* [PATCH v6 0/2] introduce kasan.write_only option in hw-tags
@ 2025-09-01 10:46 Yeoreum Yun
2025-09-01 10:46 ` [PATCH v6 1/2] kasan/hw-tags: introduce kasan.write_only option Yeoreum Yun
2025-09-01 10:46 ` [PATCH v6 2/2] kasan: apply write-only mode in kasan kunit testcases Yeoreum Yun
0 siblings, 2 replies; 7+ messages in thread
From: Yeoreum Yun @ 2025-09-01 10:46 UTC (permalink / raw)
To: ryabinin.a.a, glider, andreyknvl, dvyukov, vincenzo.frascino,
corbet, catalin.marinas, will, akpm, scott, jhubbard,
pankaj.gupta, leitao, kaleshsingh, maz, broonie, oliver.upton,
james.morse, ardb, hardevsinh.palaniya, david, yang
Cc: kasan-dev, workflows, linux-doc, linux-kernel, linux-arm-kernel,
linux-mm, Yeoreum Yun
Hardware tag based KASAN is implemented using the Memory Tagging Extension
(MTE) feature.
MTE is built on top of the ARMv8.0 virtual address tagging TBI
(Top Byte Ignore) feature and allows software to access a 4-bit
allocation tag for each 16-byte granule in the physical address space.
A logical tag is derived from bits 59-56 of the virtual
address used for the memory access. A CPU with MTE enabled will compare
the logical tag against the allocation tag and potentially raise an
tag check fault on mismatch, subject to system registers configuration.
Since ARMv8.9, FEAT_MTE_STORE_ONLY can be used to restrict raise of tag
check fault on store operation only.
Using this feature (FEAT_MTE_STORE_ONLY), introduce KASAN write-only mode
which restricts KASAN check write (store) operation only.
This mode omits KASAN check for read (fetch/load) operation.
Therefore, it might be used not only debugging purpose but also in
normal environment.
This patch is based on v6.17-rc1.
Patch History
=============
from v5 to v6:
- change macro name for KASAN kunit test.
- remove and restore useless line adding/removal.
- modify some comments on KASAN kunit test.
- https://lore.kernel.org/all/20250820071243.1567338-1-yeoreum.yun@arm.com/
from v4 to v5:
- fix wrong allocation
- add small comments
- https://lore.kernel.org/all/20250818075051.996764-1-yeoreum.yun@arm.com/
from v3 to v4:
- fix wrong condition
- https://lore.kernel.org/all/20250816110018.4055617-1-yeoreum.yun@arm.com/
from v2 to v3:
- change MET_STORE_ONLY feature as BOOT_CPU_FEATURE
- change store_only to write_only
- move write_only setup into the place other option's setup place
- change static key of kasan_flag_write_only to static boolean.
- change macro KUNIT_EXPECT_KASAN_SUCCESS to KUNIT_EXPECT_KASAN_FAIL_READ.
- https://lore.kernel.org/all/20250813175335.3980268-1-yeoreum.yun@arm.com/
from v1 to v2:
- change cryptic name -- stonly to store_only
- remove some TCF check with store which can make memory courruption.
- https://lore.kernel.org/all/20250811173626.1878783-1-yeoreum.yun@arm.com/
Yeoreum Yun (2):
kasan/hw-tags: introduce kasan.write_only option
kasan: apply write-only mode in kasan kunit testcases
Documentation/dev-tools/kasan.rst | 3 +
arch/arm64/include/asm/memory.h | 1 +
arch/arm64/include/asm/mte-kasan.h | 6 +
arch/arm64/kernel/cpufeature.c | 2 +-
arch/arm64/kernel/mte.c | 18 +++
mm/kasan/hw_tags.c | 70 +++++++++-
mm/kasan/kasan.h | 7 +
mm/kasan/kasan_test_c.c | 204 +++++++++++++++++++----------
8 files changed, 239 insertions(+), 72 deletions(-)
base-commit: 8f5ae30d69d7543eee0d70083daf4de8fe15d585
prerequisite-patch-id: 136c6b02685560c44ec3344be9b716bdfbc5ffa2
prerequisite-patch-id: 45bbbbf89a641d5daca648988d8e4d45de45db80
prerequisite-patch-id: ea19c0e099daab02577ee2e86671417fc57d0b0d
prerequisite-patch-id: 5adddd8cd6865b4d6a0b7d9e9085220e22723faa
prerequisite-patch-id: d8471a1aaee960efa4fc41ca42068aef6730a8d9
prerequisite-patch-id: 969950ee5ccabeb3df369142dfa97a4474788859
prerequisite-patch-id: 21b91081876a36ecaa5547e1f251b2101ba97950
prerequisite-patch-id: c04ce4ffe72ad15b8ab13e157d8b25d635f170a3
prerequisite-patch-id: e8b79e0c052d28833e4f4c627d5365ef5299e617
prerequisite-patch-id: 07b1a7e43f2c7f61c397ef4f6c5e12b0df3590e4
prerequisite-patch-id: 2f420864ab40988d03c96c27ca5ba431efe2717f
prerequisite-patch-id: eeac7cfc0249e5ac71f12e340277633cf4d7aabe
prerequisite-patch-id: 6d190150e7f678ce654800a41800278dc2dd0bb3
prerequisite-patch-id: cce369222a7cdd5f91d10c12cb3905107f6a7874
prerequisite-patch-id: 290b18733f6fcbf5b0bcfc1a378d2cbf3d952669
prerequisite-patch-id: c81d671f37e6465fe8ae0e5ce2e32aac8e3e5e10
prerequisite-patch-id: 7f38f1b76708ea2b33e0bd7ebd334ae6d6f95b78
prerequisite-patch-id: a730599474985e4e8f4e17a6f3521f7de687825e
prerequisite-patch-id: 0af8e9b6d2985a1da4a220de34e1a37179fa1a2c
prerequisite-patch-id: b4a83f3d74686eee187f25ca12ef75a0475fa2cf
prerequisite-patch-id: d0e7e6d3485eed1b85fca8e12c6ef4118ccd8c2d
prerequisite-patch-id: 8f1932d6d4892d06de0e6da0606fe94644d10b02
prerequisite-patch-id: 8149f1ed55eda3d2f7ac70c71480c4694ce8c293
prerequisite-patch-id: b244e6c6438bb637a9c2123d7875072a336dbf40
prerequisite-patch-id: f3bb5cef44a4dbd16d314ac72674e87da9576031
prerequisite-patch-id: e284957cded74a97be39563cc68771753f8ff560
prerequisite-patch-id: 42fb46241a4969b46377fe372b107ecf84fdac65
prerequisite-patch-id: 03ca449e3ef1e354bfca8dcfad1c1754992770f6
prerequisite-patch-id: c784c79c432175b2b8f980b570604cb3839a1d0f
prerequisite-patch-id: 6cf468fcd78d9f5566c848caa29c2e63279914c6
prerequisite-patch-id: 9e4ccee8587702f2e0fe537c7072b9888a0c1aba
prerequisite-patch-id: 1e44823aba4d29d8cf9c2d5c7659382cd4e9f578
prerequisite-patch-id: 107f6ba7dd4b22e870d641670ed020cc3d783df2
prerequisite-patch-id: 0bc6e19edcc18632ade69696a057a71f9169e90d
prerequisite-patch-id: e776b9cf46afdc0c90293081a786144d21e4ec46
prerequisite-patch-id: 18ff9ea0304a49a5e1bd200a723d8eb45c7c92f7
prerequisite-patch-id: bd747f03cfe61caa1bda1caf594ef9f195d70a73
prerequisite-patch-id: e5f37bb65433f4d290cde0a65c3cb46a5bd8f6b8
prerequisite-patch-id: 230be9c059f823ea5c78d1b1da55fb18892a0f72
prerequisite-patch-id: 150d0a767ab84dc9eb3c39bd7d63338e961b0233
prerequisite-patch-id: 383116f4edc62f1ba03ffd10385aed7140b9971c
prerequisite-patch-id: df971da9ff346719a80df1dbb0728ee35fa71ae4
prerequisite-patch-id: e725511837cca1e7e5d04670885a52582aecdc39
prerequisite-patch-id: 594e3fe39c37f00f20f48127ef02b4363ece1dcf
prerequisite-patch-id: cba6439f7314aa62c188077a120ae56201660b16
prerequisite-patch-id: 29df9f163c4dc8518a0b408b5972a8883b841dd1
prerequisite-patch-id: 78667378d037d37076499b68e80393b0861512b3
prerequisite-patch-id: c8af68f162f02af7d2090e3a20dfa95a68067fd7
prerequisite-patch-id: ee1e3cef0df94dd93584110c9fa590baec1e951f
prerequisite-patch-id: b75496be2f73ac73bd7e1f5de1ec25f395db9d1b
prerequisite-patch-id: c1c008ad523d34fc5bcd3455a6b7b46a48a0372d
prerequisite-patch-id: 13ac4ac649d2721cb1fa1a96c8680050b865de87
prerequisite-patch-id: eb6c631b6f18d1d9666723b92e11e005009a5d92
prerequisite-patch-id: 540bb74abf0680f0857eccb6d9507875923644a1
prerequisite-patch-id: 27d953412b9416a0523eef0d45557db08edebad8
prerequisite-patch-id: 28adf1a29676d8184b138f60a02e033435c44960
prerequisite-patch-id: 7f67f3bf300491ea7852fbca10d7dcb0638c1771
prerequisite-patch-id: 358ba438674c82a7998d68cca853f2828276a609
prerequisite-patch-id: cadf6f28cef328a919572d8e0ab2ebc9ed2019e6
prerequisite-patch-id: b1f40307c72f0a314c4184c2d45e0a8b4048f685
prerequisite-patch-id: cf02be23717b54437918c80cfb663ddecb2d1483
prerequisite-patch-id: c2153976ef7c54556abfc04cedf18eed300e4fd5
prerequisite-patch-id: 7413f73a43098ff888f715c13747abb62f498770
prerequisite-patch-id: 4285dc47a26a5152eaf515c2934cc0d1b7cc9d1d
prerequisite-patch-id: 94032debade30f10dfb6a4021c1a41b49d4ea069
prerequisite-patch-id: 1b0d245e4b8c568f4865a00e011d79d39adc1649
prerequisite-patch-id: 33c3958dc29779f84a2858902043840169cc7de3
prerequisite-patch-id: fbd86d03e31d738865d27b860bca951b283fdab5
prerequisite-patch-id: c20b348d2820cdfe31d800efc950c22255bc22ad
prerequisite-patch-id: 0a15397743a75a3a56017975501301d56963d771
prerequisite-patch-id: 64dca2daa72ff52744f7e86623309e757e0f1c40
prerequisite-patch-id: 34ae142eff624e64106ee0f594394e1600973e5d
prerequisite-patch-id: 9b3c97d6537a7d6ebfee8e7a51057ae0bd6be479
