1 // SPDX-License-Identifier: GPL-2.0-only
4 * Copyright (c) 2014 Samsung Electronics Co., Ltd.
5 * Author: Andrey Ryabinin <a.ryabinin@samsung.com>
8 #include <linux/bitops.h>
9 #include <linux/delay.h>
10 #include <linux/kasan.h>
11 #include <linux/kernel.h>
13 #include <linux/mman.h>
14 #include <linux/module.h>
15 #include <linux/printk.h>
16 #include <linux/random.h>
17 #include <linux/slab.h>
18 #include <linux/string.h>
19 #include <linux/uaccess.h>
21 #include <linux/vmalloc.h>
25 #include <kunit/test.h>
27 #include "../mm/kasan/kasan.h"
29 #define OOB_TAG_OFF (IS_ENABLED(CONFIG_KASAN_GENERIC) ? 0 : KASAN_GRANULE_SIZE)
32 * Some tests use these global variables to store return values from function
33 * calls that could otherwise be eliminated by the compiler as dead code.
35 void *kasan_ptr_result;
38 static struct kunit_resource resource;
39 static struct kunit_kasan_expectation fail_data;
40 static bool multishot;
43 * Temporarily enable multi-shot mode. Otherwise, KASAN would only report the
44 * first detected bug and panic the kernel if panic_on_warn is enabled. For
45 * hardware tag-based KASAN also allow tag checking to be reenabled for each
46 * test, see the comment for KUNIT_EXPECT_KASAN_FAIL().
48 static int kasan_test_init(struct kunit *test)
50 if (!kasan_enabled()) {
51 kunit_err(test, "can't run KASAN tests with KASAN disabled");
55 multishot = kasan_save_enable_multi_shot();
56 kasan_set_tagging_report_once(false);
60 static void kasan_test_exit(struct kunit *test)
62 kasan_set_tagging_report_once(true);
63 kasan_restore_multi_shot(multishot);
67 * KUNIT_EXPECT_KASAN_FAIL() - check that the executed expression produces a
68 * KASAN report; causes a test failure otherwise. This relies on a KUnit
69 * resource named "kasan_data". Do not use this name for KUnit resources
70 * outside of KASAN tests.
72 * For hardware tag-based KASAN in sync mode, when a tag fault happens, tag
73 * checking is auto-disabled. When this happens, this test handler reenables
74 * tag checking. As tag checking can be only disabled or enabled per CPU,
75 * this handler disables migration (preemption).
77 * Since the compiler doesn't see that the expression can change the fail_data
78 * fields, it can reorder or optimize away the accesses to those fields.
79 * Use READ/WRITE_ONCE() for the accesses and compiler barriers around the
80 * expression to prevent that.
82 #define KUNIT_EXPECT_KASAN_FAIL(test, expression) do { \
83 if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) && \
84 !kasan_async_mode_enabled()) \
86 WRITE_ONCE(fail_data.report_expected, true); \
87 WRITE_ONCE(fail_data.report_found, false); \
88 kunit_add_named_resource(test, \
92 "kasan_data", &fail_data); \
96 if (kasan_async_mode_enabled()) \
97 kasan_force_async_fault(); \
99 KUNIT_EXPECT_EQ(test, \
100 READ_ONCE(fail_data.report_expected), \
101 READ_ONCE(fail_data.report_found)); \
102 if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) && \
103 !kasan_async_mode_enabled()) { \
104 if (READ_ONCE(fail_data.report_found)) \
105 kasan_enable_tagging_sync(); \
110 #define KASAN_TEST_NEEDS_CONFIG_ON(test, config) do { \
111 if (!IS_ENABLED(config)) { \
112 kunit_info((test), "skipping, " #config " required"); \
117 #define KASAN_TEST_NEEDS_CONFIG_OFF(test, config) do { \
118 if (IS_ENABLED(config)) { \
119 kunit_info((test), "skipping, " #config " enabled"); \
124 static void kmalloc_oob_right(struct kunit *test)
129 ptr = kmalloc(size, GFP_KERNEL);
130 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
132 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size + OOB_TAG_OFF] = 'x');
136 static void kmalloc_oob_left(struct kunit *test)
141 ptr = kmalloc(size, GFP_KERNEL);
142 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
144 KUNIT_EXPECT_KASAN_FAIL(test, *ptr = *(ptr - 1));
148 static void kmalloc_node_oob_right(struct kunit *test)
153 ptr = kmalloc_node(size, GFP_KERNEL, 0);
154 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
156 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0);
161 * These kmalloc_pagealloc_* tests try allocating a memory chunk that doesn't
162 * fit into a slab cache and therefore is allocated via the page allocator
163 * fallback. Since this kind of fallback is only implemented for SLUB, these
164 * tests are limited to that allocator.
