From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F346C07E9D for ; Tue, 27 Sep 2022 13:16:29 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id B77F38E00D4; Tue, 27 Sep 2022 09:16:28 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id B00408E00C1; Tue, 27 Sep 2022 09:16:28 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 952188E00D4; Tue, 27 Sep 2022 09:16:28 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 7EC528E00C1 for ; Tue, 27 Sep 2022 09:16:28 -0400 (EDT) Received: from smtpin18.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id 017DB120C8A for ; Tue, 27 Sep 2022 13:16:27 +0000 (UTC) X-FDA: 79957914456.18.1969992 Received: from mail-ej1-f50.google.com (mail-ej1-f50.google.com [209.85.218.50]) by imf29.hostedemail.com (Postfix) with ESMTP id 97077120008 for ; Tue, 27 Sep 2022 13:16:27 +0000 (UTC) Received: by mail-ej1-f50.google.com with SMTP id lc7so20737446ejb.0 for ; Tue, 27 Sep 2022 06:16:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=user-agent:in-reply-to:content-disposition:mime-version:references :message-id:subject:cc:to:from:date:from:to:cc:subject:date; bh=gOghRmjXnciU76OT1A5CBEYlu/dhJhD2q5qbX7Y7RKE=; b=WAFjLp8rur6R1phCypQM6uyHOmFoaqPWVTnLZ1DdkHNLV3XzPpC0zLI4pvBlCcLglQ 248uCThRrKCvRpct7s5O7E6JJbjG4t0pObFQ8TcaL+kpIbXDMeHqjWu4cXbAppr2mFPg t3OINuwZZ3CWwh5vo4QSpeIbUPrJI4YbPf/6m8IenX1AylzglsR33mjJ3UEJo8NuWMW7 YfGXU9fhija82zdcDTpRnq4P72eAVA6dSYdc/CAqQABKrCV1/KOh6eGkxrqKZGa/lmQP EeJtXq0sjiTWO+D1uJTooWxDGORg06+AW1voKk+6yOgGxCwzZfS/6Rat6+33JvGkSg/N 0AlQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=user-agent:in-reply-to:content-disposition:mime-version:references :message-id:subject:cc:to:from:date:x-gm-message-state:from:to:cc :subject:date; bh=gOghRmjXnciU76OT1A5CBEYlu/dhJhD2q5qbX7Y7RKE=; b=qrwSSKjai0jdgH/phZZLWSlunU+ku41mW7uHtjo2Obo6f8gSoDi8Jx+rGYR3hSWDtG 4U7G3TVN2nEw2HyFYAy8+4m3/0+Z/2HzEvqA5fgPj0GEiS3wbINMOuN0BH1Ll/rT5FzC 0WAx1JIbIvEiC5xy0jl8f2FEWMF4r6hzZgZD3k+Lpa+uMUf7JYSJbk1hWzzgW/fP07Jz HHDodHyZiFsZmIOrB3jnzRLSxq58QHrq94tSBdsQXw64R+oD0obulZz/TQCzuF7HVIBb /RNe/dOKyrdtoSVrwzoJSlfI7zh6AorBQ1XEDcLfxUN9rE14ekhvRmnz/ch7EH5EGNDf YlGw== X-Gm-Message-State: ACrzQf2rbjfhfg8R8xexow3FsEtwtB7q1lWtmICJQ5jzZIH2ycteHrX7 dyHWnsPz0KS01fMKRr4kyw8Z7Q== X-Google-Smtp-Source: AMsMyM6s23Af8VoW94bp9SYXn9ovAeDvmBwYaybrJ+VhDh2jlptgQzRxPStqowchMzz2BBAx4dnaaQ== X-Received: by 2002:a17:906:8a6f:b0:780:96b4:d19e with SMTP id hy15-20020a1709068a6f00b0078096b4d19emr22599889ejc.624.1664284586284; Tue, 27 Sep 2022 06:16:26 -0700 (PDT) Received: from elver.google.com ([2a00:79e0:9c:201:693c:15a1:a531:bb4e]) by smtp.gmail.com with ESMTPSA id u24-20020a056402065800b004571907240asm1270416edx.36.2022.09.27.06.16.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 27 Sep 2022 06:16:25 -0700 (PDT) Date: Tue, 27 Sep 2022 15:16:20 +0200 From: Marco Elver To: andrey.konovalov@linux.dev Cc: Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: Re: [PATCH mm 2/3] kasan: migrate kasan_rcu_uaf test to kunit Message-ID: References: <653d43e9a6d9aad2ae148a941dab048cb8e765a8.1664044241.git.andreyknvl@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/2.2.7 (2022-08-07) ARC-Authentication-Results: i=1; imf29.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=WAFjLp8r; spf=pass (imf29.hostedemail.com: domain of elver@google.com designates 209.85.218.50 as permitted sender) smtp.mailfrom=elver@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1664284587; a=rsa-sha256; cv=none; b=AYrXKeQZ4QTA5zIJ9mLPSZWbmotQVox+Ctdrs4nBcO+x5W17kXuD0Yyim8z2PpMvwfAdCX L6p3/EMycmzZVLKF6VpXL3z43frdMj0P72hzxjeGUT7xYDxx1vC3lEP+Z7hbJnqbxxqCzI yrv1sQWtXaevFct6iGca+GNyNQXOptE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1664284587; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=gOghRmjXnciU76OT1A5CBEYlu/dhJhD2q5qbX7Y7RKE=; b=2Ts/F/SknQwlG9y7AO7+Ecbbn06y8Q6+m9M8S+1LzDZZm8fHOfPWwDNfdh663GV4yPK9Yq vfWHZo/0zfzi0viot768QctiaLY18Bp7JpPg+sVFdIxppkvaDzmUa47dTEBjHzjIpkJQ6U HXn/5RKjM3OcRYSa13mqtTrEGfpoyJ8= X-Rspamd-Server: rspam11 X-Rspamd-Queue-Id: 97077120008 X-Rspam-User: Authentication-Results: imf29.