From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on archive.lwn.net X-Spam-Level: X-Spam-Status: No, score=-13.3 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI,SPF_HELO_NONE,SPF_NONE, USER_IN_DEF_DKIM_WL autolearn=unavailable autolearn_force=no version=3.4.2 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by archive.lwn.net (Postfix) with ESMTP id E18B27DD29 for ; Thu, 13 Jun 2019 15:23:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731981AbfFMPXD (ORCPT ); Thu, 13 Jun 2019 11:23:03 -0400 Received: from mail-yw1-f74.google.com ([209.85.161.74]:33216 "EHLO mail-yw1-f74.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731948AbfFMMdn (ORCPT ); Thu, 13 Jun 2019 08:33:43 -0400 Received: by mail-yw1-f74.google.com with SMTP id d135so13523937ywd.0 for ; Thu, 13 Jun 2019 05:33:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=//K/wTWvNMc+RMO2RQcyAERyaT1WE90cBRxP/iyLlLo=; b=fR+1en1evD0MGrGBi3hUWX+CNKyGi7J9sEviw1Qrh0jxu9JAsa0TlayXXqRBmXB9Fu k2segKqgrqoLbWAMcXkua1ePfxiYwoPYYuXRmwn7kYHsiqkpY/FaATe/wa84loPTZKnL /1U01cRNgqqIZfQj/tvJehUN352E2l7VjRnvjVURh3FkVhdjItGp06izb7SKvMawSnE5 89r4ZO7rsEaQdffbAMg+8pLxRfsf0x38X/4YhOZhISUCFyF8Q6i0jNLnSdSqgsw2JzHE YH6jK7PgWG457O8pmeQePXaw8XovBW0hRF6zcirIF1KQOLpC/ckVZC0Tf8wZB3Vu72T+ iRuQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=//K/wTWvNMc+RMO2RQcyAERyaT1WE90cBRxP/iyLlLo=; b=XN/4L7/VEUbk0KMZqLaAG9dH99ez6gZI3CwZXBt6ou9aXyderv8fUI0lDjrEwc8UMC s5Q8BEYQ2NXkUyP2ZazwL0h1xU4yjR5hZ6wmxW9XqWpQmbA1WFHrPqTVjixmO00ZWacY ghMdrCJonu7z5sLbs+oYW8tzLYe7T+ihvnWYD0gq7sG8jvdVezAwW6R5ZVx6+NDtkCAh 38sZlDvH9s+OkZ+kcPYwdHNN+b7QsPvl9B4oQlKHemD02Sjn8LUsKq0OUQ25J8lp0uyc OceZxUhncAdqfABbKT2KtSGohHDQ5dwU+7Lg97brcPbuHlPT03+GLa03w0ZCKuwny4uB mRXA== X-Gm-Message-State: APjAAAVvrjTEISPu09If8s1iS9wCWlufOk2vcvxvJQeeTESleE08Htn4 DSITQCg1H5/y3+n8ihKyvB2IRaHLlw== X-Google-Smtp-Source: APXvYqxjLPfvWXQtpqx7odwmGVSJ6XsWQaBo/pStvqT+sA+KBQ8ee/sHG2SR+y5HkEiU4QWyhwMcKrG+6g== X-Received: by 2002:a25:d708:: with SMTP id o8mr4839586ybg.410.1560429221914; Thu, 13 Jun 2019 05:33:41 -0700 (PDT) Date: Thu, 13 Jun 2019 14:30:26 +0200 In-Reply-To: <20190613123028.179447-1-elver@google.com> Message-Id: <20190613123028.179447-2-elver@google.com> Mime-Version: 1.0 References: <20190613123028.179447-1-elver@google.com> X-Mailer: git-send-email 2.22.0.rc2.383.gf4fbbf30c2-goog Subject: [PATCH v4 1/3] lib/test_kasan: Add bitops tests From: Marco Elver To: peterz@infradead.org, aryabinin@virtuozzo.com, dvyukov@google.com, glider@google.com, andreyknvl@google.com, mark.rutland@arm.com, hpa@zytor.com Cc: corbet@lwn.net, tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, x86@kernel.org, arnd@arndb.de, jpoimboe@redhat.com, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arch@vger.kernel.org, kasan-dev@googlegroups.com, Marco Elver Content-Type: text/plain; charset="UTF-8" Sender: linux-doc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-doc@vger.kernel.org This adds bitops tests to the test_kasan module. In a follow-up patch, support for bitops instrumentation will be added. Signed-off-by: Marco Elver Acked-by: Mark Rutland --- Changes in v4: * Remove "within-bounds" tests. * Allocate sizeof(*bite) + 1, to not actually corrupt other memory in case instrumentation isn't working. * Clarify that accesses operate on whole longs, which causes OOB regardless of the bit accessed beyond the first long in the test. Changes in v3: * Use kzalloc instead of kmalloc. * Use