1bc8fbc5fSMarco Elver // SPDX-License-Identifier: GPL-2.0 2bc8fbc5fSMarco Elver /* 3bc8fbc5fSMarco Elver * Test cases for KFENCE memory safety error detector. Since the interface with 4bc8fbc5fSMarco Elver * which KFENCE's reports are obtained is via the console, this is the output we 5bc8fbc5fSMarco Elver * should verify. For each test case checks the presence (or absence) of 6bc8fbc5fSMarco Elver * generated reports. Relies on 'console' tracepoint to capture reports as they 7bc8fbc5fSMarco Elver * appear in the kernel log. 8bc8fbc5fSMarco Elver * 9bc8fbc5fSMarco Elver * Copyright (C) 2020, Google LLC. 10bc8fbc5fSMarco Elver * Author: Alexander Potapenko <glider@google.com> 11bc8fbc5fSMarco Elver * Marco Elver <elver@google.com> 12bc8fbc5fSMarco Elver */ 13bc8fbc5fSMarco Elver 14bc8fbc5fSMarco Elver #include <kunit/test.h> 15bc8fbc5fSMarco Elver #include <linux/jiffies.h> 16bc8fbc5fSMarco Elver #include <linux/kernel.h> 17bc8fbc5fSMarco Elver #include <linux/kfence.h> 18bc8fbc5fSMarco Elver #include <linux/mm.h> 19bc8fbc5fSMarco Elver #include <linux/random.h> 20bc8fbc5fSMarco Elver #include <linux/slab.h> 21bc8fbc5fSMarco Elver #include <linux/spinlock.h> 22bc8fbc5fSMarco Elver #include <linux/string.h> 23bc8fbc5fSMarco Elver #include <linux/tracepoint.h> 24bc8fbc5fSMarco Elver #include <trace/events/printk.h> 25bc8fbc5fSMarco Elver 26bc8fbc5fSMarco Elver #include "kfence.h" 27bc8fbc5fSMarco Elver 28bc8fbc5fSMarco Elver /* Report as observed from console. */ 29bc8fbc5fSMarco Elver static struct { 30bc8fbc5fSMarco Elver spinlock_t lock; 31bc8fbc5fSMarco Elver int nlines; 32bc8fbc5fSMarco Elver char lines[2][256]; 33bc8fbc5fSMarco Elver } observed = { 34bc8fbc5fSMarco Elver .lock = __SPIN_LOCK_UNLOCKED(observed.lock), 35bc8fbc5fSMarco Elver }; 36bc8fbc5fSMarco Elver 37bc8fbc5fSMarco Elver /* Probe for console output: obtains observed lines of interest. */ 38bc8fbc5fSMarco Elver static void probe_console(void *ignore, const char *buf, size_t len) 39bc8fbc5fSMarco Elver { 40bc8fbc5fSMarco Elver unsigned long flags; 41bc8fbc5fSMarco Elver int nlines; 42bc8fbc5fSMarco Elver 43bc8fbc5fSMarco Elver spin_lock_irqsave(&observed.lock, flags); 44bc8fbc5fSMarco Elver nlines = observed.nlines; 45bc8fbc5fSMarco Elver 46bc8fbc5fSMarco Elver if (strnstr(buf, "BUG: KFENCE: ", len) && strnstr(buf, "test_", len)) { 47bc8fbc5fSMarco Elver /* 48bc8fbc5fSMarco Elver * KFENCE report and related to the test. 49bc8fbc5fSMarco Elver * 50bc8fbc5fSMarco Elver * The provided @buf is not NUL-terminated; copy no more than 51bc8fbc5fSMarco Elver * @len bytes and let strscpy() add the missing NUL-terminator. 52bc8fbc5fSMarco Elver */ 53bc8fbc5fSMarco Elver strscpy(observed.lines[0], buf, min(len + 1, sizeof(observed.lines[0]))); 54bc8fbc5fSMarco Elver nlines = 1; 55bc8fbc5fSMarco Elver } else if (nlines == 1 && (strnstr(buf, "at 0x", len) || strnstr(buf, "of 0x", len))) { 56bc8fbc5fSMarco Elver strscpy(observed.lines[nlines++], buf, min(len + 1, sizeof(observed.lines[0]))); 57bc8fbc5fSMarco Elver } 58bc8fbc5fSMarco Elver 59bc8fbc5fSMarco Elver WRITE_ONCE(observed.nlines, nlines); /* Publish new nlines. */ 60bc8fbc5fSMarco Elver spin_unlock_irqrestore(&observed.lock, flags); 61bc8fbc5fSMarco Elver } 62bc8fbc5fSMarco Elver 63bc8fbc5fSMarco Elver /* Check if a report related to the test exists. */ 64bc8fbc5fSMarco Elver static bool report_available(void) 65bc8fbc5fSMarco Elver { 66bc8fbc5fSMarco Elver return READ_ONCE(observed.nlines) == ARRAY_SIZE(observed.lines); 67bc8fbc5fSMarco Elver } 68bc8fbc5fSMarco Elver 69bc8fbc5fSMarco Elver /* Information we expect in a report. */ 70bc8fbc5fSMarco Elver struct expect_report { 71bc8fbc5fSMarco Elver enum kfence_error_type type; /* The type or error. */ 72bc8fbc5fSMarco Elver void *fn; /* Function pointer to expected function where access occurred. */ 73bc8fbc5fSMarco Elver char *addr; /* Address at which the bad access occurred. */ 74bc8fbc5fSMarco Elver bool is_write; /* Is access a write. */ 75bc8fbc5fSMarco Elver }; 76bc8fbc5fSMarco Elver 77bc8fbc5fSMarco Elver static const char *get_access_type(const struct expect_report *r) 78bc8fbc5fSMarco Elver { 79bc8fbc5fSMarco Elver return r->is_write ? "write" : "read"; 80bc8fbc5fSMarco Elver } 81bc8fbc5fSMarco Elver 82bc8fbc5fSMarco Elver /* Check observed report matches information in @r. */ 83bc8fbc5fSMarco Elver static bool report_matches(const struct expect_report *r) 84bc8fbc5fSMarco Elver { 85bc8fbc5fSMarco Elver bool ret = false; 86bc8fbc5fSMarco Elver unsigned long flags; 87bc8fbc5fSMarco Elver typeof(observed.lines) expect; 88bc8fbc5fSMarco Elver const char *end; 89bc8fbc5fSMarco Elver char *cur; 90bc8fbc5fSMarco Elver 91bc8fbc5fSMarco Elver /* Doubled-checked locking. */ 92bc8fbc5fSMarco Elver if (!report_available()) 93bc8fbc5fSMarco Elver return false; 94bc8fbc5fSMarco Elver 95bc8fbc5fSMarco Elver /* Generate expected report contents. */ 96bc8fbc5fSMarco Elver 97bc8fbc5fSMarco Elver /* Title */ 98bc8fbc5fSMarco Elver cur = expect[0]; 99bc8fbc5fSMarco Elver end = &expect[0][sizeof(expect[0]) - 1]; 100bc8fbc5fSMarco Elver switch (r->type) { 101bc8fbc5fSMarco Elver case KFENCE_ERROR_OOB: 102bc8fbc5fSMarco Elver cur += scnprintf(cur, end - cur, "BUG: KFENCE: out-of-bounds %s", 103bc8fbc5fSMarco Elver get_access_type(r)); 104bc8fbc5fSMarco Elver break; 105bc8fbc5fSMarco Elver case KFENCE_ERROR_UAF: 106bc8fbc5fSMarco Elver cur += scnprintf(cur, end - cur, "BUG: KFENCE: use-after-free %s", 107bc8fbc5fSMarco Elver