166 static void kmalloc_pagealloc_oob_right(struct kunit *test)
169 size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
171 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB);
173 ptr = kmalloc(size, GFP_KERNEL);
174 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
176 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size + OOB_TAG_OFF] = 0);
181 static void kmalloc_pagealloc_uaf(struct kunit *test)
184 size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
186 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB);
188 ptr = kmalloc(size, GFP_KERNEL);
189 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
192 KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = 0);
195 static void kmalloc_pagealloc_invalid_free(struct kunit *test)
198 size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
200 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB);
202 ptr = kmalloc(size, GFP_KERNEL);
203 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
205 KUNIT_EXPECT_KASAN_FAIL(test, kfree(ptr + 1));
208 static void pagealloc_oob_right(struct kunit *test)
213 size_t size = (1UL << (PAGE_SHIFT + order));
216 * With generic KASAN page allocations have no redzones, thus
217 * out-of-bounds detection is not guaranteed.
218 * See https://bugzilla.kernel.org/show_bug.cgi?id=210503.
220 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC);
222 pages = alloc_pages(GFP_KERNEL, order);
223 ptr = page_address(pages);
224 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
226 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0);
227 free_pages((unsigned long)ptr, order);
230 static void pagealloc_uaf(struct kunit *test)
236 pages = alloc_pages(GFP_KERNEL, order);
237 ptr = page_address(pages);
238 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
239 free_pages((unsigned long)ptr, order);
241 KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = 0);
244 static void kmalloc_large_oob_right(struct kunit *test)
247 size_t size = KMALLOC_MAX_CACHE_SIZE - 256;
250 * Allocate a chunk that is large enough, but still fits into a slab
251 * and does not trigger the page allocator fallback in SLUB.
253 ptr = kmalloc(size, GFP_KERNEL);
254 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
256 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0);
260 static void krealloc_more_oob_helper(struct kunit *test,
261 size_t size1, size_t size2)
266 KUNIT_ASSERT_LT(test, size1, size2);
267 middle = size1 + (size2 - size1) / 2;
269 ptr1 = kmalloc(size1, GFP_KERNEL);
270 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
272 ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
273 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
275 /* All offsets up to size2 must be accessible. */
276 ptr2[size1 - 1] = 'x';
279 ptr2[size2 - 1] = 'x';
281 /* Generic mode is precise, so unaligned size2 must be inaccessible. */
282 if (IS_ENABLED(CONFIG_KASAN_GENERIC))
283 KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size2] = 'x');
285 /* For all modes first aligned offset after size2 must be inaccessible. */
286 KUNIT_EXPECT_KASAN_FAIL(test,
287 ptr2[round_up(size2, KASAN_GRANULE_SIZE)] = 'x');
292 static void krealloc_less_oob_helper(struct kunit *test,
293 size_t size1, size_t size2)
298 KUNIT_ASSERT_LT(test, size2, size1);
299 middle = size2 + (size1 - size2) / 2;
301 ptr1 = kmalloc(size1, GFP_KERNEL);
302 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
304 ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
305 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
307 /* Must be accessible for all modes. */
308 ptr2[size2 - 1] = 'x';
310 /* Generic mode is precise, so unaligned size2 must be inaccessible. */
311 if (IS_ENABLED(CONFIG_KASAN_GENERIC))
312 KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size2] = 'x');
314 /* For all modes first aligned offset after size2 must be inaccessible. */
315 KUNIT_EXPECT_KASAN_FAIL(test,
316 ptr2[round_up(size2, KASAN_GRANULE_SIZE)] = 'x');
319 * For all modes all size2, middle, and size1 should land in separate
320 * granules and thus the latter two offsets should be inaccessible.
