do not use quarantine . static void kmalloc_uaf3(struct kunit *test)char *ptr1, *ptr2;100 ;/* This test is specifically crafted for tag-based modes. */ volatile char *)ptr1)[8 ]);static void kasan_atomics_helper(struct kunit *test, void *unsafe, void *safe)int *i_unsafe = unsafe;42 ));42 ));42 ));42 , unsafe));42 , unsafe));42 , unsafe));42 , unsafe));42 , unsafe));42 , unsafe));42 ));21 , 42 ));42 ));42 ));42 , unsafe));42 , unsafe));21 , 42 ));42 ));42 , unsafe));42 , unsafe));42 , unsafe));42 , unsafe));42 , unsafe));42 , unsafe));42 ));21 , 42 ));42 ));42 ));42 , unsafe));42 , unsafe));21 , 42 ));static void kasan_atomics(struct kunit *test)void *a1, *a2;/* * Just as with kasan_bitops_tags ( ) , we allocate 48 bytes of memory such * that the following 16 bytes will make up the redzone . 48 , GFP_KERNEL);sizeof (atomic_long_t), GFP_KERNEL);/* Use atomics to access the redzone. */ 48 , a2);static void kmalloc_double_kzfree(struct kunit *test)char *ptr;16 ;/* Check that ksize() does NOT unpoison whole object. */ static void ksize_unpoisons_memory(struct kunit *test)char *ptr;128 - KASAN_GRANULE_SIZE - 5 ;/* These accesses shouldn't trigger a KASAN report. */ 0 ] = 'x' ;1 ] = 'x' ;/* These must trigger a KASAN report. */ if (IS_ENABLED(CONFIG_KASAN_GENERIC))volatile char *)ptr)[size]);volatile char *)ptr)[size + 5 ]);volatile char *)ptr)[real_size - 1 ]);/* * Check that a use - after - free is detected by ksize ( ) and via normal accesses * after it . static void ksize_uaf(struct kunit *test)char *ptr;int size = 128 - KASAN_GRANULE_SIZE;volatile char *)ptr)[0 ]);volatile char *)ptr)[size]);/* * The two tests below check that Generic KASAN prints auxiliary stack traces * for RCU callbacks and workqueues . The reports need to be inspected manually . * * These tests are still enabled for other KASAN modes to make sure that all * modes report bad accesses in tested scenarios . static struct kasan_rcu_info {int i;struct rcu_head rcu;static void rcu_uaf_reclaim(struct rcu_head *rp)struct kasan_rcu_info *fp =struct kasan_rcu_info, rcu);volatile struct kasan_rcu_info *)fp)->i;static void rcu_uaf(struct kunit *test)struct kasan_rcu_info *ptr;sizeof (struct kasan_rcu_info), GFP_KERNEL);struct kasan_rcu_info __rcu *)ptr, NULL);static void workqueue_uaf_work(struct work_struct *work)static void workqueue_uaf(struct kunit *test)struct workqueue_struct *workqueue;struct work_struct *work;"kasan_workqueue_test" );sizeof (struct work_struct), GFP_KERNEL);volatile struct work_struct *)work)->data);static void kfree_via_page(struct kunit *test)char *ptr;8 ;struct page *page;unsigned long offset;static void kfree_via_phys(struct kunit *test)char *ptr;8 ;static void kmem_cache_oob(struct kunit *test)char *p;200 ;struct kmem_cache *cache;"test_cache" , size, 0 , 0 , NULL);if (!p) {"Allocation failed: %s\n" , __func__);return ;static void kmem_cache_double_free(struct kunit *test)char *p;200 ;struct kmem_cache *cache;"test_cache" , size, 0 , 0 , NULL);if (!p) {"Allocation failed: %s\n" , __func__);return ;static void kmem_cache_invalid_free(struct kunit *test)char *p;200 ;struct kmem_cache *cache;"test_cache" , size, 0 , SLAB_TYPESAFE_BY_RCU,if (!p) {"Allocation failed: %s\n" , __func__);return ;/* Trigger invalid free, the object doesn't get freed. */ 1 ));/* * Properly free the object to prevent the " Objects remaining in * test_cache on _ _ kmem_cache_shutdown " BUG failure . static void kmem_cache_rcu_uaf(struct kunit *test)char *p;200 ;struct kmem_cache *cache;"test_cache" , size, 0 , SLAB_TYPESAFE_BY_RCU,if (!p) {"Allocation failed: %s\n" , __func__);return ;1 ;/* Free the object - this will internally schedule an RCU callback. */ /* * We should still be allowed to access the object at this point because * the cache is SLAB_TYPESAFE_BY_RCU and we ' ve been in an RCU read - side * critical section since before the kmem_cache_free ( ) . /* * Wait for the RCU callback to execute ; after this , the object should * have actually been freed from KASAN ' s perspective . static void kmem_cache_double_destroy(struct kunit *test)struct kmem_cache *cache;"test_cache" , 200 , 0 , SLAB_NO_MERGE, NULL);static void kmem_cache_accounted(struct kunit *test)int i;char *p;200 ;struct kmem_cache *cache;"test_cache" , size, 0 , SLAB_ACCOUNT, NULL);/* * Several allocations with a delay to allow for lazy per memcg kmem * cache creation . for (i = 0 ; i < 5 ; i++) {if (!p)goto free_cache;100 );static void kmem_cache_bulk(struct kunit *test)struct kmem_cache *cache;200 ;char *p[10 ];bool ret;int i;"test_cache" , size, 0 , 0 , NULL);void **)&p);if (!ret) {"Allocation failed: %s\n" , __func__);return ;for (i = 0 ; i < ARRAY_SIZE(p); i++)0 ] = p[i][size - 1 ] = 42 ;void **)&p);static void *mempool_prepare_kmalloc(struct kunit *test, mempool_t *pool, size_t size)int pool_size = 4 ;int ret;void *elem;0 , sizeof (*pool));0 );/* * Allocate one element to prevent mempool from freeing elements to the * underlying allocator and instead make it add them to the element * list when the tests trigger double - free and invalid - free bugs . * This allows testing KASAN annotations in add_element ( ) . return elem;static struct kmem_cache *mempool_prepare_slab(struct kunit *test, mempool_t *pool, size_t size)struct kmem_cache *cache;int pool_size = 4 ;int ret;"test_cache" , size, 0 , 0 , NULL);0 , sizeof (*pool));0 );/* * Do not allocate one preallocated element , as we skip the double - free * and invalid - free tests for slab mempool for simplicity . return cache;static void *mempool_prepare_page(struct kunit *test, mempool_t *pool, int order)int pool_size = 4 ;int ret;void *elem;0 , sizeof (*pool));0 );return elem;static void mempool_oob_right_helper(struct kunit *test, mempool_t *pool, size_t size)char *elem;if (IS_ENABLED(CONFIG_KASAN_GENERIC))volatile char *)&elem[size])[0 ]);else volatile char *)&elem[round_up(size, KASAN_GRANULE_SIZE)])[0 ]);static void mempool_kmalloc_oob_right(struct kunit *test)128 - KASAN_GRANULE_SIZE - 5 ;void *extra_elem;static void mempool_kmalloc_large_oob_right(struct kunit *test)1 ;void *extra_elem;static void mempool_slab_oob_right(struct kunit *test)123 ;struct kmem_cache *cache;/* * Skip the out - of - bounds test for page mempool . With Generic KASAN , page * allocations have no redzones , and thus the out - of - bounds detection is not * guaranteed ; see https : //bugzilla.kernel.org/show_bug.cgi?id=210503. With * the tag - based KASAN modes , the neighboring allocation might have the same * tag ; see https : //bugzilla.kernel.org/show_bug.cgi?id=203505. static void mempool_uaf_helper(struct kunit *test, mempool_t *pool, bool page)char *elem, *ptr;struct page *)elem) : elem;volatile char *)ptr)[0 ]);static void mempool_kmalloc_uaf(struct kunit *test)128 ;void *extra_elem;false );static void mempool_kmalloc_large_uaf(struct kunit *test)1 ;void *extra_elem;false );static void mempool_slab_uaf(struct kunit *test)123 ;struct kmem_cache *cache;false );static void mempool_page_alloc_uaf(struct kunit *test)int order = 2 ;void *extra_elem;true );static void mempool_double_free_helper(struct kunit *test, mempool_t *pool)char *elem;static void mempool_kmalloc_double_free(struct