diff mbox series

[RFC,v3,15/36] kmsan: add tests for KMSAN

Message ID 20191122112621.204798-16-glider@google.com (mailing list archive)
State New, archived
Headers show
Series Add KernelMemorySanitizer infrastructure | expand

Commit Message

Alexander Potapenko Nov. 22, 2019, 11:26 a.m. UTC
The initial commit adds several tests that trigger KMSAN warnings in
simple cases.
To use, build the kernel with CONFIG_TEST_KMSAN and do
`insmod test_kmsan.ko`

Signed-off-by: Alexander Potapenko <glider@google.com>
To: Alexander Potapenko <glider@google.com>
Cc: Vegard Nossum <vegard.nossum@oracle.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: linux-mm@kvack.org
---
v2:
 - added printk_test()

Change-Id: I287e86ae83a82b770f2baa46e5bbdce1dfa65195
---
 lib/Makefile     |   1 +
 lib/test_kmsan.c | 231 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 232 insertions(+)
 create mode 100644 lib/test_kmsan.c

Comments

Andrey Konovalov Nov. 29, 2019, 2:14 p.m. UTC | #1
On Fri, Nov 22, 2019 at 12:27 PM <glider@google.com> wrote:
>
> The initial commit adds several tests that trigger KMSAN warnings in
> simple cases.
> To use, build the kernel with CONFIG_TEST_KMSAN and do
> `insmod test_kmsan.ko`
>
> Signed-off-by: Alexander Potapenko <glider@google.com>
> To: Alexander Potapenko <glider@google.com>
> Cc: Vegard Nossum <vegard.nossum@oracle.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: linux-mm@kvack.org
> ---
> v2:
>  - added printk_test()
>
> Change-Id: I287e86ae83a82b770f2baa46e5bbdce1dfa65195
> ---
>  lib/Makefile     |   1 +
>  lib/test_kmsan.c | 231 +++++++++++++++++++++++++++++++++++++++++++++++
>  2 files changed, 232 insertions(+)
>  create mode 100644 lib/test_kmsan.c
>
> diff --git a/lib/Makefile b/lib/Makefile
> index 58a3e1b1a868..08fcb37499a0 100644
> --- a/lib/Makefile
> +++ b/lib/Makefile
> @@ -65,6 +65,7 @@ CFLAGS_test_kasan.o += $(call cc-disable-warning, vla)
>  obj-$(CONFIG_TEST_UBSAN) += test_ubsan.o
>  CFLAGS_test_ubsan.o += $(call cc-disable-warning, vla)
>  UBSAN_SANITIZE_test_ubsan.o := y
> +obj-$(CONFIG_TEST_KMSAN) += test_kmsan.o
>  obj-$(CONFIG_TEST_KSTRTOX) += test-kstrtox.o
>  obj-$(CONFIG_TEST_LIST_SORT) += test_list_sort.o
>  obj-$(CONFIG_TEST_LKM) += test_module.o
> diff --git a/lib/test_kmsan.c b/lib/test_kmsan.c
> new file mode 100644
> index 000000000000..dcbe02adbdb0
> --- /dev/null
> +++ b/lib/test_kmsan.c
> @@ -0,0 +1,231 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * Module for testing KMSAN.
> + *
> + * Copyright (C) 2017-2019 Google LLC
> + * Author: Alexander Potapenko <glider@google.com>
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License version 2 as
> + * published by the Free Software Foundation.
> + *
> + */
> +
> +/*
> + * Tests below use noinline and volatile to work around compiler optimizations
> + * that may mask KMSAN bugs.
> + */
> +#define pr_fmt(fmt) "kmsan test: %s : " fmt, __func__
> +
> +#include <linux/mm.h>
> +#include <linux/module.h>
> +#include <linux/printk.h>
> +#include <linux/slab.h>
> +#include <linux/kmsan-checks.h>
> +
> +#define CHECK(x)                                       \
> +       do {                                            \
> +               if (x)                                  \
> +                       pr_info(#x " is true\n");       \
> +               else                                    \
> +                       pr_info(#x " is false\n");      \
> +       } while (0)
> +
> +noinline void use_integer(int cond)
> +{
> +       CHECK(cond);
> +}

This function seems to be unused.