322 KUNIT_EXPECT_LE(test, round_up(size2, KASAN_GRANULE_SIZE),
323 round_down(middle, KASAN_GRANULE_SIZE));
324 KUNIT_EXPECT_LE(test, round_up(middle, KASAN_GRANULE_SIZE),
325 round_down(size1, KASAN_GRANULE_SIZE));
326 KUNIT_EXPECT_KASAN_FAIL(test, ptr2[middle] = 'x');
327 KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size1 - 1] = 'x');
328 KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size1] = 'x');
333 static void krealloc_more_oob(struct kunit *test)
335 krealloc_more_oob_helper(test, 201, 235);
338 static void krealloc_less_oob(struct kunit *test)
340 krealloc_less_oob_helper(test, 235, 201);
343 static void krealloc_pagealloc_more_oob(struct kunit *test)
345 /* page_alloc fallback in only implemented for SLUB. */
346 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB);
348 krealloc_more_oob_helper(test, KMALLOC_MAX_CACHE_SIZE + 201,
349 KMALLOC_MAX_CACHE_SIZE + 235);
352 static void krealloc_pagealloc_less_oob(struct kunit *test)
354 /* page_alloc fallback in only implemented for SLUB. */
355 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB);
357 krealloc_less_oob_helper(test, KMALLOC_MAX_CACHE_SIZE + 235,
358 KMALLOC_MAX_CACHE_SIZE + 201);
362 * Check that krealloc() detects a use-after-free, returns NULL,
363 * and doesn't unpoison the freed object.
365 static void krealloc_uaf(struct kunit *test)
371 ptr1 = kmalloc(size1, GFP_KERNEL);
372 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
375 KUNIT_EXPECT_KASAN_FAIL(test, ptr2 = krealloc(ptr1, size2, GFP_KERNEL));
376 KUNIT_ASSERT_PTR_EQ(test, (void *)ptr2, NULL);
377 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)ptr1);
380 static void kmalloc_oob_16(struct kunit *test)
386 /* This test is specifically crafted for the generic mode. */
387 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC);
389 ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL);
390 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
392 ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
393 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
395 KUNIT_EXPECT_KASAN_FAIL(test, *ptr1 = *ptr2);
400 static void kmalloc_uaf_16(struct kunit *test)
406 ptr1 = kmalloc(sizeof(*ptr1), GFP_KERNEL);
407 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
409 ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
410 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
413 KUNIT_EXPECT_KASAN_FAIL(test, *ptr1 = *ptr2);
417 static void kmalloc_oob_memset_2(struct kunit *test)
422 ptr = kmalloc(size, GFP_KERNEL);
423 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
425 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + 7 + OOB_TAG_OFF, 0, 2));
429 static void kmalloc_oob_memset_4(struct kunit *test)
434 ptr = kmalloc(size, GFP_KERNEL);
435 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
437 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + 5 + OOB_TAG_OFF, 0, 4));
442 static void kmalloc_oob_memset_8(struct kunit *test)
447 ptr = kmalloc(size, GFP_KERNEL);
448 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
450 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + 1 + OOB_TAG_OFF, 0, 8));
454 static void kmalloc_oob_memset_16(struct kunit *test)
459 ptr = kmalloc(size, GFP_KERNEL);
460 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
462 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + 1 + OOB_TAG_OFF, 0, 16));
466 static void kmalloc_oob_in_memset(struct kunit *test)
471 ptr = kmalloc(size, GFP_KERNEL);
472 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
474 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr, 0, size + 5 + OOB_TAG_OFF));
478 static void kmalloc_memmove_invalid_size(struct kunit *test)
482 volatile size_t invalid_size = -2;
484 ptr = kmalloc(size, GFP_KERNEL);
485 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
487 memset((char *)ptr, 0, 64);
489 KUNIT_EXPECT_KASAN_FAIL(test,
490 memmove((char *)ptr, (char *)ptr + 4, invalid_size));
494 static void kmalloc_uaf(struct kunit *test)
499 ptr = kmalloc(size, GFP_KERNEL);
500 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
503 KUNIT_EXPECT_KASAN_FAIL(test, *(ptr + 8) = 'x');
506 static void kmalloc_uaf_memset(struct kunit *test)
511 ptr = kmalloc(size, GFP_KERNEL);
512 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
515 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr, 0, size));
518 static void kmalloc_uaf2(struct kunit *test)
525 ptr1 = kmalloc(size, GFP_KERNEL);
526 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
530 ptr2 = kmalloc(size, GFP_KERNEL);
531 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
534 * For tag-based KASAN ptr1 and ptr2 tags might happen to be the same.
