kmsan_test.c 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * Test cases for KMSAN.
  4. * For each test case checks the presence (or absence) of generated reports.
  5. * Relies on 'console' tracepoint to capture reports as they appear in the
  6. * kernel log.
  7. *
  8. * Copyright (C) 2021-2022, Google LLC.
  9. * Author: Alexander Potapenko <glider@google.com>
  10. *
  11. */
  12. #include <kunit/test.h>
  13. #include "kmsan.h"
  14. #include <linux/jiffies.h>
  15. #include <linux/kernel.h>
  16. #include <linux/kmsan.h>
  17. #include <linux/mm.h>
  18. #include <linux/random.h>
  19. #include <linux/slab.h>
  20. #include <linux/spinlock.h>
  21. #include <linux/string.h>
  22. #include <linux/tracepoint.h>
  23. #include <linux/vmalloc.h>
  24. #include <trace/events/printk.h>
  25. static DEFINE_PER_CPU(int, per_cpu_var);
  26. /* Report as observed from console. */
  27. static struct {
  28. spinlock_t lock;
  29. bool available;
  30. bool ignore; /* Stop console output collection. */
  31. char header[256];
  32. } observed = {
  33. .lock = __SPIN_LOCK_UNLOCKED(observed.lock),
  34. };
  35. /* Probe for console output: obtains observed lines of interest. */
  36. static void probe_console(void *ignore, const char *buf, size_t len)
  37. {
  38. unsigned long flags;
  39. if (observed.ignore)
  40. return;
  41. spin_lock_irqsave(&observed.lock, flags);
  42. if (strnstr(buf, "BUG: KMSAN: ", len)) {
  43. /*
  44. * KMSAN report and related to the test.
  45. *
  46. * The provided @buf is not NUL-terminated; copy no more than
  47. * @len bytes and let strscpy() add the missing NUL-terminator.
  48. */
  49. strscpy(observed.header, buf,
  50. min(len + 1, sizeof(observed.header)));
  51. WRITE_ONCE(observed.available, true);
  52. observed.ignore = true;
  53. }
  54. spin_unlock_irqrestore(&observed.lock, flags);
  55. }
  56. /* Check if a report related to the test exists. */
  57. static bool report_available(void)
  58. {
  59. return READ_ONCE(observed.available);
  60. }
  61. /* Reset observed.available, so that the test can trigger another report. */
  62. static void report_reset(void)
  63. {
  64. unsigned long flags;
  65. spin_lock_irqsave(&observed.lock, flags);
  66. WRITE_ONCE(observed.available, false);
  67. observed.ignore = false;
  68. spin_unlock_irqrestore(&observed.lock, flags);
  69. }
  70. /* Information we expect in a report. */
  71. struct expect_report {
  72. const char *error_type; /* Error type. */
  73. /*
  74. * Kernel symbol from the error header, or NULL if no report is
  75. * expected.
  76. */
  77. const char *symbol;
  78. };
  79. /* Check observed report matches information in @r. */
  80. static bool report_matches(const struct expect_report *r)
  81. {
  82. typeof(observed.header) expected_header;
  83. unsigned long flags;
  84. bool ret = false;
  85. const char *end;
  86. char *cur;
  87. /* Doubled-checked locking. */
  88. if (!report_available() || !r->symbol)
  89. return (!report_available() && !r->symbol);
  90. /* Generate expected report contents. */
  91. /* Title */
  92. cur = expected_header;
  93. end = ARRAY_END(expected_header);
  94. cur += scnprintf(cur, end - cur, "BUG: KMSAN: %s", r->error_type);
  95. scnprintf(cur, end - cur, " in %s", r->symbol);
  96. /* The exact offset won't match, remove it; also strip module name. */
  97. cur = strchr(expected_header, '+');
  98. if (cur)
  99. *cur = '\0';
  100. spin_lock_irqsave(&observed.lock, flags);
  101. if (!report_available())
  102. goto out; /* A new report is being captured. */
  103. /* Finally match expected output to what we actually observed. */
  104. ret = strstr(observed.header, expected_header);
