Commit e5eb3246 authored by Jann Horn's avatar Jann Horn Committed by Andrew Morton
Browse files

kasan: add test for SLAB_TYPESAFE_BY_RCU quarantine skipping 

Verify that KASAN does not quarantine objects in SLAB_TYPESAFE_BY_RCU
slabs if CONFIG_SLUB_RCU_DEBUG is off.

[jannh@google.com: v2]
  Link: https://lkml.kernel.org/r/20250729-kasan-tsbrcu-noquarantine-test-v2-1-d16bd99309c9@google.com
[jannh@google.com: make comment more verbose]
   Link: https://lkml.kernel.org/r/20250814-kasan-tsbrcu-noquarantine-test-v3-1-9e9110009b4e@google.com
Link: https://lkml.kernel.org/r/20250728-kasan-tsbrcu-noquarantine-test-v1-1-fa24d9ab7f41@google.com


Signed-off-by: default avatarJann Horn <jannh@google.com>
Suggested-by: default avatarAndrey Konovalov <andreyknvl@gmail.com>
Acked-by: default avatarVlastimil Babka <vbabka@suse.cz>
Reviewed-by: default avatarAndrey Konovalov <andreyknvl@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitriy Vyukov <dvyukov@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 56b060d0

mm/kasan/kasan_test_c.c

+40 −0
Original line number Diff line number Diff line
@@ -1073,6 +1073,45 @@ static void kmem_cache_rcu_uaf(struct kunit *test) 
	kmem_cache_destroy(cache);

}



/*

 * Check that SLAB_TYPESAFE_BY_RCU objects are immediately reused when

 * CONFIG_SLUB_RCU_DEBUG is off, and stay at the same address.

 * Without this, KASAN builds would be unable to trigger bugs caused by

 * SLAB_TYPESAFE_BY_RCU users handling reycled objects improperly.

 */

static void kmem_cache_rcu_reuse(struct kunit *test)

{

	char *p, *p2;

	struct kmem_cache *cache;



	KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_SLUB_RCU_DEBUG);



	cache = kmem_cache_create("test_cache", 16, 0, SLAB_TYPESAFE_BY_RCU,

				  NULL);

	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);



	migrate_disable();

	p = kmem_cache_alloc(cache, GFP_KERNEL);

	if (!p) {

		kunit_err(test, "Allocation failed: %s\n", __func__);

		goto out;

	}



	kmem_cache_free(cache, p);

	p2 = kmem_cache_alloc(cache, GFP_KERNEL);

	if (!p2) {

		kunit_err(test, "Allocation failed: %s\n", __func__);

		goto out;

	}

	KUNIT_EXPECT_PTR_EQ(test, p, p2);



	kmem_cache_free(cache, p2);



out:

	migrate_enable();

	kmem_cache_destroy(cache);

}



static void kmem_cache_double_destroy(struct kunit *test)

{

	struct kmem_cache *cache;
@@ -2106,6 +2145,7 @@ static struct kunit_case kasan_kunit_test_cases[] = { 
	KUNIT_CASE(kmem_cache_double_free),

	KUNIT_CASE(kmem_cache_invalid_free),

	KUNIT_CASE(kmem_cache_rcu_uaf),

	KUNIT_CASE(kmem_cache_rcu_reuse),

	KUNIT_CASE(kmem_cache_double_destroy),

	KUNIT_CASE(kmem_cache_accounted),

	KUNIT_CASE(kmem_cache_bulk),