prerequisite-patch-id: 7ecc644ea8560552cf4cc12925de81b56fece04e
prerequisite-patch-id: 800813b629a6e3d09d47076d898150cd73119c07
prerequisite-patch-id: 745083490be7d6e249f24ff7574c2b8df9f37a1b
prerequisite-patch-id: 878c0fbdc362b4fd5c943400b72f4f4ffe141a55
prerequisite-patch-id: a8627b9e4e87a5fe2cb0d17125559d7be15910aa
prerequisite-patch-id: caf32baaa38ad7ed80e4109fd853097b8bcc41c8
prerequisite-patch-id: 48dbc4fefb04926762e09342b63eae52df44048f
prerequisite-patch-id: e1fb352d09da8fa6ee3306d85af029a9a4be7ec8
prerequisite-patch-id: e7a5b69d0283bfcb4e2901f64d8834ff5361f126
prerequisite-patch-id: 04712cd6067166048944e741e8f93e018904ac56
prerequisite-patch-id: f15d057c5ca21a05f7a205a6519d58ea1f592d7d
prerequisite-patch-id: 7476f8cd099b5fab7a0f6c76a378e2d50066be0b
prerequisite-patch-id: 38f0c6aa4dd53f308b4c211d7b6326de6622f045
prerequisite-patch-id: b45a6f20519aea585527078495a2c9c63feb3778
prerequisite-patch-id: 9344feb49232a49d171c5c2fee55a28873ef5710
prerequisite-patch-id: 3ae3b35697646f814c74a62027a9555bb1c28ac8
prerequisite-patch-id: cbe8aa31360444f9768764b0659e1d04cd77a5b2
prerequisite-patch-id: 133cfbe76d691ed57dbeecdc355833b0ddd20208
prerequisite-patch-id: b54ad7c10fc1a6cc0f93e603397510906ef22a68
prerequisite-patch-id: 6d62f0ec7000fd26db84a7008e2cd92738e6bddb
prerequisite-patch-id: 642b15a05d3613f503651ff795947df69c8c856a
prerequisite-patch-id: 7fce745555f774f4ddc39044c41e013fd42a5b7f
prerequisite-patch-id: 81aa7af170f321450fb7d29e788b9de90ef60261
prerequisite-patch-id: 3307943829aea5595b3ec49f22204c55adfc9c37
prerequisite-patch-id: c865672ddb7be662d9fade867201679bf5d62408
prerequisite-patch-id: 2fa765c8477947130a6be91cccae9fb2de84e193
prerequisite-patch-id: 08a9efdd6e4bc6de5baa2789f1d608ab98a327e0
prerequisite-patch-id: 0d0b0b71375800974dbe7237927dded7261180bd
prerequisite-patch-id: da00f3be5a9c30a68c3ad40eebc9e857664ba39b
prerequisite-patch-id: 7ce6f4d8ed2cca29fab9d06b53d94eaf2d4a71ca
prerequisite-patch-id: b353a98ba3563e9f19c3d869753c2a000bb0dd5c
prerequisite-patch-id: 14fc49629b991d714c75068d1bd31cd4df00369f
prerequisite-patch-id: abc5404e1ca9ebba2d256e5f19aafdc3da8433e9
prerequisite-patch-id: 3fd33bd1054f7cfe8c3d08b7c53a77df6e89dc5a
prerequisite-patch-id: 90eb019a38dbd0099a9aee921bde795dc77281c6
prerequisite-patch-id: 69933246ea66c02b0291a946a510e63b28aa4a07
prerequisite-patch-id: d4b2f02a1df02786239131b2af8626f19d7febfd
prerequisite-patch-id: 54470e5d2206ef4dd8ba2168b29cc57579fac520
prerequisite-patch-id: e0b3b83c0828ad746354d536270942259ad7d5a5
prerequisite-patch-id: f7d545aa7a1c82938ce0437c251acd1a041a32b2
prerequisite-patch-id: dfd0e53d9bf57c760fd284ce27c41ba91bf9ae5b
prerequisite-patch-id: 76313f2c8af79cfd97a5f79da5fd5b3fc4a48bfe
prerequisite-patch-id: 0779fa85eb9cac194a01a6351288508d6e80e90b
prerequisite-patch-id: 41f7a748ce6619611991b479468334d1edd23022
prerequisite-patch-id: dd030d0200d8ce2340bf7d9b71c6e9aa719eed8e
prerequisite-patch-id: 5c32ccd9b5010c5b70633a54a2e0e9273ae4cd89
prerequisite-patch-id: f9eb03ca1f597bb99366adb81a201cfdc5f46538
prerequisite-patch-id: f08d8da3f1d4b72b27a1eb0f21e05839c0dfb2ef
prerequisite-patch-id: b6d1fe4754a2f54a6eb1f881bceacecc9b8aef6e
prerequisite-patch-id: e1164905fe6444b47d301aa73434e24395ee3692
prerequisite-patch-id: b98524d164fb5270fc83200b0005dfab8ab085d0
prerequisite-patch-id: 7de80453bca3ab7af13f2d5dd0af53b49ab775be
prerequisite-patch-id: cab73f2d83bb9caba9a9140e871ed804ad93012d
prerequisite-patch-id: 4ccc38815bc167042fd9480658ca977c5a018865
prerequisite-patch-id: d7549e7c36b461ef9816b2580d31a3b322189f6b
prerequisite-patch-id: f62a5eb77118b9f534e1829f9277f78159e0426a
prerequisite-patch-id: ef6cf9280b7ad0d6df39e3c30ac70594683b3237
prerequisite-patch-id: 097d27325d53feb894b26bb0c7e152fca314e7b9
prerequisite-patch-id: ca3a3605a04c9d3dcd7f577bf11b827735ae9fb2
prerequisite-patch-id: 1896423fac08929b2cbe94ab22f355e1a1674d91
prerequisite-patch-id: 0ed94130a16282e44a3b586ea7b5a2fbcbfd8e38
prerequisite-patch-id: 2246611dab54080318ec3b1359f07f5a6c37363c
prerequisite-patch-id: 18b914f2dd8e71ec7d128bcdb4ec7f78ec7760ee
prerequisite-patch-id: 1871f47d222aa5d1a85830e25be310e38288545c
prerequisite-patch-id: 57a66df1e4e0d2ac3bc0c4eab5f622fe557f7955
prerequisite-patch-id: 26647ddce2ad9cd5ea2b6e05b9b36b64e51d2b4e
prerequisite-patch-id: 2b1aef1d3e43f6a7a9dab2e1d3eb30e9df131684
prerequisite-patch-id: 7ef55b4a331871c3153e9043aadd0aa16d4aba5c
prerequisite-patch-id: d18e41b2d1d5dbc4362ece6b4c5816a86b933638
prerequisite-patch-id: b7a386f31313694e8d75fd7edeb10c62d9bf7650
prerequisite-patch-id: 261051e73501abfbfa106f44e0e0e4c74603f131
prerequisite-patch-id: 8498a2e4f746081e719d9a021b57bc80a5ac3817
prerequisite-patch-id: 3b6a398d6d2d5f84011eb48401bb453d9e9bb1a2
prerequisite-patch-id: 7e910758654df94dfbeeaee0429e0acdf5035edb
prerequisite-patch-id: 23115277def65ee8db1c7a0b0f697211253eeef2
prerequisite-patch-id: 6514c6f702538db3fe776443b03205e0e331d59b
prerequisite-patch-id: 4eeb4b19bb876c449f377c2fce9e8d5d2e3384bb
prerequisite-patch-id: f187aa49a1b20ca85d7556fee15f526c26650688
prerequisite-patch-id: 997a8549300388c11027e465c6781acd2fa799b9
prerequisite-patch-id: 9094fb34dcdb72d2d4d9cf7b9a71dbfbe85f47db
prerequisite-patch-id: 32231f11fcc72302bf4e2bddbd362b2f27928b65
prerequisite-patch-id: 2497ea23d9ebf51b71472136e1a74bfbd2594a3c
prerequisite-patch-id: 0cf170373dfeaab97e724610375091972b91b3b3
prerequisite-patch-id: 2a20ef3c132bd0259826e6d5b020df71ace360ec
prerequisite-patch-id: 6d3d248f710c8afaa68ac2648ea0133d90bca19a
prerequisite-patch-id: 8d13795b1a92c79ed5f1c3871e3a7b0ba17e34a1
prerequisite-patch-id: 80dc4103e79eff0a7ebe12169c7b36d098382552
prerequisite-patch-id: 17b2a915420e30817ee4b8b76fe69245c351adab
prerequisite-patch-id: e3b1a35f82d7a87f54fb049bc08649663d93e889
prerequisite-patch-id: 3192e8f3349ba989abfa1603d9df1ff8ddc72801
prerequisite-patch-id: 1d258467dc0bb5418885e6cba6eefa012ad3da09
prerequisite-patch-id: bc3a68e959b57b6dc814550f81d70369b3fdc5ab
prerequisite-patch-id: 1b477cffeb8eb881f8ef21cab7d9d0fcf41bc65c
prerequisite-patch-id: 21c5fd0bc10d681bb01c4e6b9c809efb46af0473
prerequisite-patch-id: d8cfb68a6653d82fc55d9577ba45face4abdffeb
prerequisite-patch-id: f95b2692beefcdb4c01e26a27ad61fc79e15130e
prerequisite-patch-id: b4486a6d6d3a870d8604a5b95ff217a7a25b787e
prerequisite-patch-id: 1fab4dfefa1608a5668c166bc0f83a5eb03f1f6d
prerequisite-patch-id: 7c768335c56ef9f5adfd59827475bd66fceaa608
prerequisite-patch-id: 226bf92946bc11d17c3fc46a5d63614e92a9ef9e
prerequisite-patch-id: 1ee2b49c3c8ad17e9b50c5e005e9c7ed9f37a0de
prerequisite-patch-id: 29cb1d6dd1a1815e72efe384b6779a0aecd30904
prerequisite-patch-id: f75afa353717cc8eda63b392c1f195bde1daff5e
prerequisite-patch-id: 0834d786bee7772b207590046df0c594bc39c9e3
prerequisite-patch-id: eec4e0f5694ea87625ae8cb483601d7dcd1518b3
prerequisite-patch-id: 6e467aa948af15cb7d5d848c6923c311fba01a19
prerequisite-patch-id: fb2e1540330d24599ad4dd426cb78f4db631af1c
prerequisite-patch-id: 76b11bb00d485a802efbef14aafd93387609470f
prerequisite-patch-id: a565b77909e10221b99afe597443ff71de11e1ba
--
LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v6 1/2] kasan/hw-tags: introduce kasan.write_only option
2025-09-01 10:46 [PATCH v6 0/2] introduce kasan.write_only option in hw-tags Yeoreum Yun
@ 2025-09-01 10:46 ` Yeoreum Yun
2025-09-01 16:53 ` Catalin Marinas
2025-09-01 19:23 ` Andrew Morton
2025-09-01 10:46 ` [PATCH v6 2/2] kasan: apply write-only mode in kasan kunit testcases Yeoreum Yun
1 sibling, 2 replies; 7+ messages in thread
From: Yeoreum Yun @ 2025-09-01 10:46 UTC (permalink / raw)
To: ryabinin.a.a, glider, andreyknvl, dvyukov, vincenzo.frascino,
corbet, catalin.marinas, will, akpm, scott, jhubbard,
pankaj.gupta, leitao, kaleshsingh, maz, broonie, oliver.upton,
james.morse, ardb, hardevsinh.palaniya, david, yang
Cc: kasan-dev, workflows, linux-doc, linux-kernel, linux-arm-kernel,
linux-mm, Yeoreum Yun
Since Armv8.9, FEATURE_MTE_STORE_ONLY feature is introduced to restrict
raise of tag check fault on store operation only.