get_access_type(r)); 108bc8fbc5fSMarco Elver break; 109bc8fbc5fSMarco Elver case KFENCE_ERROR_CORRUPTION: 110bc8fbc5fSMarco Elver cur += scnprintf(cur, end - cur, "BUG: KFENCE: memory corruption"); 111bc8fbc5fSMarco Elver break; 112bc8fbc5fSMarco Elver case KFENCE_ERROR_INVALID: 113bc8fbc5fSMarco Elver cur += scnprintf(cur, end - cur, "BUG: KFENCE: invalid %s", 114bc8fbc5fSMarco Elver get_access_type(r)); 115bc8fbc5fSMarco Elver break; 116bc8fbc5fSMarco Elver case KFENCE_ERROR_INVALID_FREE: 117bc8fbc5fSMarco Elver cur += scnprintf(cur, end - cur, "BUG: KFENCE: invalid free"); 118bc8fbc5fSMarco Elver break; 119bc8fbc5fSMarco Elver } 120bc8fbc5fSMarco Elver 121bc8fbc5fSMarco Elver scnprintf(cur, end - cur, " in %pS", r->fn); 122bc8fbc5fSMarco Elver /* The exact offset won't match, remove it; also strip module name. */ 123bc8fbc5fSMarco Elver cur = strchr(expect[0], '+'); 124bc8fbc5fSMarco Elver if (cur) 125bc8fbc5fSMarco Elver *cur = '\0'; 126bc8fbc5fSMarco Elver 127bc8fbc5fSMarco Elver /* Access information */ 128bc8fbc5fSMarco Elver cur = expect[1]; 129bc8fbc5fSMarco Elver end = &expect[1][sizeof(expect[1]) - 1]; 130bc8fbc5fSMarco Elver 131bc8fbc5fSMarco Elver switch (r->type) { 132bc8fbc5fSMarco Elver case KFENCE_ERROR_OOB: 133bc8fbc5fSMarco Elver cur += scnprintf(cur, end - cur, "Out-of-bounds %s at", get_access_type(r)); 134bc8fbc5fSMarco Elver break; 135bc8fbc5fSMarco Elver case KFENCE_ERROR_UAF: 136bc8fbc5fSMarco Elver cur += scnprintf(cur, end - cur, "Use-after-free %s at", get_access_type(r)); 137bc8fbc5fSMarco Elver break; 138bc8fbc5fSMarco Elver case KFENCE_ERROR_CORRUPTION: 139bc8fbc5fSMarco Elver cur += scnprintf(cur, end - cur, "Corrupted memory at"); 140bc8fbc5fSMarco Elver break; 141bc8fbc5fSMarco Elver case KFENCE_ERROR_INVALID: 142bc8fbc5fSMarco Elver cur += scnprintf(cur, end - cur, "Invalid %s at", get_access_type(r)); 143bc8fbc5fSMarco Elver break; 144bc8fbc5fSMarco Elver case KFENCE_ERROR_INVALID_FREE: 145bc8fbc5fSMarco Elver cur += scnprintf(cur, end - cur, "Invalid free of"); 146bc8fbc5fSMarco Elver break; 147bc8fbc5fSMarco Elver } 148bc8fbc5fSMarco Elver 14935beccf0SMarco Elver cur += scnprintf(cur, end - cur, " 0x%p", (void *)r->addr); 150bc8fbc5fSMarco Elver 151bc8fbc5fSMarco Elver spin_lock_irqsave(&observed.lock, flags); 152bc8fbc5fSMarco Elver if (!report_available()) 153bc8fbc5fSMarco Elver goto out; /* A new report is being captured. */ 154bc8fbc5fSMarco Elver 155bc8fbc5fSMarco Elver /* Finally match expected output to what we actually observed. */ 156bc8fbc5fSMarco Elver ret = strstr(observed.lines[0], expect[0]) && strstr(observed.lines[1], expect[1]); 157bc8fbc5fSMarco Elver out: 158bc8fbc5fSMarco Elver spin_unlock_irqrestore(&observed.lock, flags); 159bc8fbc5fSMarco Elver return ret; 160bc8fbc5fSMarco Elver } 161bc8fbc5fSMarco Elver 162bc8fbc5fSMarco Elver /* ===== Test cases ===== */ 163bc8fbc5fSMarco Elver 164bc8fbc5fSMarco Elver #define TEST_PRIV_WANT_MEMCACHE ((void *)1) 165bc8fbc5fSMarco Elver 166bc8fbc5fSMarco Elver /* Cache used by tests; if NULL, allocate from kmalloc instead. */ 167bc8fbc5fSMarco Elver static struct kmem_cache *test_cache; 168bc8fbc5fSMarco Elver 169bc8fbc5fSMarco Elver static size_t setup_test_cache(struct kunit *test, size_t size, slab_flags_t flags, 170bc8fbc5fSMarco Elver void (*ctor)(void *)) 171bc8fbc5fSMarco Elver { 172bc8fbc5fSMarco Elver if (test->priv != TEST_PRIV_WANT_MEMCACHE) 173bc8fbc5fSMarco Elver return size; 174bc8fbc5fSMarco Elver 175bc8fbc5fSMarco Elver kunit_info(test, "%s: size=%zu, ctor=%ps\n", __func__, size, ctor); 176bc8fbc5fSMarco Elver 177bc8fbc5fSMarco Elver /* 178bc8fbc5fSMarco Elver * Use SLAB_NOLEAKTRACE to prevent merging with existing caches. Any 179bc8fbc5fSMarco Elver * other flag in SLAB_NEVER_MERGE also works. Use SLAB_ACCOUNT to 180bc8fbc5fSMarco Elver * allocate via memcg, if enabled. 181bc8fbc5fSMarco Elver */ 182bc8fbc5fSMarco Elver flags |= SLAB_NOLEAKTRACE | SLAB_ACCOUNT; 183bc8fbc5fSMarco Elver test_cache = kmem_cache_create("test", size, 1, flags, ctor); 184bc8fbc5fSMarco Elver KUNIT_ASSERT_TRUE_MSG(test, test_cache, "could not create cache"); 185bc8fbc5fSMarco Elver 186bc8fbc5fSMarco Elver return size; 187bc8fbc5fSMarco Elver } 188bc8fbc5fSMarco Elver 189bc8fbc5fSMarco Elver static void test_cache_destroy(void) 190bc8fbc5fSMarco Elver { 191bc8fbc5fSMarco Elver if (!test_cache) 192bc8fbc5fSMarco Elver return; 193bc8fbc5fSMarco Elver 194bc8fbc5fSMarco Elver kmem_cache_destroy(test_cache); 195bc8fbc5fSMarco Elver test_cache = NULL; 196bc8fbc5fSMarco Elver } 197bc8fbc5fSMarco Elver 198bc8fbc5fSMarco Elver static inline size_t kmalloc_cache_alignment(size_t size) 199bc8fbc5fSMarco Elver { 200588c7fa0SHyeonggon Yoo return kmalloc_caches[kmalloc_type(GFP_KERNEL)][__kmalloc_index(size, false)]->align; 201bc8fbc5fSMarco Elver } 202bc8fbc5fSMarco Elver 203bc8fbc5fSMarco Elver /* Must always inline to match stack trace against caller. */ 204bc8fbc5fSMarco Elver static __always_inline void test_free(void *ptr) 205bc8fbc5fSMarco Elver { 206bc8fbc5fSMarco Elver if (test_cache) 207bc8fbc5fSMarco Elver kmem_cache_free(test_cache, ptr); 208bc8fbc5fSMarco Elver else 209bc8fbc5fSMarco Elver kfree(ptr); 210bc8fbc5fSMarco Elver } 211bc8fbc5fSMarco Elver 212bc8fbc5fSMarco Elver /* 213bc8fbc5fSMarco Elver * If this should be a KFENCE allocation, and on which side the allocation and 214bc8fbc5fSMarco Elver * the closest guard page should be. 215bc8fbc5fSMarco Elver */ 216bc8fbc5fSMarco Elver enum