  105. out:
  106. spin_unlock_irqrestore(&observed.lock, flags);
  107. return ret;
  108. }
  109. /* ===== Test cases ===== */
  110. /* Prevent replacing branch with select in LLVM. */
  111. static noinline void check_true(char *arg)
  112. {
  113. pr_info("%s is true\n", arg);
  114. }
  115. static noinline void check_false(char *arg)
  116. {
  117. pr_info("%s is false\n", arg);
  118. }
  119. #define USE(x) \
  120. do { \
  121. if (x) \
  122. check_true(#x); \
  123. else \
  124. check_false(#x); \
  125. } while (0)
  126. #define EXPECTATION_ETYPE_FN(e, reason, fn) \
  127. struct expect_report e = { \
  128. .error_type = reason, \
  129. .symbol = fn, \
  130. }
  131. #define EXPECTATION_NO_REPORT(e) EXPECTATION_ETYPE_FN(e, NULL, NULL)
  132. #define EXPECTATION_UNINIT_VALUE_FN(e, fn) \
  133. EXPECTATION_ETYPE_FN(e, "uninit-value", fn)
  134. #define EXPECTATION_UNINIT_VALUE(e) EXPECTATION_UNINIT_VALUE_FN(e, __func__)
  135. #define EXPECTATION_USE_AFTER_FREE(e) \
  136. EXPECTATION_ETYPE_FN(e, "use-after-free", __func__)
  137. /* Test case: ensure that kmalloc() returns uninitialized memory. */
  138. static void test_uninit_kmalloc(struct kunit *test)
  139. {
  140. EXPECTATION_UNINIT_VALUE(expect);
  141. int *ptr;
  142. kunit_info(test, "uninitialized kmalloc test (UMR report)\n");
  143. ptr = kmalloc_obj(*ptr);
  144. USE(*ptr);
  145. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  146. }
  147. /*
  148. * Test case: ensure that kmalloc'ed memory becomes initialized after memset().
  149. */
  150. static void test_init_kmalloc(struct kunit *test)
  151. {
  152. EXPECTATION_NO_REPORT(expect);
  153. int *ptr;
  154. kunit_info(test, "initialized kmalloc test (no reports)\n");
  155. ptr = kmalloc_obj(*ptr);
  156. memset(ptr, 0, sizeof(*ptr));
  157. USE(*ptr);
  158. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  159. }
  160. /* Test case: ensure that kzalloc() returns initialized memory. */
  161. static void test_init_kzalloc(struct kunit *test)
  162. {
  163. EXPECTATION_NO_REPORT(expect);
  164. int *ptr;
  165. kunit_info(test, "initialized kzalloc test (no reports)\n");
  166. ptr = kzalloc_obj(*ptr);
  167. USE(*ptr);
  168. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  169. }
  170. /* Test case: ensure that local variables are uninitialized by default. */
  171. static void test_uninit_stack_var(struct kunit *test)
  172. {
  173. EXPECTATION_UNINIT_VALUE(expect);
  174. volatile int cond;
  175. kunit_info(test, "uninitialized stack variable (UMR report)\n");
  176. USE(cond);
  177. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  178. }
  179. /* Test case: ensure that local variables with initializers are initialized. */
  180. static void test_init_stack_var(struct kunit *test)
  181. {
  182. EXPECTATION_NO_REPORT(expect);
  183. volatile int cond = 1;
  184. kunit_info(test, "initialized stack variable (no reports)\n");
  185. USE(cond);
  186. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  187. }
  188. static noinline void two_param_fn_2(int arg1, int arg2)
  189. {
  190. USE(arg1);
  191. USE(arg2);
  192. }
  193. static noinline void one_param_fn(int arg)
  194. {
  195. two_param_fn_2(arg, arg);
  196. USE(arg);
  197. }
  198. static noinline void two_param_fn(int arg1, int arg2)
  199. {
  200. int init = 0;
  201. one_param_fn(init);
  202. USE(arg1);
  203. USE(arg2);
  204. }
  205. static void test_params(struct kunit *test)
  206. {
  207. #ifdef CONFIG_KMSAN_CHECK_PARAM_RETVAL
  208. /*
  209. * With eager param/retval checking enabled, KMSAN will report an error
  210. * before the call to two_param_fn().