Introcude KASAN write only mode based on this feature.
KASAN write only mode restricts KASAN checks operation for write only and
omits the checks for fetch/read operations when accessing memory.
So it might be used not only debugging enviroment but also normal
enviroment to check memory safty.
This features can be controlled with "kasan.write_only" arguments.
When "kasan.write_only=on", KASAN checks write operation only otherwise
KASAN checks all operations.
This changes the MTE_STORE_ONLY feature as BOOT_CPU_FEATURE like
ARM64_MTE_ASYMM so that makes it initialise in kasan_init_hw_tags()
with other function together.
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
---
Documentation/dev-tools/kasan.rst | 3 ++
arch/arm64/include/asm/memory.h | 1 +
arch/arm64/include/asm/mte-kasan.h | 6 +++
arch/arm64/kernel/cpufeature.c | 2 +-
arch/arm64/kernel/mte.c | 18 ++++++++
mm/kasan/hw_tags.c | 70 +++++++++++++++++++++++++++++-
mm/kasan/kasan.h | 7 +++
7 files changed, 104 insertions(+), 3 deletions(-)
diff --git a/Documentation/dev-tools/kasan.rst b/Documentation/dev-tools/kasan.rst
index 0a1418ab72fd..a034700da7c4 100644
--- a/Documentation/dev-tools/kasan.rst
+++ b/Documentation/dev-tools/kasan.rst
@@ -143,6 +143,9 @@ disabling KASAN altogether or controlling its features:
Asymmetric mode: a bad access is detected synchronously on reads and
asynchronously on writes.
+- ``kasan.write_only=off`` or ``kasan.write_only=on`` controls whether KASAN
+ checks the write (store) accesses only or all accesses (default: ``off``).
+
- ``kasan.vmalloc=off`` or ``=on`` disables or enables tagging of vmalloc
allocations (default: ``on``).
diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h
index 5213248e081b..f1505c4acb38 100644
--- a/arch/arm64/include/asm/memory.h
+++ b/arch/arm64/include/asm/memory.h
@@ -308,6 +308,7 @@ static inline const void *__tag_set(const void *addr, u8 tag)
#define arch_enable_tag_checks_sync() mte_enable_kernel_sync()
#define arch_enable_tag_checks_async() mte_enable_kernel_async()
#define arch_enable_tag_checks_asymm() mte_enable_kernel_asymm()
+#define arch_enable_tag_checks_write_only() mte_enable_kernel_store_only()
#define arch_suppress_tag_checks_start() mte_enable_tco()
#define arch_suppress_tag_checks_stop() mte_disable_tco()
#define arch_force_async_tag_fault() mte_check_tfsr_exit()
diff --git a/arch/arm64/include/asm/mte-kasan.h b/arch/arm64/include/asm/mte-kasan.h
index 2e98028c1965..0f9b08e8fb8d 100644
--- a/arch/arm64/include/asm/mte-kasan.h
+++ b/arch/arm64/include/asm/mte-kasan.h
@@ -200,6 +200,7 @@ static inline void mte_set_mem_tag_range(void *addr, size_t size, u8 tag,
void mte_enable_kernel_sync(void);
void mte_enable_kernel_async(void);
void mte_enable_kernel_asymm(void);
+int mte_enable_kernel_store_only(void);
#else /* CONFIG_ARM64_MTE */
@@ -251,6 +252,11 @@ static inline void mte_enable_kernel_asymm(void)
{
}
+static inline int mte_enable_kernel_store_only(void)
+{
+ return -EINVAL;
+}
+
#endif /* CONFIG_ARM64_MTE */
#endif /* __ASSEMBLY__ */
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index 9ad065f15f1d..505bd56e21a2 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -2920,7 +2920,7 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
{
.desc = "Store Only MTE Tag Check",
.capability = ARM64_MTE_STORE_ONLY,
- .type = ARM64_CPUCAP_SYSTEM_FEATURE,
+ .type = ARM64_CPUCAP_BOOT_CPU_FEATURE,
.matches = has_cpuid_feature,
ARM64_CPUID_FIELDS(ID_AA64PFR2_EL1, MTESTOREONLY, IMP)
},
diff --git a/arch/arm64/kernel/mte.c b/arch/arm64/kernel/mte.c
index e5e773844889..54a52dc5c1ae 100644
--- a/arch/arm64/kernel/mte.c
+++ b/arch/arm64/kernel/mte.c
@@ -157,6 +157,24 @@ void mte_enable_kernel_asymm(void)
mte_enable_kernel_sync();
}
}
+
+int mte_enable_kernel_store_only(void)
+{
+ /*
+ * If the CPU does not support MTE store only,
+ * the kernel checks all operations.
+ */
+ if (!cpus_have_cap(ARM64_MTE_STORE_ONLY))
+ return -EINVAL;
+
+ sysreg_clear_set(sctlr_el1, SCTLR_EL1_TCSO_MASK,
+ SYS_FIELD_PREP(SCTLR_EL1, TCSO, 1));
+ isb();
+
+ pr_info_once("MTE: enabled store only mode at EL1\n");
+
+ return 0;
+}
#endif
#ifdef CONFIG_KASAN_HW_TAGS
diff --git a/mm/kasan/hw_tags.c b/mm/kasan/hw_tags.c
index 9a6927394b54..ef2bec55ec14 100644
--- a/mm/kasan/hw_tags.c
+++ b/mm/kasan/hw_tags.c
@@ -41,9 +41,16 @@ enum kasan_arg_vmalloc {
KASAN_ARG_VMALLOC_ON,
};
+enum kasan_arg_write_only {
+ KASAN_ARG_WRITE_ONLY_DEFAULT,
+ KASAN_ARG_WRITE_ONLY_OFF,
+ KASAN_ARG_WRITE_ONLY_ON,
+};
+
static enum kasan_arg kasan_arg __ro_after_init;
static enum kasan_arg_mode kasan_arg_mode __ro_after_init;
static enum kasan_arg_vmalloc kasan_arg_vmalloc __initdata;
+static enum kasan_arg_write_only kasan_arg_write_only __ro_after_init;
/*
* Whether KASAN is enabled at all.
@@ -67,6 +74,9 @@ DEFINE_STATIC_KEY_FALSE(kasan_flag_vmalloc);
#endif
EXPORT_SYMBOL_GPL(kasan_flag_vmalloc);
+/* Whether to check write accesses only. */
+static bool kasan_flag_write_only = false;
+
#define PAGE_ALLOC_SAMPLE_DEFAULT 1
#define PAGE_ALLOC_SAMPLE_ORDER_DEFAULT 3
@@ -141,6 +151,23 @@ static int __init early_kasan_flag_vmalloc(char *arg)
}
early_param("kasan.vmalloc", early_kasan_flag_vmalloc);
+/* kasan.write_only=off/on */
+static int __init early_kasan_flag_write_only(char *arg)
+{
+ if (!arg)
+ return -EINVAL;
+
+ if (!strcmp(arg, "off"))
+ kasan_arg_write_only = KASAN_ARG_WRITE_ONLY_OFF;
+ else if (!strcmp(arg, "on"))
+ kasan_arg_write_only = KASAN_ARG_WRITE_ONLY_ON;
+ else
+ return -EINVAL;
+
+ return 0;
+}
+early_param("kasan.write_only", early_kasan_flag_write_only);
+
static inline const char *kasan_mode_info(void)
{
if (kasan_mode == KASAN_MODE_ASYNC)
@@ -257,15 +284,28 @@ void __init kasan_init_hw_tags(void)
break;
}
+ switch (kasan_arg_write_only) {
+ case KASAN_ARG_WRITE_ONLY_DEFAULT:
+ /* Default is specified by kasan_flag_write_only definition. */
+ break;
+ case KASAN_ARG_WRITE_ONLY_OFF:
+ kasan_flag_write_only = false;
+ break;
+ case KASAN_ARG_WRITE_ONLY_ON:
+ kasan_flag_write_only = true;
+ break;
+ }
+
kasan_init_tags();
/* KASAN is now initialized, enable it. */
static_branch_enable(&kasan_flag_enabled);
- pr_info("KernelAddressSanitizer initialized (hw-tags, mode=%s, vmalloc=%s, stacktrace=%s)\n",
+ pr_info("KernelAddressSanitizer initialized (hw-tags, mode=%s, vmalloc=%s, stacktrace=%s, write_only=%s\n",
kasan_mode_info(),
str_on_off(kasan_vmalloc_enabled()),
- str_on_off(kasan_stack_collection_enabled()));
+ str_on_off(kasan_stack_collection_enabled()),
+ str_on_off(kasan_arg_write_only));
}
#ifdef CONFIG_KASAN_VMALLOC
@@ -392,6 +432,26 @@ void kasan_enable_hw_tags(void)
hw_enable_tag_checks_asymm();
else
hw_enable_tag_checks_sync();
+
+ /*
+ * CPUs can only be in one of two states:
+ * - All CPUs support the write_only feature
+ * - No CPUs support the write_only feature
+ *
+ * If the first CPU attempts hw_enable_tag_checks_write_only() and
+ * finds the feature unsupported, kasan_arg_write_only is set to OFF
+ * to avoid further unnecessary calls on other CPUs.
+ *
+ * Although this could be tracked with a single variable, both
+ * kasan_arg_write_only (boot argument) and kasan_flag_write_only
+ * (hardware state) are kept separate, consistent with other options.