> +
> +int signed_sum3(int a, int b, int c)
> +{
> +       return a + b + c;
> +}
> +
> +noinline void uninit_kmalloc_test(void)
> +{
> +       int *ptr;
> +
> +       pr_info("-----------------------------\n");
> +       pr_info("uninitialized kmalloc test (UMR report)\n");
> +       ptr = kmalloc(sizeof(int), GFP_KERNEL);
> +       pr_info("kmalloc returned %p\n", ptr);
> +       CHECK(*ptr);
> +}
> +noinline void init_kmalloc_test(void)
> +{
> +       int *ptr;
> +
> +       pr_info("-----------------------------\n");
> +       pr_info("initialized kmalloc test (no reports)\n");
> +       ptr = kmalloc(sizeof(int), GFP_KERNEL);
> +       memset(ptr, 0, sizeof(int));
> +       pr_info("kmalloc returned %p\n", ptr);
> +       CHECK(*ptr);
> +}
> +
> +noinline void init_kzalloc_test(void)
> +{
> +       int *ptr;
> +
> +       pr_info("-----------------------------\n");
> +       pr_info("initialized kzalloc test (no reports)\n");
> +       ptr = kzalloc(sizeof(int), GFP_KERNEL);
> +       pr_info("kzalloc returned %p\n", ptr);
> +       CHECK(*ptr);
> +}
> +
> +noinline void uninit_multiple_args_test(void)
> +{
> +       volatile int a;
> +       volatile char b = 3, c;
> +
> +       pr_info("-----------------------------\n");
> +       pr_info("uninitialized local passed to fn (UMR report)\n");
> +       CHECK(signed_sum3(a, b, c));
> +}
> +
> +noinline void uninit_stack_var_test(void)
> +{
> +       int cond;
> +
> +       pr_info("-----------------------------\n");
> +       pr_info("uninitialized stack variable (UMR report)\n");
> +       CHECK(cond);
> +}
> +
> +noinline void init_stack_var_test(void)
> +{
> +       volatile int cond = 1;
> +
> +       pr_info("-----------------------------\n");
> +       pr_info("initialized stack variable (no reports)\n");
> +       CHECK(cond);
> +}
> +
> +noinline void two_param_fn_2(int arg1, int arg2)
> +{
> +       CHECK(arg1);
> +       CHECK(arg2);
> +}
> +
> +noinline void one_param_fn(int arg)
> +{
> +       two_param_fn_2(arg, arg);
> +       CHECK(arg);
> +}
> +
> +noinline void two_param_fn(int arg1, int arg2)
> +{
> +       int init = 0;
> +
> +       one_param_fn(init);
> +       CHECK(arg1);
> +       CHECK(arg2);
> +}
> +
> +void params_test(void)
> +{
> +       int uninit, init = 1;
> +
> +       two_param_fn(uninit, init);
> +}

This one as well.