  211. */
  212. EXPECTATION_UNINIT_VALUE_FN(expect, "test_params");
  213. #else
  214. EXPECTATION_UNINIT_VALUE_FN(expect, "two_param_fn");
  215. #endif
  216. volatile int uninit, init = 1;
  217. kunit_info(test,
  218. "uninit passed through a function parameter (UMR report)\n");
  219. two_param_fn(uninit, init);
  220. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  221. }
  222. static int signed_sum3(int a, int b, int c)
  223. {
  224. return a + b + c;
  225. }
  226. /*
  227. * Test case: ensure that uninitialized values are tracked through function
  228. * arguments.
  229. */
  230. static void test_uninit_multiple_params(struct kunit *test)
  231. {
  232. EXPECTATION_UNINIT_VALUE(expect);
  233. volatile char b = 3, c;
  234. volatile int a;
  235. kunit_info(test, "uninitialized local passed to fn (UMR report)\n");
  236. USE(signed_sum3(a, b, c));
  237. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  238. }
  239. /* Helper function to make an array uninitialized. */
  240. static noinline void do_uninit_local_array(char *array, int start, int stop)
  241. {
  242. volatile char uninit;
  243. for (int i = start; i < stop; i++)
  244. array[i] = uninit;
  245. }
  246. /*
  247. * Test case: ensure kmsan_check_memory() reports an error when checking
  248. * uninitialized memory.
  249. */
  250. static void test_uninit_kmsan_check_memory(struct kunit *test)
  251. {
  252. EXPECTATION_UNINIT_VALUE_FN(expect, "test_uninit_kmsan_check_memory");
  253. volatile char local_array[8];
  254. kunit_info(
  255. test,
  256. "kmsan_check_memory() called on uninit local (UMR report)\n");
  257. do_uninit_local_array((char *)local_array, 5, 7);
  258. kmsan_check_memory((char *)local_array, 8);
  259. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  260. }
  261. /*
  262. * Test case: check that a virtual memory range created with vmap() from
  263. * initialized pages is still considered as initialized.
  264. */
  265. static void test_init_kmsan_vmap_vunmap(struct kunit *test)
  266. {
  267. EXPECTATION_NO_REPORT(expect);
  268. const int npages = 2;
  269. struct page **pages;
  270. void *vbuf;
  271. kunit_info(test, "pages initialized via vmap (no reports)\n");
  272. pages = kmalloc_objs(*pages, npages);
  273. for (int i = 0; i < npages; i++)
  274. pages[i] = alloc_page(GFP_KERNEL);
  275. vbuf = vmap(pages, npages, VM_MAP, PAGE_KERNEL);
  276. memset(vbuf, 0xfe, npages * PAGE_SIZE);
  277. for (int i = 0; i < npages; i++)
  278. kmsan_check_memory(page_address(pages[i]), PAGE_SIZE);
  279. if (vbuf)
  280. vunmap(vbuf);
  281. for (int i = 0; i < npages; i++) {
  282. if (pages[i])
  283. __free_page(pages[i]);
  284. }
  285. kfree(pages);
  286. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  287. }
  288. /*
  289. * Test case: ensure that memset() can initialize a buffer allocated via
  290. * vmalloc().
  291. */
  292. static void test_init_vmalloc(struct kunit *test)
  293. {
  294. EXPECTATION_NO_REPORT(expect);
  295. int npages = 8;
  296. char *buf;
  297. kunit_info(test, "vmalloc buffer can be initialized (no reports)\n");
  298. buf = vmalloc(PAGE_SIZE * npages);
  299. buf[0] = 1;
  300. memset(buf, 0xfe, PAGE_SIZE * npages);
  301. USE(buf[0]);
  302. for (int i = 0; i < npages; i++)
  303. kmsan_check_memory(&buf[PAGE_SIZE * i], PAGE_SIZE);
  304. vfree(buf);
  305. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  306. }
  307. /* Test case: ensure that use-after-free reporting works for kmalloc. */
  308. static void test_uaf(struct kunit *test)
  309. {
  310. EXPECTATION_USE_AFTER_FREE(expect);
  311. volatile int value;
  312. volatile int *var;
  313. kunit_info(test, "use-after-free in kmalloc-ed buffer (UMR report)\n");
  314. var = kmalloc(80, GFP_KERNEL);
  315. var[3] = 0xfeedface;
  316. kfree((int *)var);
  317. /* Copy the invalid value before checking it. */
  318. value = var[3];
  319. USE(value);
  320. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  321. }
  322. static void test_uninit_page(struct kunit *test)
