1 // SPDX-License-Identifier: GPL-2.0
2 #include <kunit/test.h>
3 #include <kunit/test-bug.h>
4 #include <linux/mm.h>
5 #include <linux/slab.h>
6 #include <linux/module.h>
7 #include <linux/kernel.h>
8 #include "../mm/slab.h"
9
10 static struct kunit_resource resource;
11 static int slab_errors;
12
13 /*
14 * Wrapper function for kmem_cache_create(), which reduces 2 parameters:
15 * 'align' and 'ctor', and sets SLAB_SKIP_KFENCE flag to avoid getting an
16 * object from kfence pool, where the operation could be caught by both
17 * our test and kfence sanity check.
18 */
test_kmem_cache_create(const char * name,unsigned int size,slab_flags_t flags)19 static struct kmem_cache *test_kmem_cache_create(const char *name,
20 unsigned int size, slab_flags_t flags)
21 {
22 struct kmem_cache *s = kmem_cache_create(name, size, 0,
23 (flags | SLAB_NO_USER_FLAGS), NULL);
24 s->flags |= SLAB_SKIP_KFENCE;
25 return s;
26 }
27
test_clobber_zone(struct kunit * test)28 static void test_clobber_zone(struct kunit *test)
29 {
30 struct kmem_cache *s = test_kmem_cache_create("TestSlub_RZ_alloc", 64,
31 SLAB_RED_ZONE);
32 u8 *p = kmem_cache_alloc(s, GFP_KERNEL);
33
34 kasan_disable_current();
35 p[64] = 0x12;
36
37 validate_slab_cache(s);
38 KUNIT_EXPECT_EQ(test, 2, slab_errors);
39
40 kasan_enable_current();
41 kmem_cache_free(s, p);
42 kmem_cache_destroy(s);
43 }
44
45 #ifndef CONFIG_KASAN
test_next_pointer(struct kunit * test)46 static void test_next_pointer(struct kunit *test)
47 {
48 struct kmem_cache *s = test_kmem_cache_create("TestSlub_next_ptr_free",
49 64, SLAB_POISON);
50 u8 *p = kmem_cache_alloc(s, GFP_KERNEL);
51 unsigned long tmp;
52 unsigned long *ptr_addr;
53
54 kmem_cache_free(s, p);
55
56 ptr_addr = (unsigned long *)(p + s->offset);
57 tmp = *ptr_addr;
58 p[s->offset] = ~p[s->offset];
59
60 /*
61 * Expecting three errors.
62 * One for the corrupted freechain and the other one for the wrong
63 * count of objects in use. The third error is fixing broken cache.
64 */
65 validate_slab_cache(s);
66 KUNIT_EXPECT_EQ(test, 3, slab_errors);
67
68 /*
69 * Try to repair corrupted freepointer.
70 * Still expecting two errors. The first for the wrong count
71 * of objects in use.
72 * The second error is for fixing broken cache.
73 */
74 *ptr_addr = tmp;
75 slab_errors = 0;
76
77 validate_slab_cache(s);
78 KUNIT_EXPECT_EQ(test, 2, slab_errors);
79
80 /*
81 * Previous validation repaired the count of objects in use.
82 * Now expecting no error.
83 */
84 slab_errors = 0;
85 validate_slab_cache(s);
86 KUNIT_EXPECT_EQ(test, 0, slab_errors);
87
88 kmem_cache_destroy(s);
89 }
90
test_first_word(struct kunit * test)91 static void test_first_word(struct kunit *test)
92 {
93 struct kmem_cache *s = test_kmem_cache_create("TestSlub_1th_word_free",
94 64, SLAB_POISON);
95 u8 *p = kmem_cache_alloc(s, GFP_KERNEL);
96
97 kmem_cache_free(s, p);
98 *p = 0x78;
99
100 validate_slab_cache(s);
101 KUNIT_EXPECT_EQ(test, 2, slab_errors);
102
103 kmem_cache_destroy(s);
104 }
105
test_clobber_50th_byte(struct kunit * test)106 static void test_clobber_50th_byte(struct kunit *test)
107 {
108 struct kmem_cache *s = test_kmem_cache_create("TestSlub_50th_word_free",
109 64, SLAB_POISON);
110 u8 *p = kmem_cache_alloc(s, GFP_KERNEL);
111
112 kmem_cache_free(s, p);
113 p[50] = 0x9a;
114
115 validate_slab_cache(s);
116 KUNIT_EXPECT_EQ(test, 2, slab_errors);
117
118 kmem_cache_destroy(s);
119 }
120 #endif
121
test_clobber_redzone_free(struct kunit * test)122 static void test_clobber_redzone_free(struct kunit *test)
123 {
124 struct kmem_cache *s = test_kmem_cache_create("TestSlub_RZ_free", 64,
125 SLAB_RED_ZONE);
126 u8 *p = kmem_cache_alloc(s, GFP_KERNEL);
127
128 kasan_disable_current();
129 kmem_cache_free(s, p);
130 p[64] = 0xab;
131
132 validate_slab_cache(s);
133 KUNIT_EXPECT_EQ(test, 2, slab_errors);
134
135 kasan_enable_current();
136 kmem_cache_destroy(s);
137 }
138
test_kmalloc_redzone_access(struct kunit * test)139 static void test_kmalloc_redzone_access(struct kunit *test)
140 {
141 struct kmem_cache *s = test_kmem_cache_create("TestSlub_RZ_kmalloc", 32,
142 SLAB_KMALLOC|SLAB_STORE_USER|SLAB_RED_ZONE);
143 u8 *p = kmalloc_trace(s, GFP_KERNEL, 18);
144
145 kasan_disable_current();
146
147 /* Suppress the -Warray-bounds warning */
148 OPTIMIZER_HIDE_VAR(p);
149 p[18] = 0xab;
150 p[19] = 0xab;
151
152 validate_slab_cache(s);
153 KUNIT_EXPECT_EQ(test, 2, slab_errors);
154
155 kasan_enable_current();
156 kmem_cache_free(s, p);
157 kmem_cache_destroy(s);
158 }
159
test_init(struct kunit * test)160 static int test_init(struct kunit *test)
161 {
162 slab_errors = 0;
163
164 kunit_add_named_resource(test, NULL, NULL, &resource,
165 "slab_errors", &slab_errors);
166 return 0;
167 }
168
169 static struct kunit_case test_cases[] = {
170 KUNIT_CASE(test_clobber_zone),
171
172 #ifndef CONFIG_KASAN
173 KUNIT_CASE(test_next_pointer),
174 KUNIT_CASE(test_first_word),
175 KUNIT_CASE(test_clobber_50th_byte),
176 #endif
177
178 KUNIT_CASE(test_clobber_redzone_free),
179 KUNIT_CASE(test_kmalloc_redzone_access),
180 {}
181 };
182
183 static struct kunit_suite test_suite = {
184 .name = "slub_test",
185 .init = test_init,
186 .test_cases = test_cases,
187 };
188 kunit_test_suite(test_suite);
189
190 MODULE_LICENSE("GPL");
191