Commit e909cedf authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'linux_kselftest-kunit-fixes-7.1-rc6' of... 

Merge tag 'linux_kselftest-kunit-fixes-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest

Pull kunit fix from Shuah Khan:
 "Fix a use-after-free in kunit debugfs when using kunit.filter when the
  executor frees dynamically allocated resources after running boot-time
  tests. This resulted in fatal hardware exception due to invalidation
  of capability flags on the reclaimed memory on some architectures such
  as CHERI RISC-V that support the feature, and silent memory corruption
  on others.

  The fix for this couples the lifetime of the filtered suite memory
  allocation to the lifetime of the kunit subsystem and its associated
  VFS nodes. Ownership of the boot-time suite_set is now transferred to
  a global tracker ('kunit_boot_suites'), and the memory is cleanly
  released in kunit_exit() during module teardown"

* tag 'linux_kselftest-kunit-fixes-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
  kunit: fix use-after-free in debugfs when using kunit.filter
parents d60ec36c fb6988b8

include/kunit/test.h

+1 −0
Original line number Diff line number Diff line
@@ -613,6 +613,7 @@ unsigned long kunit_vm_mmap(struct kunit *test, struct file *file, 
			    unsigned long offset);



void kunit_cleanup(struct kunit *test);

void kunit_free_boot_suites(void);



void __printf(2, 3) kunit_log_append(struct string_stream *log, const char *fmt, ...);

lib/kunit/executor.c

+16 −3
Original line number Diff line number Diff line
@@ -15,6 +15,16 @@ extern struct kunit_suite * const __kunit_suites_end[]; 
extern struct kunit_suite * const __kunit_init_suites_start[];

extern struct kunit_suite * const __kunit_init_suites_end[];



static struct kunit_suite_set kunit_boot_suites;



void kunit_free_boot_suites(void)

{

	if (kunit_boot_suites.start) {

		kunit_free_suite_set(kunit_boot_suites);

		kunit_boot_suites = (struct kunit_suite_set){ NULL, NULL };

	}

}



static char *action_param;



module_param_named(action, action_param, charp, 0400);
@@ -411,9 +421,12 @@ int kunit_run_all_tests(void) 
		pr_err("kunit executor: unknown action '%s'\n", action_param);



free_out:

	if (filter_glob_param || filter_param)

	if (filter_glob_param || filter_param) {

		if (err)

			kunit_free_suite_set(suite_set);

	else if (init_num_suites > 0)

		else

			kunit_boot_suites = suite_set;

	} else if (init_num_suites > 0)

		/* Don't use kunit_free_suite_set because suites aren't individually allocated */

		kfree(suite_set.start);

lib/kunit/test.c

+1 −0
Original line number Diff line number Diff line
@@ -1075,6 +1075,7 @@ static void __exit kunit_exit(void) 
	kunit_bus_shutdown();



	kunit_debugfs_cleanup();

	kunit_free_boot_suites();

}

module_exit(kunit_exit);