+ */
+ if (kasan_arg_write_only == KASAN_ARG_WRITE_ONLY_ON &&
+ hw_enable_tag_checks_write_only()) {
+ kasan_arg_write_only = KASAN_ARG_WRITE_ONLY_OFF;
+ kasan_flag_write_only = false;
+ pr_err_once("write-only mode is not supported and thus not enabled\n");
+ }
}
#if IS_ENABLED(CONFIG_KASAN_KUNIT_TEST)
@@ -404,4 +464,10 @@ VISIBLE_IF_KUNIT void kasan_force_async_fault(void)
}
EXPORT_SYMBOL_IF_KUNIT(kasan_force_async_fault);
+VISIBLE_IF_KUNIT bool kasan_write_only_enabled(void)
+{
+ return kasan_flag_write_only;
+}
+EXPORT_SYMBOL_IF_KUNIT(kasan_write_only_enabled);
+
#endif
diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
index 129178be5e64..844eedf2ef9c 100644
--- a/mm/kasan/kasan.h
+++ b/mm/kasan/kasan.h
@@ -431,6 +431,7 @@ static inline const void *arch_kasan_set_tag(const void *addr, u8 tag)
#define hw_suppress_tag_checks_start() arch_suppress_tag_checks_start()
#define hw_suppress_tag_checks_stop() arch_suppress_tag_checks_stop()
#define hw_force_async_tag_fault() arch_force_async_tag_fault()
+#define hw_enable_tag_checks_write_only() arch_enable_tag_checks_write_only()
#define hw_get_random_tag() arch_get_random_tag()
#define hw_get_mem_tag(addr) arch_get_mem_tag(addr)
#define hw_set_mem_tag_range(addr, size, tag, init) \
@@ -451,11 +452,17 @@ void __init kasan_init_tags(void);
#if defined(CONFIG_KASAN_HW_TAGS) && IS_ENABLED(CONFIG_KASAN_KUNIT_TEST)
void kasan_force_async_fault(void);
+bool kasan_write_only_enabled(void);
#else /* CONFIG_KASAN_HW_TAGS && CONFIG_KASAN_KUNIT_TEST */
static inline void kasan_force_async_fault(void) { }
+static inline bool kasan_write_only_enabled(void)
+{
+ return false;
+}
+
#endif /* CONFIG_KASAN_HW_TAGS && CONFIG_KASAN_KUNIT_TEST */
#ifdef CONFIG_KASAN_SW_TAGS
--
LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH v6 2/2] kasan: apply write-only mode in kasan kunit testcases
2025-09-01 10:46 [PATCH v6 0/2] introduce kasan.write_only option in hw-tags Yeoreum Yun
2025-09-01 10:46 ` [PATCH v6 1/2] kasan/hw-tags: introduce kasan.write_only option Yeoreum Yun
@ 2025-09-01 10:46 ` Yeoreum Yun
2025-09-03 12:49 ` Andrey Konovalov
1 sibling, 1 reply; 7+ messages in thread
From: Yeoreum Yun @ 2025-09-01 10:46 UTC (permalink / raw)
To: ryabinin.a.a, glider, andreyknvl, dvyukov, vincenzo.frascino,
corbet, catalin.marinas, will, akpm, scott, jhubbard,
pankaj.gupta, leitao, kaleshsingh, maz, broonie, oliver.upton,
james.morse, ardb, hardevsinh.palaniya, david, yang
Cc: kasan-dev, workflows, linux-doc, linux-kernel, linux-arm-kernel,
linux-mm, Yeoreum Yun
When KASAN is configured in write-only mode,
fetch/load operations do not trigger tag check faults.
As a result, the outcome of some test cases may differ
compared to when KASAN is configured without write-only mode.
Therefore, by modifying pre-exist testcases
check the write only makes tag check fault (TCF) where
writing is perform in "allocated memory" but tag is invalid
(i.e) redzone write in atomic_set() testcases.
Otherwise check the invalid fetch/read doesn't generate TCF.
Also, skip some testcases affected by initial value
(i.e) atomic_cmpxchg() testcase maybe successd if
it passes valid atomic_t address and invalid oldaval address.
In this case, if invalid atomic_t doesn't have the same oldval,
it won't trigger write operation so the test will pass.
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
---
mm/kasan/kasan_test_c.c | 204 ++++++++++++++++++++++++++--------------
1 file changed, 135 insertions(+), 69 deletions(-)
diff --git a/mm/kasan/kasan_test_c.c b/mm/kasan/kasan_test_c.c
index e0968acc03aa..8b3bb33603e1 100644
--- a/mm/kasan/kasan_test_c.c
+++ b/mm/kasan/kasan_test_c.c
@@ -94,11 +94,13 @@ static void kasan_test_exit(struct kunit *test)
}
/**
- * KUNIT_EXPECT_KASAN_FAIL - check that the executed expression produces a
- * KASAN report; causes a KUnit test failure otherwise.
+ * KUNIT_EXPECT_KASAN_RESULT - check that the executed expression
+ * causes a KUnit test failure when the result is different from @fail.
*
* @test: Currently executing KUnit test.
- * @expression: Expression that must produce a KASAN report.
+ * @expr: Expression to be tested.
+ * @expr_str: Expression to be tested encoded as a string.
+ * @fail: Whether expression should produce a KASAN report.
*
* For hardware tag-based KASAN, when a synchronous tag fault happens, tag
* checking is auto-disabled. When this happens, this test handler reenables
@@ -110,25 +112,29 @@ static void kasan_test_exit(struct kunit *test)
* Use READ/WRITE_ONCE() for the accesses and compiler barriers around the
* expression to prevent that.
*
- * In between KUNIT_EXPECT_KASAN_FAIL checks, test_status.report_found is kept
+ * In between KUNIT_EXPECT_KASAN_RESULT checks, test_status.report_found is kept
* as false. This allows detecting KASAN reports that happen outside of the
* checks by asserting !test_status.report_found at the start of
- * KUNIT_EXPECT_KASAN_FAIL and in kasan_test_exit.
+ * KUNIT_EXPECT_KASAN_RESULT and in kasan_test_exit.
*/
-#define KUNIT_EXPECT_KASAN_FAIL(test, expression) do { \
+#define KUNIT_EXPECT_KASAN_RESULT(test, expr, expr_str, fail) \
+do { \
if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) && \
kasan_sync_fault_possible()) \
migrate_disable(); \
KUNIT_EXPECT_FALSE(test, READ_ONCE(test_status.report_found)); \
barrier(); \
- expression; \
+ expr; \
barrier(); \
if (kasan_async_fault_possible()) \
kasan_force_async_fault(); \
- if (!READ_ONCE(test_status.report_found)) { \
- KUNIT_FAIL(test, KUNIT_SUBTEST_INDENT "KASAN failure " \
- "expected in \"" #expression \
- "\", but none occurred"); \
+ if (READ_ONCE(test_status.report_found) != fail) { \
+ KUNIT_FAIL(test, KUNIT_SUBTEST_INDENT "KASAN failure" \
+ "%sexpected in \"" expr_str \
+ "\", but %soccurred", \
+ (fail ? " " : " not "), \
+ (test_status.report_found ? \
+ "" : "none ")); \
} \
if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) && \
kasan_sync_fault_possible()) { \
@@ -141,6 +147,34 @@ static void kasan_test_exit(struct kunit *test)
WRITE_ONCE(test_status.async_fault, false); \
} while (0)
+/*
+ * KUNIT_EXPECT_KASAN_FAIL - check that the executed expression produces a
+ * KASAN report; causes a KUnit test failure otherwise.
+ *
+ * @test: Currently executing KUnit test.
+ * @expr: Expression that must produce a KASAN report.
+ */
+#define KUNIT_EXPECT_KASAN_FAIL(test, expr) \
+ KUNIT_EXPECT_KASAN_RESULT(test, expr, #expr, true)
+
+/*
+ * KUNIT_EXPECT_KASAN_FAIL_READ - check that the executed expression
+ * produces a KASAN report when the write-only mode is not enabled;
+ * causes a KUnit test failure otherwise.
+ *
+ * Note: At the moment, this macro does not check whether the produced
+ * KASAN report is a report about a bad read access. It is only intended
+ * for checking the write-only KASAN mode functionality without failing
+ * KASAN tests.
+ *
+ * @test: Currently executing KUnit test.
+ * @expr: Expression that must only produce a KASAN report
+ * when the write-only mode is not enabled.
+ */
+#define KUNIT_EXPECT_KASAN_FAIL_READ(test, expr) \
+ KUNIT_EXPECT_KASAN_RESULT(test, expr, #expr, \
+ !kasan_write_only_enabled()) \
+
#define KASAN_TEST_NEEDS_CONFIG_ON(test, config) do { \
if (!IS_ENABLED(config)) \
kunit_skip((test), "Test requires " #config "=y"); \
@@ -183,8 +217,8 @@ static void kmalloc_oob_right(struct kunit *test)
KUNIT_EXPECT_KASAN_FAIL(test, ptr[size + 5] = 'y');
/* Out-of-bounds access past the aligned kmalloc object. */
- KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] =
- ptr[size + KASAN_GRANULE_SIZE + 5]);
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, ptr[0] =
+ ptr[size + KASAN_GRANULE_SIZE + 5]);
kfree(ptr);
}
@@ -198,7 +232,7 @@ static void kmalloc_oob_left(struct kunit *test)
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
OPTIMIZER_HIDE_VAR(ptr);
- KUNIT_EXPECT_KASAN_FAIL(test, *ptr = *(ptr - 1));
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, *ptr = *(ptr - 1));
kfree(ptr);
}
@@ -211,7 +245,7 @@ static void kmalloc_node_oob_right(struct kunit *test)
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
OPTIMIZER_HIDE_VAR(ptr);
- KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = ptr[size]);
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, ptr[0] = ptr[size]);
kfree(ptr);
}
@@ -291,7 +325,7 @@ static void kmalloc_large_uaf(struct kunit *test)
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
kfree(ptr);
- KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]);
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[0]);
}
static void kmalloc_large_invalid_free(struct kunit *test)
@@ -323,7 +357,7 @@ static void page_alloc_oob_right(struct kunit *test)
ptr = page_address(pages);
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
- KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = ptr[size]);
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, ptr[0] = ptr[size]);
free_pages((unsigned long)ptr, order);
}
@@ -338,7 +372,7 @@ static void page_alloc_uaf(struct kunit *test)
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
free_pages((unsigned long)ptr, order);
- KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]);
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[0]);
}
static void krealloc_more_oob_helper(struct kunit *test,
@@ -458,7 +492,7 @@ static void krealloc_uaf(struct kunit *test)
KUNIT_EXPECT_KASAN_FAIL(test, ptr2 = krealloc(ptr1, size2, GFP_KERNEL));
KUNIT_ASSERT_NULL(test, ptr2);
- KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)ptr1);
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, *(volatile char *)ptr1);
}
static void kmalloc_oob_16(struct kunit *test)
@@ -501,7 +535,7 @@ static void kmalloc_uaf_16(struct kunit *test)
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
kfree(ptr2);
- KUNIT_EXPECT_KASAN_FAIL(test, *ptr1 = *ptr2);
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, *ptr1 = *ptr2);
kfree(ptr1);
}
@@ -640,8 +674,8 @@ static void kmalloc_memmove_invalid_size(struct kunit *test)
memset((char *)ptr, 0, 64);
OPTIMIZER_HIDE_VAR(ptr);
OPTIMIZER_HIDE_VAR(invalid_size);
- KUNIT_EXPECT_KASAN_FAIL(test,
- memmove((char *)ptr, (char *)ptr + 4, invalid_size));
+ KUNIT_EXPECT_KASAN_FAIL_READ(test,
+ memmove((char *)ptr, (char *)ptr + 4, invalid_size));
kfree(ptr);
}
@@ -654,7 +688,7 @@ static void kmalloc_uaf(struct kunit *test)
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
kfree(ptr);
- KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[8]);
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[8]);
}
static void kmalloc_uaf_memset(struct kunit *test)
@@ -701,7 +735,7 @@ static void kmalloc_uaf2(struct kunit *test)
goto again;
}
- KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr1)[40]);
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr1)[40]);
KUNIT_EXPECT_PTR_NE(test, ptr1, ptr2);
kfree(ptr2);
@@ -727,19 +761,19 @@ static void kmalloc_uaf3(struct kunit *test)
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
kfree(ptr2);
- KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr1)[8]);
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr1)[8]);
}
static void kasan_atomics_helper(struct kunit *test, void *unsafe, void *safe)
{
int *i_unsafe = unsafe;
- KUNIT_EXPECT_KASAN_FAIL(test, READ_ONCE(*i_unsafe));
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, READ_ONCE(*i_unsafe));
KUNIT_EXPECT_KASAN_FAIL(test, WRITE_ONCE(*i_unsafe, 42));
- KUNIT_EXPECT_KASAN_FAIL(test, smp_load_acquire(i_unsafe));
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, smp_load_acquire(i_unsafe));
KUNIT_EXPECT_KASAN_FAIL(test, smp_store_release(i_unsafe, 42));
- KUNIT_EXPECT_KASAN_FAIL(test, atomic_read(unsafe));
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, atomic_read(unsafe));
KUNIT_EXPECT_KASAN_FAIL(test, atomic_set(unsafe, 42));
KUNIT_EXPECT_KASAN_FAIL(test, atomic_add(42, unsafe));
KUNIT_EXPECT_KASAN_FAIL(test, atomic_sub(42, unsafe));
@@ -752,18 +786,31 @@ static void kasan_atomics_helper(struct kunit *test, void *unsafe, void *safe)
KUNIT_EXPECT_KASAN_FAIL(test, atomic_xchg(unsafe, 42));
KUNIT_EXPECT_KASAN_FAIL(test, atomic_cmpxchg(unsafe, 21, 42));
KUNIT_EXPECT_KASAN_FAIL(test, atomic_try_cmpxchg(unsafe, safe, 42));
- KUNIT_EXPECT_KASAN_FAIL(test, atomic_try_cmpxchg(safe, unsafe, 42));
+ /*
+ * The result of the test below may vary due to garbage values of
+ * unsafe in write-only mode.
