jsauer/torvalds-linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-01-12 01:20:14 +00:00
Code

kasan: add test for SLAB_TYPESAFE_BY_RCU quarantine skipping

Browse Source 
Verify that KASAN does not quarantine objects in SLAB_TYPESAFE_BY_RCU
slabs if CONFIG_SLUB_RCU_DEBUG is off.

[jannh@google.com: v2]
  Link: https://lkml.kernel.org/r/20250729-kasan-tsbrcu-noquarantine-test-v2-1-d16bd99309c9@google.com
[jannh@google.com: make comment more verbose]
   Link: https://lkml.kernel.org/r/20250814-kasan-tsbrcu-noquarantine-test-v3-1-9e9110009b4e@google.com
Link: https://lkml.kernel.org/r/20250728-kasan-tsbrcu-noquarantine-test-v1-1-fa24d9ab7f41@google.com
Signed-off-by: Jann Horn <jannh@google.com>
Suggested-by: Andrey Konovalov <andreyknvl@gmail.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitriy Vyukov <dvyukov@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
This commit is contained in:
Jann Horn 2025-07-28 17:25:07 +02:00 committed by Andrew Morton
parent 56b060d0a1
commit e5eb324688
1 changed files with 40 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
mm/kasan/kasan_test_c.c
View File

@ -1073,6 +1073,45 @@ static void kmem_cache_rcu_uaf(struct kunit *test)
kmem_cache_destroy(cache);
}
/*
* Check that SLAB_TYPESAFE_BY_RCU objects are immediately reused when
* CONFIG_SLUB_RCU_DEBUG is off, and stay at the same address.
* Without this, KASAN builds would be unable to trigger bugs caused by
* SLAB_TYPESAFE_BY_RCU users handling reycled objects improperly.
*/
static void kmem_cache_rcu_reuse(struct kunit *test)
{
char *p, *p2;
struct kmem_cache *cache;
KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_SLUB_RCU_DEBUG);
cache = kmem_cache_create("test_cache", 16, 0, SLAB_TYPESAFE_BY_RCU,
NULL);
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
migrate_disable();
p = kmem_cache_alloc(cache, GFP_KERNEL);
if (!p) {
kunit_err(test, "Allocation failed: %s\n", __func__);
goto out;
}
kmem_cache_free(cache, p);
p2 = kmem_cache_alloc(cache, GFP_KERNEL);
if (!p2) {
kunit_err(test, "Allocation failed: %s\n", __func__);
goto out;
}
KUNIT_EXPECT_PTR_EQ(test, p, p2);
kmem_cache_free(cache, p2);
out:
migrate_enable();
kmem_cache_destroy(cache);
}
static void kmem_cache_double_destroy(struct kunit *test)
{
struct kmem_cache *cache;
@ -2106,6 +2145,7 @@ static struct kunit_case kasan_kunit_test_cases[] = {
KUNIT_CASE(kmem_cache_double_free),
KUNIT_CASE(kmem_cache_invalid_free),
KUNIT_CASE(kmem_cache_rcu_uaf),
KUNIT_CASE(kmem_cache_rcu_reuse),
KUNIT_CASE(kmem_cache_double_destroy),
KUNIT_CASE(kmem_cache_accounted),
KUNIT_CASE(kmem_cache_bulk),