| Message ID | 20231214164423.6202-1-npache@redhat.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [v2] kunit: kasan_test: disable fortify string checker on kmalloc_oob_memset | expand |
On Thu, Dec 14, 2023 at 5:44 PM Nico Pache <npache@redhat.com> wrote: > > similar to commit 09c6304e38e4 ("kasan: test: fix compatibility with > FORTIFY_SOURCE") the kernel is panicing in kmalloc_oob_memset_*. > > This is due to the `ptr` not being hidden from the optimizer which would > disable the runtime fortify string checker. > > kernel BUG at lib/string_helpers.c:1048! > Call Trace: > [<00000000272502e2>] fortify_panic+0x2a/0x30 > ([<00000000272502de>] fortify_panic+0x26/0x30) > [<001bffff817045c4>] kmalloc_oob_memset_2+0x22c/0x230 [kasan_test] > > Hide the `ptr` variable from the optimizer to fix the kernel panic. > Also define a memset_size variable and hide that as well. This cleans up > the code and follows the same convention as other tests. > > Signed-off-by: Nico Pache <npache@redhat.com> > --- > mm/kasan/kasan_test.c | 20 ++++++++++++++++---- > 1 file changed, 16 insertions(+), 4 deletions(-) > > diff --git a/mm/kasan/kasan_test.c b/mm/kasan/kasan_test.c > index 8281eb42464b..34515a106ca5 100644 > --- a/mm/kasan/kasan_test.c > +++ b/mm/kasan/kasan_test.c > @@ -493,14 +493,17 @@ static void kmalloc_oob_memset_2(struct kunit *test) > { > char *ptr; > size_t size = 128 - KASAN_GRANULE_SIZE; > + size_t memset_size = 2; > > KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); > > ptr = kmalloc(size, GFP_KERNEL); > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > > + OPTIMIZER_HIDE_VAR(ptr); > OPTIMIZER_HIDE_VAR(size); > - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 1, 0, 2)); > + OPTIMIZER_HIDE_VAR(memset_size); > + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 1, 0, memset_size)); > kfree(ptr); > } > > @@ -508,14 +511,17 @@ static void kmalloc_oob_memset_4(struct kunit *test) > { > char *ptr; > size_t size = 128 - KASAN_GRANULE_SIZE; > + size_t memset_size = 4; > > KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); > > ptr = kmalloc(size, GFP_KERNEL); > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > > + OPTIMIZER_HIDE_VAR(ptr); > OPTIMIZER_HIDE_VAR(size); > - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 3, 0, 4)); > + OPTIMIZER_HIDE_VAR(memset_size); > + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 3, 0, memset_size)); > kfree(ptr); > } > > @@ -523,14 +529,17 @@ static void kmalloc_oob_memset_8(struct kunit *test) > { > char *ptr; > size_t size = 128 - KASAN_GRANULE_SIZE; > + size_t memset_size = 8; > > KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); > > ptr = kmalloc(size, GFP_KERNEL); > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > > + OPTIMIZER_HIDE_VAR(ptr); > OPTIMIZER_HIDE_VAR(size); > - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 7, 0, 8)); > + OPTIMIZER_HIDE_VAR(memset_size); > + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 7, 0, memset_size)); > kfree(ptr); > } > > @@ -538,14 +547,17 @@ static void kmalloc_oob_memset_16(struct kunit *test) > { > char *ptr; > size_t size = 128 - KASAN_GRANULE_SIZE; > + size_t memset_size = 16; > > KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); > > ptr = kmalloc(size, GFP_KERNEL); > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > > + OPTIMIZER_HIDE_VAR(ptr); > OPTIMIZER_HIDE_VAR(size); > - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 15, 0, 16)); > + OPTIMIZER_HIDE_VAR(memset_size); > + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 15, 0, memset_size)); > kfree(ptr); > } > > -- > 2.43.0 > Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com> Thanks!
diff --git a/mm/kasan/kasan_test.c b/mm/kasan/kasan_test.c index 8281eb42464b..34515a106ca5 100644 --- a/mm/kasan/kasan_test.c +++ b/mm/kasan/kasan_test.c @@ -493,14 +493,17 @@ static void kmalloc_oob_memset_2(struct kunit *test) { char *ptr; size_t size = 128 - KASAN_GRANULE_SIZE; + size_t memset_size = 2; KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); ptr = kmalloc(size, GFP_KERNEL); KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); + OPTIMIZER_HIDE_VAR(ptr); OPTIMIZER_HIDE_VAR(size); - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 1, 0, 2)); + OPTIMIZER_HIDE_VAR(memset_size); + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 1, 0, memset_size)); kfree(ptr); } @@ -508,14 +511,17 @@ static void kmalloc_oob_memset_4(struct kunit *test) { char *ptr; size_t size = 128 - KASAN_GRANULE_SIZE; + size_t memset_size = 4; KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); ptr = kmalloc(size, GFP_KERNEL); KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); + OPTIMIZER_HIDE_VAR(ptr); OPTIMIZER_HIDE_VAR(size); - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 3, 0, 4)); + OPTIMIZER_HIDE_VAR(memset_size); + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 3, 0, memset_size)); kfree(ptr); } @@ -523,14 +529,17 @@ static void kmalloc_oob_memset_8(struct kunit *test) { char *ptr; size_t size = 128 - KASAN_GRANULE_SIZE; + size_t memset_size = 8; KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); ptr = kmalloc(size, GFP_KERNEL); KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); + OPTIMIZER_HIDE_VAR(ptr); OPTIMIZER_HIDE_VAR(size); - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 7, 0, 8)); + OPTIMIZER_HIDE_VAR(memset_size); + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 7, 0, memset_size)); kfree(ptr); } @@ -538,14 +547,17 @@ static void kmalloc_oob_memset_16(struct kunit *test) { char *ptr; size_t size = 128 - KASAN_GRANULE_SIZE; + size_t memset_size = 16; KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); ptr = kmalloc(size, GFP_KERNEL); KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); + OPTIMIZER_HIDE_VAR(ptr); OPTIMIZER_HIDE_VAR(size); - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 15, 0, 16)); + OPTIMIZER_HIDE_VAR(memset_size); + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 15, 0, memset_size)); kfree(ptr); }
similar to commit 09c6304e38e4 ("kasan: test: fix compatibility with FORTIFY_SOURCE") the kernel is panicing in kmalloc_oob_memset_*. This is due to the `ptr` not being hidden from the optimizer which would disable the runtime fortify string checker. kernel BUG at lib/string_helpers.c:1048! Call Trace: [<00000000272502e2>] fortify_panic+0x2a/0x30 ([<00000000272502de>] fortify_panic+0x26/0x30) [<001bffff817045c4>] kmalloc_oob_memset_2+0x22c/0x230 [kasan_test] Hide the `ptr` variable from the optimizer to fix the kernel panic. Also define a memset_size variable and hide that as well. This cleans up the code and follows the same convention as other tests. Signed-off-by: Nico Pache <npache@redhat.com> --- mm/kasan/kasan_test.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)