sizeof(*bits). Changes in v2: * Use BITS_PER_LONG. * Use heap allocated memory for test, as newer compilers (correctly) warn on OOB stack access. --- lib/test_kasan.c | 82 ++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 79 insertions(+), 3 deletions(-) diff --git a/lib/test_kasan.c b/lib/test_kasan.c index 7de2702621dc..e76a4711d456 100644 --- a/lib/test_kasan.c +++ b/lib/test_kasan.c @@ -11,16 +11,17 @@ #define pr_fmt(fmt) "kasan test: %s " fmt, __func__ +#include #include +#include #include -#include #include +#include +#include #include #include #include #include -#include -#include /* * Note: test functions are marked noinline so that their names appear in @@ -623,6 +624,80 @@ static noinline void __init kasan_strings(void) strnlen(ptr, 1); } +static noinline void __init kasan_bitops(void) +{ + /* + * Allocate 1 more byte, which causes kzalloc to round up to 16-bytes; + * this way we do not actually corrupt other memory, in case + * instrumentation is not working as intended. + */ + long *bits = kzalloc(sizeof(*bits) + 1, GFP_KERNEL); + if (!bits) + return; + + /* + * Below calls try to access bit within allocated memory; however, the + * below accesses are still out-of-bounds, since bitops are defined to + * operate on the whole long the bit is in. + */ + pr_info("out-of-bounds in set_bit\n"); + set_bit(BITS_PER_LONG, bits); + + pr_info("out-of-bounds in __set_bit\n"); + __set_bit(BITS_PER_LONG, bits); + + pr_info("out-of-bounds in clear_bit\n"); + clear_bit(BITS_PER_LONG, bits); + + pr_info("out-of-bounds in __clear_bit\n"); + __clear_bit(BITS_PER_LONG, bits); + + pr_info("out-of-bounds in clear_bit_unlock\n"); + clear_bit_unlock(BITS_PER_LONG, bits); + + pr_info("out-of-bounds in __clear_bit_unlock\n"); + __clear_bit_unlock(BITS_PER_LONG, bits); + + pr_info("out-of-bounds in change_bit\n"); + change_bit(BITS_PER_LONG, bits); + + pr_info("out-of-bounds in __change_bit\n"); + __change_bit(BITS_PER_LONG, bits); + + /* + * Below calls try to access bit beyond allocated memory. + */ + pr_info("out-of-bounds in test_and_set_bit\n"); + test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits); + + pr_info("out-of-bounds in __test_and_set_bit\n"); + __test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits); + + pr_info("out-of-bounds in test_and_set_bit_lock\n"); + test_and_set_bit_lock(BITS_PER_LONG + BITS_PER_BYTE, bits); + + pr_info("out-of-bounds in test_and_clear_bit\n"); + test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits); + + pr_info("out-of-bounds in __test_and_clear_bit\n"); + __test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits); + + pr_info("out-of-bounds in test_and_change_bit\n"); + test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits); + + pr_info("out-of-bounds in __test_and_change_bit\n"); + __test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits); + + pr_info("out-of-bounds in test_bit\n"); + (void)test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits); + +#if defined(clear_bit_unlock_is_negative_byte) + pr_info("out-of-bounds in clear_bit_unlock_is_negative_byte\n"); + clear_bit_unlock_is_negative_byte(BITS_PER_LONG + BITS_PER_BYTE, bits); +#endif + kfree(bits); +} + static int __init kmalloc_tests_init(void) { /* @@ -664,6 +739,7 @@ static int __init kmalloc_tests_init(void) kasan_memchr(); kasan_memcmp(); kasan_strings(); + kasan_bitops(); kasan_restore_multi_shot(multishot); -- 2.22.0.rc2.383.gf4fbbf30c2-goog