> +
> +noinline void do_uninit_local_array(char *array, int start, int stop)
> +{
> +       int i;
> +       volatile char uninit;
> +
> +       for (i = start; i < stop; i++)
> +               array[i] = uninit;
> +}
> +
> +noinline void uninit_kmsan_check_memory_test(void)
> +{
> +       volatile char local_array[8];
> +
> +       pr_info("-----------------------------\n");
> +       pr_info("kmsan_check_memory() called on uninit local (UMR report)\n");
> +       do_uninit_local_array((char *)local_array, 5, 7);
> +
> +       kmsan_check_memory((char *)local_array, 8);
> +}
> +
> +noinline void init_kmsan_vmap_vunmap_test(void)
> +{
> +       const int npages = 2;
> +       struct page *pages[npages];
> +       void *vbuf;
> +       int i;
> +
> +       pr_info("-----------------------------\n");
> +       pr_info("pages initialized via vmap (no reports)\n");
> +
> +       for (i = 0; i < npages; i++)
> +               pages[i] = alloc_page(GFP_KERNEL);
> +       vbuf = vmap(pages, npages, VM_MAP, PAGE_KERNEL);
> +       memset(vbuf, 0xfe, npages * PAGE_SIZE);
> +       for (i = 0; i < npages; i++)
> +               kmsan_check_memory(page_address(pages[i]), PAGE_SIZE);
> +
> +       if (vbuf)
> +               vunmap(vbuf);
> +       for (i = 0; i < npages; i++)
> +               if (pages[i])
> +                       __free_page(pages[i]);
> +}
> +
> +noinline void init_vmalloc(void)
> +{
> +       char *buf;
> +       int npages = 8, i;
> +
> +       pr_info("-----------------------------\n");
> +       pr_info("pages initialized via vmap (no reports)\n");
> +       buf = vmalloc(PAGE_SIZE * npages);
> +       buf[0] = 1;
> +       memset(buf, 0xfe, PAGE_SIZE * npages);
> +       CHECK(buf[0]);
> +       for (i = 0; i < npages; i++)
> +               kmsan_check_memory(&buf[PAGE_SIZE * i], PAGE_SIZE);
> +       vfree(buf);
> +}
> +
> +noinline void uaf_test(void)
> +{
> +       volatile int *var;
> +
> +       pr_info("-----------------------------\n");
> +       pr_info("use-after-free in kmalloc-ed buffer (UMR report)\n");
> +       var = kmalloc(80, GFP_KERNEL);
> +       var[3] = 0xfeedface;
> +       kfree((int *)var);
> +       CHECK(var[3]);
> +}
> +
> +noinline void printk_test(void)
> +{
> +       volatile int uninit;
> +
> +       pr_info("-----------------------------\n");
> +       pr_info("uninit local passed to pr_info() (UMR report)\n");
> +       pr_info("%px contains %d\n", &uninit, uninit);
> +}
> +
> +static noinline int __init kmsan_tests_init(void)
> +{
> +       uninit_kmalloc_test();
> +       init_kmalloc_test();
> +       init_kzalloc_test();
> +       uninit_multiple_args_test();
> +       uninit_stack_var_test();
> +       init_stack_var_test();
> +       uninit_kmsan_check_memory_test();
> +       init_kmsan_vmap_vunmap_test();
> +       init_vmalloc();

Perhaps s/init_vmalloc/init_vmalloc_test?

