kasan: a couple of test fixes
Subsystems (2)
cover kasan: a couple of test fixes
The first one fixes the invalid-free test crashing the kernel, and the second one fixes the memset tests working incorrectly due to compiler optimizations.
Andrey Konovalov (2):
kasan: fix invalid-free test crashing the kernel
kasan: disallow compiler to optimize away memset in tests
lib/Makefile | 1 + lib/test_kasan.c | 8 ++++++++ 2 files changed, 9 insertions(+)
Signature · 7 lines
2.16.2.395.g2e18187dfd-goog -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
PATCH 1/2 kasan: fix invalid-free test crashing the kernel
When an invalid-free is triggered by one of the KASAN tests, the object doesn't actually get freed. This later leads to a BUG failure in kmem_cache_destroy that checks that there are no allocated objects in the cache that is being destroyed. Fix this by calling kmem_cache_free with the proper object address after the call that triggers invalid-free.
--- lib/test_kasan.c | 8 ++++++++ 1 file changed, 8 insertions(+)
lib/test_kasan.c +8 -0
@@ -567,7 +567,15 @@ static noinline void __init kmem_cache_invalid_free(void)return ; } +/* Trigger invalid free, the object doesn't get freed */ kmem_cache_free (cache, p +1 ); + +/* +* Properly free the object to prevent the "Objects remaining in +* test_cache on __kmem_cache_shutdown" BUG failure. +*/ +kmem_cache_free (cache, p); +kmem_cache_destroy (cache); }
Signature · 7 lines
2.16.2.395.g2e18187dfd-goog -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
Re: [PATCH 1/2] kasan: fix invalid-free test crashing the kernel
Quoted 5 lines · Andrey Konovalov
When an invalid-free is triggered by one of the KASAN tests, the object doesn't actually get freed. This later leads to a BUG failure in
kmem_cache_destroythat checks that there are no allocated objects in the cache that is being destroyed. Fix this by callingkmem_cache_freewith the proper object address after the call that triggers invalid-free.
Note, that for this patch to fix the issue, it is supposed to go on top of the "kasan, slub: fix handling of kasan_slab_free hook" patch I sent recently.
https://patchwork.kernel.org/patch/10238179/
Quoted 27 lines
Signed-off-by Andrey Konovalov <[email protected]>--- lib/test_kasan.c | 8 ++++++++ 1 file changed, 8 insertions(+)lib/test_kasan.c +8
-1@@ -567,7 +567,15 @@ static noinline void __init kmem_cache_invalid_free(void)return ; } +/* Trigger invalid free, the object doesn't get freed */ kmem_cache_free (cache, p +1 ); + +/* +* Properly free the object to prevent the "Objects remaining in +* test_cache on __kmem_cache_shutdown" BUG failure. +*/ +kmem_cache_free (cache, p); +kmem_cache_destroy (cache); } --
Quoted 2 lines
2.16.2.395.g2e18187dfd-goog
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
Re: [PATCH 1/2] kasan: fix invalid-free test crashing the kernel
In reply to Andrey KonovalovQuoted 7 lines · Andrey Konovalov
When an invalid-free is triggered by one of the KASAN tests, the object doesn't actually get freed. This later leads to a BUG failure in
kmem_cache_destroythat checks that there are no allocated objects in the cache that is being destroyed. Fix this by callingkmem_cache_freewith the proper object address after the call that triggers invalid-free.Signed-off-by Andrey Konovalov <[email protected]>
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
PATCH 2/2 kasan: disallow compiler to optimize away memset in tests
In reply to Andrey KonovalovA compiler can optimize away memset calls by replacing them with mov instructions. There are KASAN tests, that specifically test that KASAN correctly handles memset calls, we don't want this optimization to happen.
The solution is to add -fno-builtin flag to test_kasan.ko
--- lib/Makefile | 1 + 1 file changed, 1 insertion(+)
lib/Makefile +1 -0
@@ -52,6 +52,7 @@ obj-$(CONFIG_TEST_FIRMWARE) += test_firmware.o obj-$(CONFIG_TEST_SYSCTL) += test_sysctl.o obj-$(CONFIG_TEST_HASH) += test_hash.o test_siphash.o obj-$(CONFIG_TEST_KASAN) += test_kasan.o +CFLAGS_test_kasan.o += -fno-builtin obj-$(CONFIG_TEST_KSTRTOX) += test-kstrtox.o obj-$(CONFIG_TEST_LIST_SORT) += test_list_sort.o obj-$(CONFIG_TEST_LKM) += test_module.o
Signature · 7 lines
2.16.2.395.g2e18187dfd-goog -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
Re: [PATCH 2/2] kasan: disallow compiler to optimize away memset in tests
Quoted 8 lines · Andrey Konovalov
A compiler can optimize away memset calls by replacing them with mov instructions. There are KASAN tests, that specifically test that KASAN correctly handles memset calls, we don't want this optimization to happen.
The solution is to add -fno-builtin flag to test_kasan.ko
Signed-off-by Andrey Konovalov <[email protected]>
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>