535 * Allow up to 16 attempts at generating different tags.
537 if (!IS_ENABLED(CONFIG_KASAN_GENERIC) && ptr1 == ptr2 && counter++ < 16) {
542 KUNIT_EXPECT_KASAN_FAIL(test, ptr1[40] = 'x');
543 KUNIT_EXPECT_PTR_NE(test, ptr1, ptr2);
548 static void kfree_via_page(struct kunit *test)
553 unsigned long offset;
555 ptr = kmalloc(size, GFP_KERNEL);
556 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
558 page = virt_to_page(ptr);
559 offset = offset_in_page(ptr);
560 kfree(page_address(page) + offset);
563 static void kfree_via_phys(struct kunit *test)
569 ptr = kmalloc(size, GFP_KERNEL);
570 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
572 phys = virt_to_phys(ptr);
573 kfree(phys_to_virt(phys));
576 static void kmem_cache_oob(struct kunit *test)
580 struct kmem_cache *cache;
582 cache = kmem_cache_create("test_cache", size, 0, 0, NULL);
583 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
585 p = kmem_cache_alloc(cache, GFP_KERNEL);
587 kunit_err(test, "Allocation failed: %s\n", __func__);
588 kmem_cache_destroy(cache);
592 KUNIT_EXPECT_KASAN_FAIL(test, *p = p[size + OOB_TAG_OFF]);
594 kmem_cache_free(cache, p);
595 kmem_cache_destroy(cache);
598 static void kmem_cache_accounted(struct kunit *test)
603 struct kmem_cache *cache;
605 cache = kmem_cache_create("test_cache", size, 0, SLAB_ACCOUNT, NULL);
606 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
609 * Several allocations with a delay to allow for lazy per memcg kmem
612 for (i = 0; i < 5; i++) {
613 p = kmem_cache_alloc(cache, GFP_KERNEL);
617 kmem_cache_free(cache, p);
622 kmem_cache_destroy(cache);
625 static void kmem_cache_bulk(struct kunit *test)
627 struct kmem_cache *cache;
633 cache = kmem_cache_create("test_cache", size, 0, 0, NULL);
634 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
636 ret = kmem_cache_alloc_bulk(cache, GFP_KERNEL, ARRAY_SIZE(p), (void **)&p);
638 kunit_err(test, "Allocation failed: %s\n", __func__);
639 kmem_cache_destroy(cache);
643 for (i = 0; i < ARRAY_SIZE(p); i++)
644 p[i][0] = p[i][size - 1] = 42;
646 kmem_cache_free_bulk(cache, ARRAY_SIZE(p), (void **)&p);
647 kmem_cache_destroy(cache);
650 static char global_array[10];
652 static void kasan_global_oob(struct kunit *test)
655 char *p = &global_array[ARRAY_SIZE(global_array) + i];
657 /* Only generic mode instruments globals. */
658 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC);
660 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
663 /* Check that ksize() makes the whole object accessible. */
664 static void ksize_unpoisons_memory(struct kunit *test)
667 size_t size = 123, real_size;
669 ptr = kmalloc(size, GFP_KERNEL);
670 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
671 real_size = ksize(ptr);
673 /* This access shouldn't trigger a KASAN report. */
677 KUNIT_EXPECT_KASAN_FAIL(test, ptr[real_size] = 'y');
683 * Check that a use-after-free is detected by ksize() and via normal accesses
686 static void ksize_uaf(struct kunit *test)
689 int size = 128 - KASAN_GRANULE_SIZE;
691 ptr = kmalloc(size, GFP_KERNEL);
692 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
695 KUNIT_EXPECT_KASAN_FAIL(test, ksize(ptr));
696 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = *ptr);
697 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = *(ptr + size));
700 static void kasan_stack_oob(struct kunit *test)
702 char stack_array[10];
703 volatile int i = OOB_TAG_OFF;
704 char *p = &stack_array[ARRAY_SIZE(stack_array) + i];
706 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_STACK);
708 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
711 static void kasan_alloca_oob_left(struct kunit *test)
714 char alloca_array[i];
715 char *p = alloca_array - 1;
717 /* Only generic mode instruments dynamic allocas. */
718 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC);
719 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_STACK);
721 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
724 static void kasan_alloca_oob_right(struct kunit *test)
727 char alloca_array[i];
728 char *p = alloca_array + i;
730 /* Only generic mode instruments dynamic allocas. */
731 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC);
732 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_STACK);
734 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
737 static void kmem_cache_double_free(struct kunit *test)
741 struct kmem_cache *cache;
743 cache = kmem_cache_create("test_cache", size, 0, 0, NULL);
744 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
746 p = kmem_cache_alloc(cache, GFP_KERNEL);
748 kunit_err(test, "Allocation failed: %s\n", __func__);
