linux-kernel - Re: [PATCH] kunit: fix too small allocation when using suite-only kunit.filter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 4 Oct 2021 14:58:59 -0700
From:   Brendan Higgins <brendanhiggins@...gle.com>
To:     Daniel Latypov <dlatypov@...gle.com>
Cc:     davidgow@...gle.com, linux-kernel@...r.kernel.org,
        kunit-dev@...glegroups.com, linux-kselftest@...r.kernel.org,
        skhan@...uxfoundation.org,
        kernel test robot <oliver.sang@...el.com>
Subject: Re: [PATCH] kunit: fix too small allocation when using suite-only kunit.filter_glob

On Fri, Oct 1, 2021 at 6:36 PM Daniel Latypov <dlatypov@...gle.com> wrote:
>
> When a user filters by a suite and not a test, e.g.
> $ ./tools/testing/kunit/kunit.py run 'suite_name'
>
> it hits this code
>   const int len = strlen(filter_glob);
>   ...
>   parsed->suite_glob = kmalloc(len, GFP_KERNEL);
> which fails to allocate space for the terminating NULL.
>
> Somehow, it seems like we can't easily reproduce this under UML, so the
> existing `parse_filter_test()` didn't catch this.
>
> Fix this by allocating `len + 1` and switch to kzalloc() just to be a
> bit more defensive. We're only going to run this code once per kernel
> boot, and it should never be very long.
>
> Also update the unit tests to be a bit more cautious.
> This bug showed up as a NULL pointer dereference here:
> >  KUNIT_EXPECT_STREQ(test, (const char *)filtered.start[0][0]->name, "suite0");
> `filtered.start[0][0]` was NULL, and `name` is at offset 0 in the struct,
> so `...->name` was also NULL.
>
> Fixes: 3b29021ddd10 ("kunit: tool: allow filtering test cases via glob")
> Reported-by: kernel test robot <oliver.sang@...el.com>
> Signed-off-by: Daniel Latypov <dlatypov@...gle.com>

Acked-by: Brendan Higgins <brendanhiggins@...gle.com>