> +       uaf_test();
> +       printk_test();
> +       return -EAGAIN;
> +}
> +
> +module_init(kmsan_tests_init);
> +MODULE_LICENSE("GPL");
> --
> 2.24.0.432.g9d3f5f5b63-goog
>
Alexander Potapenko Dec. 5, 2019, 2:30 p.m. UTC | #2
On Fri, Nov 29, 2019 at 3:15 PM Andrey Konovalov <andreyknvl@google.com> wrote:
>
> On Fri, Nov 22, 2019 at 12:27 PM <glider@google.com> wrote:
> >
> > The initial commit adds several tests that trigger KMSAN warnings in
> > simple cases.
> > To use, build the kernel with CONFIG_TEST_KMSAN and do
> > `insmod test_kmsan.ko`
> >
> > Signed-off-by: Alexander Potapenko <glider@google.com>
> > To: Alexander Potapenko <glider@google.com>
> > Cc: Vegard Nossum <vegard.nossum@oracle.com>
> > Cc: Dmitry Vyukov <dvyukov@google.com>
> > Cc: linux-mm@kvack.org
> > ---
> > v2:
> >  - added printk_test()
> >
> > Change-Id: I287e86ae83a82b770f2baa46e5bbdce1dfa65195
> > ---
> >  lib/Makefile     |   1 +
> >  lib/test_kmsan.c | 231 +++++++++++++++++++++++++++++++++++++++++++++++
> >  2 files changed, 232 insertions(+)
> >  create mode 100644 lib/test_kmsan.c
> >
> > diff --git a/lib/Makefile b/lib/Makefile
> > index 58a3e1b1a868..08fcb37499a0 100644
> > --- a/lib/Makefile
> > +++ b/lib/Makefile
> > @@ -65,6 +65,7 @@ CFLAGS_test_kasan.o += $(call cc-disable-warning, vla)
> >  obj-$(CONFIG_TEST_UBSAN) += test_ubsan.o
> >  CFLAGS_test_ubsan.o += $(call cc-disable-warning, vla)
> >  UBSAN_SANITIZE_test_ubsan.o := y
> > +obj-$(CONFIG_TEST_KMSAN) += test_kmsan.o
> >  obj-$(CONFIG_TEST_KSTRTOX) += test-kstrtox.o
> >  obj-$(CONFIG_TEST_LIST_SORT) += test_list_sort.o
> >  obj-$(CONFIG_TEST_LKM) += test_module.o
> > diff --git a/lib/test_kmsan.c b/lib/test_kmsan.c
> > new file mode 100644
> > index 000000000000..dcbe02adbdb0
> > --- /dev/null
> > +++ b/lib/test_kmsan.c
> > @@ -0,0 +1,231 @@
> > +// SPDX-License-Identifier: GPL-2.0
> > +/*
> > + * Module for testing KMSAN.
> > + *
> > + * Copyright (C) 2017-2019 Google LLC
> > + * Author: Alexander Potapenko <glider@google.com>
> > + *
> > + * This program is free software; you can redistribute it and/or modify
> > + * it under the terms of the GNU General Public License version 2 as
> > + * published by the Free Software Foundation.
> > + *
> > + */
> > +
> > +/*
> > + * Tests below use noinline and volatile to work around compiler optimizations
> > + * that may mask KMSAN bugs.
> > + */
> > +#define pr_fmt(fmt) "kmsan test: %s : " fmt, __func__
> > +
> > +#include <linux/mm.h>
> > +#include <linux/module.h>
> > +#include <linux/printk.h>
> > +#include <linux/slab.h>
> > +#include <linux/kmsan-checks.h>
> > +
> > +#define CHECK(x)                                       \
> > +       do {                                            \
> > +               if (x)                                  \
> > +                       pr_info(#x " is true\n");       \
> > +               else                                    \
> > +                       pr_info(#x " is false\n");      \
> > +       } while (0)
> > +
> > +noinline void use_integer(int cond)
> > +{
> > +       CHECK(cond);
> > +}
>
> This function seems to be unused.
Removed it, thanks!
> > +
> > +int signed_sum3(int a, int b, int c)
> > +{
> > +       return a + b + c;
> > +}
> > +
> > +noinline void uninit_kmalloc_test(void)
> > +{
> > +       int *ptr;
> > +
> > +       pr_info("-----------------------------\n");
> > +       pr_info("uninitialized kmalloc test (UMR report)\n");
> > +       ptr = kmalloc(sizeof(int), GFP_KERNEL);
> > +       pr_info("kmalloc returned %p\n", ptr);
> > +       CHECK(*ptr);
> > +}
> > +noinline void init_kmalloc_test(void)
> > +{
> > +       int *ptr;
> > +
> > +       pr_info("-----------------------------\n");
> > +       pr_info("initialized kmalloc test (no reports)\n");
> > +       ptr = kmalloc(sizeof(int), GFP_KERNEL);
> > +       memset(ptr, 0, sizeof(int));
> > +       pr_info("kmalloc returned %p\n", ptr);
> > +       CHECK(*ptr);
> > +}
> > +
> > +noinline void init_kzalloc_test(void)
> > +{
> > +       int *ptr;
> > +
> > +       pr_info("-----------------------------\n");
> > +       pr_info("initialized kzalloc test (no reports)\n");
> > +       ptr = kzalloc(sizeof(int), GFP_KERNEL);
> > +       pr_info("kzalloc returned %p\n", ptr);
> > +       CHECK(*ptr);
> > +}
> > +
> > +noinline void uninit_multiple_args_test(void)
> > +{
> > +       volatile int a;
> > +       volatile char b = 3, c;
> > +
> > +       pr_info("-----------------------------\n");
> > +       pr_info("uninitialized local passed to fn (UMR report)\n");
> > +       CHECK(signed_sum3(a, b, c));
> > +}
> > +
> > +noinline void uninit_stack_var_test(void)
> > +{
> > +       int cond;
> > +
> > +       pr_info("-----------------------------\n");
> > +       pr_info("uninitialized stack variable (UMR report)\n");
> > +       CHECK(cond);
> > +}
> > +
> > +noinline void init_stack_var_test(void)
> > +{
> > +       volatile int cond = 1;
> > +
> > +       pr_info("-----------------------------\n");
> > +       pr_info("initialized stack variable (no reports)\n");
> > +       CHECK(cond);
> > +}
> > +
> > +noinline void two_param_fn_2(int arg1, int arg2)
> > +{
> > +       CHECK(arg1);
> > +       CHECK(arg2);
> > +}
> > +
> > +noinline void one_param_fn(int arg)
> > +{
> > +       two_param_fn_2(arg, arg);
> > +       CHECK(arg);
> > +}
> > +
> > +noinline void two_param_fn(int arg1, int arg2)
> > +{
> > +       int init = 0;
> > +
> > +       one_param_fn(init);
> > +       CHECK(arg1);
> > +       CHECK(arg2);
> > +}
> > +
> > +void params_test(void)
> > +{
> > +       int uninit, init = 1;
> > +
> > +       two_param_fn(uninit, init);
> > +}
>
> This one as well.

