Re: [PATCH bpf-next v4 10/10] selftests/bpf: add tests to validate KASAN on JIT programs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] Test fails spuriously on default kernels due to missing verification of the kasan_multi_shot requirement.
- [Low] The variable `nsize` is assigned but never used, constituting dead code.
--

--- Patch [10]: [PATCH bpf-next v4 10/10] selftests/bpf: add tests to validate KASAN on JIT programs ---
commit c15c25b993ae0bc70091046fa0c6b2bb1e71d099
Author: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>

selftests/bpf: add tests to validate KASAN on JIT programs

This patch adds a basic test runner to load and run BPF programs that
trigger memory management bugs to validate KASAN instrumentation.
It runs various memory access tests and checks kernel logs for the expected
KASAN splat, requiring the kernel to be configured with kasan_multi_shot.

> diff --git a/tools/testing/selftests/bpf/prog_tests/kasan.c b/tools/testing/selftests/bpf/prog_tests/kasan.c
> new file mode 100644
> index 0000000000000..f006b92ee131a
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/kasan.c

[ ... ]

> +static int check_kasan_report_in_kernel_logs(char *buf, struct test_ctx *ctx,
> +					     bool is_write, int size)
> +{
> +	char access_log[READ_CHUNK_SIZE];
> +	char *kasan_report_start;
> +	int nsize;
> +
> +	snprintf(access_log, READ_CHUNK_SIZE, KASAN_PATTERN_SLAB_UAF,
> +		 ctx->prog_tag[0], ctx->prog_tag[1], ctx->prog_tag[2],
> +		 ctx->prog_tag[3], ctx->prog_tag[4], ctx->prog_tag[5],
> +		 ctx->prog_tag[6], ctx->prog_tag[7], ctx->prog_name);

[ ... ]

> +	kasan_report_start = strstr(buf, access_log);
> +
> +	if (!kasan_report_start)
> +		return 1;
> +
> +	nsize = snprintf(access_log, READ_CHUNK_SIZE, KASAN_PATTERN_REPORT,
> +			 is_write ? "Write" : "Read", size);

[Severity: Low]
This isn't a bug, but the variable nsize is assigned here and never used.
Should this assignment be removed to avoid dead code?

> +
> +	if (!strstr(kasan_report_start, access_log))
> +		return 1;
> +
> +	return 0;
> +}

[ ... ]

> +void test_kasan(void)
> +{
> +	struct kasan_write_val val;
> +	struct test_spec *test;
> +	struct test_ctx *ctx;
> +	struct kasan *skel;
> +	__u32 key = 0;
> +	int i, ret;
> +
> +	ctx = calloc(1, sizeof(struct test_ctx));
> +	if (!ASSERT_OK_PTR(ctx, "alloc test ctx"))
> +		return;
> +
> +	if (!is_jit_enabled() || !get_kasan_jit_enabled()) {
> +		test__skip();
> +		goto end;
> +	}

[Severity: Medium]
Since the commit message notes that the kernel must run with the
kasan_multi_shot configuration, what happens if this parameter is missing?

Could this test fail spuriously on default kernels where multi-shot is
disabled, since it doesn't verify if kasan_multi_shot is active before
triggering multiple reports?

> +
> +	skel = kasan__open();
> +	if (!ASSERT_OK_PTR(skel, "open prog"))
> +		goto end;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708-kasan-v4-0-d5c177ab8227@bootlin.com?part=10