749 kmem_cache_destroy(cache);
753 kmem_cache_free(cache, p);
754 KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p));
755 kmem_cache_destroy(cache);
758 static void kmem_cache_invalid_free(struct kunit *test)
762 struct kmem_cache *cache;
764 cache = kmem_cache_create("test_cache", size, 0, SLAB_TYPESAFE_BY_RCU,
766 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
768 p = kmem_cache_alloc(cache, GFP_KERNEL);
770 kunit_err(test, "Allocation failed: %s\n", __func__);
771 kmem_cache_destroy(cache);
775 /* Trigger invalid free, the object doesn't get freed. */
776 KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p + 1));
779 * Properly free the object to prevent the "Objects remaining in
780 * test_cache on __kmem_cache_shutdown" BUG failure.
782 kmem_cache_free(cache, p);
784 kmem_cache_destroy(cache);
787 static void kasan_memchr(struct kunit *test)
793 * str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT.
794 * See https://bugzilla.kernel.org/show_bug.cgi?id=206337 for details.
796 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_AMD_MEM_ENCRYPT);
799 size = round_up(size, OOB_TAG_OFF);
801 ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
802 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
804 KUNIT_EXPECT_KASAN_FAIL(test,
805 kasan_ptr_result = memchr(ptr, '1', size + 1));
810 static void kasan_memcmp(struct kunit *test)
817 * str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT.
818 * See https://bugzilla.kernel.org/show_bug.cgi?id=206337 for details.
820 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_AMD_MEM_ENCRYPT);
823 size = round_up(size, OOB_TAG_OFF);
825 ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
826 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
827 memset(arr, 0, sizeof(arr));
829 KUNIT_EXPECT_KASAN_FAIL(test,
830 kasan_int_result = memcmp(ptr, arr, size+1));
834 static void kasan_strings(struct kunit *test)
840 * str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT.
841 * See https://bugzilla.kernel.org/show_bug.cgi?id=206337 for details.
843 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_AMD_MEM_ENCRYPT);
845 ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
846 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
851 * Try to cause only 1 invalid access (less spam in dmesg).
852 * For that we need ptr to point to zeroed byte.
853 * Skip metadata that could be stored in freed object so ptr
854 * will likely point to zeroed byte.
857 KUNIT_EXPECT_KASAN_FAIL(test, kasan_ptr_result = strchr(ptr, '1'));
859 KUNIT_EXPECT_KASAN_FAIL(test, kasan_ptr_result = strrchr(ptr, '1'));
861 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strcmp(ptr, "2"));
863 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strncmp(ptr, "2", 1));
865 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strlen(ptr));
867 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strnlen(ptr, 1));
870 static void kasan_bitops_modify(struct kunit *test, int nr, void *addr)
872 KUNIT_EXPECT_KASAN_FAIL(test, set_bit(nr, addr));
873 KUNIT_EXPECT_KASAN_FAIL(test, __set_bit(nr, addr));
874 KUNIT_EXPECT_KASAN_FAIL(test, clear_bit(nr, addr));
875 KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit(nr, addr));
876 KUNIT_EXPECT_KASAN_FAIL(test, clear_bit_unlock(nr, addr));
877 KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit_unlock(nr, addr));
878 KUNIT_EXPECT_KASAN_FAIL(test, change_bit(nr, addr));
879 KUNIT_EXPECT_KASAN_FAIL(test, __change_bit(nr, addr));
882 static void kasan_bitops_test_and_modify(struct kunit *test, int nr, void *addr)
884 KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit(nr, addr));
885 KUNIT_EXPECT_KASAN_FAIL(test, __test_and_set_bit(nr, addr));
886 KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit_lock(nr, addr));
887 KUNIT_EXPECT_KASAN_FAIL(test, test_and_clear_bit(nr, addr));
888 KUNIT_EXPECT_KASAN_FAIL(test, __test_and_clear_bit(nr, addr));
889 KUNIT_EXPECT_KASAN_FAIL(test, test_and_change_bit(nr, addr));
890 KUNIT_EXPECT_KASAN_FAIL(test, __test_and_change_bit(nr, addr));
891 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = test_bit(nr, addr));
893 #if defined(clear_bit_unlock_is_negative_byte)
894 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result =
895 clear_bit_unlock_is_negative_byte(nr, addr));
899 static void kasan_bitops_generic(struct kunit *test)
903 /* This test is specifically crafted for the generic mode. */
904 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC);
907 * Allocate 1 more byte, which causes kzalloc to round up to 16 bytes;
908 * this way we do not actually corrupt other memory.