+ * Therefore, skip this test when KASAN is configured in write-only mode.
+ */
+ if (!kasan_write_only_enabled())
+ KUNIT_EXPECT_KASAN_FAIL(test, atomic_try_cmpxchg(safe, unsafe, 42));
KUNIT_EXPECT_KASAN_FAIL(test, atomic_sub_and_test(42, unsafe));
KUNIT_EXPECT_KASAN_FAIL(test, atomic_dec_and_test(unsafe));
KUNIT_EXPECT_KASAN_FAIL(test, atomic_inc_and_test(unsafe));
KUNIT_EXPECT_KASAN_FAIL(test, atomic_add_negative(42, unsafe));
- KUNIT_EXPECT_KASAN_FAIL(test, atomic_add_unless(unsafe, 21, 42));
- KUNIT_EXPECT_KASAN_FAIL(test, atomic_inc_not_zero(unsafe));
- KUNIT_EXPECT_KASAN_FAIL(test, atomic_inc_unless_negative(unsafe));
- KUNIT_EXPECT_KASAN_FAIL(test, atomic_dec_unless_positive(unsafe));
- KUNIT_EXPECT_KASAN_FAIL(test, atomic_dec_if_positive(unsafe));
+ /*
+ * The result of the test below may vary due to garbage values of
+ * unsafe in write-only mode.
+ * Therefore, skip this test when KASAN is configured in write-only mode.
+ */
+ if (!kasan_write_only_enabled()) {
+ KUNIT_EXPECT_KASAN_FAIL(test, atomic_add_unless(unsafe, 21, 42));
+ KUNIT_EXPECT_KASAN_FAIL(test, atomic_inc_not_zero(unsafe));
+ KUNIT_EXPECT_KASAN_FAIL(test, atomic_inc_unless_negative(unsafe));
+ KUNIT_EXPECT_KASAN_FAIL(test, atomic_dec_unless_positive(unsafe));
+ KUNIT_EXPECT_KASAN_FAIL(test, atomic_dec_if_positive(unsafe));
+ }
- KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_read(unsafe));
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, atomic_long_read(unsafe));
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_set(unsafe, 42));
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_add(42, unsafe));
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_sub(42, unsafe));
@@ -776,16 +823,29 @@ static void kasan_atomics_helper(struct kunit *test, void *unsafe, void *safe)
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_xchg(unsafe, 42));
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_cmpxchg(unsafe, 21, 42));
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_try_cmpxchg(unsafe, safe, 42));
- KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_try_cmpxchg(safe, unsafe, 42));
+ /*
+ * The result of the test below may vary due to garbage values of
+ * unsafe in write-only mode.
+ * Therefore, skip this test when KASAN is configured in write-only mode.
+ */
+ if (!kasan_write_only_enabled())
+ KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_try_cmpxchg(safe, unsafe, 42));
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_sub_and_test(42, unsafe));
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_dec_and_test(unsafe));
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_inc_and_test(unsafe));
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_add_negative(42, unsafe));
- KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_add_unless(unsafe, 21, 42));
- KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_inc_not_zero(unsafe));
- KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_inc_unless_negative(unsafe));
- KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_dec_unless_positive(unsafe));
- KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_dec_if_positive(unsafe));
+ /*
+ * The result of the test below may vary due to garbage values of
+ * unsafe in write-only mode.
+ * Therefore, skip this test when KASAN is configured in write-only mode.
+ */
+ if (!kasan_write_only_enabled()) {
+ KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_add_unless(unsafe, 21, 42));
+ KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_inc_not_zero(unsafe));
+ KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_inc_unless_negative(unsafe));
+ KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_dec_unless_positive(unsafe));
+ KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_dec_if_positive(unsafe));
+ }
}
static void kasan_atomics(struct kunit *test)
@@ -842,8 +902,8 @@ static void ksize_unpoisons_memory(struct kunit *test)
/* These must trigger a KASAN report. */
if (IS_ENABLED(CONFIG_KASAN_GENERIC))
KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size]);
- KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size + 5]);
- KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[real_size - 1]);
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[size + 5]);
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[real_size - 1]);
kfree(ptr);
}
@@ -863,8 +923,8 @@ static void ksize_uaf(struct kunit *test)
OPTIMIZER_HIDE_VAR(ptr);
KUNIT_EXPECT_KASAN_FAIL(test, ksize(ptr));
- KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]);
- KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size]);
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[0]);
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[size]);
}
/*
@@ -899,9 +959,9 @@ static void rcu_uaf(struct kunit *test)
global_rcu_ptr = rcu_dereference_protected(
(struct kasan_rcu_info __rcu *)ptr, NULL);
- KUNIT_EXPECT_KASAN_FAIL(test,
- call_rcu(&global_rcu_ptr->rcu, rcu_uaf_reclaim);
- rcu_barrier());
+ KUNIT_EXPECT_KASAN_FAIL_READ(test,
+ call_rcu(&global_rcu_ptr->rcu, rcu_uaf_reclaim);
+ rcu_barrier());
}
static void workqueue_uaf_work(struct work_struct *work)
@@ -924,8 +984,8 @@ static void workqueue_uaf(struct kunit *test)
queue_work(workqueue, work);
destroy_workqueue(workqueue);
- KUNIT_EXPECT_KASAN_FAIL(test,
- ((volatile struct work_struct *)work)->data);
+ KUNIT_EXPECT_KASAN_FAIL_READ(test,
+ ((volatile struct work_struct *)work)->data);
}
static void kfree_via_page(struct kunit *test)
@@ -972,7 +1032,7 @@ static void kmem_cache_oob(struct kunit *test)
return;
}
- KUNIT_EXPECT_KASAN_FAIL(test, *p = p[size + OOB_TAG_OFF]);
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, *p = p[size + OOB_TAG_OFF]);
kmem_cache_free(cache, p);
kmem_cache_destroy(cache);
@@ -1068,7 +1128,7 @@ static void kmem_cache_rcu_uaf(struct kunit *test)
*/
rcu_barrier();
- KUNIT_EXPECT_KASAN_FAIL(test, READ_ONCE(*p));
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, READ_ONCE(*p));
kmem_cache_destroy(cache);
}
@@ -1207,7 +1267,7 @@ static void mempool_oob_right_helper(struct kunit *test, mempool_t *pool, size_t
KUNIT_EXPECT_KASAN_FAIL(test,
((volatile char *)&elem[size])[0]);
else
- KUNIT_EXPECT_KASAN_FAIL(test,
+ KUNIT_EXPECT_KASAN_FAIL_READ(test,
((volatile char *)&elem[round_up(size, KASAN_GRANULE_SIZE)])[0]);
mempool_free(elem, pool);
@@ -1273,7 +1333,7 @@ static void mempool_uaf_helper(struct kunit *test, mempool_t *pool, bool page)
mempool_free(elem, pool);
ptr = page ? page_address((struct page *)elem) : elem;
- KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]);
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[0]);
}
static void mempool_kmalloc_uaf(struct kunit *test)
@@ -1532,7 +1592,7 @@ static void kasan_memchr(struct kunit *test)
OPTIMIZER_HIDE_VAR(ptr);
OPTIMIZER_HIDE_VAR(size);
- KUNIT_EXPECT_KASAN_FAIL(test,
+ KUNIT_EXPECT_KASAN_FAIL_READ(test,
kasan_ptr_result = memchr(ptr, '1', size + 1));
kfree(ptr);
@@ -1559,7 +1619,7 @@ static void kasan_memcmp(struct kunit *test)
OPTIMIZER_HIDE_VAR(ptr);
OPTIMIZER_HIDE_VAR(size);
- KUNIT_EXPECT_KASAN_FAIL(test,
+ KUNIT_EXPECT_KASAN_FAIL_READ(test,
kasan_int_result = memcmp(ptr, arr, size+1));
kfree(ptr);
}
@@ -1594,7 +1654,7 @@ static void kasan_strings(struct kunit *test)
strscpy(ptr, src + 1, KASAN_GRANULE_SIZE));
/* strscpy should fail if the first byte is unreadable. */
- KUNIT_EXPECT_KASAN_FAIL(test, strscpy(ptr, src + KASAN_GRANULE_SIZE,
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, strscpy(ptr, src + KASAN_GRANULE_SIZE,
KASAN_GRANULE_SIZE));
kfree(src);
@@ -1607,17 +1667,17 @@ static void kasan_strings(struct kunit *test)
* will likely point to zeroed byte.
*/
ptr += 16;
- KUNIT_EXPECT_KASAN_FAIL(test, kasan_ptr_result = strchr(ptr, '1'));
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_ptr_result = strchr(ptr, '1'));
- KUNIT_EXPECT_KASAN_FAIL(test, kasan_ptr_result = strrchr(ptr, '1'));
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_ptr_result = strrchr(ptr, '1'));
- KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strcmp(ptr, "2"));
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_int_result = strcmp(ptr, "2"));
- KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strncmp(ptr, "2", 1));
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_int_result = strncmp(ptr, "2", 1));
- KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strlen(ptr));
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_int_result = strlen(ptr));
- KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strnlen(ptr, 1));
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_int_result = strnlen(ptr, 1));
}
static void kasan_bitops_modify(struct kunit *test, int nr, void *addr)
@@ -1636,12 +1696,18 @@ static void kasan_bitops_test_and_modify(struct kunit *test, int nr, void *addr)
{
KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit(nr, addr));
KUNIT_EXPECT_KASAN_FAIL(test, __test_and_set_bit(nr, addr));
- KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit_lock(nr, addr));
+ /*
+ * When KASAN is running in write-only mode,
+ * a fault won't occur when the bit is set.
+ * Therefore, skip the test_and_set_bit_lock test in write-only mode.
