Re: [PATCH bpf-next v4 10/10] selftests/bpf: add tests to validate KASAN on JIT programs

["Alexis Lothoré" <alexis.lothore@bootlin.com>]

On Wed Jul 8, 2026 at 10:28 AM CEST, sashiko-bot wrote:
> Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
> - [Medium] Test fails spuriously on default kernels due to missing verification of the kasan_multi_shot requirement.
> - [Low] The variable `nsize` is assigned but never used, constituting dead code.
> --
>
> --- Patch [10]: [PATCH bpf-next v4 10/10] selftests/bpf: add tests to validate KASAN on JIT programs ---
> commit c15c25b993ae0bc70091046fa0c6b2bb1e71d099
> Author: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
>
> selftests/bpf: add tests to validate KASAN on JIT programs
>
> This patch adds a basic test runner to load and run BPF programs that
> trigger memory management bugs to validate KASAN instrumentation.
> It runs various memory access tests and checks kernel logs for the expected
> KASAN splat, requiring the kernel to be configured with kasan_multi_shot.
>
>> diff --git a/tools/testing/selftests/bpf/prog_tests/kasan.c b/tools/testing/selftests/bpf/prog_tests/kasan.c
>> new file mode 100644
>> index 0000000000000..f006b92ee131a
>> --- /dev/null
>> +++ b/tools/testing/selftests/bpf/prog_tests/kasan.c
>
> [ ... ]
>
>> +static int check_kasan_report_in_kernel_logs(char *buf, struct test_ctx *ctx,
>> +					     bool is_write, int size)
>> +{
>> +	char access_log[READ_CHUNK_SIZE];
>> +	char *kasan_report_start;
>> +	int nsize;
>> +
>> +	snprintf(access_log, READ_CHUNK_SIZE, KASAN_PATTERN_SLAB_UAF,
>> +		 ctx->prog_tag[0], ctx->prog_tag[1], ctx->prog_tag[2],
>> +		 ctx->prog_tag[3], ctx->prog_tag[4], ctx->prog_tag[5],
>> +		 ctx->prog_tag[6], ctx->prog_tag[7], ctx->prog_name);
>
> [ ... ]
>
>> +	kasan_report_start = strstr(buf, access_log);
>> +
>> +	if (!kasan_report_start)
>> +		return 1;
>> +
>> +	nsize = snprintf(access_log, READ_CHUNK_SIZE, KASAN_PATTERN_REPORT,
>> +			 is_write ? "Write" : "Read", size);
>
> [Severity: Low]
> This isn't a bug, but the variable nsize is assigned here and never used.
> Should this assignment be removed to avoid dead code?

I'll rather add an ASSERT on it.

>> +
>> +	if (!strstr(kasan_report_start, access_log))
>> +		return 1;
>> +
>> +	return 0;
>> +}
>
> [ ... ]
>
>> +void test_kasan(void)
>> +{
>> +	struct kasan_write_val val;
>> +	struct test_spec *test;
>> +	struct test_ctx *ctx;
>> +	struct kasan *skel;
>> +	__u32 key = 0;
>> +	int i, ret;
>> +
>> +	ctx = calloc(1, sizeof(struct test_ctx));
>> +	if (!ASSERT_OK_PTR(ctx, "alloc test ctx"))
>> +		return;
>> +
>> +	if (!is_jit_enabled() || !get_kasan_jit_enabled()) {
>> +		test__skip();
>> +		goto end;
>> +	}
>
> [Severity: Medium]
> Since the commit message notes that the kernel must run with the
> kasan_multi_shot configuration, what happens if this parameter is missing?
>
> Could this test fail spuriously on default kernels where multi-shot is
> disabled, since it doesn't verify if kasan_multi_shot is active before
> triggering multiple reports?

The current test design assumes that kasan_multi_shot is not enabled by
the test itself but by the CI runner. This is actually already the case
for the BPF CI. But maybe having a SKIP instead of FAIL is more friendly
for anyone trying to run the tests and forgetting to enable
kasan_multi_shot (some additional doc have been requested and added
since first revision, but I guess the check would not hurt).

Alexis

-- 
Alexis Lothoré, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com