kunit *test)128 ;char *extra_elem;static void mempool_kmalloc_large_double_free(struct kunit *test)1 ;char *extra_elem;static void mempool_page_alloc_double_free(struct kunit *test)int order = 2 ;char *extra_elem;static void mempool_kmalloc_invalid_free_helper(struct kunit *test, mempool_t *pool)char *elem;1 , pool));static void mempool_kmalloc_invalid_free(struct kunit *test)128 ;char *extra_elem;static void mempool_kmalloc_large_invalid_free(struct kunit *test)1 ;char *extra_elem;/* * Skip the invalid - free test for page mempool . The invalid - free detection only * works for compound pages and mempool preallocates all page elements without * the _ _ GFP_COMP flag . static char global_array[10 ];static void kasan_global_oob_right(struct kunit *test)/* * Deliberate out - of - bounds access . To prevent CONFIG_UBSAN_LOCAL_BOUNDS * from failing here and panicking the kernel , access the array via a * volatile pointer , which will prevent the compiler from being able to * determine the array bounds . * * This access uses a volatile pointer to char ( char * volatile ) rather * than the more conventional pointer to volatile char ( volatile char * ) * because we want to prevent the compiler from making inferences about * the pointer itself ( i . e . its array bounds ) , not the data that it * refers to . char *volatile array = global_array;char *p = &array[ARRAY_SIZE(global_array) + 3 ];/* Only generic mode instruments globals. */ volatile char *)p);static void kasan_global_oob_left(struct kunit *test)char *volatile array = global_array;char *p = array - 3 ;/* * GCC is known to fail this test , skip it . * See https : //bugzilla.kernel.org/show_bug.cgi?id=215051. volatile char *)p);static void kasan_stack_oob(struct kunit *test)char stack_array[10 ];/* See comment in kasan_global_oob_right. */ char *volatile array = stack_array;char *p = &array[ARRAY_SIZE(stack_array) + OOB_TAG_OFF];volatile char *)p);static void kasan_alloca_oob_left(struct kunit *test)volatile int i = 10 ;char alloca_array[i];/* See comment in kasan_global_oob_right. */ char *volatile array = alloca_array;char *p = array - 1 ;/* Only generic mode instruments dynamic allocas. */ volatile char *)p);static void kasan_alloca_oob_right(struct kunit *test)volatile int i = 10 ;char alloca_array[i];/* See comment in kasan_global_oob_right. */ char *volatile array = alloca_array;char *p = array + i;/* Only generic mode instruments dynamic allocas. */ volatile char *)p);static void kasan_memchr(struct kunit *test)char *ptr;24 ;/* * str * functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT . * See https : //bugzilla.kernel.org/show_bug.cgi?id=206337 for details. if (OOB_TAG_OFF)'1' , size + 1 ));static void kasan_memcmp(struct kunit *test)char *ptr;24 ;int arr[9 ];/* * str * functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT . * See https : //bugzilla.kernel.org/show_bug.cgi?id=206337 for details. if (OOB_TAG_OFF)0 , sizeof (arr));1 ));static void kasan_strings(struct kunit *test)char *ptr;char *src;24 ;/* * str * functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT . * See https : //bugzilla.kernel.org/show_bug.cgi?id=206337 for details. "f0cacc1a0000000" , KASAN_GRANULE_SIZE);/* * Make sure that strscpy ( ) does not trigger KASAN if it overreads into * poisoned memory . * * The expected size does not include the terminator ' \ 0 ' * so it is ( KASAN_GRANULE_SIZE - 2 ) = = * KASAN_GRANULE_SIZE - ( " initial removed character " + " \ 0 " ) . 