Added params_test to kmsan_tests_init() below.
> > +
> > +noinline void do_uninit_local_array(char *array, int start, int stop)
> > +{
> > +       int i;
> > +       volatile char uninit;
> > +
> > +       for (i = start; i < stop; i++)
> > +               array[i] = uninit;
> > +}
> > +
> > +noinline void uninit_kmsan_check_memory_test(void)
> > +{
> > +       volatile char local_array[8];
> > +
> > +       pr_info("-----------------------------\n");
> > +       pr_info("kmsan_check_memory() called on uninit local (UMR report)\n");
> > +       do_uninit_local_array((char *)local_array, 5, 7);
> > +
> > +       kmsan_check_memory((char *)local_array, 8);
> > +}
> > +
> > +noinline void init_kmsan_vmap_vunmap_test(void)
> > +{
> > +       const int npages = 2;
> > +       struct page *pages[npages];
> > +       void *vbuf;
> > +       int i;
> > +
> > +       pr_info("-----------------------------\n");
> > +       pr_info("pages initialized via vmap (no reports)\n");
> > +
> > +       for (i = 0; i < npages; i++)
> > +               pages[i] = alloc_page(GFP_KERNEL);
> > +       vbuf = vmap(pages, npages, VM_MAP, PAGE_KERNEL);
> > +       memset(vbuf, 0xfe, npages * PAGE_SIZE);
> > +       for (i = 0; i < npages; i++)
> > +               kmsan_check_memory(page_address(pages[i]), PAGE_SIZE);
> > +
> > +       if (vbuf)
> > +               vunmap(vbuf);
> > +       for (i = 0; i < npages; i++)
> > +               if (pages[i])
> > +                       __free_page(pages[i]);
> > +}
> > +
> > +noinline void init_vmalloc(void)
> > +{
> > +       char *buf;
> > +       int npages = 8, i;
> > +
> > +       pr_info("-----------------------------\n");
> > +       pr_info("pages initialized via vmap (no reports)\n");
> > +       buf = vmalloc(PAGE_SIZE * npages);
> > +       buf[0] = 1;
> > +       memset(buf, 0xfe, PAGE_SIZE * npages);
> > +       CHECK(buf[0]);
> > +       for (i = 0; i < npages; i++)
> > +               kmsan_check_memory(&buf[PAGE_SIZE * i], PAGE_SIZE);
> > +       vfree(buf);
> > +}
> > +
> > +noinline void uaf_test(void)
> > +{
> > +       volatile int *var;
> > +
> > +       pr_info("-----------------------------\n");
> > +       pr_info("use-after-free in kmalloc-ed buffer (UMR report)\n");
> > +       var = kmalloc(80, GFP_KERNEL);
> > +       var[3] = 0xfeedface;
> > +       kfree((int *)var);
> > +       CHECK(var[3]);
> > +}
> > +
> > +noinline void printk_test(void)
> > +{
> > +       volatile int uninit;
> > +
> > +       pr_info("-----------------------------\n");
> > +       pr_info("uninit local passed to pr_info() (UMR report)\n");
> > +       pr_info("%px contains %d\n", &uninit, uninit);
> > +}
> > +
> > +static noinline int __init kmsan_tests_init(void)
> > +{
> > +       uninit_kmalloc_test();
> > +       init_kmalloc_test();
> > +       init_kzalloc_test();
> > +       uninit_multiple_args_test();
> > +       uninit_stack_var_test();
> > +       init_stack_var_test();
> > +       uninit_kmsan_check_memory_test();
> > +       init_kmsan_vmap_vunmap_test();
> > +       init_vmalloc();
>
> Perhaps s/init_vmalloc/init_vmalloc_test?
Done

>
> > +       uaf_test();
> > +       printk_test();
> > +       return -EAGAIN;
> > +}
> > +
> > +module_init(kmsan_tests_init);
> > +MODULE_LICENSE("GPL");
> > --
> > 2.24.0.432.g9d3f5f5b63-goog
> >



--
Alexander Potapenko
Software Engineer

Google Germany GmbH
Erika-Mann-Straße, 33
80636 München

Geschäftsführer: Paul Manicle, Halimah DeLaine Prado
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg
diff mbox series

Patch

diff --git a/lib/Makefile b/lib/Makefile
index 58a3e1b1a868..08fcb37499a0 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -65,6 +65,7 @@  CFLAGS_test_kasan.o += $(call cc-disable-warning, vla)
 obj-$(CONFIG_TEST_UBSAN) += test_ubsan.o
 CFLAGS_test_ubsan.o += $(call cc-disable-warning, vla)
 UBSAN_SANITIZE_test_ubsan.o := y
+obj-$(CONFIG_TEST_KMSAN) += test_kmsan.o
 obj-$(CONFIG_TEST_KSTRTOX) += test-kstrtox.o
 obj-$(CONFIG_TEST_LIST_SORT) += test_list_sort.o
 obj-$(CONFIG_TEST_LKM) += test_module.o
diff --git a/lib/test_kmsan.c b/lib/test_kmsan.c
new file mode 100644
index 000000000000..dcbe02adbdb0
--- /dev/null
+++ b/lib/test_kmsan.c
@@ -0,0 +1,231 @@ 
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Module for testing KMSAN.
+ *
+ * Copyright (C) 2017-2019 Google LLC
+ * Author: Alexander Potapenko <glider@google.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+/*
+ * Tests below use noinline and volatile to work around compiler optimizations
+ * that may mask KMSAN bugs.
+ */
+#define pr_fmt(fmt) "kmsan test: %s : " fmt, __func__
+
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/printk.h>
+#include <linux/slab.h>
+#include <linux/kmsan-checks.h>
+
+#define CHECK(x)					\
+	do {						\
+		if (x)					\
+			pr_info(#x " is true\n");	\
+		else					\
+			pr_info(#x " is false\n");	\
+	} while (0)
+
+noinline void use_integer(int cond)
+{
+	CHECK(cond);
+}
+
+int signed_sum3(int a, int b, int c)
+{
+	return a + b + c;
+}
+
+noinline void uninit_kmalloc_test(void)
+{
+	int *ptr;
+
+	pr_info("-----------------------------\n");
+	pr_info("uninitialized kmalloc test (UMR report)\n");
+	ptr = kmalloc(sizeof(int), GFP_KERNEL);
+	pr_info("kmalloc returned %p\n", ptr);
+	CHECK(*ptr);
+}
+noinline void init_kmalloc_test(void)
+{
+	int *ptr;
+
+	pr_info("-----------------------------\n");
+	pr_info("initialized kmalloc test (no reports)\n");
+	ptr = kmalloc(sizeof(int), GFP_KERNEL);
+	memset(ptr, 0, sizeof(int));
+	pr_info("kmalloc returned %p\n", ptr);
+	CHECK(*ptr);
+}
+
+noinline void init_kzalloc_test(void)
+{
+	int *ptr;
+
+	pr_info("-----------------------------\n");
+	pr_info("initialized kzalloc test (no reports)\n");
+	ptr = kzalloc(sizeof(int), GFP_KERNEL);
+	pr_info("kzalloc returned %p\n", ptr);
+	CHECK(*ptr);
+}
+
+noinline void uninit_multiple_args_test(void)
+{
+	volatile int a;
+	volatile char b = 3, c;
+
+	pr_info("-----------------------------\n");
+	pr_info("uninitialized local passed to fn (UMR report)\n");
+	CHECK(signed_sum3(a, b, c));
+}
+
+noinline void uninit_stack_var_test(void)
+{
+	int cond;
+
+	pr_info("-----------------------------\n");
