kasan: clean up comments in tests
Clarify and update comments in KASAN tests. Link: https://linux-review.googlesource.com/id/I6c816c51fa1e0eb7aa3dead6bda1f339d2af46c8 Link: https://lkml.kernel.org/r/ba6db104d53ae0e3796f80ef395f6873c1c1282f.1610733117.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov <andreyknvl@google.com> Reviewed-by: Marco Elver <elver@google.com> Reviewed-by: Alexander Potapenko <glider@google.com> Cc: Andrey Ryabinin <aryabinin@virtuozzo.com> Cc: Branislav Rankov <Branislav.Rankov@arm.com> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Evgenii Stepanov <eugenis@google.com> Cc: Kevin Brodsky <kevin.brodsky@arm.com> Cc: Peter Collingbourne <pcc@google.com> Cc: Vincenzo Frascino <vincenzo.frascino@arm.com> Cc: Will Deacon <will.deacon@arm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Andrey Konovalov
Linus Torvalds
parent
4062c24598
commit
0fd3792536
|
|
@ -28,10 +28,9 @@
|
|||
#define OOB_TAG_OFF (IS_ENABLED(CONFIG_KASAN_GENERIC) ? 0 : KASAN_GRANULE_SIZE)
|
||||
|
||||
/*
|
||||
* We assign some test results to these globals to make sure the tests
|
||||
* are not eliminated as dead code.
|
||||
* Some tests use these global variables to store return values from function
|
||||
* calls that could otherwise be eliminated by the compiler as dead code.
|
||||
*/
|
||||
|
||||
void *kasan_ptr_result;
|
||||
int kasan_int_result;
|
||||
|
||||
|
|
@ -39,14 +38,13 @@ static struct kunit_resource resource;
|
|||
static struct kunit_kasan_expectation fail_data;
|
||||
static bool multishot;
|
||||
|
||||
/*
|
||||
* Temporarily enable multi-shot mode. Otherwise, KASAN would only report the
|
||||
* first detected bug and panic the kernel if panic_on_warn is enabled.
|
||||
*/
|
||||
static int kasan_test_init(struct kunit *test)
|
||||
{
|
||||
/*
|
||||
* Temporarily enable multi-shot mode and set panic_on_warn=0.
|
||||
* Otherwise, we'd only get a report for the first case.
|
||||
*/
|
||||
multishot = kasan_save_enable_multi_shot();
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
@ -56,12 +54,12 @@ static void kasan_test_exit(struct kunit *test)
|
|||
}
|
||||
|
||||
/**
|
||||
* KUNIT_EXPECT_KASAN_FAIL() - Causes a test failure when the expression does
|
||||
* not cause a KASAN error. This uses a KUnit resource named "kasan_data." Do
|
||||
* Do not use this name for a KUnit resource outside here.
|
||||
*
|
||||
* KUNIT_EXPECT_KASAN_FAIL() - check that the executed expression produces a
|
||||
* KASAN report; causes a test failure otherwise. This relies on a KUnit
|
||||
* resource named "kasan_data". Do not use this name for KUnit resources
|
||||
* outside of KASAN tests.
|
||||
*/
|
||||
#define KUNIT_EXPECT_KASAN_FAIL(test, condition) do { \
|
||||
#define KUNIT_EXPECT_KASAN_FAIL(test, expression) do { \
|
||||
fail_data.report_expected = true; \
|
||||
fail_data.report_found = false; \
|
||||
kunit_add_named_resource(test, \
|
||||
|
|
@ -69,7 +67,7 @@ static void kasan_test_exit(struct kunit *test)
|
|||
NULL, \
|
||||
&resource, \
|
||||
"kasan_data", &fail_data); \
|
||||
condition; \
|
||||
expression; \
|
||||
KUNIT_EXPECT_EQ(test, \
|
||||
fail_data.report_expected, \
|
||||
fail_data.report_found); \
|
||||
|
|
@ -121,7 +119,8 @@ static void kmalloc_pagealloc_oob_right(struct kunit *test)
|
|||
return;
|
||||
}
|
||||
|
||||
/* Allocate a chunk that does not fit into a SLUB cache to trigger
|
||||
/*
|
||||
* Allocate a chunk that does not fit into a SLUB cache to trigger
|
||||
* the page allocator fallback.