allocation_policy { 217bc8fbc5fSMarco Elver ALLOCATE_ANY, /* KFENCE, any side. */ 218bc8fbc5fSMarco Elver ALLOCATE_LEFT, /* KFENCE, left side of page. */ 219bc8fbc5fSMarco Elver ALLOCATE_RIGHT, /* KFENCE, right side of page. */ 220bc8fbc5fSMarco Elver ALLOCATE_NONE, /* No KFENCE allocation. */ 221bc8fbc5fSMarco Elver }; 222bc8fbc5fSMarco Elver 223bc8fbc5fSMarco Elver /* 224bc8fbc5fSMarco Elver * Try to get a guarded allocation from KFENCE. Uses either kmalloc() or the 225bc8fbc5fSMarco Elver * current test_cache if set up. 226bc8fbc5fSMarco Elver */ 227bc8fbc5fSMarco Elver static void *test_alloc(struct kunit *test, size_t size, gfp_t gfp, enum allocation_policy policy) 228bc8fbc5fSMarco Elver { 229bc8fbc5fSMarco Elver void *alloc; 230bc8fbc5fSMarco Elver unsigned long timeout, resched_after; 231bc8fbc5fSMarco Elver const char *policy_name; 232bc8fbc5fSMarco Elver 233bc8fbc5fSMarco Elver switch (policy) { 234bc8fbc5fSMarco Elver case ALLOCATE_ANY: 235bc8fbc5fSMarco Elver policy_name = "any"; 236bc8fbc5fSMarco Elver break; 237bc8fbc5fSMarco Elver case ALLOCATE_LEFT: 238bc8fbc5fSMarco Elver policy_name = "left"; 239bc8fbc5fSMarco Elver break; 240bc8fbc5fSMarco Elver case ALLOCATE_RIGHT: 241bc8fbc5fSMarco Elver policy_name = "right"; 242bc8fbc5fSMarco Elver break; 243bc8fbc5fSMarco Elver case ALLOCATE_NONE: 244bc8fbc5fSMarco Elver policy_name = "none"; 245bc8fbc5fSMarco Elver break; 246bc8fbc5fSMarco Elver } 247bc8fbc5fSMarco Elver 248bc8fbc5fSMarco Elver kunit_info(test, "%s: size=%zu, gfp=%x, policy=%s, cache=%i\n", __func__, size, gfp, 249bc8fbc5fSMarco Elver policy_name, !!test_cache); 250bc8fbc5fSMarco Elver 251bc8fbc5fSMarco Elver /* 252bc8fbc5fSMarco Elver * 100x the sample interval should be more than enough to ensure we get 253bc8fbc5fSMarco Elver * a KFENCE allocation eventually. 254bc8fbc5fSMarco Elver */ 255bc8fbc5fSMarco Elver timeout = jiffies + msecs_to_jiffies(100 * CONFIG_KFENCE_SAMPLE_INTERVAL); 256bc8fbc5fSMarco Elver /* 257bc8fbc5fSMarco Elver * Especially for non-preemption kernels, ensure the allocation-gate 258bc8fbc5fSMarco Elver * timer can catch up: after @resched_after, every failed allocation 259bc8fbc5fSMarco Elver * attempt yields, to ensure the allocation-gate timer is scheduled. 260bc8fbc5fSMarco Elver */ 261bc8fbc5fSMarco Elver resched_after = jiffies + msecs_to_jiffies(CONFIG_KFENCE_SAMPLE_INTERVAL); 262bc8fbc5fSMarco Elver do { 263bc8fbc5fSMarco Elver if (test_cache) 264bc8fbc5fSMarco Elver alloc = kmem_cache_alloc(test_cache, gfp); 265bc8fbc5fSMarco Elver else 266bc8fbc5fSMarco Elver alloc = kmalloc(size, gfp); 267bc8fbc5fSMarco Elver 268bc8fbc5fSMarco Elver if (is_kfence_address(alloc)) { 269bc8fbc5fSMarco Elver struct page *page = virt_to_head_page(alloc); 270588c7fa0SHyeonggon Yoo struct kmem_cache *s = test_cache ?: 271588c7fa0SHyeonggon Yoo kmalloc_caches[kmalloc_type(GFP_KERNEL)][__kmalloc_index(size, false)]; 272bc8fbc5fSMarco Elver 273bc8fbc5fSMarco Elver /* 274bc8fbc5fSMarco Elver * Verify that various helpers return the right values 275bc8fbc5fSMarco Elver * even for KFENCE objects; these are required so that 276bc8fbc5fSMarco Elver * memcg accounting works correctly. 277bc8fbc5fSMarco Elver */ 278bc8fbc5fSMarco Elver KUNIT_EXPECT_EQ(test, obj_to_index(s, page, alloc), 0U); 279bc8fbc5fSMarco Elver KUNIT_EXPECT_EQ(test, objs_per_slab_page(s, page), 1); 280bc8fbc5fSMarco Elver 281bc8fbc5fSMarco Elver if (policy == ALLOCATE_ANY) 282bc8fbc5fSMarco Elver return alloc; 283bc8fbc5fSMarco Elver if (policy == ALLOCATE_LEFT && IS_ALIGNED((unsigned long)alloc, PAGE_SIZE)) 284bc8fbc5fSMarco Elver return alloc; 285bc8fbc5fSMarco Elver if (policy == ALLOCATE_RIGHT && 286bc8fbc5fSMarco Elver !IS_ALIGNED((unsigned long)alloc, PAGE_SIZE)) 287bc8fbc5fSMarco Elver return alloc; 288bc8fbc5fSMarco Elver } else if (policy == ALLOCATE_NONE) 289bc8fbc5fSMarco Elver return alloc; 290bc8fbc5fSMarco Elver 291bc8fbc5fSMarco Elver test_free(alloc); 292bc8fbc5fSMarco Elver 293bc8fbc5fSMarco Elver if (time_after(jiffies, resched_after)) 294bc8fbc5fSMarco Elver cond_resched(); 295bc8fbc5fSMarco Elver } while (time_before(jiffies, timeout)); 296bc8fbc5fSMarco Elver 297bc8fbc5fSMarco Elver KUNIT_ASSERT_TRUE_MSG(test, false, "failed to allocate from KFENCE"); 298bc8fbc5fSMarco Elver return NULL; /* Unreachable. */ 299bc8fbc5fSMarco Elver } 300bc8fbc5fSMarco Elver 301bc8fbc5fSMarco Elver static void test_out_of_bounds_read(struct kunit *test) 302bc8fbc5fSMarco Elver { 303bc8fbc5fSMarco Elver size_t size = 32; 304bc8fbc5fSMarco Elver struct expect_report expect = { 305bc8fbc5fSMarco Elver .type = KFENCE_ERROR_OOB, 306bc8fbc5fSMarco Elver .fn = test_out_of_bounds_read, 307bc8fbc5fSMarco Elver .is_write = false, 308bc8fbc5fSMarco Elver }; 309bc8fbc5fSMarco Elver char *buf; 310bc8fbc5fSMarco Elver 311bc8fbc5fSMarco Elver setup_test_cache(test, size, 0, NULL); 312bc8fbc5fSMarco Elver 313bc8fbc5fSMarco Elver /* 314bc8fbc5fSMarco Elver * If we don't have our own cache, adjust based on alignment, so that we 315bc8fbc5fSMarco Elver * actually access guard pages on either side. 316bc8fbc5fSMarco Elver */ 317bc8fbc5fSMarco Elver if (!test_cache) 318bc8fbc5fSMarco Elver size = kmalloc_cache_alignment(size); 319bc8fbc5fSMarco Elver 320bc8fbc5fSMarco Elver /* Test both sides. */ 321bc8fbc5fSMarco Elver 322bc8fbc5fSMarco Elver buf = test_alloc(test, size, GFP_KERNEL, ALLOCATE_LEFT); 323bc8fbc5fSMarco Elver expect.addr = buf - 1; 324bc8fbc5fSMarco Elver READ_ONCE(*expect.addr); 