+	pr_info("uninitialized stack variable (UMR report)\n");
+	CHECK(cond);
+}
+
+noinline void init_stack_var_test(void)
+{
+	volatile int cond = 1;
+
+	pr_info("-----------------------------\n");
+	pr_info("initialized stack variable (no reports)\n");
+	CHECK(cond);
+}
+
+noinline void two_param_fn_2(int arg1, int arg2)
+{
+	CHECK(arg1);
+	CHECK(arg2);
+}
+
+noinline void one_param_fn(int arg)
+{
+	two_param_fn_2(arg, arg);
+	CHECK(arg);
+}
+
+noinline void two_param_fn(int arg1, int arg2)
+{
+	int init = 0;
+
+	one_param_fn(init);
+	CHECK(arg1);
+	CHECK(arg2);
+}
+
+void params_test(void)
+{
+	int uninit, init = 1;
+
+	two_param_fn(uninit, init);
+}
+
+noinline void do_uninit_local_array(char *array, int start, int stop)
+{
+	int i;
+	volatile char uninit;
+
+	for (i = start; i < stop; i++)
+		array[i] = uninit;
+}
+
+noinline void uninit_kmsan_check_memory_test(void)
+{
+	volatile char local_array[8];
+
+	pr_info("-----------------------------\n");
+	pr_info("kmsan_check_memory() called on uninit local (UMR report)\n");
+	do_uninit_local_array((char *)local_array, 5, 7);
+
+	kmsan_check_memory((char *)local_array, 8);
+}
+
+noinline void init_kmsan_vmap_vunmap_test(void)
+{
+	const int npages = 2;
+	struct page *pages[npages];
+	void *vbuf;
+	int i;
+
+	pr_info("-----------------------------\n");
+	pr_info("pages initialized via vmap (no reports)\n");
+
+	for (i = 0; i < npages; i++)
+		pages[i] = alloc_page(GFP_KERNEL);
+	vbuf = vmap(pages, npages, VM_MAP, PAGE_KERNEL);
+	memset(vbuf, 0xfe, npages * PAGE_SIZE);
+	for (i = 0; i < npages; i++)
+		kmsan_check_memory(page_address(pages[i]), PAGE_SIZE);
+
+	if (vbuf)
+		vunmap(vbuf);
+	for (i = 0; i < npages; i++)
+		if (pages[i])
+			__free_page(pages[i]);
+}
+
+noinline void init_vmalloc(void)
+{
+	char *buf;
+	int npages = 8, i;
+
+	pr_info("-----------------------------\n");
+	pr_info("pages initialized via vmap (no reports)\n");
+	buf = vmalloc(PAGE_SIZE * npages);
+	buf[0] = 1;
+	memset(buf, 0xfe, PAGE_SIZE * npages);
+	CHECK(buf[0]);
+	for (i = 0; i < npages; i++)
+		kmsan_check_memory(&buf[PAGE_SIZE * i], PAGE_SIZE);
+	vfree(buf);
+}
+
+noinline void uaf_test(void)
+{
+	volatile int *var;
+
+	pr_info("-----------------------------\n");
+	pr_info("use-after-free in kmalloc-ed buffer (UMR report)\n");
+	var = kmalloc(80, GFP_KERNEL);
+	var[3] = 0xfeedface;
+	kfree((int *)var);
+	CHECK(var[3]);
+}
+
+noinline void printk_test(void)
+{
+	volatile int uninit;
+
+	pr_info("-----------------------------\n");
+	pr_info("uninit local passed to pr_info() (UMR report)\n");
+	pr_info("%px contains %d\n", &uninit, uninit);
+}
+
+static noinline int __init kmsan_tests_init(void)
+{
+	uninit_kmalloc_test();
+	init_kmalloc_test();
+	init_kzalloc_test();
+	uninit_multiple_args_test();
+	uninit_stack_var_test();
+	init_stack_var_test();
+	uninit_kmsan_check_memory_test();
+	init_kmsan_vmap_vunmap_test();
+	init_vmalloc();
+	uaf_test();
+	printk_test();
+	return -EAGAIN;
+}
+
+module_init(kmsan_tests_init);
+MODULE_LICENSE("GPL");