|
||||
*/
|
||||
ptr = kmalloc(size, GFP_KERNEL);
|
||||
|
|
@ -168,7 +167,9 @@ static void kmalloc_large_oob_right(struct kunit *test)
|
|||
{
|
||||
char *ptr;
|
||||
size_t size = KMALLOC_MAX_CACHE_SIZE - 256;
|
||||
/* Allocate a chunk that is large enough, but still fits into a slab
|
||||
|
||||
/*
|
||||
* Allocate a chunk that is large enough, but still fits into a slab
|
||||
* and does not trigger the page allocator fallback in SLUB.
|
||||
*/
|
||||
ptr = kmalloc(size, GFP_KERNEL);
|
||||
|
|
@ -469,10 +470,13 @@ static void ksize_unpoisons_memory(struct kunit *test)
|
|||
ptr = kmalloc(size, GFP_KERNEL);
|
||||
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
|
||||
real_size = ksize(ptr);
|
||||
/* This access doesn't trigger an error. */
|
||||
|
||||
/* This access shouldn't trigger a KASAN report. */
|
||||
ptr[size] = 'x';
|
||||
/* This one does. */
|
||||
|
||||
/* This one must. */
|
||||
KUNIT_EXPECT_KASAN_FAIL(test, ptr[real_size] = 'y');
|
||||
|
||||
kfree(ptr);
|
||||
}
|
||||
|
||||
|
|
@ -568,7 +572,7 @@ static void kmem_cache_invalid_free(struct kunit *test)
|
|||
return;
|
||||
}
|
||||
|
||||
/* Trigger invalid free, the object doesn't get freed */
|
||||
/* Trigger invalid free, the object doesn't get freed. */
|
||||
KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p + 1));
|
||||
|
||||
/*
|
||||
|
|
@ -585,7 +589,10 @@ static void kasan_memchr(struct kunit *test)
|
|||
char *ptr;
|
||||
size_t size = 24;
|
||||
|
||||
/* See https://bugzilla.kernel.org/show_bug.cgi?id=206337 */
|
||||
/*
|
||||
* str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT.
|
||||
* See https://bugzilla.kernel.org/show_bug.cgi?id=206337 for details.
|
||||
*/
|
||||
if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
|
||||
kunit_info(test,
|
||||
"str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT");
|
||||
|
|
@ -610,7 +617,10 @@ static void kasan_memcmp(struct kunit *test)
|
|||
size_t size = 24;
|
||||
int arr[9];
|
||||
|
||||
/* See https://bugzilla.kernel.org/show_bug.cgi?id=206337 */
|
||||
/*
|
||||
* str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT.
|
||||
* See https://bugzilla.kernel.org/show_bug.cgi?id=206337 for details.
|
||||
*/
|
||||
if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
|
||||
kunit_info(test,
|
||||
"str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT");
|
||||
|
|
@ -634,7 +644,10 @@ static void kasan_strings(struct kunit *test)
|
|||
char *ptr;
|
||||
size_t size = 24;
|
||||
|
||||
/* See https://bugzilla.kernel.org/show_bug.cgi?id=206337 */
|
||||
/*
|
||||
* str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT.
|
||||
* See https://bugzilla.kernel.org/show_bug.cgi?id=206337 for details.
|
||||
*/
|
||||
if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
|
||||
kunit_info(test,
|
||||
"str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT");
|
||||
|
|
@ -706,7 +719,7 @@ static void kasan_bitops_generic(struct kunit *test)
|
|||
}
|
||||
|
||||
/*
|
||||
* Allocate 1 more byte, which causes kzalloc to round up to 16-bytes;
|
||||
* Allocate 1 more byte, which causes kzalloc to round up to 16 bytes;
|
||||
* this way we do not actually corrupt other memory.
|
||||
*/
|
||||
bits = kzalloc(sizeof(*bits) + 1, GFP_KERNEL);
|
||||
|
|
|
|||
|
|
@ -123,8 +123,9 @@ static noinline void __init kasan_workqueue_uaf(void)
|
|||
static int __init test_kasan_module_init(void)
|
||||
{
|
||||
/*
|
||||
* Temporarily enable multi-shot mode. Otherwise, we'd only get a
|
||||
* report for the first case.
|
||||
* Temporarily enable multi-shot mode. Otherwise, KASAN would only
|
||||
* report the first detected bug and panic the kernel if panic_on_warn
|
||||
* is enabled.
|
||||
*/
|
||||
bool multishot = kasan_save_enable_multi_shot();
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue