All of lore.kernel.org
 help / color / mirror / Atom feed
From: sashiko-bot@kernel.org
To: "Sasha Levin" <sashal@kernel.org>
Cc: linux-modules@vger.kernel.org
Subject: Re: [PATCH v7 4/4] kallsyms: add KUnit tests for lineinfo feature
Date: Thu, 09 Jul 2026 16:50:58 +0000	[thread overview]
Message-ID: <20260709165058.A07321F000E9@smtp.kernel.org> (raw)
In-Reply-To: <20260709163833.3851179-5-sashal@kernel.org>

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Unchecked NULL pointer dereference when allocating test symbol buffer.
--

--- Patch [4]: [PATCH v7 4/4] kallsyms: add KUnit tests for lineinfo feature ---
commit aa7a75a3dcd2a5f7456eb96f884496c36509f6d7
Author: Sasha Levin <sashal@kernel.org>

    kallsyms: add KUnit tests for lineinfo feature

This commit adds a KUnit test module to verify that the kallsyms lineinfo
feature produces correct annotations in stack traces. It also exports
sprint_backtrace() and sprint_backtrace_build_id() so the test module can
exercise the backtrace APIs.

> diff --git a/lib/tests/lineinfo_kunit.c b/lib/tests/lineinfo_kunit.c
> new file mode 100644
> index 0000000000000..dad1522a44f5a
> --- /dev/null
> +++ b/lib/tests/lineinfo_kunit.c
[ ... ]
> +static char *alloc_sym_buf(struct kunit *test)
> +{
> +	return kunit_kzalloc(test, KSYM_SYMBOL_LEN, GFP_KERNEL);
> +}
[ ... ]
> +static void test_normal_function(struct kunit *test)
> +{
> +	char *buf = alloc_sym_buf(test);
> +	unsigned long addr = target_addr(lineinfo_target_normal);
> +
> +	skip_without_module_lineinfo(test);
> +
> +	sprint_with_lineinfo(buf, addr);

[Severity: Medium]
Will this crash the kernel if kunit_kzalloc() fails and returns NULL?

If memory allocation fails under pressure, alloc_sym_buf() returns NULL. The
callers like test_normal_function() pass this buffer unchecked into
sprint_with_lineinfo(), which eventually passes it to kallsyms_lookup_buildid()
as the namebuf parameter.

Looking at kallsyms_lookup_buildid() in kernel/kallsyms.c, the buffer is
dereferenced immediately:

kernel/kallsyms.c:kallsyms_lookup_buildid() {
    ...
    namebuf[0] = 0;
    ...
}

Should alloc_sym_buf() use KUNIT_ASSERT_NOT_NULL(test, buf) to gracefully fail
the test instead of causing a NULL pointer dereference?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709163833.3851179-1-sashal@kernel.org?part=4

  reply	other threads:[~2026-07-09 16:50 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-09 16:38 [PATCH v7 0/4] kallsyms: embed source file:line info in kernel stack traces Sasha Levin
2026-07-09 16:38 ` [PATCH v7 1/4] " Sasha Levin
2026-07-09 16:51   ` sashiko-bot
2026-07-09 16:38 ` [PATCH v7 2/4] kallsyms: extend lineinfo to loadable modules Sasha Levin
2026-07-09 16:50   ` sashiko-bot
2026-07-09 16:38 ` [PATCH v7 3/4] kallsyms: delta-compress lineinfo tables for ~2.7x size reduction Sasha Levin
2026-07-09 16:38 ` [PATCH v7 4/4] kallsyms: add KUnit tests for lineinfo feature Sasha Levin
2026-07-09 16:50   ` sashiko-bot [this message]
2026-07-10 10:04 ` [PATCH v7 0/4] kallsyms: embed source file:line info in kernel stack traces Geert Uytterhoeven

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260709165058.A07321F000E9@smtp.kernel.org \
    --to=sashiko-bot@kernel.org \
    --cc=linux-modules@vger.kernel.org \
    --cc=sashal@kernel.org \
    --cc=sashiko-reviews@lists.linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.