  323. {
  324. EXPECTATION_UNINIT_VALUE(expect);
  325. struct page *page;
  326. int *ptr;
  327. kunit_info(test, "uninitialized page allocation (UMR report)\n");
  328. page = alloc_pages(GFP_KERNEL, 0);
  329. ptr = page_address(page);
  330. USE(*ptr);
  331. __free_pages(page, 0);
  332. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  333. }
  334. static volatile char *test_uaf_pages_helper(int order, int offset)
  335. {
  336. struct page *page;
  337. volatile char *var;
  338. /* Memory is initialized up until __free_pages() thanks to __GFP_ZERO. */
  339. page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order);
  340. var = page_address(page) + offset;
  341. __free_pages(page, order);
  342. return var;
  343. }
  344. /* Test case: ensure that use-after-free reporting works for a freed page. */
  345. static void test_uaf_pages(struct kunit *test)
  346. {
  347. EXPECTATION_USE_AFTER_FREE(expect);
  348. volatile char value;
  349. kunit_info(test, "use-after-free on a freed page (UMR report)\n");
  350. /* Allocate a single page, free it, then try to access it. */
  351. value = *test_uaf_pages_helper(0, 3);
  352. USE(value);
  353. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  354. }
  355. /* Test case: ensure that UAF reporting works for high order pages. */
  356. static void test_uaf_high_order_pages(struct kunit *test)
  357. {
  358. EXPECTATION_USE_AFTER_FREE(expect);
  359. volatile char value;
  360. kunit_info(test,
  361. "use-after-free on a freed high-order page (UMR report)\n");
  362. /*
  363. * Create a high-order non-compound page, free it, then try to access
  364. * its tail page.
  365. */
  366. value = *test_uaf_pages_helper(1, PAGE_SIZE + 3);
  367. USE(value);
  368. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  369. }
  370. /*
  371. * Test case: ensure that uninitialized values are propagated through per-CPU
  372. * memory.
  373. */
  374. static void test_percpu_propagate(struct kunit *test)
  375. {
  376. EXPECTATION_UNINIT_VALUE(expect);
  377. volatile int uninit, check;
  378. kunit_info(test,
  379. "uninit local stored to per_cpu memory (UMR report)\n");
  380. this_cpu_write(per_cpu_var, uninit);
  381. check = this_cpu_read(per_cpu_var);
  382. USE(check);
  383. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  384. }
  385. /*
  386. * Test case: ensure that passing uninitialized values to printk() leads to an
  387. * error report.
  388. */
  389. static void test_printk(struct kunit *test)
  390. {
  391. #ifdef CONFIG_KMSAN_CHECK_PARAM_RETVAL
  392. /*
  393. * With eager param/retval checking enabled, KMSAN will report an error
  394. * before the call to pr_info().
  395. */
  396. EXPECTATION_UNINIT_VALUE_FN(expect, "test_printk");
  397. #else
  398. EXPECTATION_UNINIT_VALUE_FN(expect, "number");
  399. #endif
  400. volatile int uninit;
  401. kunit_info(test, "uninit local passed to pr_info() (UMR report)\n");
  402. pr_info("%px contains %d\n", &uninit, uninit);
  403. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  404. }
  405. /* Prevent the compiler from inlining a memcpy() call. */
  406. static noinline void *memcpy_noinline(volatile void *dst,
  407. const volatile void *src, size_t size)
  408. {
  409. return memcpy((void *)dst, (const void *)src, size);
  410. }
  411. /* Test case: ensure that memcpy() correctly copies initialized values. */
  412. static void test_init_memcpy(struct kunit *test)
  413. {
  414. EXPECTATION_NO_REPORT(expect);
  415. volatile long long src;
  416. volatile long long dst = 0;
  417. src = 1;
  418. kunit_info(
  419. test,
  420. "memcpy()ing aligned initialized src to aligned dst (no reports)\n");
  421. memcpy_noinline((void *)&dst, (void *)&src, sizeof(src));
  422. kmsan_check_memory((void *)&dst, sizeof(dst));
  423. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  424. }
  425. /*
  426. * Test case: ensure that memcpy() correctly copies uninitialized values between
  427. * aligned `src` and `dst`.