2 ,1 , KASAN_GRANULE_SIZE));/* strscpy should fail if the first byte is unreadable. */ /* * Try to cause only 1 invalid access ( less spam in dmesg ) . * For that we need ptr to point to zeroed byte . * Skip metadata that could be stored in freed object so ptr * will likely point to zeroed byte . 16 ;'1' ));'1' ));"2" ));"2" , 1 ));1 ));static void kasan_bitops_modify(struct kunit *test, int nr, void *addr)static void kasan_bitops_test_and_modify(struct kunit *test, int nr, void *addr)if (nr < 7 )1 << nr, addr));static void kasan_bitops_generic(struct kunit *test)long *bits;/* This test is specifically crafted for the generic mode. */ /* * Allocate 1 more byte , which causes kzalloc to round up to 16 bytes ; * this way we do not actually corrupt other memory . sizeof (*bits) + 1 , GFP_KERNEL);/* * Below calls try to access bit within allocated memory ; however , the * below accesses are still out - of - bounds , since bitops are defined to * operate on the whole long the bit is in . /* * Below calls try to access bit beyond allocated memory . static void kasan_bitops_tags(struct kunit *test)long *bits;/* This test is specifically crafted for tag-based modes. */ /* kmalloc-64 cache will be used and the last 16 bytes will be the redzone. */ 48 , GFP_KERNEL);/* Do the accesses past the 48 allocated bytes, but within the redone. */ void *)bits + 48 );void *)bits + 48 );static void vmalloc_helpers_tags(struct kunit *test)void *ptr;/* This test is intended for tag-based modes. */ if (!kasan_vmalloc_enabled())"Test requires kasan.vmalloc=on" );/* Check that the returned pointer is tagged. */ /* Make sure exported vmalloc helpers handle tagged pointers. */ #if !IS_MODULE(CONFIG_KASAN_KUNIT_TEST)int rv;/* Make sure vmalloc'ed memory permissions can be changed. */ unsigned long )ptr, 1 );0 );unsigned long )ptr, 1 );0 );#endif static void vmalloc_oob(struct kunit *test)char *v_ptr, *p_ptr;struct page *page;2 - KASAN_GRANULE_SIZE - 5 ;if (!kasan_vmalloc_enabled())"Test requires kasan.vmalloc=on" );/* * We have to be careful not to hit the guard page in vmalloc tests . * The MMU will catch that and crash us . /* Make sure in-bounds accesses are valid. */ 0 ] = 0 ;1 ] = 0 ;/* * An unaligned access past the requested vmalloc size . * Only generic KASAN can precisely detect these . if (IS_ENABLED(CONFIG_KASAN_GENERIC))volatile char *)v_ptr)[size]);/* An aligned access into the first out-of-bounds granule. */ volatile char *)v_ptr)[size + 5 ]);/* Check that in-bounds accesses to the physical page are valid. */ 0 ] = 0 ;/* * We can ' t check for use - after - unmap bugs in this nor in the following * vmalloc tests , as the page might be fully unmapped and accessing it * will crash the kernel . static void vmap_tags(struct kunit *test)char *p_ptr, *v_ptr;struct page *p_page, *v_page;/* * This test is specifically crafted for the software tag - based mode , * the only tag - based mode that poisons vmap mappings . if (!kasan_vmalloc_enabled())"Test requires kasan.vmalloc=on" );1 );1 , VM_MAP, PAGE_KERNEL);/* * We can ' t check for out - of - bounds bugs in this nor in the following * vmalloc tests , as allocations have page granularity and accessing * the guard page will crash the kernel . /* Make sure that in-bounds accesses through both pointers work. */ 0 ;0 ;/* Make sure vmalloc_to_page() correctly recovers the page pointer. */ unsigned long )p_ptr, 1 );static void vm_map_ram_tags(struct kunit *test)char *p_ptr, *v_ptr;struct page *page;/* * This test is specifically crafted for the software tag - based mode , * the only tag - based mode that poisons vm_map_ram mappings . 