| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAAeHK+yT+hPK6Vcj+KWv-7vPk=OQUGvODJUUO3atqHcoVTXvSQ@mail.gmail.com>
Date: Tue, 14 Apr 2020 16:00:18 +0200
From: Andrey Konovalov <andreyknvl@...gle.com>
To: David Gow <davidgow@...gle.com>
Cc: Patricia Alfonso <trishalfonso@...gle.com>,
Brendan Higgins <brendanhiggins@...gle.com>,
Andrey Ryabinin <aryabinin@...tuozzo.com>,
Dmitry Vyukov <dvyukov@...gle.com>,
Ingo Molnar <mingo@...hat.com>,
Peter Zijlstra <peterz@...radead.org>,
Juri Lelli <juri.lelli@...hat.com>,
Vincent Guittot <vincent.guittot@...aro.org>,
LKML <linux-kernel@...r.kernel.org>,
kasan-dev <kasan-dev@...glegroups.com>,
kunit-dev@...glegroups.com,
"open list:KERNEL SELFTEST FRAMEWORK"
<linux-kselftest@...r.kernel.org>
Subject: Re: [PATCH v5 2/4] KUnit: KASAN Integration
On Tue, Apr 14, 2020 at 5:17 AM 'David Gow' via kasan-dev
<kasan-dev@...glegroups.com> wrote:
>
> From: Patricia Alfonso <trishalfonso@...gle.com>
>
> Integrate KASAN into KUnit testing framework.
> - Fail tests when KASAN reports an error that is not expected
> - Use KUNIT_EXPECT_KASAN_FAIL to expect a KASAN error in KASAN
> tests
> - Expected KASAN reports pass tests and are still printed when run
> without kunit_tool (kunit_tool still bypasses the report due to the
> test passing)
> - KUnit struct in current task used to keep track of the current
> test from KASAN code
> - Also make KASAN no-longer panic when panic_on_warn and
> kasan_multi_shot are enabled (as multi-shot does nothing
> otherwise)
>
> Make use of "[PATCH v3 kunit-next 1/2] kunit: generalize
> kunit_resource API beyond allocated resources" and "[PATCH v3
> kunit-next 2/2] kunit: add support for named resources" from Alan
> Maguire [1]
> - A named resource is added to a test when a KASAN report is
> expected
> - This resource contains a struct for kasan_data containing
> booleans representing if a KASAN report is expected and if a
> KASAN report is found
>
> [1] (https://lore.kernel.org/linux-kselftest/1583251361-12748-1-git-send-email-alan.maguire@oracle.com/T/#t)
>
> Signed-off-by: Patricia Alfonso <trishalfonso@...gle.com>
> Signed-off-by: David Gow <davidgow@...gle.com>
> Reviewed-by: Dmitry Vyukov <dvyukov@...gle.com>
> ---
> include/kunit/test.h | 5 +++++
> include/linux/kasan.h | 6 ++++++
> lib/kunit/test.c | 13 ++++++++-----
> lib/test_kasan.c | 44 +++++++++++++++++++++++++++++++++++++++----
> mm/kasan/report.c | 34 ++++++++++++++++++++++++++++++++-
> 5 files changed, 92 insertions(+), 10 deletions(-)
>
> diff --git a/include/kunit/test.h b/include/kunit/test.h
> index ac59d18e6bab..1dc3d118f64b 100644
> --- a/include/kunit/test.h
> +++ b/include/kunit/test.h
> @@ -225,6 +225,11 @@ struct kunit {
> struct list_head resources; /* Protected by lock. */
> };
>
> +static inline void kunit_set_failure(struct kunit *test)
> +{
> + WRITE_ONCE(test->success, false);
> +}
> +
> void kunit_init_test(struct kunit *test, const char *name, char *log);
>
> int kunit_run_tests(struct kunit_suite *suite);
> diff --git a/include/linux/kasan.h b/include/linux/kasan.h
> index 5cde9e7c2664..148eaef3e003 100644
> --- a/include/linux/kasan.h
> +++ b/include/linux/kasan.h
> @@ -14,6 +14,12 @@ struct task_struct;
> #include <asm/kasan.h>
> #include <asm/pgtable.h>
>
> +/* kasan_data struct is used in KUnit tests for KASAN expected failures */
> +struct kunit_kasan_expectation {
> + bool report_expected;
> + bool report_found;
> +};
> +
> extern unsigned char kasan_early_shadow_page[PAGE_SIZE];
> extern pte_t kasan_early_shadow_pte[PTRS_PER_PTE];
> extern pmd_t kasan_early_shadow_pmd[PTRS_PER_PMD];
> diff --git a/lib/kunit/test.c b/lib/kunit/test.c
> index 2cb7c6220a00..030a3281591e 100644
> --- a/lib/kunit/test.c
> +++ b/lib/kunit/test.c
> @@ -10,16 +10,12 @@
> #include <linux/kernel.h>
> #include <linux/kref.h>
> #include <linux/sched/debug.h>
> +#include <linux/sched.h>
>
> #include "debugfs.h"
> #include "string-stream.h"
> #include "try-catch-impl.h"
>
> -static void kunit_set_failure(struct kunit *test)
> -{
> - WRITE_ONCE(test->success, false);
> -}
> -
> static void kunit_print_tap_version(void)
> {
> static bool kunit_has_printed_tap_version;
> @@ -288,6 +284,10 @@ static void kunit_try_run_case(void *data)
> struct kunit_suite *suite = ctx->suite;
> struct kunit_case *test_case = ctx->test_case;
>
> +#if (IS_ENABLED(CONFIG_KASAN) && IS_ENABLED(CONFIG_KUNIT))
> + current->kunit_test = test;
> +#endif /* IS_ENABLED(CONFIG_KASAN) && IS_ENABLED(CONFIG_KUNIT) */
> +
> /*
> * kunit_run_case_internal may encounter a fatal error; if it does,
> * abort will be called, this thread will exit, and finally the parent
> @@ -603,6 +603,9 @@ void kunit_cleanup(struct kunit *test)
> spin_unlock(&test->lock);
> kunit_remove_resource(test, res);
> }
> +#if (IS_ENABLED(CONFIG_KASAN) && IS_ENABLED(CONFIG_KUNIT))
> + current->kunit_test = NULL;
> +#endif /* IS_ENABLED(CONFIG_KASAN) && IS_ENABLED(CONFIG_KUNIT)*/
> }
> EXPORT_SYMBOL_GPL(kunit_cleanup);
>
> diff --git a/lib/test_kasan.c b/lib/test_kasan.c
> index 3872d250ed2c..7b4cb107b387 100644
> --- a/lib/test_kasan.c
> +++ b/lib/test_kasan.c
> @@ -23,12 +23,48 @@
>
> #include <asm/page.h>
>
> -/*
> - * Note: test functions are marked noinline so that their names appear in
> - * reports.