  428. */
  429. static void test_memcpy_aligned_to_aligned(struct kunit *test)
  430. {
  431. EXPECTATION_UNINIT_VALUE_FN(expect, "test_memcpy_aligned_to_aligned");
  432. volatile int uninit_src;
  433. volatile int dst = 0;
  434. kunit_info(
  435. test,
  436. "memcpy()ing aligned uninit src to aligned dst (UMR report)\n");
  437. memcpy_noinline((void *)&dst, (void *)&uninit_src, sizeof(uninit_src));
  438. kmsan_check_memory((void *)&dst, sizeof(dst));
  439. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  440. }
  441. /*
  442. * Test case: ensure that memcpy() correctly copies uninitialized values between
  443. * aligned `src` and unaligned `dst`.
  444. *
  445. * Copying aligned 4-byte value to an unaligned one leads to touching two
  446. * aligned 4-byte values. This test case checks that KMSAN correctly reports an
  447. * error on the mentioned two values.
  448. */
  449. static void test_memcpy_aligned_to_unaligned(struct kunit *test)
  450. {
  451. EXPECTATION_UNINIT_VALUE_FN(expect, "test_memcpy_aligned_to_unaligned");
  452. volatile int uninit_src;
  453. volatile char dst[8] = { 0 };
  454. kunit_info(
  455. test,
  456. "memcpy()ing aligned uninit src to unaligned dst (UMR report)\n");
  457. kmsan_check_memory((void *)&uninit_src, sizeof(uninit_src));
  458. memcpy_noinline((void *)&dst[1], (void *)&uninit_src,
  459. sizeof(uninit_src));
  460. kmsan_check_memory((void *)dst, 4);
  461. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  462. report_reset();
  463. kmsan_check_memory((void *)&dst[4], sizeof(uninit_src));
  464. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  465. }
  466. /*
  467. * Test case: ensure that origin slots do not accidentally get overwritten with
  468. * zeroes during memcpy().
  469. *
  470. * Previously, when copying memory from an aligned buffer to an unaligned one,
  471. * if there were zero origins corresponding to zero shadow values in the source
  472. * buffer, they could have ended up being copied to nonzero shadow values in the
  473. * destination buffer:
  474. *
  475. * memcpy(0xffff888080a00000, 0xffff888080900002, 8)
  476. *
  477. * src (0xffff888080900002): ..xx .... xx..
  478. * src origins: o111 0000 o222
  479. * dst (0xffff888080a00000): xx.. ..xx
  480. * dst origins: o111 0000
  481. * (or 0000 o222)
  482. *
  483. * (here . stands for an initialized byte, and x for an uninitialized one.
  484. *
  485. * Ensure that this does not happen anymore, and for both destination bytes
  486. * the origin is nonzero (i.e. KMSAN reports an error).
  487. */
  488. static void test_memcpy_initialized_gap(struct kunit *test)
  489. {
  490. EXPECTATION_UNINIT_VALUE_FN(expect, "test_memcpy_initialized_gap");
  491. volatile char uninit_src[12];
  492. volatile char dst[8] = { 0 };
  493. kunit_info(
  494. test,
  495. "unaligned 4-byte initialized value gets a nonzero origin after memcpy() - (2 UMR reports)\n");
  496. uninit_src[0] = 42;
  497. uninit_src[1] = 42;
  498. uninit_src[4] = 42;
  499. uninit_src[5] = 42;
  500. uninit_src[6] = 42;
  501. uninit_src[7] = 42;
  502. uninit_src[10] = 42;
  503. uninit_src[11] = 42;
  504. memcpy_noinline((void *)&dst[0], (void *)&uninit_src[2], 8);
  505. kmsan_check_memory((void *)&dst[0], 4);
  506. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  507. report_reset();
  508. kmsan_check_memory((void *)&dst[2], 4);
  509. KUNIT_EXPECT_FALSE(test, report_matches(&expect));
  510. report_reset();
  511. kmsan_check_memory((void *)&dst[4], 4);
