From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id D8857C54EE9 for ; Tue, 27 Sep 2022 13:17:20 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 7A6958E00D5; Tue, 27 Sep 2022 09:17:20 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 72FF28E00C1; Tue, 27 Sep 2022 09:17:20 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 5A90F8E00D5; Tue, 27 Sep 2022 09:17:20 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 45FC68E00C1 for ; Tue, 27 Sep 2022 09:17:20 -0400 (EDT) Received: from smtpin23.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 1397E140D50 for ; Tue, 27 Sep 2022 13:17:20 +0000 (UTC) X-FDA: 79957916640.23.F9B501C Received: from mail-ed1-f45.google.com (mail-ed1-f45.google.com [209.85.208.45]) by imf25.hostedemail.com (Postfix) with ESMTP id BE652A0009 for ; Tue, 27 Sep 2022 13:17:19 +0000 (UTC) Received: by mail-ed1-f45.google.com with SMTP id z97so13125688ede.8 for ; Tue, 27 Sep 2022 06:17:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=user-agent:in-reply-to:content-disposition:mime-version:references :message-id:subject:cc:to:from:date:from:to:cc:subject:date; bh=In1vsB/Xjfh9ZnfNvqM8dWCAty6NwecZWkJggwcWzrI=; b=MPWNC1rEjW7iV+yNpMgr+SzEHDVYyrzeSE/RS9EgXzVVBXCdqcy9R2rn7oMTdIv5kW 9t8PCuiUQ6MZ6NdTKOIpVMTdkq4MaHiSsrCvHsfoaUwLYTfW7hSAPWTz7SLkL0SF4W6i 5hasBut3NxwqG7HNMPfj/d1P2zT2pg5JVg0cdYPyokTTZ9VHIJ/ZuZdr3L00Y9hKiatJ rOZ9lk7HlOUHhPvXYNZB0uHX3uHMtZo+KQKWGPwEAsSKqdsotTE/sfWDJ1Uv65cFJKso kw4h/iMz5kr5xoi0l2bwMUGpj+3MgZGceQZve1+G1pnyEmwoBO84TTOuUzNdOt8H5x9M /9GA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=user-agent:in-reply-to:content-disposition:mime-version:references :message-id:subject:cc:to:from:date:x-gm-message-state:from:to:cc :subject:date; bh=In1vsB/Xjfh9ZnfNvqM8dWCAty6NwecZWkJggwcWzrI=; b=jrIU7Yn/vJ0gtoI1pf7j7HNAVkCy8lJYTJ8XXcVeZH7NAYaCIde0bYePL3xc9Dx5p4 9VFythmVX0tNq+fLIFRC1mvRTqdwxo+swBrgfysndUeYM4HrY9+Dhrqwrls6qLNGmqdo EC0TTXLKGFfWXb1zJDTVDTt1iM+5NtoTHMa6v0wEbbj9YG9uelpiXg3KV7HObcmtemF1 9DL/hWlPsZX7g8O73i+VlmsxfYfll0cG0Q6Sr+8xTqpfCa+3aTqiMYZlMXvXh03oeKpD wt8wgxGgptC+EwX4VUuE4Jf7seWzdzAmgJF5Vj75p9QJ8Dj1Y7jE5GM8MR5MTLJYi9Kk aIgA== X-Gm-Message-State: ACrzQf0rWF/Yrlr5M6CvZJgKaZRQsqKtjfjqOjfALBK1oAhTv0V42JQ/ mL7cA0Y0tEX9+kXH5Rz4dX+PiQ== X-Google-Smtp-Source: AMsMyM70B36DrxzZchpp1McX0IFVOUt/Lxru8O6Pu+f9ZlH/RHOKYouT7tKEvgOLgcC3fVCCwkzY6A== X-Received: by 2002:aa7:cc8a:0:b0:446:7668:2969 with SMTP id p10-20020aa7cc8a000000b0044676682969mr27808864edt.206.1664284638152; Tue, 27 Sep 2022 06:17:18 -0700 (PDT) Received: from elver.google.com ([2a00:79e0:9c:201:693c:15a1:a531:bb4e]) by smtp.gmail.com with ESMTPSA id 22-20020a170906311600b0077fbef08212sm100359ejx.22.2022.09.27.06.17.