910 bits = kzalloc(sizeof(*bits) + 1, GFP_KERNEL);
911 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits);
914 * Below calls try to access bit within allocated memory; however, the
915 * below accesses are still out-of-bounds, since bitops are defined to
916 * operate on the whole long the bit is in.
918 kasan_bitops_modify(test, BITS_PER_LONG, bits);
921 * Below calls try to access bit beyond allocated memory.
923 kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, bits);
928 static void kasan_bitops_tags(struct kunit *test)
932 /* This test is specifically crafted for tag-based modes. */
933 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC);
935 /* kmalloc-64 cache will be used and the last 16 bytes will be the redzone. */
936 bits = kzalloc(48, GFP_KERNEL);
937 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits);
939 /* Do the accesses past the 48 allocated bytes, but within the redone. */
940 kasan_bitops_modify(test, BITS_PER_LONG, (void *)bits + 48);
941 kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, (void *)bits + 48);
946 static void kmalloc_double_kzfree(struct kunit *test)
951 ptr = kmalloc(size, GFP_KERNEL);
952 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
954 kfree_sensitive(ptr);
955 KUNIT_EXPECT_KASAN_FAIL(test, kfree_sensitive(ptr));
958 static void vmalloc_oob(struct kunit *test)
962 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_VMALLOC);
965 * We have to be careful not to hit the guard page.
966 * The MMU will catch that and crash us.
968 area = vmalloc(3000);
969 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, area);
971 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)area)[3100]);
976 * Check that the assigned pointer tag falls within the [KASAN_TAG_MIN,
977 * KASAN_TAG_KERNEL) range (note: excluding the match-all tag) for tag-based
980 static void match_all_not_assigned(struct kunit *test)
986 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC);
988 for (i = 0; i < 256; i++) {
989 size = (get_random_int() % 1024) + 1;
990 ptr = kmalloc(size, GFP_KERNEL);
991 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
992 KUNIT_EXPECT_GE(test, (u8)get_tag(ptr), (u8)KASAN_TAG_MIN);
993 KUNIT_EXPECT_LT(test, (u8)get_tag(ptr), (u8)KASAN_TAG_KERNEL);
997 for (i = 0; i < 256; i++) {
998 order = (get_random_int() % 4) + 1;
999 pages = alloc_pages(GFP_KERNEL, order);
1000 ptr = page_address(pages);
1001 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
1002 KUNIT_EXPECT_GE(test, (u8)get_tag(ptr), (u8)KASAN_TAG_MIN);
1003 KUNIT_EXPECT_LT(test, (u8)get_tag(ptr), (u8)KASAN_TAG_KERNEL);
1004 free_pages((unsigned long)ptr, order);
1008 /* Check that 0xff works as a match-all pointer tag for tag-based modes. */
1009 static void match_all_ptr_tag(struct kunit *test)
1014 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC);
1016 ptr = kmalloc(128, GFP_KERNEL);
1017 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
1019 /* Backup the assigned tag. */
1021 KUNIT_EXPECT_NE(test, tag, (u8)KASAN_TAG_KERNEL);
1023 /* Reset the tag to 0xff.*/