  512. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  513. }
  514. /* Generate test cases for memset16(), memset32(), memset64(). */
  515. #define DEFINE_TEST_MEMSETXX(size) \
  516. static void test_memset##size(struct kunit *test) \
  517. { \
  518. EXPECTATION_NO_REPORT(expect); \
  519. volatile uint##size##_t uninit; \
  520. \
  521. kunit_info(test, \
  522. "memset" #size "() should initialize memory\n"); \
  523. memset##size((uint##size##_t *)&uninit, 0, 1); \
  524. kmsan_check_memory((void *)&uninit, sizeof(uninit)); \
  525. KUNIT_EXPECT_TRUE(test, report_matches(&expect)); \
  526. }
  527. DEFINE_TEST_MEMSETXX(16)
  528. DEFINE_TEST_MEMSETXX(32)
  529. DEFINE_TEST_MEMSETXX(64)
  530. /* Test case: ensure that KMSAN does not access shadow memory out of bounds. */
  531. static void test_memset_on_guarded_buffer(struct kunit *test)
  532. {
  533. void *buf = vmalloc(PAGE_SIZE);
  534. kunit_info(test,
  535. "memset() on ends of guarded buffer should not crash\n");
  536. for (size_t size = 0; size <= 128; size++) {
  537. memset(buf, 0xff, size);
  538. memset(buf + PAGE_SIZE - size, 0xff, size);
  539. }
  540. vfree(buf);
  541. }
  542. static noinline void fibonacci(int *array, int size, int start)
  543. {
  544. if (start < 2 || (start == size))
  545. return;
  546. array[start] = array[start - 1] + array[start - 2];
  547. fibonacci(array, size, start + 1);
  548. }
  549. static void test_long_origin_chain(struct kunit *test)
  550. {
  551. EXPECTATION_UNINIT_VALUE_FN(expect, "test_long_origin_chain");
  552. /* (KMSAN_MAX_ORIGIN_DEPTH * 2) recursive calls to fibonacci(). */
  553. volatile int accum[KMSAN_MAX_ORIGIN_DEPTH * 2 + 2];
  554. int last = ARRAY_SIZE(accum) - 1;
  555. kunit_info(
  556. test,
  557. "origin chain exceeding KMSAN_MAX_ORIGIN_DEPTH (UMR report)\n");
  558. /*
  559. * We do not set accum[1] to 0, so the uninitializedness will be carried
  560. * over to accum[2..last].
  561. */
  562. accum[0] = 1;
  563. fibonacci((int *)accum, ARRAY_SIZE(accum), 2);
  564. kmsan_check_memory((void *)&accum[last], sizeof(int));
  565. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  566. }
  567. /*
  568. * Test case: ensure that saving/restoring/printing stacks to/from stackdepot
  569. * does not trigger errors.
  570. *
  571. * KMSAN uses stackdepot to store origin stack traces, that's why we do not
  572. * instrument lib/stackdepot.c. Yet it must properly mark its outputs as
  573. * initialized because other kernel features (e.g. netdev tracker) may also
  574. * access stackdepot from instrumented code.
  575. */
  576. static void test_stackdepot_roundtrip(struct kunit *test)
  577. {
  578. unsigned long src_entries[16], *dst_entries;
  579. unsigned int src_nentries, dst_nentries;
  580. EXPECTATION_NO_REPORT(expect);
  581. depot_stack_handle_t handle;
  582. kunit_info(test, "testing stackdepot roundtrip (no reports)\n");
  583. src_nentries =
  584. stack_trace_save(src_entries, ARRAY_SIZE(src_entries), 1);
  585. handle = stack_depot_save(src_entries, src_nentries, GFP_KERNEL);
  586. stack_depot_print(handle);
  587. dst_nentries = stack_depot_fetch(handle, &dst_entries);
  588. KUNIT_EXPECT_TRUE(test, src_nentries == dst_nentries);
  589. kmsan_check_memory((void *)dst_entries,
  590. sizeof(*dst_entries) * dst_nentries);
  591. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  592. }
  593. /*
  594. * Test case: ensure that kmsan_unpoison_memory() and the instrumentation work
  595. * the same.