+ */
+ if (!kasan_write_only_enabled())
+ KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit_lock(nr, addr));
KUNIT_EXPECT_KASAN_FAIL(test, test_and_clear_bit(nr, addr));
KUNIT_EXPECT_KASAN_FAIL(test, __test_and_clear_bit(nr, addr));
KUNIT_EXPECT_KASAN_FAIL(test, test_and_change_bit(nr, addr));
KUNIT_EXPECT_KASAN_FAIL(test, __test_and_change_bit(nr, addr));
- KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = test_bit(nr, addr));
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_int_result = test_bit(nr, addr));
if (nr < 7)
KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result =
xor_unlock_is_negative_byte(1 << nr, addr));
@@ -1765,7 +1831,7 @@ static void vmalloc_oob(struct kunit *test)
KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)v_ptr)[size]);
/* An aligned access into the first out-of-bounds granule. */
- KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)v_ptr)[size + 5]);
+ KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)v_ptr)[size + 5]);
/* Check that in-bounds accesses to the physical page are valid. */
page = vmalloc_to_page(v_ptr);
@@ -2042,15 +2108,15 @@ static void copy_user_test_oob(struct kunit *test)
KUNIT_EXPECT_KASAN_FAIL(test,
unused = copy_from_user(kmem, usermem, size + 1));
- KUNIT_EXPECT_KASAN_FAIL(test,
+ KUNIT_EXPECT_KASAN_FAIL_READ(test,
unused = copy_to_user(usermem, kmem, size + 1));
KUNIT_EXPECT_KASAN_FAIL(test,
unused = __copy_from_user(kmem, usermem, size + 1));
- KUNIT_EXPECT_KASAN_FAIL(test,
+ KUNIT_EXPECT_KASAN_FAIL_READ(test,
unused = __copy_to_user(usermem, kmem, size + 1));
KUNIT_EXPECT_KASAN_FAIL(test,
unused = __copy_from_user_inatomic(kmem, usermem, size + 1));
- KUNIT_EXPECT_KASAN_FAIL(test,
+ KUNIT_EXPECT_KASAN_FAIL_READ(test,
unused = __copy_to_user_inatomic(usermem, kmem, size + 1));
/*
--
LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH v6 1/2] kasan/hw-tags: introduce kasan.write_only option
2025-09-01 10:46 ` [PATCH v6 1/2] kasan/hw-tags: introduce kasan.write_only option Yeoreum Yun
@ 2025-09-01 16:53 ` Catalin Marinas
2025-09-01 19:23 ` Andrew Morton
1 sibling, 0 replies; 7+ messages in thread
From: Catalin Marinas @ 2025-09-01 16:53 UTC (permalink / raw)
To: Yeoreum Yun
Cc: ryabinin.a.a, glider, andreyknvl, dvyukov, vincenzo.frascino,
corbet, will, akpm, scott, jhubbard, pankaj.gupta, leitao,
kaleshsingh, maz, broonie, oliver.upton, james.morse, ardb,
hardevsinh.palaniya, david, yang, kasan-dev, workflows, linux-doc,
linux-kernel, linux-arm-kernel, linux-mm
On Mon, Sep 01, 2025 at 11:46:22AM +0100, Yeoreum Yun wrote:
> Since Armv8.9, FEATURE_MTE_STORE_ONLY feature is introduced to restrict
> raise of tag check fault on store operation only.
> Introcude KASAN write only mode based on this feature.
>
> KASAN write only mode restricts KASAN checks operation for write only and
> omits the checks for fetch/read operations when accessing memory.
> So it might be used not only debugging enviroment but also normal
> enviroment to check memory safty.
>
> This features can be controlled with "kasan.write_only" arguments.
> When "kasan.write_only=on", KASAN checks write operation only otherwise
> KASAN checks all operations.
>
> This changes the MTE_STORE_ONLY feature as BOOT_CPU_FEATURE like
> ARM64_MTE_ASYMM so that makes it initialise in kasan_init_hw_tags()
> with other function together.
>
> Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
> Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v6 1/2] kasan/hw-tags: introduce kasan.write_only option
2025-09-01 10:46 ` [PATCH v6 1/2] kasan/hw-tags: introduce kasan.write_only option Yeoreum Yun
2025-09-01 16:53 ` Catalin Marinas
@ 2025-09-01 19:23 ` Andrew Morton
2025-09-01 20:31 ` Yeoreum Yun
1 sibling, 1 reply; 7+ messages in thread
From: Andrew Morton @ 2025-09-01 19:23 UTC (permalink / raw)
To: Yeoreum Yun
Cc: ryabinin.a.a, glider, andreyknvl, dvyukov, vincenzo.frascino,
corbet, catalin.marinas, will, scott, jhubbard, pankaj.gupta,
leitao, kaleshsingh, maz, broonie, oliver.upton, james.morse,
ardb, hardevsinh.palaniya, david, yang, kasan-dev, workflows,
linux-doc, linux-kernel, linux-arm-kernel, linux-mm
On Mon, 1 Sep 2025 11:46:22 +0100 Yeoreum Yun <yeoreum.yun@arm.com> wrote:
> Since Armv8.9, FEATURE_MTE_STORE_ONLY feature is introduced to restrict
> raise of tag check fault on store operation only.
> Introcude KASAN write only mode based on this feature.
>
> KASAN write only mode restricts KASAN checks operation for write only and
> omits the checks for fetch/read operations when accessing memory.
> So it might be used not only debugging enviroment but also normal
> enviroment to check memory safty.
>
> This features can be controlled with "kasan.write_only" arguments.
> When "kasan.write_only=on", KASAN checks write operation only otherwise
> KASAN checks all operations.
>
> This changes the MTE_STORE_ONLY feature as BOOT_CPU_FEATURE like
> ARM64_MTE_ASYMM so that makes it initialise in kasan_init_hw_tags()
> with other function together.
>
> ...
>
>
> - pr_info("KernelAddressSanitizer initialized (hw-tags, mode=%s, vmalloc=%s, stacktrace=%s)\n",
> + pr_info("KernelAddressSanitizer initialized (hw-tags, mode=%s, vmalloc=%s, stacktrace=%s, write_only=%s\n",
> kasan_mode_info(),
This lost the closing ")" in the printk control string. I fixed that
up while resolving rejects.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v6 1/2] kasan/hw-tags: introduce kasan.write_only option
2025-09-01 19:23 ` Andrew Morton
@ 2025-09-01 20:31 ` Yeoreum Yun
0 siblings, 0 replies; 7+ messages in thread
From: Yeoreum Yun @ 2025-09-01 20:31 UTC (permalink / raw)
To: Andrew Morton
Cc: ryabinin.a.a, glider, andreyknvl, dvyukov, vincenzo.frascino,
corbet, catalin.marinas, will, scott, jhubbard, pankaj.gupta,
leitao, kaleshsingh, maz, broonie, oliver.upton, james.morse,
ardb, hardevsinh.palaniya, david, yang, kasan-dev, workflows,
linux-doc, linux-kernel, linux-arm-kernel, linux-mm
> On Mon, 1 Sep 2025 11:46:22 +0100 Yeoreum Yun <yeoreum.yun@arm.com> wrote:
>
> > Since Armv8.9, FEATURE_MTE_STORE_ONLY feature is introduced to restrict
> > raise of tag check fault on store operation only.
> > Introcude KASAN write only mode based on this feature.
> >
> > KASAN write only mode restricts KASAN checks operation for write only and
> > omits the checks for fetch/read operations when accessing memory.
> > So it might be used not only debugging enviroment but also normal
> > enviroment to check memory safty.
> >
> > This features can be controlled with "kasan.write_only" arguments.
> > When "kasan.write_only=on", KASAN checks write operation only otherwise
> > KASAN checks all operations.
> >
> > This changes the MTE_STORE_ONLY feature as BOOT_CPU_FEATURE like
> > ARM64_MTE_ASYMM so that makes it initialise in kasan_init_hw_tags()
> > with other function together.
> >
> > ...
> >
> >
> > - pr_info("KernelAddressSanitizer initialized (hw-tags, mode=%s, vmalloc=%s, stacktrace=%s)\n",
> > + pr_info("KernelAddressSanitizer initialized (hw-tags, mode=%s, vmalloc=%s, stacktrace=%s, write_only=%s\n",
> > kasan_mode_info(),
>
> This lost the closing ")" in the printk control string. I fixed that
> up while resolving rejects.
Oops.. Thanks and Sorry for my mistake :( ...
--
Sincerely,
Yeoreum Yun
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v6 2/2] kasan: apply write-only mode in kasan kunit testcases
2025-09-01 10:46 ` [PATCH v6 2/2] kasan: apply write-only mode in kasan kunit testcases Yeoreum Yun
@ 2025-09-03 12:49 ` Andrey Konovalov
0 siblings, 0 replies; 7+ messages in thread
From: Andrey Konovalov @ 2025-09-03 12:49 UTC (permalink / raw)
To: Yeoreum Yun
Cc: ryabinin.a.a, glider, dvyukov, vincenzo.frascino, corbet,
catalin.marinas, will, akpm, scott, jhubbard, pankaj.gupta,
leitao, kaleshsingh, maz, broonie, oliver.upton, james.morse,
ardb, hardevsinh.palaniya, david, yang, kasan-dev, workflows,
linux-doc, linux-kernel, linux-arm-kernel, linux-mm
On Mon, Sep 1, 2025 at 12:46 PM Yeoreum Yun <yeoreum.yun@arm.com> wrote:
>
> When KASAN is configured in write-only mode,
> fetch/load operations do not trigger tag check faults.
>
> As a result, the outcome of some test cases may differ
> compared to when KASAN is configured without write-only mode.
>
> Therefore, by modifying pre-exist testcases
> check the write only makes tag check fault (TCF) where
> writing is perform in "allocated memory" but tag is invalid
> (i.e) redzone write in atomic_set() testcases.
> Otherwise check the invalid fetch/read doesn't generate TCF.
>
> Also, skip some testcases affected by initial value
> (i.e) atomic_cmpxchg() testcase maybe successd if
> it passes valid atomic_t address and invalid oldaval address.
> In this case, if invalid atomic_t doesn't have the same oldval,
> it won't trigger write operation so the test will pass.
>
> Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
> ---
> mm/kasan/kasan_test_c.c | 204 ++++++++++++++++++++++++++--------------
> 1 file changed, 135 insertions(+), 69 deletions(-)
>
> diff --git a/mm/kasan/kasan_test_c.c b/mm/kasan/kasan_test_c.c
> index e0968acc03aa..8b3bb33603e1 100644
> --- a/mm/kasan/kasan_test_c.c
> +++ b/mm/kasan/kasan_test_c.c
> @@ -94,11 +94,13 @@ static void kasan_test_exit(struct kunit *test)
> }
>
> /**
> - * KUNIT_EXPECT_KASAN_FAIL - check that the executed expression produces a
> - * KASAN report; causes a KUnit test failure otherwise.
> + * KUNIT_EXPECT_KASAN_RESULT - check that the executed expression
> + * causes a KUnit test failure when the result is different from @fail.
What I meant here was:
KUNIT_EXPECT_KASAN_RESULT - checks whether the executed expression
produces a KASAN report; causes a KUnit test failure when the result
is different from @fail.
> *
> * @test: Currently executing KUnit test.
> - * @expression: Expression that must produce a KASAN report.
> + * @expr: Expression to be tested.
> + * @expr_str: Expression to be tested encoded as a string.
> + * @fail: Whether expression should produce a KASAN report.
> *
> * For hardware tag-based KASAN, when a synchronous tag fault happens, tag
> * checking is auto-disabled. When this happens, this test handler reenables
> @@ -110,25 +112,29 @@ static void kasan_test_exit(struct kunit *test)
> * Use READ/WRITE_ONCE() for the accesses and compiler barriers around the
> * expression to prevent that.
> *
> - * In between KUNIT_EXPECT_KASAN_FAIL checks, test_status.report_found is kept
> + * In between KUNIT_EXPECT_KASAN_RESULT checks, test_status.report_found is kept
> * as false. This allows detecting KASAN reports that happen outside of the
> * checks by asserting !test_status.report_found at the start of
> - * KUNIT_EXPECT_KASAN_FAIL and in kasan_test_exit.
> + * KUNIT_EXPECT_KASAN_RESULT and in kasan_test_exit.
> */
> -#define KUNIT_EXPECT_KASAN_FAIL(test, expression) do { \
> +#define KUNIT_EXPECT_KASAN_RESULT(test, expr, expr_str, fail) \
> +do { \
> if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) && \
> kasan_sync_fault_possible()) \
> migrate_disable(); \
> KUNIT_EXPECT_FALSE(test, READ_ONCE(test_status.report_found)); \
> barrier(); \
> - expression; \
> + expr; \
> barrier(); \
> if (kasan_async_fault_possible()) \
> kasan_force_async_fault(); \
> - if (!READ_ONCE(test_status.report_found)) { \
> - KUNIT_FAIL(test, KUNIT_SUBTEST_INDENT "KASAN failure " \
> - "expected in \"" #expression \
> - "\", but none occurred"); \
> + if (READ_ONCE(test_status.report_found) != fail) { \
> + KUNIT_FAIL(test, KUNIT_SUBTEST_INDENT "KASAN failure" \
> + "%sexpected in \"" expr_str \
> + "\", but %soccurred", \
> + (fail ? " " : " not "), \
> + (test_status.report_found ? \
> + "" : "none ")); \
> } \
> if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) && \
> kasan_sync_fault_possible()) { \
> @@ -141,6 +147,34 @@ static void kasan_test_exit(struct kunit *test)
> WRITE_ONCE(test_status.async_fault, false); \
> } while (0)
>
> +/*
> + * KUNIT_EXPECT_KASAN_FAIL - check that the executed expression produces a
> + * KASAN report; causes a KUnit test failure otherwise.
> + *
> + * @test: Currently executing KUnit test.
> + * @expr: Expression that must produce a KASAN report.
> + */
> +#define KUNIT_EXPECT_KASAN_FAIL(test, expr) \
> + KUNIT_EXPECT_KASAN_RESULT(test, expr, #expr, true)
> +
> +/*
> + * KUNIT_EXPECT_KASAN_FAIL_READ - check that the executed expression
> + * produces a KASAN report when the write-only mode is not enabled;
> + * causes a KUnit test failure otherwise.
> + *
> + * Note: At the moment, this macro does not check whether the produced
> + * KASAN report is a report about a bad read access. It is only intended
> + * for checking the write-only KASAN mode functionality without failing
> + * KASAN tests.
> + *
> + * @test: Currently executing KUnit test.
> + * @expr: Expression that must only produce a KASAN report
> + * when the write-only mode is not enabled.
> + */
> +#define KUNIT_EXPECT_KASAN_FAIL_READ(test, expr) \
> + KUNIT_EXPECT_KASAN_RESULT(test, expr, #expr, \
> + !kasan_write_only_enabled()) \
> +
> #define KASAN_TEST_NEEDS_CONFIG_ON(test, config) do { \
> if (!IS_ENABLED(config)) \
> kunit_skip((test), "Test requires " #config "=y"); \
> @@ -183,8 +217,8 @@ static void kmalloc_oob_right(struct kunit *test)
> KUNIT_EXPECT_KASAN_FAIL(test, ptr[size + 5] = 'y');
>
> /* Out-of-bounds access past the aligned kmalloc object. */
> - KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] =
> - ptr[size + KASAN_GRANULE_SIZE + 5]);
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, ptr[0] =
> + ptr[size + KASAN_GRANULE_SIZE + 5]);
>
> kfree(ptr);
> }
> @@ -198,7 +232,7 @@ static void kmalloc_oob_left(struct kunit *test)
> KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> OPTIMIZER_HIDE_VAR(ptr);
> - KUNIT_EXPECT_KASAN_FAIL(test, *ptr = *(ptr - 1));
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, *ptr = *(ptr - 1));
> kfree(ptr);
> }
>
> @@ -211,7 +245,7 @@ static void kmalloc_node_oob_right(struct kunit *test)
> KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> OPTIMIZER_HIDE_VAR(ptr);
> - KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = ptr[size]);
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, ptr[0] = ptr[size]);
> kfree(ptr);
> }
>
> @@ -291,7 +325,7 @@ static void kmalloc_large_uaf(struct kunit *test)
> KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> kfree(ptr);
>
> - KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]);
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[0]);
> }
>
> static void kmalloc_large_invalid_free(struct kunit *test)
> @@ -323,7 +357,7 @@ static void page_alloc_oob_right(struct kunit *test)
> ptr = page_address(pages);
> KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> - KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = ptr[size]);
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, ptr[0] = ptr[size]);
> free_pages((unsigned long)ptr, order);
> }
>
> @@ -338,7 +372,7 @@ static void page_alloc_uaf(struct kunit *test)
> KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
> free_pages((unsigned long)ptr, order);
>
> - KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]);
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[0]);
> }
>
> static void krealloc_more_oob_helper(struct kunit *test,
> @@ -458,7 +492,7 @@ static void krealloc_uaf(struct kunit *test)
>
> KUNIT_EXPECT_KASAN_FAIL(test, ptr2 = krealloc(ptr1, size2, GFP_KERNEL));
> KUNIT_ASSERT_NULL(test, ptr2);
> - KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)ptr1);
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, *(volatile char *)ptr1);
> }
>
> static void kmalloc_oob_16(struct kunit *test)
> @@ -501,7 +535,7 @@ static void kmalloc_uaf_16(struct kunit *test)
> KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
> kfree(ptr2);
>
> - KUNIT_EXPECT_KASAN_FAIL(test, *ptr1 = *ptr2);
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, *ptr1 = *ptr2);
> kfree(ptr1);
> }
>
> @@ -640,8 +674,8 @@ static void kmalloc_memmove_invalid_size(struct kunit *test)
> memset((char *)ptr, 0, 64);
> OPTIMIZER_HIDE_VAR(ptr);
> OPTIMIZER_HIDE_VAR(invalid_size);
> - KUNIT_EXPECT_KASAN_FAIL(test,
> - memmove((char *)ptr, (char *)ptr + 4, invalid_size));
> + KUNIT_EXPECT_KASAN_FAIL_READ(test,
> + memmove((char *)ptr, (char *)ptr + 4, invalid_size));
> kfree(ptr);
> }
>
> @@ -654,7 +688,7 @@ static void kmalloc_uaf(struct kunit *test)
> KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
>
> kfree(ptr);
> - KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[8]);
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[8]);
> }
>
> static void kmalloc_uaf_memset(struct kunit *test)
> @@ -701,7 +735,7 @@ static void kmalloc_uaf2(struct kunit *test)
> goto again;
> }
>
> - KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr1)[40]);
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr1)[40]);
> KUNIT_EXPECT_PTR_NE(test, ptr1, ptr2);
>
> kfree(ptr2);
> @@ -727,19 +761,19 @@ static void kmalloc_uaf3(struct kunit *test)
> KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
> kfree(ptr2);
>
> - KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr1)[8]);
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr1)[8]);
> }
>
> static void kasan_atomics_helper(struct kunit *test, void *unsafe, void *safe)
> {
> int *i_unsafe = unsafe;
>
> - KUNIT_EXPECT_KASAN_FAIL(test, READ_ONCE(*i_unsafe));
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, READ_ONCE(*i_unsafe));
> KUNIT_EXPECT_KASAN_FAIL(test, WRITE_ONCE(*i_unsafe, 42));
> - KUNIT_EXPECT_KASAN_FAIL(test, smp_load_acquire(i_unsafe));
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, smp_load_acquire(i_unsafe));
> KUNIT_EXPECT_KASAN_FAIL(test, smp_store_release(i_unsafe, 42));
>
> - KUNIT_EXPECT_KASAN_FAIL(test, atomic_read(unsafe));
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, atomic_read(unsafe));
> KUNIT_EXPECT_KASAN_FAIL(test, atomic_set(unsafe, 42));
> KUNIT_EXPECT_KASAN_FAIL(test, atomic_add(42, unsafe));
> KUNIT_EXPECT_KASAN_FAIL(test, atomic_sub(42, unsafe));
> @@ -752,18 +786,31 @@ static void kasan_atomics_helper(struct kunit *test, void *unsafe, void *safe)
> KUNIT_EXPECT_KASAN_FAIL(test, atomic_xchg(unsafe, 42));
> KUNIT_EXPECT_KASAN_FAIL(test, atomic_cmpxchg(unsafe, 21, 42));
> KUNIT_EXPECT_KASAN_FAIL(test, atomic_try_cmpxchg(unsafe, safe, 42));
> - KUNIT_EXPECT_KASAN_FAIL(test, atomic_try_cmpxchg(safe, unsafe, 42));
> + /*
> + * The result of the test below may vary due to garbage values of
> + * unsafe in write-only mode.
> + * Therefore, skip this test when KASAN is configured in write-only mode.
> + */
> + if (!kasan_write_only_enabled())
> + KUNIT_EXPECT_KASAN_FAIL(test, atomic_try_cmpxchg(safe, unsafe, 42));
> KUNIT_EXPECT_KASAN_FAIL(test, atomic_sub_and_test(42, unsafe));
> KUNIT_EXPECT_KASAN_FAIL(test, atomic_dec_and_test(unsafe));
> KUNIT_EXPECT_KASAN_FAIL(test, atomic_inc_and_test(unsafe));
> KUNIT_EXPECT_KASAN_FAIL(test, atomic_add_negative(42, unsafe));
> - KUNIT_EXPECT_KASAN_FAIL(test, atomic_add_unless(unsafe, 21, 42));
> - KUNIT_EXPECT_KASAN_FAIL(test, atomic_inc_not_zero(unsafe));
> - KUNIT_EXPECT_KASAN_FAIL(test, atomic_inc_unless_negative(unsafe));
> - KUNIT_EXPECT_KASAN_FAIL(test, atomic_dec_unless_positive(unsafe));
> - KUNIT_EXPECT_KASAN_FAIL(test, atomic_dec_if_positive(unsafe));
> + /*
> + * The result of the test below may vary due to garbage values of
> + * unsafe in write-only mode.
> + * Therefore, skip this test when KASAN is configured in write-only mode.
