// SPDX-License-Identifier: GPL-2.0 /* * Test cases for KFENCE memory safety error detector. Since the interface with * which KFENCE's reports are obtained is via the console, this is the output we * should verify. For each test case checks the presence (or absence) of * generated reports. Relies on 'console' tracepoint to capture reports as they * appear in the kernel log. * * Copyright (C) 2020, Google LLC. * Author: Alexander Potapenko <[email protected]> * Marco Elver <[email protected]> */ #include <kunit/test.h> #include <linux/jiffies.h> #include <linux/kernel.h> #include <linux/kfence.h> #include <linux/mm.h> #include <linux/random.h> #include <linux/slab.h> #include <linux/spinlock.h> #include <linux/string.h> #include <linux/tracepoint.h> #include <trace/events/printk.h> #include <asm/kfence.h> #include "kfence.h" /* May be overridden by <asm/kfence.h>. */ #ifndef arch_kfence_test_address #define arch_kfence_test_address(addr) … #endif #define KFENCE_TEST_REQUIRES(test, cond) … /* Report as observed from console. */ static struct { … } observed = …; /* Probe for console output: obtains observed lines of interest. */ static void probe_console(void *ignore, const char *buf, size_t len) { … } /* Check if a report related to the test exists. */ static bool report_available(void) { … } /* Information we expect in a report. */ struct expect_report { … }; static const char *get_access_type(const struct expect_report *r) { … } /* Check observed report matches information in @r. */ static bool report_matches(const struct expect_report *r) { … } /* ===== Test cases ===== */ #define TEST_PRIV_WANT_MEMCACHE … /* Cache used by tests; if NULL, allocate from kmalloc instead. */ static struct kmem_cache *test_cache; static size_t setup_test_cache(struct kunit *test, size_t size, slab_flags_t flags, void (*ctor)(void *)) { … } static void test_cache_destroy(void) { … } static inline size_t kmalloc_cache_alignment(size_t size) { … } /* Must always inline to match stack trace against caller. */ static __always_inline void test_free(void *ptr) { … } /* * If this should be a KFENCE allocation, and on which side the allocation and * the closest guard page should be. */ enum allocation_policy { … }; /* * Try to get a guarded allocation from KFENCE. Uses either kmalloc() or the * current test_cache if set up. */ static void *test_alloc(struct kunit *test, size_t size, gfp_t gfp, enum allocation_policy policy) { … } static void test_out_of_bounds_read(struct kunit *test) { … } static void test_out_of_bounds_write(struct kunit *test) { … } static void test_use_after_free_read(struct kunit *test) { … } static void test_double_free(struct kunit *test) { … } static void test_invalid_addr_free(struct kunit *test) { … } static void test_corruption(struct kunit *test) { … } /* * KFENCE is unable to detect an OOB if the allocation's alignment requirements * leave a gap between the object and the guard page. Specifically, an * allocation of e.g. 73 bytes is aligned on 8 and 128 bytes for SLUB or SLAB * respectively. Therefore it is impossible for the allocated object to * contiguously line up with the right guard page. * * However, we test that an access to memory beyond the gap results in KFENCE * detecting an OOB access. */ static void test_kmalloc_aligned_oob_read(struct kunit *test) { … } static void test_kmalloc_aligned_oob_write(struct kunit *test) { … } /* Test cache shrinking and destroying with KFENCE. */ static void test_shrink_memcache(struct kunit *test) { … } static void ctor_set_x(void *obj) { … } /* Ensure that SL*B does not modify KFENCE objects on bulk free. */ static void test_free_bulk(struct kunit *test) { … } /* Test init-on-free works. */ static void test_init_on_free(struct kunit *test) { … } /* Ensure that constructors work properly. */ static void test_memcache_ctor(struct kunit *test) { … } /* Test that memory is zeroed if requested. */ static void test_gfpzero(struct kunit *test) { … } static void test_invalid_access(struct kunit *test) { … } /* Test SLAB_TYPESAFE_BY_RCU works. */ static void test_memcache_typesafe_by_rcu(struct kunit *test) { … } /* Test krealloc(). */ static void test_krealloc(struct kunit *test) { … } /* Test that some objects from a bulk allocation belong to KFENCE pool. */ static void test_memcache_alloc_bulk(struct kunit *test) { … } /* * KUnit does not provide a way to provide arguments to tests, and we encode * additional info in the name. Set up 2 tests per test case, one using the * default allocator, and another using a custom memcache (suffix '-memcache'). */ #define KFENCE_KUNIT_CASE(test_name) … static struct kunit_case kfence_test_cases[] = …; /* ===== End test cases ===== */ static int test_init(struct kunit *test) { … } static void test_exit(struct kunit *test) { … } static int kfence_suite_init(struct kunit_suite *suite) { … } static void kfence_suite_exit(struct kunit_suite *suite) { … } static struct kunit_suite kfence_test_suite = …; kunit_test_suites(…); MODULE_LICENSE(…) …; MODULE_AUTHOR(…) …; MODULE_DESCRIPTION(…) …;
Codebase Browser
linux