Message-ID: <CABVgOSk93mNY4diXppGWJZgWJhrHpGqECBXNROWkRCaZjFi2tw@mail.gmail.com>
Date: Sat, 6 Jul 2024 16:04:25 +0800
From: David Gow <davidgow@...gle.com>
To: Stephen Boyd <sboyd@...nel.org>
Cc: Michael Turquette <mturquette@...libre.com>, linux-kernel@...r.kernel.org, 
	linux-clk@...r.kernel.org, patches@...ts.linux.dev, 
	kunit-dev@...glegroups.com, linux-kselftest@...r.kernel.org, 
	devicetree@...r.kernel.org, Brendan Higgins <brendan.higgins@...ux.dev>, 
	Rae Moar <rmoar@...gle.com>, Greg Kroah-Hartman <gregkh@...uxfoundation.org>, 
	"Rafael J . Wysocki" <rafael@...nel.org>, Rob Herring <robh@...nel.org>, 
	Saravana Kannan <saravanak@...gle.com>, Daniel Latypov <dlatypov@...gle.com>, 
	Christian Marangi <ansuelsmth@...il.com>, 
	Krzysztof Kozlowski <krzysztof.kozlowski+dt@...aro.org>, Conor Dooley <conor+dt@...nel.org>, 
	Maxime Ripard <maxime@...no.tech>
Subject: Re: [PATCH v6 5/8] platform: Add test managed platform_device/driver APIs

On Sat, 6 Jul 2024 at 12:55, Stephen Boyd <sboyd@...nel.org> wrote:
>
> Introduce KUnit resource wrappers around platform_driver_register(),
> platform_device_alloc(), and platform_device_add() so that test authors
> can register platform drivers/devices from their tests and have the
> drivers/devices automatically be unregistered when the test is done.
>
> This makes test setup code simpler when a platform driver or platform
> device is needed. Add a few test cases at the same time to make sure the
> APIs work as intended.
>
> Cc: Brendan Higgins <brendan.higgins@...ux.dev>
> Reviewed-by: David Gow <davidgow@...gle.com>
> Cc: Rae Moar <rmoar@...gle.com>
> Reviewed-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> Cc: "Rafael J. Wysocki" <rafael@...nel.org>
> Signed-off-by: Stephen Boyd <sboyd@...nel.org>
> ---

Hmm... this is failing under KASAN for me. I'll take a closer look
next week, but in case there's anything super-obvious, here's the
report:

> [15:54:33] BUG: KASAN: slab-use-after-free in kobject_put+0x224/0x280
> [15:54:33] Read of size 1 at addr ffff888002ca484c by task kunit_try_catch/226
> [15:54:33]
> [15:54:33] CPU: 0 PID: 226 Comm: kunit_try_catch Tainted: G      D          N 6.10.0-rc1-g21fbb4cfd3cc #25
> [15:54:33] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [15:54:33] Call Trace:
> [15:54:33]  <TASK>
> [15:54:33]  dump_stack_lvl+0x3f/0x50
> [15:54:33]  print_report+0xcd/0x620
> [15:54:33]  ? kobject_put+0x224/0x280
> [15:54:33]  kasan_report+0xde/0x110
> [15:54:33]  ? kobject_put+0x224/0x280
> [15:54:33]  kobject_put+0x224/0x280
> [15:54:33]  kunit_remove_resource+0x12c/0x1d0
> [15:54:33]  kunit_cleanup+0x8d/0x130
> [15:54:33]  ? __pfx_kunit_try_run_case_cleanup+0x10/0x10
> [15:54:33]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
> [15:54:33]  kunit_generic_run_threadfn_adapter+0x7b/0xe0
> [15:54:33]  kthread+0x289/0x360
> [15:54:33]  ? __pfx_kthread+0x10/0x10
> [15:54:33]  ret_from_fork+0x2f/0x70
> [15:54:33]  ? __pfx_kthread+0x10/0x10
> [15:54:33]  ret_from_fork_asm+0x19/0x30
> [15:54:33]  </TASK>
> [15:54:33]
> [15:54:33] Allocated by task 225:
> [15:54:33]  kasan_save_stack+0x33/0x60
> [15:54:33]  kasan_save_track+0x14/0x30
> [15:54:33]  __kasan_kmalloc+0x8f/0xa0
> [15:54:33]  platform_device_alloc+0x26/0x200
> [15:54:33]  kunit_platform_device_alloc_init+0x52/0xc0
> [15:54:33]  __kunit_add_resource+0x98/0x1e0
> [15:54:33]  kunit_platform_device_alloc+0xe7/0x170
> [15:54:33]  kunit_platform_device_add_test+0x91/0x560
> [15:54:33]  kunit_try_run_case+0x1ad/0x490
> [15:54:33]  kunit_generic_run_threadfn_adapter+0x7b/0xe0
> [15:54:33]  kthread+0x289/0x360
> [15:54:33]  ret_from_fork+0x2f/0x70
> [15:54:33]  ret_from_fork_asm+0x19/0x30
> [15:54:33]
> [15:54:33] Freed by task 226:
> [15:54:33]  kasan_save_stack+0x33/0x60
> [15:54:33]  kasan_save_track+0x14/0x30
> [15:54:33]  kasan_save_free_info+0x3b/0x60
> [15:54:33]  __kasan_slab_free+0x101/0x160
> [15:54:33]  kfree+0x94/0x190
> [15:54:33]  device_release+0x9a/0x210
> [15:54:33]  kobject_put+0x150/0x280
> [15:54:33]  kunit_remove_resource+0x12c/0x1d0
> [15:54:33]  kunit_cleanup+0x8d/0x130
> [15:54:33]  kunit_generic_run_threadfn_adapter+0x7b/0xe0
> [15:54:33]  kthread+0x289/0x360
> [15:54:33]  ret_from_fork+0x2f/0x70
> [15:54:33]  ret_from_fork_asm+0x19/0x30
> [15:54:33]
> [15:54:33] The buggy address belongs to the object at ffff888002ca4800
> [15:54:33]  which belongs to the cache kmalloc-1k of size 1024
> [15:54:33] The buggy address is located 76 bytes inside of
> [15:54:33]  freed 1024-byte region [ffff888002ca4800, ffff888002ca4c00)
> [15:54:33]
> [15:54:33] The buggy address belongs to the physical page:
> [15:54:33] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2ca4
> [15:54:33] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> [15:54:33] flags: 0x4000000000000040(head|zone=1)
> [15:54:33] page_type: 0xffffefff(slab)
> [15:54:33] raw: 4000000000000040 ffff888001041b00 dead000000000122 0000000000000000
> [15:54:33] raw: 0000000000000000 0000000080080008 00000001ffffefff 0000000000000000
> [15:54:33] head: 4000000000000040 ffff888001041b00 dead000000000122 0000000000000000
> [15:54:33] head: 0000000000000000 0000000080080008 00000001ffffefff 0000000000000000
> [15:54:33] head: 4000000000000002 ffffea00000b2901 ffffffffffffffff 0000000000000000
> [15:54:33] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
> [15:54:33] page dumped because: kasan: bad access detected
> [15:54:33]
> [15:54:33] Memory state around the buggy address:
> [15:54:33]  ffff888002ca4700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [15:54:33]  ffff888002ca4780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [15:54:33] >ffff888002ca4800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [15:54:33]                                               ^
> [15:54:33]  ffff888002ca4880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [15:54:33]  ffff888002ca4900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [15:54:33] ==================================================================
> [15:54:33] ------------[ cut here ]------------
> [15:54:33] refcount_t: underflow; use-after-free.
> [15:54:33] WARNING: CPU: 0 PID: 226 at lib/refcount.c:28 refcount_warn_saturate+0xf2/0x150
> [15:54:33] CPU: 0 PID: 226 Comm: kunit_try_catch Tainted: G    B D          N 6.10.0-rc1-g21fbb4cfd3cc #25
> [15:54:33] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [15:54:33] RIP: 0010:refcount_warn_saturate+0xf2/0x150
> [15:54:33] Code: 3b aa cb 00 01 e8 3e c1 b0 ff 0f 0b eb 91 80 3d 2a aa cb 00 00 75 88 48 c7 c7 40 f3 88 ad c6 05 1a aa cb 00 01 e8 1e c1 b0 ff <0f> 0b e9 6e ff ff ff 80 3d 0a aa cb 00 00 0f 85 61 ff ff ff 48 c7
> [15:54:33] RSP: 0018:ffff88800357fe58 EFLAGS: 00000286
> [15:54:33] RAX: 0000000000000000 RBX: ffff888002ca4848 RCX: 1ffffffff5b920d4
> [15:54:33] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffffadc906a0
> [15:54:33] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff5b920d4
> [15:54:33] R10: 0000000000000003 R11: 0000000000000001 R12: ffff88800111fb28
> [15:54:33] R13: ffff88800111fb28 R14: ffff88800111fb28 R15: 0000000000000286
> [15:54:33] FS:  0000000000000000(0000) GS:ffffffffadc6f000(0000) knlGS:0000000000000000
> [15:54:33] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [15:54:33] CR2: dffffc0000000000 CR3: 000000000a25a000 CR4: 00000000000006f0
> [15:54:33] Call Trace:
> [15:54:33]  <TASK>
> [15:54:33]  ? __warn+0xb0/0x170
> [15:54:33]  ? refcount_warn_saturate+0xf2/0x150
> [15:54:33]  ? report_bug+0x298/0x350
> [15:54:33]  ? handle_bug+0x6d/0x90
> [15:54:33]  ? exc_invalid_op+0x17/0x40
> [15:54:33]  ? asm_exc_invalid_op+0x1a/0x20
> [15:54:33]  ? refcount_warn_saturate+0xf2/0x150
> [15:54:33]  ? refcount_warn_saturate+0xf2/0x150
> [15:54:33]  kunit_remove_resource+0x12c/0x1d0
> [15:54:33]  kunit_cleanup+0x8d/0x130
> [15:54:33]  ? __pfx_kunit_try_run_case_cleanup+0x10/0x10
> [15:54:33]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
> [15:54:33]  kunit_generic_run_threadfn_adapter+0x7b/0xe0
> [15:54:33]  kthread+0x289/0x360
> [15:54:33]  ? __pfx_kthread+0x10/0x10
> [15:54:33]  ret_from_fork+0x2f/0x70
> [15:54:33]  ? __pfx_kthread+0x10/0x10
> [15:54:33]  ret_from_fork_asm+0x19/0x30
> [15:54:33]  </TASK>
> [15:54:33] ---[ end trace 0000000000000000 ]---
> [15:54:33] [FAILED] kunit_platform_device_add_test

It repros here with:
./tools/testing/kunit/kunit.py run --arch x86_64 --kconfig_add
CONFIG_KASAN=y --kconfig_add CONFIG_KASAN_VMALLOC=y
kunit_platform_driver

Seems to otherwise pass on all of my default configs/archs.

Cheers,
-- David

Download attachment "smime.p7s" of type "application/pkcs7-signature" (4014 bytes)

Powered by blists - more mailing lists