1024 ptr = set_tag(ptr, KASAN_TAG_KERNEL);
1026 /* This access shouldn't trigger a KASAN report. */
1029 /* Recover the pointer tag and free. */
1030 ptr = set_tag(ptr, tag);
1034 /* Check that there are no match-all memory tags for tag-based modes. */
1035 static void match_all_mem_tag(struct kunit *test)
1040 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC);
1042 ptr = kmalloc(128, GFP_KERNEL);
1043 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
1044 KUNIT_EXPECT_NE(test, (u8)get_tag(ptr), (u8)KASAN_TAG_KERNEL);
1046 /* For each possible tag value not matching the pointer tag. */
1047 for (tag = KASAN_TAG_MIN; tag <= KASAN_TAG_KERNEL; tag++) {
1048 if (tag == get_tag(ptr))
1051 /* Mark the first memory granule with the chosen memory tag. */
1052 kasan_poison(ptr, KASAN_GRANULE_SIZE, (u8)tag);
1054 /* This access must cause a KASAN report. */
1055 KUNIT_EXPECT_KASAN_FAIL(test, *ptr = 0);
1058 /* Recover the memory tag and free. */
1059 kasan_poison(ptr, KASAN_GRANULE_SIZE, get_tag(ptr));
1063 static struct kunit_case kasan_kunit_test_cases[] = {
1064 KUNIT_CASE(kmalloc_oob_right),
1065 KUNIT_CASE(kmalloc_oob_left),
1066 KUNIT_CASE(kmalloc_node_oob_right),
1067 KUNIT_CASE(kmalloc_pagealloc_oob_right),
1068 KUNIT_CASE(kmalloc_pagealloc_uaf),
1069 KUNIT_CASE(kmalloc_pagealloc_invalid_free),
1070 KUNIT_CASE(pagealloc_oob_right),
1071 KUNIT_CASE(pagealloc_uaf),
1072 KUNIT_CASE(kmalloc_large_oob_right),
1073 KUNIT_CASE(krealloc_more_oob),
1074 KUNIT_CASE(krealloc_less_oob),
1075 KUNIT_CASE(krealloc_pagealloc_more_oob),
1076 KUNIT_CASE(krealloc_pagealloc_less_oob),
1077 KUNIT_CASE(krealloc_uaf),
1078 KUNIT_CASE(kmalloc_oob_16),
1079 KUNIT_CASE(kmalloc_uaf_16),
1080 KUNIT_CASE(kmalloc_oob_in_memset),
1081 KUNIT_CASE(kmalloc_oob_memset_2),
1082 KUNIT_CASE(kmalloc_oob_memset_4),
1083 KUNIT_CASE(kmalloc_oob_memset_8),
1084 KUNIT_CASE(kmalloc_oob_memset_16),
1085 KUNIT_CASE(kmalloc_memmove_invalid_size),
1086 KUNIT_CASE(kmalloc_uaf),
1087 KUNIT_CASE(kmalloc_uaf_memset),
1088 KUNIT_CASE(kmalloc_uaf2),
1089 KUNIT_CASE(kfree_via_page),
1090 KUNIT_CASE(kfree_via_phys),
1091 KUNIT_CASE(kmem_cache_oob),
1092 KUNIT_CASE(kmem_cache_accounted),
1093 KUNIT_CASE(kmem_cache_bulk),
1094 KUNIT_CASE(kasan_global_oob),
1095 KUNIT_CASE(kasan_stack_oob),
1096 KUNIT_CASE(kasan_alloca_oob_left),
1097 KUNIT_CASE(kasan_alloca_oob_right),
1098 KUNIT_CASE(ksize_unpoisons_memory),
1099 KUNIT_CASE(ksize_uaf),
1100 KUNIT_CASE(kmem_cache_double_free),
1101 KUNIT_CASE(kmem_cache_invalid_free),
1102 KUNIT_CASE(kasan_memchr),
1103 KUNIT_CASE(kasan_memcmp),
1104 KUNIT_CASE(kasan_strings),
1105 KUNIT_CASE(kasan_bitops_generic),
1106 KUNIT_CASE(kasan_bitops_tags),
1107 KUNIT_CASE(kmalloc_double_kzfree),
1108 KUNIT_CASE(vmalloc_oob),
1109 KUNIT_CASE(match_all_not_assigned),
1110 KUNIT_CASE(match_all_ptr_tag),
1111 KUNIT_CASE(match_all_mem_tag),
1115 static struct kunit_suite kasan_kunit_test_suite = {
1117 .init = kasan_test_init,
1118 .test_cases = kasan_kunit_test_cases,
1119 .exit = kasan_test_exit,
1122 kunit_test_suite(kasan_kunit_test_suite);
1124 MODULE_LICENSE("GPL");