  596. */
  597. static void test_unpoison_memory(struct kunit *test)
  598. {
  599. EXPECTATION_UNINIT_VALUE_FN(expect, "test_unpoison_memory");
  600. volatile char a[4], b[4];
  601. kunit_info(
  602. test,
  603. "unpoisoning via the instrumentation vs. kmsan_unpoison_memory() (2 UMR reports)\n");
  604. /* Initialize a[0] and check a[1]--a[3]. */
  605. a[0] = 0;
  606. kmsan_check_memory((char *)&a[1], 3);
  607. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  608. report_reset();
  609. /* Initialize b[0] and check b[1]--b[3]. */
  610. kmsan_unpoison_memory((char *)&b[0], 1);
  611. kmsan_check_memory((char *)&b[1], 3);
  612. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  613. }
  614. static void test_copy_from_kernel_nofault(struct kunit *test)
  615. {
  616. long ret;
  617. char buf[4], src[4];
  618. size_t size = sizeof(buf);
  619. EXPECTATION_UNINIT_VALUE_FN(expect, "copy_from_kernel_nofault");
  620. kunit_info(
  621. test,
  622. "testing copy_from_kernel_nofault with uninitialized memory\n");
  623. ret = copy_from_kernel_nofault((char *)&buf[0], (char *)&src[0], size);
  624. USE(ret);
  625. KUNIT_EXPECT_TRUE(test, report_matches(&expect));
  626. }
  627. static struct kunit_case kmsan_test_cases[] = {
  628. KUNIT_CASE(test_uninit_kmalloc),
  629. KUNIT_CASE(test_init_kmalloc),
  630. KUNIT_CASE(test_init_kzalloc),
  631. KUNIT_CASE(test_uninit_stack_var),
  632. KUNIT_CASE(test_init_stack_var),
  633. KUNIT_CASE(test_params),
  634. KUNIT_CASE(test_uninit_multiple_params),
  635. KUNIT_CASE(test_uninit_kmsan_check_memory),
  636. KUNIT_CASE(test_init_kmsan_vmap_vunmap),
  637. KUNIT_CASE(test_init_vmalloc),
  638. KUNIT_CASE(test_uninit_page),
  639. KUNIT_CASE(test_uaf),
  640. KUNIT_CASE(test_uaf_pages),
  641. KUNIT_CASE(test_uaf_high_order_pages),
  642. KUNIT_CASE(test_percpu_propagate),
  643. KUNIT_CASE(test_printk),
  644. KUNIT_CASE(test_init_memcpy),
  645. KUNIT_CASE(test_memcpy_aligned_to_aligned),
  646. KUNIT_CASE(test_memcpy_aligned_to_unaligned),
  647. KUNIT_CASE(test_memcpy_initialized_gap),
  648. KUNIT_CASE(test_memset16),
  649. KUNIT_CASE(test_memset32),
  650. KUNIT_CASE(test_memset64),
  651. KUNIT_CASE(test_memset_on_guarded_buffer),
  652. KUNIT_CASE(test_long_origin_chain),
  653. KUNIT_CASE(test_stackdepot_roundtrip),
  654. KUNIT_CASE(test_unpoison_memory),
  655. KUNIT_CASE(test_copy_from_kernel_nofault),
  656. {},
  657. };
  658. /* ===== End test cases ===== */
  659. static int test_init(struct kunit *test)
  660. {
  661. unsigned long flags;
  662. spin_lock_irqsave(&observed.lock, flags);
  663. observed.header[0] = '\0';
  664. observed.ignore = false;
  665. observed.available = false;
  666. spin_unlock_irqrestore(&observed.lock, flags);
  667. return 0;
  668. }
  669. static void test_exit(struct kunit *test)
  670. {
  671. }
  672. static int orig_panic_on_kmsan;
  673. static int kmsan_suite_init(struct kunit_suite *suite)
  674. {
  675. register_trace_console(probe_console, NULL);
  676. orig_panic_on_kmsan = panic_on_kmsan;
  677. panic_on_kmsan = 0;
  678. return 0;
  679. }
  680. static void kmsan_suite_exit(struct kunit_suite *suite)
  681. {
  682. unregister_trace_console(probe_console, NULL);
  683. tracepoint_synchronize_unregister();
  684. panic_on_kmsan = orig_panic_on_kmsan;
  685. }
  686. static struct kunit_suite kmsan_test_suite = {
  687. .name = "kmsan",
  688. .test_cases = kmsan_test_cases,
  689. .init = test_init,
  690. .exit = test_exit,
  691. .suite_init = kmsan_suite_init,
  692. .suite_exit = kmsan_suite_exit,
  693. };
  694. kunit_test_suites(&kmsan_test_suite);
  695. MODULE_LICENSE("GPL");
  696. MODULE_AUTHOR("Alexander Potapenko <glider@google.com>");
  697. MODULE_DESCRIPTION("Test cases for KMSAN");