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 27 Sep 2022 06:17:17 -0700 (PDT) Date: Tue, 27 Sep 2022 15:17:10 +0200 From: Marco Elver To: andrey.konovalov@linux.dev Cc: Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: Re: [PATCH mm 3/3] kasan: migrate workqueue_uaf test to kunit Message-ID: References: <653d43e9a6d9aad2ae148a941dab048cb8e765a8.1664044241.git.andreyknvl@google.com> <2815073f2be37e554f7f0fd7b1d10e9742be6ce3.1664044241.git.andreyknvl@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <2815073f2be37e554f7f0fd7b1d10e9742be6ce3.1664044241.git.andreyknvl@google.com> User-Agent: Mutt/2.2.7 (2022-08-07) ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1664284639; a=rsa-sha256; cv=none; b=okOXGaBHTFXmfbvhVdToSR7H+izDp311hSCI9eKBSvG7nBBreqzty4eOPvPycJYXN0clXi 0d+QfkFsfLKEi+uERuqX3IQVrtHbrvq+qxOvTDsNNs/PAOiq5hd8cr+stFwh/mS2TuQ28n 6F1nhPI8OWA6Al/L//4ptqPCKJeWEiE= ARC-Authentication-Results: i=1; imf25.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=MPWNC1rE; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf25.hostedemail.com: domain of elver@google.com designates 209.85.208.45 as permitted sender) smtp.mailfrom=elver@google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1664284639; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=In1vsB/Xjfh9ZnfNvqM8dWCAty6NwecZWkJggwcWzrI=; b=F+5ifzfePs+rrOMm9TQT2o821oGB2JO9z2GKY7Qa4tiFsCots2AAVsVw2k5/nVx8BY8HbX 9W49an+k++IcfYiDl3N0DwXO7BE2PoFPBe4Zi2DWWZlpsNbWVa+yYDihVvoaQSgVb7gaSR /IXhw6tayuWcJ8AAHEhbAgdaAAzNHxY= Authentication-Results: imf25.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=MPWNC1rE; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf25.hostedemail.com: domain of elver@google.com designates 209.85.208.45 as permitted sender) smtp.mailfrom=elver@google.com X-Rspamd-Server: rspam09 X-Rspamd-Queue-Id: BE652A0009 X-Stat-Signature: wangnx5djq9has81x8rh5ydu49i8h91p X-Rspam-User: X-HE-Tag: 1664284639-18966 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Sat, Sep 24, 2022 at 08:31PM +0200, andrey.konovalov@linux.dev wrote: > From: Andrey Konovalov > > Migrate the workqueue_uaf test to the KUnit framework. > > Initially, this test was intended to check that Generic KASAN prints > auxiliary stack traces for workqueues. Nevertheless, the test is enabled > for all modes to make that KASAN reports bad accesses in the tested > scenario. > > The presence of auxiliary stack traces for the Generic mode needs to be > inspected manually. > > Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver > --- > mm/kasan/kasan_test.c | 40 +++++++++++++++++++++++++++++------- > mm/kasan/kasan_test_module.c | 30 --------------------------- > 2 files changed, 33 insertions(+), 37 deletions(-) > > diff --git a/mm/kasan/kasan_test.c b/mm/kasan/kasan_test.c > index 005776325e20..71cb402c404f 100644 > --- a/mm/kasan/kasan_test.c > +++ b/mm/kasan/kasan_test.c > @@ -1134,6 +1134,14 @@ static void kmalloc_double_kzfree(struct kunit *test) > KUNIT_EXPECT_KASAN_FAIL(test, kfree_sensitive(ptr)); > } > > +/* > + * The two tests below check that Generic KASAN prints auxiliary stack traces > + * for RCU callbacks and workqueues. The reports need to be inspected manually. > + * > + * These tests are still enabled for other KASAN modes to make sure that all > + * modes report bad accesses in tested