> + */
> + if (!kasan_write_only_enabled()) {
> + KUNIT_EXPECT_KASAN_FAIL(test, atomic_add_unless(unsafe, 21, 42));
> + KUNIT_EXPECT_KASAN_FAIL(test, atomic_inc_not_zero(unsafe));
> + KUNIT_EXPECT_KASAN_FAIL(test, atomic_inc_unless_negative(unsafe));
> + KUNIT_EXPECT_KASAN_FAIL(test, atomic_dec_unless_positive(unsafe));
> + KUNIT_EXPECT_KASAN_FAIL(test, atomic_dec_if_positive(unsafe));
> + }
>
> - KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_read(unsafe));
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, atomic_long_read(unsafe));
> KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_set(unsafe, 42));
> KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_add(42, unsafe));
> KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_sub(42, unsafe));
> @@ -776,16 +823,29 @@ static void kasan_atomics_helper(struct kunit *test, void *unsafe, void *safe)
> KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_xchg(unsafe, 42));
> KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_cmpxchg(unsafe, 21, 42));
> KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_try_cmpxchg(unsafe, safe, 42));
> - KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_try_cmpxchg(safe, unsafe, 42));
> + /*
> + * The result of the test below may vary due to garbage values of
> + * unsafe in write-only mode.
> + * Therefore, skip this test when KASAN is configured in write-only mode.
> + */
> + if (!kasan_write_only_enabled())
> + KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_try_cmpxchg(safe, unsafe, 42));
> KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_sub_and_test(42, unsafe));
> KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_dec_and_test(unsafe));
> KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_inc_and_test(unsafe));
> KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_add_negative(42, unsafe));
> - KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_add_unless(unsafe, 21, 42));
> - KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_inc_not_zero(unsafe));
> - KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_inc_unless_negative(unsafe));
> - KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_dec_unless_positive(unsafe));
> - KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_dec_if_positive(unsafe));
> + /*
> + * The result of the test below may vary due to garbage values of
> + * unsafe in write-only mode.
> + * Therefore, skip this test when KASAN is configured in write-only mode.
> + */
> + if (!kasan_write_only_enabled()) {
> + KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_add_unless(unsafe, 21, 42));
> + KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_inc_not_zero(unsafe));
> + KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_inc_unless_negative(unsafe));
> + KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_dec_unless_positive(unsafe));
> + KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_dec_if_positive(unsafe));
> + }
> }
>
> static void kasan_atomics(struct kunit *test)
> @@ -842,8 +902,8 @@ static void ksize_unpoisons_memory(struct kunit *test)
> /* These must trigger a KASAN report. */
> if (IS_ENABLED(CONFIG_KASAN_GENERIC))
> KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size]);
> - KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size + 5]);
> - KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[real_size - 1]);
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[size + 5]);
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[real_size - 1]);
>
> kfree(ptr);
> }
> @@ -863,8 +923,8 @@ static void ksize_uaf(struct kunit *test)
>
> OPTIMIZER_HIDE_VAR(ptr);
> KUNIT_EXPECT_KASAN_FAIL(test, ksize(ptr));
> - KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]);
> - KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size]);
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[0]);
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[size]);
> }
>
> /*
> @@ -899,9 +959,9 @@ static void rcu_uaf(struct kunit *test)
> global_rcu_ptr = rcu_dereference_protected(
> (struct kasan_rcu_info __rcu *)ptr, NULL);
>
> - KUNIT_EXPECT_KASAN_FAIL(test,
> - call_rcu(&global_rcu_ptr->rcu, rcu_uaf_reclaim);
> - rcu_barrier());
> + KUNIT_EXPECT_KASAN_FAIL_READ(test,
> + call_rcu(&global_rcu_ptr->rcu, rcu_uaf_reclaim);
> + rcu_barrier());
> }
>
> static void workqueue_uaf_work(struct work_struct *work)
> @@ -924,8 +984,8 @@ static void workqueue_uaf(struct kunit *test)
> queue_work(workqueue, work);
> destroy_workqueue(workqueue);
>
> - KUNIT_EXPECT_KASAN_FAIL(test,
> - ((volatile struct work_struct *)work)->data);
> + KUNIT_EXPECT_KASAN_FAIL_READ(test,
> + ((volatile struct work_struct *)work)->data);
> }
>
> static void kfree_via_page(struct kunit *test)
> @@ -972,7 +1032,7 @@ static void kmem_cache_oob(struct kunit *test)
> return;
> }
>
> - KUNIT_EXPECT_KASAN_FAIL(test, *p = p[size + OOB_TAG_OFF]);
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, *p = p[size + OOB_TAG_OFF]);
>
> kmem_cache_free(cache, p);
> kmem_cache_destroy(cache);
> @@ -1068,7 +1128,7 @@ static void kmem_cache_rcu_uaf(struct kunit *test)
> */
> rcu_barrier();
>
> - KUNIT_EXPECT_KASAN_FAIL(test, READ_ONCE(*p));
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, READ_ONCE(*p));
>
> kmem_cache_destroy(cache);
> }
> @@ -1207,7 +1267,7 @@ static void mempool_oob_right_helper(struct kunit *test, mempool_t *pool, size_t
> KUNIT_EXPECT_KASAN_FAIL(test,
> ((volatile char *)&elem[size])[0]);
> else
> - KUNIT_EXPECT_KASAN_FAIL(test,
> + KUNIT_EXPECT_KASAN_FAIL_READ(test,
> ((volatile char *)&elem[round_up(size, KASAN_GRANULE_SIZE)])[0]);
>
> mempool_free(elem, pool);
> @@ -1273,7 +1333,7 @@ static void mempool_uaf_helper(struct kunit *test, mempool_t *pool, bool page)
> mempool_free(elem, pool);
>
> ptr = page ? page_address((struct page *)elem) : elem;
> - KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]);
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[0]);
> }
>
> static void mempool_kmalloc_uaf(struct kunit *test)
> @@ -1532,7 +1592,7 @@ static void kasan_memchr(struct kunit *test)
>
> OPTIMIZER_HIDE_VAR(ptr);
> OPTIMIZER_HIDE_VAR(size);
> - KUNIT_EXPECT_KASAN_FAIL(test,
> + KUNIT_EXPECT_KASAN_FAIL_READ(test,
> kasan_ptr_result = memchr(ptr, '1', size + 1));
>
> kfree(ptr);
> @@ -1559,7 +1619,7 @@ static void kasan_memcmp(struct kunit *test)
>
> OPTIMIZER_HIDE_VAR(ptr);
> OPTIMIZER_HIDE_VAR(size);
> - KUNIT_EXPECT_KASAN_FAIL(test,
> + KUNIT_EXPECT_KASAN_FAIL_READ(test,
> kasan_int_result = memcmp(ptr, arr, size+1));
> kfree(ptr);
> }
> @@ -1594,7 +1654,7 @@ static void kasan_strings(struct kunit *test)
> strscpy(ptr, src + 1, KASAN_GRANULE_SIZE));
>
> /* strscpy should fail if the first byte is unreadable. */
> - KUNIT_EXPECT_KASAN_FAIL(test, strscpy(ptr, src + KASAN_GRANULE_SIZE,
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, strscpy(ptr, src + KASAN_GRANULE_SIZE,
> KASAN_GRANULE_SIZE));
>
> kfree(src);
> @@ -1607,17 +1667,17 @@ static void kasan_strings(struct kunit *test)
> * will likely point to zeroed byte.
> */
> ptr += 16;
> - KUNIT_EXPECT_KASAN_FAIL(test, kasan_ptr_result = strchr(ptr, '1'));
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_ptr_result = strchr(ptr, '1'));
>
> - KUNIT_EXPECT_KASAN_FAIL(test, kasan_ptr_result = strrchr(ptr, '1'));
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_ptr_result = strrchr(ptr, '1'));
>
> - KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strcmp(ptr, "2"));
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_int_result = strcmp(ptr, "2"));
>
> - KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strncmp(ptr, "2", 1));
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_int_result = strncmp(ptr, "2", 1));
>
> - KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strlen(ptr));
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_int_result = strlen(ptr));
>
> - KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strnlen(ptr, 1));
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_int_result = strnlen(ptr, 1));
> }
>
> static void kasan_bitops_modify(struct kunit *test, int nr, void *addr)
> @@ -1636,12 +1696,18 @@ static void kasan_bitops_test_and_modify(struct kunit *test, int nr, void *addr)
> {
> KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit(nr, addr));
> KUNIT_EXPECT_KASAN_FAIL(test, __test_and_set_bit(nr, addr));
> - KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit_lock(nr, addr));
> + /*
> + * When KASAN is running in write-only mode,
> + * a fault won't occur when the bit is set.
> + * Therefore, skip the test_and_set_bit_lock test in write-only mode.
> + */
> + if (!kasan_write_only_enabled())
> + KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit_lock(nr, addr));
> KUNIT_EXPECT_KASAN_FAIL(test, test_and_clear_bit(nr, addr));
> KUNIT_EXPECT_KASAN_FAIL(test, __test_and_clear_bit(nr, addr));
> KUNIT_EXPECT_KASAN_FAIL(test, test_and_change_bit(nr, addr));
> KUNIT_EXPECT_KASAN_FAIL(test, __test_and_change_bit(nr, addr));
> - KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = test_bit(nr, addr));
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_int_result = test_bit(nr, addr));
> if (nr < 7)
> KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result =
> xor_unlock_is_negative_byte(1 << nr, addr));
> @@ -1765,7 +1831,7 @@ static void vmalloc_oob(struct kunit *test)
> KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)v_ptr)[size]);
>
> /* An aligned access into the first out-of-bounds granule. */
> - KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)v_ptr)[size + 5]);
> + KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)v_ptr)[size + 5]);
>
> /* Check that in-bounds accesses to the physical page are valid. */
> page = vmalloc_to_page(v_ptr);
> @@ -2042,15 +2108,15 @@ static void copy_user_test_oob(struct kunit *test)
>
> KUNIT_EXPECT_KASAN_FAIL(test,
> unused = copy_from_user(kmem, usermem, size + 1));
> - KUNIT_EXPECT_KASAN_FAIL(test,
> + KUNIT_EXPECT_KASAN_FAIL_READ(test,
> unused = copy_to_user(usermem, kmem, size + 1));
> KUNIT_EXPECT_KASAN_FAIL(test,
> unused = __copy_from_user(kmem, usermem, size + 1));
> - KUNIT_EXPECT_KASAN_FAIL(test,
> + KUNIT_EXPECT_KASAN_FAIL_READ(test,
> unused = __copy_to_user(usermem, kmem, size + 1));
> KUNIT_EXPECT_KASAN_FAIL(test,
> unused = __copy_from_user_inatomic(kmem, usermem, size + 1));
> - KUNIT_EXPECT_KASAN_FAIL(test,
> + KUNIT_EXPECT_KASAN_FAIL_READ(test,
> unused = __copy_to_user_inatomic(usermem, kmem, size + 1));
>
> /*
> --
> LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}
>
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2025-09-03 15:30 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-09-01 10:46 [PATCH v6 0/2] introduce kasan.write_only option in hw-tags Yeoreum Yun
2025-09-01 10:46 ` [PATCH v6 1/2] kasan/hw-tags: introduce kasan.write_only option Yeoreum Yun
2025-09-01 16:53 ` Catalin Marinas
2025-09-01 19:23 ` Andrew Morton
2025-09-01 20:31 ` Yeoreum Yun
2025-09-01 10:46 ` [PATCH v6 2/2] kasan: apply write-only mode in kasan kunit testcases Yeoreum Yun
2025-09-03 12:49 ` Andrey Konovalov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).