325bc8fbc5fSMarco Elver KUNIT_EXPECT_TRUE(test, report_matches(&expect)); 326bc8fbc5fSMarco Elver test_free(buf); 327bc8fbc5fSMarco Elver 328bc8fbc5fSMarco Elver buf = test_alloc(test, size, GFP_KERNEL, ALLOCATE_RIGHT); 329bc8fbc5fSMarco Elver expect.addr = buf + size; 330bc8fbc5fSMarco Elver READ_ONCE(*expect.addr); 331bc8fbc5fSMarco Elver KUNIT_EXPECT_TRUE(test, report_matches(&expect)); 332bc8fbc5fSMarco Elver test_free(buf); 333bc8fbc5fSMarco Elver } 334bc8fbc5fSMarco Elver 335bc8fbc5fSMarco Elver static void test_out_of_bounds_write(struct kunit *test) 336bc8fbc5fSMarco Elver { 337bc8fbc5fSMarco Elver size_t size = 32; 338bc8fbc5fSMarco Elver struct expect_report expect = { 339bc8fbc5fSMarco Elver .type = KFENCE_ERROR_OOB, 340bc8fbc5fSMarco Elver .fn = test_out_of_bounds_write, 341bc8fbc5fSMarco Elver .is_write = true, 342bc8fbc5fSMarco Elver }; 343bc8fbc5fSMarco Elver char *buf; 344bc8fbc5fSMarco Elver 345bc8fbc5fSMarco Elver setup_test_cache(test, size, 0, NULL); 346bc8fbc5fSMarco Elver buf = test_alloc(test, size, GFP_KERNEL, ALLOCATE_LEFT); 347bc8fbc5fSMarco Elver expect.addr = buf - 1; 348bc8fbc5fSMarco Elver WRITE_ONCE(*expect.addr, 42); 349bc8fbc5fSMarco Elver KUNIT_EXPECT_TRUE(test, report_matches(&expect)); 350bc8fbc5fSMarco Elver test_free(buf); 351bc8fbc5fSMarco Elver } 352bc8fbc5fSMarco Elver 353bc8fbc5fSMarco Elver static void test_use_after_free_read(struct kunit *test) 354bc8fbc5fSMarco Elver { 355bc8fbc5fSMarco Elver const size_t size = 32; 356bc8fbc5fSMarco Elver struct expect_report expect = { 357bc8fbc5fSMarco Elver .type = KFENCE_ERROR_UAF, 358bc8fbc5fSMarco Elver .fn = test_use_after_free_read, 359bc8fbc5fSMarco Elver .is_write = false, 360bc8fbc5fSMarco Elver }; 361bc8fbc5fSMarco Elver 362bc8fbc5fSMarco Elver setup_test_cache(test, size, 0, NULL); 363bc8fbc5fSMarco Elver expect.addr = test_alloc(test, size, GFP_KERNEL, ALLOCATE_ANY); 364bc8fbc5fSMarco Elver test_free(expect.addr); 365bc8fbc5fSMarco Elver READ_ONCE(*expect.addr); 366bc8fbc5fSMarco Elver KUNIT_EXPECT_TRUE(test, report_matches(&expect)); 367bc8fbc5fSMarco Elver } 368bc8fbc5fSMarco Elver 369bc8fbc5fSMarco Elver static void test_double_free(struct kunit *test) 370bc8fbc5fSMarco Elver { 371bc8fbc5fSMarco Elver const size_t size = 32; 372bc8fbc5fSMarco Elver struct expect_report expect = { 373bc8fbc5fSMarco Elver .type = KFENCE_ERROR_INVALID_FREE, 374bc8fbc5fSMarco Elver .fn = test_double_free, 375bc8fbc5fSMarco Elver }; 376bc8fbc5fSMarco Elver 377bc8fbc5fSMarco Elver setup_test_cache(test, size, 0, NULL); 378bc8fbc5fSMarco Elver expect.addr = test_alloc(test, size, GFP_KERNEL, ALLOCATE_ANY); 379bc8fbc5fSMarco Elver test_free(expect.addr); 380bc8fbc5fSMarco Elver test_free(expect.addr); /* Double-free. */ 381bc8fbc5fSMarco Elver KUNIT_EXPECT_TRUE(test, report_matches(&expect)); 382bc8fbc5fSMarco Elver } 383bc8fbc5fSMarco Elver 384bc8fbc5fSMarco Elver static void test_invalid_addr_free(struct kunit *test) 385bc8fbc5fSMarco Elver { 386bc8fbc5fSMarco Elver const size_t size = 32; 387bc8fbc5fSMarco Elver struct expect_report expect = { 388bc8fbc5fSMarco Elver .type = KFENCE_ERROR_INVALID_FREE, 389bc8fbc5fSMarco Elver .fn = test_invalid_addr_free, 390bc8fbc5fSMarco Elver }; 391bc8fbc5fSMarco Elver char *buf; 392bc8fbc5fSMarco Elver 393bc8fbc5fSMarco Elver setup_test_cache(test, size, 0, NULL); 394bc8fbc5fSMarco Elver buf = test_alloc(test, size, GFP_KERNEL, ALLOCATE_ANY); 395bc8fbc5fSMarco Elver expect.addr = buf + 1; /* Free on invalid address. */ 396bc8fbc5fSMarco Elver test_free(expect.addr); /* Invalid address free. */ 397bc8fbc5fSMarco Elver test_free(buf); /* No error. */ 398bc8fbc5fSMarco Elver KUNIT_EXPECT_TRUE(test, report_matches(&expect)); 399bc8fbc5fSMarco Elver } 400bc8fbc5fSMarco Elver 401bc8fbc5fSMarco Elver static void test_corruption(struct kunit *test) 402bc8fbc5fSMarco Elver { 403bc8fbc5fSMarco Elver size_t size = 32; 404bc8fbc5fSMarco Elver struct expect_report expect = { 405bc8fbc5fSMarco Elver .type = KFENCE_ERROR_CORRUPTION, 406bc8fbc5fSMarco Elver .fn = test_corruption, 407bc8fbc5fSMarco Elver }; 408bc8fbc5fSMarco Elver char *buf; 409bc8fbc5fSMarco Elver 410bc8fbc5fSMarco Elver setup_test_cache(test, size, 0, NULL); 411bc8fbc5fSMarco Elver 412bc8fbc5fSMarco Elver /* Test both sides. */ 413bc8fbc5fSMarco Elver 414bc8fbc5fSMarco Elver buf = test_alloc(test, size, GFP_KERNEL, ALLOCATE_LEFT); 415bc8fbc5fSMarco Elver expect.addr = buf + size; 416bc8fbc5fSMarco Elver WRITE_ONCE(*expect.addr, 42); 417bc8fbc5fSMarco Elver test_free(buf); 418bc8fbc5fSMarco Elver KUNIT_EXPECT_TRUE(test, report_matches(&expect)); 419bc8fbc5fSMarco Elver 420bc8fbc5fSMarco Elver buf = test_alloc(test, size, GFP_KERNEL, ALLOCATE_RIGHT); 421bc8fbc5fSMarco Elver expect.addr = buf - 1; 422bc8fbc5fSMarco Elver WRITE_ONCE(*expect.addr, 42); 423bc8fbc5fSMarco Elver test_free(buf); 424bc8fbc5fSMarco Elver KUNIT_EXPECT_TRUE(test, report_matches(&expect)); 425bc8fbc5fSMarco Elver } 426bc8fbc5fSMarco Elver 427bc8fbc5fSMarco Elver /* 428bc8fbc5fSMarco Elver * KFENCE is unable to detect an OOB if the allocation's alignment requirements 429bc8fbc5fSMarco Elver * leave a gap between the object and the guard page. Specifically, an 430bc8fbc5fSMarco Elver * allocation of e.g. 73 bytes is aligned on 8 and 128 bytes for SLUB or SLAB 431bc8fbc5fSMarco Elver * respectively. Therefore it is impossible for the allocated object to 432bc8fbc5fSMarco Elver * contiguously line up with the right guard page. 433bc8fbc5fSMarco Elver * 434bc8fbc5fSMarco Elver * However, we test that an access to memory beyond the gap results in KFENCE 435bc8fbc5fSMarco Elver * detecting an OOB access. 