| Message ID | a8ca8bd5eb4114304b34dd8bac7a6280d358c728.1726571179.git.ritesh.list@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [RFC,v2,01/13] mm/kfence: Add a new kunit test test_use_after_free_read_nofault() | expand |
Hello Kasan/kfence-devs, Wanted your inputs on this kfence kunit test [PATCH-1] and it's respective powerpc fix [Patch-2]. The commit msgs has a good description of it. I see that the same problem was noticed on s390 as well [1] a while ago. So that makes me believe that maybe we should have a kunit test for the same to make sure all architectures handles this properly. Thoughts? [1]: https://lore.kernel.org/all/20230213183858.1473681-1-hca@linux.ibm.com/ -ritesh "Ritesh Harjani (IBM)" <ritesh.list@gmail.com> writes: > From: Nirjhar Roy <nirjhar@linux.ibm.com> > > Faults from copy_from_kernel_nofault() needs to be handled by fixup > table and should not be handled by kfence. Otherwise while reading > /proc/kcore which uses copy_from_kernel_nofault(), kfence can generate > false negatives. This can happen when /proc/kcore ends up reading an > unmapped address from kfence pool. > > Let's add a testcase to cover this case. > > Co-developed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com> > Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com> > Signed-off-by: Nirjhar Roy <nirjhar@linux.ibm.com> > Cc: kasan-dev@googlegroups.com > Cc: Alexander Potapenko <glider@google.com> > Cc: linux-mm@kvack.org > --- > mm/kfence/kfence_test.c | 17 +++++++++++++++++ > 1 file changed, 17 insertions(+) > > diff --git a/mm/kfence/kfence_test.c b/mm/kfence/kfence_test.c > index 00fd17285285..f65fb182466d 100644 > --- a/mm/kfence/kfence_test.c > +++ b/mm/kfence/kfence_test.c > @@ -383,6 +383,22 @@ static void test_use_after_free_read(struct kunit *test) > KUNIT_EXPECT_TRUE(test, report_matches(&expect)); > } > > +static void test_use_after_free_read_nofault(struct kunit *test) > +{ > + const size_t size = 32; > + char *addr; > + char dst; > + int ret; > + > + setup_test_cache(test, size, 0, NULL); > + addr = test_alloc(test, size, GFP_KERNEL, ALLOCATE_ANY); > + test_free(addr); > + /* Use after free with *_nofault() */ > + ret = copy_from_kernel_nofault(&dst, addr, 1); > + KUNIT_EXPECT_EQ(test, ret, -EFAULT); > + KUNIT_EXPECT_FALSE(test, report_available()); > +} > + > static void test_double_free(struct kunit *test) > { > const size_t size = 32; > @@ -780,6 +796,7 @@ static struct kunit_case kfence_test_cases[] = { > KFENCE_KUNIT_CASE(test_out_of_bounds_read), > KFENCE_KUNIT_CASE(test_out_of_bounds_write), > KFENCE_KUNIT_CASE(test_use_after_free_read), > + KFENCE_KUNIT_CASE(test_use_after_free_read_nofault), > KFENCE_KUNIT_CASE(test_double_free), > KFENCE_KUNIT_CASE(test_invalid_addr_free), > KFENCE_KUNIT_CASE(test_corruption), > -- > 2.46.0
diff --git a/mm/kfence/kfence_test.c b/mm/kfence/kfence_test.c index 00fd17285285..f65fb182466d 100644 --- a/mm/kfence/kfence_test.c +++ b/mm/kfence/kfence_test.c @@ -383,6 +383,22 @@ static void test_use_after_free_read(struct kunit *test) KUNIT_EXPECT_TRUE(test, report_matches(&expect)); } +static void test_use_after_free_read_nofault(struct kunit *test) +{ + const size_t size = 32; + char *addr; + char dst; + int ret; + + setup_test_cache(test, size, 0, NULL); + addr = test_alloc(test, size, GFP_KERNEL, ALLOCATE_ANY); + test_free(addr); + /* Use after free with *_nofault() */ + ret = copy_from_kernel_nofault(&dst, addr, 1); + KUNIT_EXPECT_EQ(test, ret, -EFAULT); + KUNIT_EXPECT_FALSE(test, report_available()); +} + static void test_double_free(struct kunit *test) { const size_t size = 32; @@ -780,6 +796,7 @@ static struct kunit_case kfence_test_cases[] = { KFENCE_KUNIT_CASE(test_out_of_bounds_read), KFENCE_KUNIT_CASE(test_out_of_bounds_write), KFENCE_KUNIT_CASE(test_use_after_free_read), + KFENCE_KUNIT_CASE(test_use_after_free_read_nofault), KFENCE_KUNIT_CASE(test_double_free), KFENCE_KUNIT_CASE(test_invalid_addr_free), KFENCE_KUNIT_CASE(test_corruption),