> +#include <kunit/test.h>
> +
> +static struct kunit_resource resource;
> +static struct kunit_kasan_expectation fail_data;
> +static bool multishot;
> +
> +static int kasan_test_init(struct kunit *test)
> +{
> + /*
> + * Temporarily enable multi-shot mode and set panic_on_warn=0.
> + * Otherwise, we'd only get a report for the first case.
> + */
> + multishot = kasan_save_enable_multi_shot();
> +
> + return 0;
> +}
> +
> +static void kasan_test_exit(struct kunit *test)
> +{
> + kasan_restore_multi_shot(multishot);
> +}
> +
> +/**
> + * KUNIT_EXPECT_KASAN_FAIL() - Causes a test failure when the expression does
> + * not cause a KASAN error. This uses a KUnit resource named "kasan_data." Do
> + * Do not use this name for a KUnit resource outside here.
> + *
> */
> +#define KUNIT_EXPECT_KASAN_FAIL(test, condition) do { \
> + fail_data.report_expected = true; \
> + fail_data.report_found = false; \
> + kunit_add_named_resource(test, \
> + NULL, \
> + NULL, \
> + &resource, \
> + "kasan_data", &fail_data); \
> + condition; \
> + KUNIT_EXPECT_EQ(test, \
> + fail_data.report_expected, \
> + fail_data.report_found); \
> +} while (0)
>
[...]
> -static noinline void __init kmalloc_oob_right(void)
Actually this also needs to be fixed. You remove this line in this
patch and add it back in the next one. Please test that the kernel
builds with your patches applied one by one.
> {
> char *ptr;
> size_t size = 123;
> diff --git a/mm/kasan/report.c b/mm/kasan/report.c
> index 5ef9f24f566b..a58a9f3b7f2c 100644
> --- a/mm/kasan/report.c
> +++ b/mm/kasan/report.c
> @@ -32,6 +32,8 @@
>
> #include <asm/sections.h>
>
> +#include <kunit/test.h>
> +
> #include "kasan.h"
> #include "../slab.h"
>
> @@ -92,7 +94,7 @@ static void end_report(unsigned long *flags)
> pr_err("==================================================================\n");
> add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
> spin_unlock_irqrestore(&report_lock, *flags);
> - if (panic_on_warn)
> + if (panic_on_warn && !test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags))
> panic("panic_on_warn set ...\n");
> kasan_enable_current();
> }
> @@ -455,12 +457,37 @@ static bool report_enabled(void)
> return !test_and_set_bit(KASAN_BIT_REPORTED, &kasan_flags);
> }
>
> +#if IS_ENABLED(CONFIG_KUNIT)
> +static void kasan_update_kunit_status(struct kunit *cur_test)
> +{
> + struct kunit_resource *resource;
> + struct kunit_kasan_expectation *kasan_data;
> +
> + resource = kunit_find_named_resource(cur_test, "kasan_data");
> +
> + if (!resource) {
> + kunit_set_failure(cur_test);
> + return;
> + }
> +
> + kasan_data = (struct kunit_kasan_expectation *)resource->data;
> + kasan_data->report_found = true;
> + kunit_put_resource(resource);
> +}
> +#endif /* IS_ENABLED(CONFIG_KUNIT) */
> +
> void kasan_report_invalid_free(void *object, unsigned long ip)
> {
> unsigned long flags;
> u8 tag = get_tag(object);
>
> object = reset_tag(object);
> +
> +#if IS_ENABLED(CONFIG_KUNIT)
> + if (current->kunit_test)
> + kasan_update_kunit_status(current->kunit_test);
> +#endif /* IS_ENABLED(CONFIG_KUNIT) */
> +
> start_report(&flags);
> pr_err("BUG: KASAN: double-free or invalid-free in %pS\n", (void *)ip);
> print_tags(tag, object);
> @@ -481,6 +508,11 @@ void __kasan_report(unsigned long addr, size_t size, bool is_write, unsigned lon
> if (likely(!report_enabled()))
> return;
>
> +#if IS_ENABLED(CONFIG_KUNIT)
> + if (current->kunit_test)
> + kasan_update_kunit_status(current->kunit_test);
> +#endif /* IS_ENABLED(CONFIG_KUNIT) */
> +
> disable_trace_on_warning();
>
> tagged_addr = (void *)addr;
> --
> 2.26.0.110.g2183baf09c-goog
>
> --
> You received this message because you are subscribed to the Google Groups "kasan-dev" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to kasan-dev+unsubscribe@...glegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/kasan-dev/20200414031647.124664-3-davidgow%40google.com.
Powered by blists - more mailing lists