scenarios. > + */ > + > static struct kasan_rcu_info { > int i; > struct rcu_head rcu; > @@ -1148,13 +1156,6 @@ static void rcu_uaf_reclaim(struct rcu_head *rp) > ((volatile struct kasan_rcu_info *)fp)->i; > } > > -/* > - * Check that Generic KASAN prints auxiliary stack traces for RCU callbacks. > - * The report needs to be inspected manually. > - * > - * This test is still enabled for other KASAN modes to make sure that all modes > - * report bad accesses in tested scenarios. > - */ > static void rcu_uaf(struct kunit *test) > { > struct kasan_rcu_info *ptr; > @@ -1170,6 +1171,30 @@ static void rcu_uaf(struct kunit *test) > rcu_barrier()); > } > > +static void workqueue_uaf_work(struct work_struct *work) > +{ > + kfree(work); > +} > + > +static void workqueue_uaf(struct kunit *test) > +{ > + struct workqueue_struct *workqueue; > + struct work_struct *work; > + > + workqueue = create_workqueue("kasan_workqueue_test"); > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, workqueue); > + > + work = kmalloc(sizeof(struct work_struct), GFP_KERNEL); > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, work); > + > + INIT_WORK(work, workqueue_uaf_work); > + queue_work(workqueue, work); > + destroy_workqueue(workqueue); > + > + KUNIT_EXPECT_KASAN_FAIL(test, > + ((volatile struct work_struct *)work)->data); > +} > + > static void vmalloc_helpers_tags(struct kunit *test) > { > void *ptr; > @@ -1502,6 +1527,7 @@ static struct kunit_case kasan_kunit_test_cases[] = { > KUNIT_CASE(kasan_bitops_tags), > KUNIT_CASE(kmalloc_double_kzfree), > KUNIT_CASE(rcu_uaf), > + KUNIT_CASE(workqueue_uaf), > KUNIT_CASE(vmalloc_helpers_tags), > KUNIT_CASE(vmalloc_oob), > KUNIT_CASE(vmap_tags), > diff --git a/mm/kasan/kasan_test_module.c b/mm/kasan/kasan_test_module.c > index 4688cbcd722d..7be7bed456ef 100644 > --- a/mm/kasan/kasan_test_module.c > +++ b/mm/kasan/kasan_test_module.c > @@ -62,35 +62,6 @@ static noinline void __init copy_user_test(void) > kfree(kmem); > } > > -static noinline void __init kasan_workqueue_work(struct work_struct *work) > -{ > - kfree(work); > -} > - > -static noinline void __init kasan_workqueue_uaf(void) > -{ > - struct workqueue_struct *workqueue; > - struct work_struct *work; > - > - workqueue = create_workqueue("kasan_wq_test"); > - if (!workqueue) { > - pr_err("Allocation failed\n"); > - return; > - } > - work = kmalloc(sizeof(struct work_struct), GFP_KERNEL); > - if (!work) { > - pr_err("Allocation failed\n"); > - return; > - } > - > - INIT_WORK(work, kasan_workqueue_work); > - queue_work(workqueue, work); > - destroy_workqueue(workqueue); > - > - pr_info("use-after-free on workqueue\n"); > - ((volatile struct work_struct *)work)->data; > -} > - > static int __init test_kasan_module_init(void) > { > /* > @@ -101,7 +72,6 @@ static int __init test_kasan_module_init(void) > bool multishot = kasan_save_enable_multi_shot(); > > copy_user_test(); > - kasan_workqueue_uaf(); > > kasan_restore_multi_shot(multishot); > return -EAGAIN; > -- > 2.25.1