436bc8fbc5fSMarco Elver */ 437bc8fbc5fSMarco Elver static void test_kmalloc_aligned_oob_read(struct kunit *test) 438bc8fbc5fSMarco Elver { 439bc8fbc5fSMarco Elver const size_t size = 73; 440bc8fbc5fSMarco Elver const size_t align = kmalloc_cache_alignment(size); 441bc8fbc5fSMarco Elver struct expect_report expect = { 442bc8fbc5fSMarco Elver .type = KFENCE_ERROR_OOB, 443bc8fbc5fSMarco Elver .fn = test_kmalloc_aligned_oob_read, 444bc8fbc5fSMarco Elver .is_write = false, 445bc8fbc5fSMarco Elver }; 446bc8fbc5fSMarco Elver char *buf; 447bc8fbc5fSMarco Elver 448bc8fbc5fSMarco Elver buf = test_alloc(test, size, GFP_KERNEL, ALLOCATE_RIGHT); 449bc8fbc5fSMarco Elver 450bc8fbc5fSMarco Elver /* 451bc8fbc5fSMarco Elver * The object is offset to the right, so there won't be an OOB to the 452bc8fbc5fSMarco Elver * left of it. 453bc8fbc5fSMarco Elver */ 454bc8fbc5fSMarco Elver READ_ONCE(*(buf - 1)); 455bc8fbc5fSMarco Elver KUNIT_EXPECT_FALSE(test, report_available()); 456bc8fbc5fSMarco Elver 457bc8fbc5fSMarco Elver /* 458bc8fbc5fSMarco Elver * @buf must be aligned on @align, therefore buf + size belongs to the 459bc8fbc5fSMarco Elver * same page -> no OOB. 460bc8fbc5fSMarco Elver */ 461bc8fbc5fSMarco Elver READ_ONCE(*(buf + size)); 462bc8fbc5fSMarco Elver KUNIT_EXPECT_FALSE(test, report_available()); 463bc8fbc5fSMarco Elver 464bc8fbc5fSMarco Elver /* Overflowing by @align bytes will result in an OOB. */ 465bc8fbc5fSMarco Elver expect.addr = buf + size + align; 466bc8fbc5fSMarco Elver READ_ONCE(*expect.addr); 467bc8fbc5fSMarco Elver KUNIT_EXPECT_TRUE(test, report_matches(&expect)); 468bc8fbc5fSMarco Elver 469bc8fbc5fSMarco Elver test_free(buf); 470bc8fbc5fSMarco Elver } 471bc8fbc5fSMarco Elver 472bc8fbc5fSMarco Elver static void test_kmalloc_aligned_oob_write(struct kunit *test) 473bc8fbc5fSMarco Elver { 474bc8fbc5fSMarco Elver const size_t size = 73; 475bc8fbc5fSMarco Elver struct expect_report expect = { 476bc8fbc5fSMarco Elver .type = KFENCE_ERROR_CORRUPTION, 477bc8fbc5fSMarco Elver .fn = test_kmalloc_aligned_oob_write, 478bc8fbc5fSMarco Elver }; 479bc8fbc5fSMarco Elver char *buf; 480bc8fbc5fSMarco Elver 481bc8fbc5fSMarco Elver buf = test_alloc(test, size, GFP_KERNEL, ALLOCATE_RIGHT); 482bc8fbc5fSMarco Elver /* 483bc8fbc5fSMarco Elver * The object is offset to the right, so we won't get a page 484bc8fbc5fSMarco Elver * fault immediately after it. 485bc8fbc5fSMarco Elver */ 486bc8fbc5fSMarco Elver expect.addr = buf + size; 487bc8fbc5fSMarco Elver WRITE_ONCE(*expect.addr, READ_ONCE(*expect.addr) + 1); 488bc8fbc5fSMarco Elver KUNIT_EXPECT_FALSE(test, report_available()); 489bc8fbc5fSMarco Elver test_free(buf); 490bc8fbc5fSMarco Elver KUNIT_EXPECT_TRUE(test, report_matches(&expect)); 491bc8fbc5fSMarco Elver } 492bc8fbc5fSMarco Elver 493bc8fbc5fSMarco Elver /* Test cache shrinking and destroying with KFENCE. */ 494bc8fbc5fSMarco Elver static void test_shrink_memcache(struct kunit *test) 495bc8fbc5fSMarco Elver { 496bc8fbc5fSMarco Elver const size_t size = 32; 497bc8fbc5fSMarco Elver void *buf; 498bc8fbc5fSMarco Elver 499bc8fbc5fSMarco Elver setup_test_cache(test, size, 0, NULL); 500bc8fbc5fSMarco Elver KUNIT_EXPECT_TRUE(test, test_cache); 501bc8fbc5fSMarco Elver buf = test_alloc(test, size, GFP_KERNEL, ALLOCATE_ANY); 502bc8fbc5fSMarco Elver kmem_cache_shrink(test_cache); 503bc8fbc5fSMarco Elver test_free(buf); 504bc8fbc5fSMarco Elver 505bc8fbc5fSMarco Elver KUNIT_EXPECT_FALSE(test, report_available()); 506bc8fbc5fSMarco Elver } 507bc8fbc5fSMarco Elver 508bc8fbc5fSMarco Elver static void ctor_set_x(void *obj) 509bc8fbc5fSMarco Elver { 510bc8fbc5fSMarco Elver /* Every object has at least 8 bytes. */ 511bc8fbc5fSMarco Elver memset(obj, 'x', 8); 512bc8fbc5fSMarco Elver } 513bc8fbc5fSMarco Elver 514bc8fbc5fSMarco Elver /* Ensure that SL*B does not modify KFENCE objects on bulk free. */ 515bc8fbc5fSMarco Elver static void test_free_bulk(struct kunit *test) 516bc8fbc5fSMarco Elver { 517bc8fbc5fSMarco Elver int iter; 518bc8fbc5fSMarco Elver 519bc8fbc5fSMarco Elver for (iter = 0; iter < 5; iter++) { 520bc8fbc5fSMarco Elver const size_t size = setup_test_cache(test, 8 + prandom_u32_max(300), 0, 521bc8fbc5fSMarco Elver (iter & 1) ? ctor_set_x : NULL); 522bc8fbc5fSMarco Elver void *objects[] = { 523bc8fbc5fSMarco Elver test_alloc(test, size, GFP_KERNEL, ALLOCATE_RIGHT), 524bc8fbc5fSMarco Elver test_alloc(test, size, GFP_KERNEL, ALLOCATE_NONE), 525bc8fbc5fSMarco Elver test_alloc(test, size, GFP_KERNEL, ALLOCATE_LEFT), 526bc8fbc5fSMarco Elver test_alloc(test, size, GFP_KERNEL, ALLOCATE_NONE), 527bc8fbc5fSMarco Elver test_alloc(test, size, GFP_KERNEL, ALLOCATE_NONE), 528bc8fbc5fSMarco Elver }; 529bc8fbc5fSMarco Elver 530bc8fbc5fSMarco Elver kmem_cache_free_bulk(test_cache, ARRAY_SIZE(objects), objects); 531bc8fbc5fSMarco Elver KUNIT_ASSERT_FALSE(test, report_available()); 532bc8fbc5fSMarco Elver test_cache_destroy(); 533bc8fbc5fSMarco Elver } 534bc8fbc5fSMarco Elver } 535bc8fbc5fSMarco Elver 536bc8fbc5fSMarco Elver /* Test init-on-free works. */ 537bc8fbc5fSMarco Elver static void test_init_on_free(struct kunit *test) 538bc8fbc5fSMarco Elver { 539bc8fbc5fSMarco Elver const size_t size = 32; 540bc8fbc5fSMarco Elver struct expect_report expect = { 541bc8fbc5fSMarco Elver .type = KFENCE_ERROR_UAF, 542bc8fbc5fSMarco Elver .fn = test_init_on_free, 543bc8fbc5fSMarco Elver .is_write = false, 544bc8fbc5fSMarco Elver }; 545bc8fbc5fSMarco Elver int i; 546bc8fbc5fSMarco Elver 547bc8fbc5fSMarco Elver if (!IS_ENABLED(CONFIG_INIT_ON_FREE_DEFAULT_ON)) 548bc8fbc5fSMarco Elver return; 549bc8fbc5fSMarco Elver /* Assume it hasn't been disabled on command line. */ 550bc8fbc5fSMarco Elver 551bc8fbc5fSMarco Elver setup_test_cache(test, size, 0, NULL); 552bc8fbc5fSMarco Elver expect.addr = test_alloc(test, size, GFP_KERNEL, ALLOCATE_ANY); 553bc8fbc5fSMarco Elver for (i = 0; i < size; i++) 554bc8fbc5fSMarco Elver expect.addr[i] = i + 1; 555bc8fbc5fSMarco Elver test_free(expect.addr); 556bc8fbc5fSMarco Elver 557bc8fbc5fSMarco Elver for (i = 0; i < size; i++) { 558bc8fbc5fSMarco Elver /* 559bc8fbc5fSMarco Elver * This may fail if the page was recycled by KFENCE and then 560bc8fbc5fSMarco Elver * written to again -- this however, is near impossible with a 561bc8fbc5fSMarco Elver * default config. 562bc8fbc5fSMarco Elver */ 563bc8fbc5fSMarco Elver KUNIT_EXPECT_EQ(test, expect.addr[i], (char)0); 564bc8fbc5fSMarco Elver 565bc8fbc5fSMarco Elver if (!i) /* Only check first access to not fail test if page is ever re-protected. */ 566bc8fbc5fSMarco Elver KUNIT_EXPECT_TRUE(test, report_matches(&expect)); 567bc8fbc5fSMarco Elver } 568bc8fbc5fSMarco Elver } 569bc8fbc5fSMarco Elver 570bc8fbc5fSMarco Elver /* Ensure that constructors work properly. */ 571bc8fbc5fSMarco Elver static void test_memcache_ctor(struct kunit *test) 572bc8fbc5fSMarco Elver { 573bc8fbc5fSMarco Elver const size_t size = 32; 574bc8fbc5fSMarco Elver char *buf; 575bc8fbc5fSMarco Elver int i; 576bc8fbc5fSMarco Elver 577bc8fbc5fSMarco Elver setup_test_cache(test, size, 0, ctor_set_x); 578bc8fbc5fSMarco Elver buf = test_alloc(test, size, GFP_KERNEL, ALLOCATE_ANY); 579bc8fbc5fSMarco Elver 580bc8fbc5fSMarco Elver for (i = 0; i < 8; i++) 581bc8fbc5fSMarco Elver KUNIT_EXPECT_EQ(test, buf[i], (char)'x'); 582bc8fbc5fSMarco Elver 583bc8fbc5fSMarco Elver test_free(buf); 584bc8fbc5fSMarco Elver 585bc8fbc5fSMarco Elver KUNIT_EXPECT_FALSE(test, report_available()); 586bc8fbc5fSMarco Elver } 587bc8fbc5fSMarco Elver 588bc8fbc5fSMarco Elver /* Test that memory is zeroed if requested. */ 589bc8fbc5fSMarco Elver static void test_gfpzero(struct kunit *test) 590bc8fbc5fSMarco Elver { 591bc8fbc5fSMarco Elver const size_t size = PAGE_SIZE; /* PAGE_SIZE so we can use ALLOCATE_ANY. */ 592bc8fbc5fSMarco Elver char *buf1, *buf2; 593bc8fbc5fSMarco Elver int i; 594bc8fbc5fSMarco Elver 595bc8fbc5fSMarco Elver if (CONFIG_KFENCE_SAMPLE_INTERVAL > 100) { 596bc8fbc5fSMarco Elver kunit_warn(test, "skipping ... would take too long\n"); 597bc8fbc5fSMarco Elver return; 598bc8fbc5fSMarco Elver } 599bc8fbc5fSMarco Elver 600bc8fbc5fSMarco Elver setup_test_cache(test, size, 0, NULL); 601bc8fbc5fSMarco Elver buf1 = test_alloc(test, size, GFP_KERNEL, ALLOCATE_ANY); 602bc8fbc5fSMarco Elver for (i = 0; i < size; i++) 603bc8fbc5fSMarco Elver buf1[i] = i + 1; 604bc8fbc5fSMarco Elver test_free(buf1); 605bc8fbc5fSMarco Elver 606bc8fbc5fSMarco Elver /* Try to get same address again -- this can take a while. */ 607bc8fbc5fSMarco Elver for (i = 0;; i++) { 608bc8fbc5fSMarco Elver buf2 = test_alloc(test, size, GFP_KERNEL | __GFP_ZERO, ALLOCATE_ANY); 609bc8fbc5fSMarco Elver if (buf1 == buf2) 610bc8fbc5fSMarco Elver break; 611bc8fbc5fSMarco Elver test_free(buf2); 612bc8fbc5fSMarco Elver 613bc8fbc5fSMarco Elver if (i == CONFIG_KFENCE_NUM_OBJECTS) { 614bc8fbc5fSMarco Elver kunit_warn(test, "giving up ... cannot get same object back\n"); 615bc8fbc5fSMarco Elver return; 616bc8fbc5fSMarco Elver } 617bc8fbc5fSMarco Elver } 618bc8fbc5fSMarco Elver 619bc8fbc5fSMarco Elver for (i = 0; i < size; i++) 620bc8fbc5fSMarco Elver KUNIT_EXPECT_EQ(test, buf2[i], (char)0); 621bc8fbc5fSMarco Elver 622bc8fbc5fSMarco Elver test_free(buf2); 623bc8fbc5fSMarco Elver 624bc8fbc5fSMarco Elver KUNIT_EXPECT_FALSE(test, report_available()); 625bc8fbc5fSMarco Elver } 626bc8fbc5fSMarco Elver 627bc8fbc5fSMarco Elver static void test_invalid_access(struct kunit *test) 628bc8fbc5fSMarco Elver { 629bc8fbc5fSMarco Elver const struct expect_report expect = { 630bc8fbc5fSMarco Elver .type = KFENCE_ERROR_INVALID, 631bc8fbc5fSMarco Elver .fn = test_invalid_access, 632bc8fbc5fSMarco Elver .addr = &__kfence_pool[10], 633bc8fbc5fSMarco Elver .is_write = false, 634bc8fbc5fSMarco Elver }; 635bc8fbc5fSMarco Elver 636bc8fbc5fSMarco Elver READ_ONCE(__kfence_pool[10]); 637bc8fbc5fSMarco Elver KUNIT_EXPECT_TRUE(test, report_matches(&expect)); 638bc8fbc5fSMarco Elver } 639bc8fbc5fSMarco Elver 640bc8fbc5fSMarco Elver /* Test SLAB_TYPESAFE_BY_RCU works. */ 641bc8fbc5fSMarco Elver static void test_memcache_typesafe_by_rcu(struct kunit *test) 642bc8fbc5fSMarco Elver { 643bc8fbc5fSMarco Elver const size_t size = 32; 644bc8fbc5fSMarco Elver struct expect_report expect = { 645bc8fbc5fSMarco Elver .type = KFENCE_ERROR_UAF, 646bc8fbc5fSMarco Elver .fn = test_memcache_typesafe_by_rcu, 647bc8fbc5fSMarco Elver .is_write = false, 648bc8fbc5fSMarco Elver }; 649bc8fbc5fSMarco Elver 650bc8fbc5fSMarco Elver setup_test_cache(test, size, SLAB_TYPESAFE_BY_RCU, NULL); 651bc8fbc5fSMarco Elver KUNIT_EXPECT_TRUE(test, test_cache); /* Want memcache. */ 652bc8fbc5fSMarco Elver 653bc8fbc5fSMarco Elver expect.addr = test_alloc(test, size, GFP_KERNEL, ALLOCATE_ANY); 654bc8fbc5fSMarco Elver *expect.addr = 42; 655bc8fbc5fSMarco Elver 656bc8fbc5fSMarco Elver rcu_read_lock(); 657bc8fbc5fSMarco Elver test_free(expect.addr); 658bc8fbc5fSMarco Elver KUNIT_EXPECT_EQ(test, *expect.addr, (char)42); 659bc8fbc5fSMarco Elver /* 660bc8fbc5fSMarco Elver * Up to this point, memory should not have been freed yet, and 661bc8fbc5fSMarco Elver * therefore there should be no KFENCE report from the above access. 