1 );1 , -1 );/* Make sure that in-bounds accesses through both pointers work. */ 0 ;0 ;1 );unsigned long )p_ptr, 1 );/* * Check that the assigned pointer tag falls within the [ KASAN_TAG_MIN , * KASAN_TAG_KERNEL ) range ( note : excluding the match - all tag ) for tag - based * modes . static void match_all_not_assigned(struct kunit *test)char *ptr;struct page *pages;int i, size, order;for (i = 0 ; i < 256 ; i++) {1 , 1024 );for (i = 0 ; i < 256 ; i++) {1 , 4 );unsigned long )ptr, order);if (!kasan_vmalloc_enabled())return ;for (i = 0 ; i < 256 ; i++) {1 , 1024 );/* Check that 0xff works as a match-all pointer tag for tag-based modes. */ static void match_all_ptr_tag(struct kunit *test)char *ptr;128 , GFP_KERNEL);/* Backup the assigned tag. */ /* Reset the tag to 0xff.*/ /* This access shouldn't trigger a KASAN report. */ 0 ;/* Recover the pointer tag and free. */ /* Check that there are no match-all memory tags for tag-based modes. */ static void match_all_mem_tag(struct kunit *test)char *ptr;int tag;128 , GFP_KERNEL);/* For each possible tag value not matching the pointer tag. */ for (tag = KASAN_TAG_MIN; tag <= KASAN_TAG_KERNEL; tag++) {/* * For Software Tag - Based KASAN , skip the majority of tag * values to avoid the test printing too many reports . if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) &&8 && tag <= KASAN_TAG_KERNEL - 8 )continue ;if (tag == get_tag(ptr))continue ;/* Mark the first memory granule with the chosen memory tag. */ false );/* This access must cause a KASAN report. */ 0 );/* Recover the memory tag and free. */ false );/* * Check that Rust performing a use - after - free using ` unsafe ` is detected . * This is a smoke test to make sure that Rust is being sanitized properly . static void rust_uaf(struct kunit *test)/* * copy_to_kernel_nofault ( ) is an internal helper available when * kasan_test is built - in , so it must not be visible to loadable modules . #ifndef MODULEstatic void copy_to_kernel_nofault_oob(struct kunit *test)char *ptr;char buf[128 ];sizeof (buf);/* * This test currently fails with the HW_TAGS mode . The reason is * unknown and needs to be investigated . /* * We test copy_to_kernel_nofault ( ) to detect corrupted memory that is * being written into the kernel . In contrast , * copy_from_kernel_nofault ( ) is primarily used in kernel helper * functions where the source address might be random or uninitialized . * Applying KASAN instrumentation to copy_from_kernel_nofault ( ) could * lead to false positives . By focusing KASAN checks only on * copy_to_kernel_nofault ( ) , we ensure that only valid memory is * written to the kernel , minimizing the risk of kernel corruption * while avoiding false positives in the reverse case . 0 ], ptr, size));0 ], size));#endif /* !MODULE */ static void copy_user_test_oob(struct kunit *test)char *kmem;char __user *usermem;unsigned long useraddr;128 - KASAN_GRANULE_SIZE;int __maybe_unused unused;0 , PAGE_SIZE,0 );0 ,"Could not create userspace mm" );unsigned long )TASK_SIZE,"Failed to allocate user memory" );char __user *)useraddr;1 ));1 ));1 ));1 ));1 ));1 ));/* * Prepare a long string in usermem to avoid the strncpy_from_user test * bailing out on ' \ 0 ' before it reaches out - of - bounds . 'a' , size);0 );1 ));static struct kunit_case kasan_kunit_test_cases[] = {#ifndef MODULE#endif static struct kunit_suite kasan_kunit_test_suite = {"kasan" ,exit = kasan_test_exit,"KUnit tests for checking KASAN bug-detection capabilities" );"GPL" );
Messung V0.5 in Prozent C=95 H=95 G=94
¤ Dauer der Verarbeitung: 0.26 Sekunden
(vorverarbeitet am 2026-09-29)
¤ *© Formatika GbR, Deutschland