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=WAFjLp8r; spf=pass (imf29.hostedemail.com: domain of elver@google.com designates 209.85.218.50 as permitted sender) smtp.mailfrom=elver@google.com; dmarc=pass (policy=reject) header.from=google.com X-Stat-Signature: oo9t764uw13c4fh7ncb3ymaz7k7quy8e X-HE-Tag: 1664284587-907494 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Sat, Sep 24, 2022 at 08:31PM +0200, andrey.konovalov@linux.dev wrote: > From: Andrey Konovalov > > Migrate the kasan_rcu_uaf test to the KUnit framework. > > Changes to the implementation of the test: > > - Call rcu_barrier() after call_rcu() to make that the RCU callbacks get > triggered before the test is over. > > - Cast pointer passed to rcu_dereference_protected as __rcu to get rid of > the Sparse warning. > > - Check that KASAN prints a report via KUNIT_EXPECT_KASAN_FAIL. > > Initially, this test was intended to check that Generic KASAN prints > auxiliary stack traces for RCU objects. Nevertheless, the test is enabled > for all modes to make that KASAN reports bad accesses in RCU callbacks. > > The presence of auxiliary stack traces for the Generic mode needs to be > inspected manually. > > Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver > --- > mm/kasan/kasan_test.c | 37 ++++++++++++++++++++++++++++++++++++ > mm/kasan/kasan_test_module.c | 30 ----------------------------- > 2 files changed, 37 insertions(+), 30 deletions(-) > > diff --git a/mm/kasan/kasan_test.c b/mm/kasan/kasan_test.c > index 3a2886f85e69..005776325e20 100644 > --- a/mm/kasan/kasan_test.c > +++ b/mm/kasan/kasan_test.c > @@ -1134,6 +1134,42 @@ static void kmalloc_double_kzfree(struct kunit *test) > KUNIT_EXPECT_KASAN_FAIL(test, kfree_sensitive(ptr)); > } > > +static struct kasan_rcu_info { > + int i; > + struct rcu_head rcu; > +} *global_rcu_ptr; > + > +static void rcu_uaf_reclaim(struct rcu_head *rp) > +{ > + struct kasan_rcu_info *fp = > + container_of(rp, struct kasan_rcu_info, rcu); > + > + kfree(fp); > + ((volatile struct kasan_rcu_info *)fp)->i; > +} > + > +/* > + * Check that Generic KASAN prints auxiliary stack traces for RCU callbacks. > + * The report needs to be inspected manually. > + * > + * This test is still enabled for other KASAN modes to make sure that all modes > + * report bad accesses in tested scenarios. > + */ > +static void rcu_uaf(struct kunit *test) > +{ > + struct kasan_rcu_info *ptr; > + > + ptr = kmalloc(sizeof(struct kasan_rcu_info), GFP_KERNEL); > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > + > + global_rcu_ptr = rcu_dereference_protected( > + (struct kasan_rcu_info __rcu *)ptr, NULL); > + > + KUNIT_EXPECT_KASAN_FAIL(test, > + call_rcu(&global_rcu_ptr->rcu, rcu_uaf_reclaim); > + rcu_barrier()); > +} > + > static void vmalloc_helpers_tags(struct kunit *test) > { > void *ptr; > @@ -1465,6 +1501,7 @@ static struct kunit_case kasan_kunit_test_cases[] = { > KUNIT_CASE(kasan_bitops_generic), > KUNIT_CASE(kasan_bitops_tags), > KUNIT_CASE(kmalloc_double_kzfree), > + KUNIT_CASE(rcu_uaf), > KUNIT_CASE(vmalloc_helpers_tags), > KUNIT_CASE(vmalloc_oob), > KUNIT_CASE(vmap_tags), > diff --git a/mm/kasan/kasan_test_module.c b/mm/kasan/kasan_test_module.c > index e4ca82dc2c16..4688cbcd722d 100644 > --- a/mm/kasan/kasan_test_module.c > +++ b/mm/kasan/kasan_test_module.c > @@ -62,35 +62,6 @@ static noinline void __init copy_user_test(void) > kfree(kmem); > } > > -static struct kasan_rcu_info { > - int i; > - struct rcu_head rcu; > -} *global_rcu_ptr; > - > -static noinline void __init kasan_rcu_reclaim(struct rcu_head *rp) > -{ > - struct kasan_rcu_info *fp = container_of(rp, > - struct kasan_rcu_info, rcu); > - > - kfree(fp); > - ((volatile struct kasan_rcu_info *)fp)->i; > -} > - > -static noinline void __init kasan_rcu_uaf(void) > -{ > - struct kasan_rcu_info *ptr; > - > - pr_info("use-after-free in kasan_rcu_reclaim\n"); > - ptr = kmalloc(sizeof(struct kasan_rcu_info), GFP_KERNEL); > - if (!ptr) { > - pr_err("Allocation failed\n"); > - return; > - } > - > - global_rcu_ptr = rcu_dereference_protected(ptr, NULL); > - call_rcu(&global_rcu_ptr->rcu, kasan_rcu_reclaim); > -} > - > static noinline void __init kasan_workqueue_work(struct work_struct *work) > { > kfree(work); > @@ -130,7 +101,6 @@ static int __init test_kasan_module_init(void) > bool multishot = kasan_save_enable_multi_shot(); > > copy_user_test(); > - kasan_rcu_uaf(); > kasan_workqueue_uaf(); > > kasan_restore_multi_shot(multishot); > -- > 2.25.1