662bc8fbc5fSMarco Elver */ 663bc8fbc5fSMarco Elver rcu_read_unlock(); 664bc8fbc5fSMarco Elver 665bc8fbc5fSMarco Elver /* Above access to @expect.addr should not have generated a report! */ 666bc8fbc5fSMarco Elver KUNIT_EXPECT_FALSE(test, report_available()); 667bc8fbc5fSMarco Elver 668bc8fbc5fSMarco Elver /* Only after rcu_barrier() is the memory guaranteed to be freed. */ 669bc8fbc5fSMarco Elver rcu_barrier(); 670bc8fbc5fSMarco Elver 671bc8fbc5fSMarco Elver /* Expect use-after-free. */ 672bc8fbc5fSMarco Elver KUNIT_EXPECT_EQ(test, *expect.addr, (char)42); 673bc8fbc5fSMarco Elver KUNIT_EXPECT_TRUE(test, report_matches(&expect)); 674bc8fbc5fSMarco Elver } 675bc8fbc5fSMarco Elver 676bc8fbc5fSMarco Elver /* Test krealloc(). */ 677bc8fbc5fSMarco Elver static void test_krealloc(struct kunit *test) 678bc8fbc5fSMarco Elver { 679bc8fbc5fSMarco Elver const size_t size = 32; 680bc8fbc5fSMarco Elver const struct expect_report expect = { 681bc8fbc5fSMarco Elver .type = KFENCE_ERROR_UAF, 682bc8fbc5fSMarco Elver .fn = test_krealloc, 683bc8fbc5fSMarco Elver .addr = test_alloc(test, size, GFP_KERNEL, ALLOCATE_ANY), 684bc8fbc5fSMarco Elver .is_write = false, 685bc8fbc5fSMarco Elver }; 686bc8fbc5fSMarco Elver char *buf = expect.addr; 687bc8fbc5fSMarco Elver int i; 688bc8fbc5fSMarco Elver 689bc8fbc5fSMarco Elver KUNIT_EXPECT_FALSE(test, test_cache); 690bc8fbc5fSMarco Elver KUNIT_EXPECT_EQ(test, ksize(buf), size); /* Precise size match after KFENCE alloc. */ 691bc8fbc5fSMarco Elver for (i = 0; i < size; i++) 692bc8fbc5fSMarco Elver buf[i] = i + 1; 693bc8fbc5fSMarco Elver 694bc8fbc5fSMarco Elver /* Check that we successfully change the size. */ 695bc8fbc5fSMarco Elver buf = krealloc(buf, size * 3, GFP_KERNEL); /* Grow. */ 696bc8fbc5fSMarco Elver /* Note: Might no longer be a KFENCE alloc. */ 697bc8fbc5fSMarco Elver KUNIT_EXPECT_GE(test, ksize(buf), size * 3); 698bc8fbc5fSMarco Elver for (i = 0; i < size; i++) 699bc8fbc5fSMarco Elver KUNIT_EXPECT_EQ(test, buf[i], (char)(i + 1)); 700bc8fbc5fSMarco Elver for (; i < size * 3; i++) /* Fill to extra bytes. */ 701bc8fbc5fSMarco Elver buf[i] = i + 1; 702bc8fbc5fSMarco Elver 703bc8fbc5fSMarco Elver buf = krealloc(buf, size * 2, GFP_KERNEL); /* Shrink. */ 704bc8fbc5fSMarco Elver KUNIT_EXPECT_GE(test, ksize(buf), size * 2); 705bc8fbc5fSMarco Elver for (i = 0; i < size * 2; i++) 706bc8fbc5fSMarco Elver KUNIT_EXPECT_EQ(test, buf[i], (char)(i + 1)); 707bc8fbc5fSMarco Elver 708bc8fbc5fSMarco Elver buf = krealloc(buf, 0, GFP_KERNEL); /* Free. */ 709bc8fbc5fSMarco Elver KUNIT_EXPECT_EQ(test, (unsigned long)buf, (unsigned long)ZERO_SIZE_PTR); 710bc8fbc5fSMarco Elver KUNIT_ASSERT_FALSE(test, report_available()); /* No reports yet! */ 711bc8fbc5fSMarco Elver 712bc8fbc5fSMarco Elver READ_ONCE(*expect.addr); /* Ensure krealloc() actually freed earlier KFENCE object. */ 713bc8fbc5fSMarco Elver KUNIT_ASSERT_TRUE(test, report_matches(&expect)); 714bc8fbc5fSMarco Elver } 715bc8fbc5fSMarco Elver 716bc8fbc5fSMarco Elver /* Test that some objects from a bulk allocation belong to KFENCE pool. */ 717bc8fbc5fSMarco Elver static void test_memcache_alloc_bulk(struct kunit *test) 718bc8fbc5fSMarco Elver { 719bc8fbc5fSMarco Elver const size_t size = 32; 720bc8fbc5fSMarco Elver bool pass = false; 721bc8fbc5fSMarco Elver unsigned long timeout; 722bc8fbc5fSMarco Elver 723bc8fbc5fSMarco Elver setup_test_cache(test, size, 0, NULL); 724bc8fbc5fSMarco Elver KUNIT_EXPECT_TRUE(test, test_cache); /* Want memcache. */ 725bc8fbc5fSMarco Elver /* 726bc8fbc5fSMarco Elver * 100x the sample interval should be more than enough to ensure we get 727bc8fbc5fSMarco Elver * a KFENCE allocation eventually. 728bc8fbc5fSMarco Elver */ 729bc8fbc5fSMarco Elver timeout = jiffies + msecs_to_jiffies(100 * CONFIG_KFENCE_SAMPLE_INTERVAL); 730bc8fbc5fSMarco Elver do { 731bc8fbc5fSMarco Elver void *objects[100]; 732bc8fbc5fSMarco Elver int i, num = kmem_cache_alloc_bulk(test_cache, GFP_ATOMIC, ARRAY_SIZE(objects), 733bc8fbc5fSMarco Elver objects); 734bc8fbc5fSMarco Elver if (!num) 735bc8fbc5fSMarco Elver continue; 736bc8fbc5fSMarco Elver for (i = 0; i < ARRAY_SIZE(objects); i++) { 737bc8fbc5fSMarco Elver if (is_kfence_address(objects[i])) { 738bc8fbc5fSMarco Elver pass = true; 739bc8fbc5fSMarco Elver break; 740bc8fbc5fSMarco Elver } 741bc8fbc5fSMarco Elver } 742bc8fbc5fSMarco Elver kmem_cache_free_bulk(test_cache, num, objects); 743bc8fbc5fSMarco Elver /* 744bc8fbc5fSMarco Elver * kmem_cache_alloc_bulk() disables interrupts, and calling it 745bc8fbc5fSMarco Elver * in a tight loop may not give KFENCE a chance to switch the 746bc8fbc5fSMarco Elver * static branch. Call cond_resched() to let KFENCE chime in. 747bc8fbc5fSMarco Elver */ 748bc8fbc5fSMarco Elver cond_resched(); 749bc8fbc5fSMarco Elver } while (!pass && time_before(jiffies, timeout)); 750bc8fbc5fSMarco Elver 751bc8fbc5fSMarco Elver KUNIT_EXPECT_TRUE(test, pass); 752bc8fbc5fSMarco Elver KUNIT_EXPECT_FALSE(test, report_available()); 753bc8fbc5fSMarco Elver } 754bc8fbc5fSMarco Elver 755bc8fbc5fSMarco Elver /* 756bc8fbc5fSMarco Elver * KUnit does not provide a way to provide arguments to tests, and we encode 757bc8fbc5fSMarco Elver * additional info in the name. Set up 2 tests per test case, one using the 758bc8fbc5fSMarco Elver * default allocator, and another using a custom memcache (suffix '-memcache'). 759bc8fbc5fSMarco Elver */ 760bc8fbc5fSMarco Elver #define KFENCE_KUNIT_CASE(test_name) \ 761bc8fbc5fSMarco Elver { .run_case = test_name, .name = #test_name }, \ 762bc8fbc5fSMarco Elver { .run_case = test_name, .name = #test_name "-memcache" } 763bc8fbc5fSMarco Elver 764bc8fbc5fSMarco Elver static struct kunit_case kfence_test_cases[] = { 765bc8fbc5fSMarco Elver KFENCE_KUNIT_CASE(test_out_of_bounds_read), 766bc8fbc5fSMarco Elver KFENCE_KUNIT_CASE(test_out_of_bounds_write), 767bc8fbc5fSMarco Elver KFENCE_KUNIT_CASE(test_use_after_free_read), 768bc8fbc5fSMarco Elver KFENCE_KUNIT_CASE(test_double_free), 769bc8fbc5fSMarco Elver KFENCE_KUNIT_CASE(test_invalid_addr_free), 770bc8fbc5fSMarco Elver KFENCE_KUNIT_CASE(test_corruption), 771bc8fbc5fSMarco Elver KFENCE_KUNIT_CASE(test_free_bulk), 772bc8fbc5fSMarco Elver KFENCE_KUNIT_CASE(test_init_on_free), 773bc8fbc5fSMarco Elver KUNIT_CASE(test_kmalloc_aligned_oob_read), 774bc8fbc5fSMarco Elver KUNIT_CASE(test_kmalloc_aligned_oob_write), 775bc8fbc5fSMarco Elver KUNIT_CASE(test_shrink_memcache), 776bc8fbc5fSMarco Elver KUNIT_CASE(test_memcache_ctor), 777bc8fbc5fSMarco Elver KUNIT_CASE(test_invalid_access), 778bc8fbc5fSMarco Elver KUNIT_CASE(test_gfpzero), 779bc8fbc5fSMarco Elver KUNIT_CASE(test_memcache_typesafe_by_rcu), 780bc8fbc5fSMarco Elver KUNIT_CASE(test_krealloc), 781bc8fbc5fSMarco Elver KUNIT_CASE(test_memcache_alloc_bulk), 782bc8fbc5fSMarco Elver {}, 783bc8fbc5fSMarco Elver }; 784bc8fbc5fSMarco Elver 785bc8fbc5fSMarco Elver /* ===== End test cases ===== */ 786bc8fbc5fSMarco Elver 787bc8fbc5fSMarco Elver static int test_init(struct kunit *test) 788bc8fbc5fSMarco Elver { 789bc8fbc5fSMarco Elver unsigned long flags; 790bc8fbc5fSMarco Elver int i; 791bc8fbc5fSMarco Elver 792*c40c6e59SMarco Elver if (!__kfence_pool) 793*c40c6e59SMarco Elver return -EINVAL; 794*c40c6e59SMarco Elver 795bc8fbc5fSMarco Elver spin_lock_irqsave(&observed.lock, flags); 796bc8fbc5fSMarco Elver for (i = 0; i < ARRAY_SIZE(observed.lines); i++) 797bc8fbc5fSMarco Elver observed.lines[i][0] = '\0'; 798bc8fbc5fSMarco Elver observed.nlines = 0; 799bc8fbc5fSMarco Elver spin_unlock_irqrestore(&observed.lock, flags); 800bc8fbc5fSMarco Elver 801bc8fbc5fSMarco Elver /* Any test with 'memcache' in its name will want a memcache. */ 802bc8fbc5fSMarco Elver if (strstr(test->name, "memcache")) 803bc8fbc5fSMarco Elver test->priv = TEST_PRIV_WANT_MEMCACHE; 804bc8fbc5fSMarco Elver else 805bc8fbc5fSMarco Elver test->priv = NULL; 806bc8fbc5fSMarco Elver 807bc8fbc5fSMarco Elver return 0; 808bc8fbc5fSMarco Elver } 809bc8fbc5fSMarco Elver 810bc8fbc5fSMarco Elver static void test_exit(struct kunit *test) 811bc8fbc5fSMarco Elver { 812bc8fbc5fSMarco Elver test_cache_destroy(); 813bc8fbc5fSMarco Elver } 814bc8fbc5fSMarco Elver 815bc8fbc5fSMarco Elver static struct kunit_suite kfence_test_suite = { 816bc8fbc5fSMarco Elver .name = "kfence", 817bc8fbc5fSMarco Elver .test_cases = kfence_test_cases, 818bc8fbc5fSMarco Elver .init = test_init, 819bc8fbc5fSMarco Elver .exit = test_exit, 820bc8fbc5fSMarco Elver }; 821bc8fbc5fSMarco Elver static struct kunit_suite *kfence_test_suites[] = { &kfence_test_suite, NULL }; 822bc8fbc5fSMarco Elver 823bc8fbc5fSMarco Elver static void register_tracepoints(struct tracepoint *tp, void *ignore) 824bc8fbc5fSMarco Elver { 825bc8fbc5fSMarco Elver check_trace_callback_type_console(probe_console); 826bc8fbc5fSMarco Elver if (!strcmp(tp->name, "console")) 827bc8fbc5fSMarco Elver WARN_ON(tracepoint_probe_register(tp, probe_console, NULL)); 828bc8fbc5fSMarco Elver } 829bc8fbc5fSMarco Elver 830bc8fbc5fSMarco Elver static void unregister_tracepoints(struct tracepoint *tp, void *ignore) 831bc8fbc5fSMarco Elver { 832bc8fbc5fSMarco Elver if (!strcmp(tp->name, "console")) 833bc8fbc5fSMarco Elver tracepoint_probe_unregister(tp, probe_console, NULL); 834bc8fbc5fSMarco Elver } 835bc8fbc5fSMarco Elver 836bc8fbc5fSMarco Elver /* 837bc8fbc5fSMarco Elver * We only want to do tracepoints setup and teardown once, therefore we have to 838bc8fbc5fSMarco Elver * customize the init and exit functions and cannot rely on kunit_test_suite(). 839bc8fbc5fSMarco Elver */ 840bc8fbc5fSMarco Elver static int __init kfence_test_init(void) 841bc8fbc5fSMarco Elver { 842bc8fbc5fSMarco Elver /* 843bc8fbc5fSMarco Elver * Because we want to be able to build the test as a module, we need to 844bc8fbc5fSMarco Elver * iterate through all known tracepoints, since the static registration 845bc8fbc5fSMarco Elver * won't work here. 846bc8fbc5fSMarco Elver */ 847bc8fbc5fSMarco Elver for_each_kernel_tracepoint(register_tracepoints, NULL); 848bc8fbc5fSMarco Elver return __kunit_test_suites_init(kfence_test_suites); 849bc8fbc5fSMarco Elver } 850bc8fbc5fSMarco Elver 851bc8fbc5fSMarco Elver static void kfence_test_exit(void) 852bc8fbc5fSMarco Elver { 853bc8fbc5fSMarco Elver __kunit_test_suites_exit(kfence_test_suites); 854bc8fbc5fSMarco Elver for_each_kernel_tracepoint(unregister_tracepoints, NULL); 855bc8fbc5fSMarco Elver tracepoint_synchronize_unregister(); 856bc8fbc5fSMarco Elver } 857bc8fbc5fSMarco Elver 85832ae8a06SWeizhao Ouyang late_initcall_sync(kfence_test_init); 859bc8fbc5fSMarco Elver module_exit(kfence_test_exit); 860bc8fbc5fSMarco Elver 861bc8fbc5fSMarco Elver MODULE_LICENSE("GPL v2"); 862bc8fbc5fSMarco Elver MODULE_AUTHOR("Alexander Potapenko <glider@google.com>, Marco Elver <elver@google.com>"); 863