[thirdparty/kernel/linux.git] / lib / slub_kunit.c

// SPDX-License-Identifier: GPL-2.0
#include <kunit/test.h>
#include <kunit/test-bug.h>
#include <linux/mm.h>
#include <linux/slab.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include "../mm/slab.h"

static struct kunit_resource resource;
static int slab_errors;

/*
 * Wrapper function for kmem_cache_create(), which reduces 2 parameters:
 * 'align' and 'ctor', and sets SLAB_SKIP_KFENCE flag to avoid getting an
 * object from kfence pool, where the operation could be caught by both
 * our test and kfence sanity check.
 */
static struct kmem_cache *test_kmem_cache_create(const char *name,
				unsigned int size, slab_flags_t flags)
{
	struct kmem_cache *s = kmem_cache_create(name, size, 0,
					(flags | SLAB_NO_USER_FLAGS), NULL);
	s->flags |= SLAB_SKIP_KFENCE;
	return s;
}

static void test_clobber_zone(struct kunit *test)
{
	struct kmem_cache *s = test_kmem_cache_create("TestSlub_RZ_alloc", 64,
							SLAB_RED_ZONE);
	u8 *p = kmem_cache_alloc(s, GFP_KERNEL);

	kasan_disable_current();
	p[64] = 0x12;

	validate_slab_cache(s);
	KUNIT_EXPECT_EQ(test, 2, slab_errors);

	kasan_enable_current();
	kmem_cache_free(s, p);
	kmem_cache_destroy(s);
}

#ifndef CONFIG_KASAN
static void test_next_pointer(struct kunit *test)
{
	struct kmem_cache *s = test_kmem_cache_create("TestSlub_next_ptr_free",
							64, SLAB_POISON);
	u8 *p = kmem_cache_alloc(s, GFP_KERNEL);
	unsigned long tmp;
	unsigned long *ptr_addr;

	kmem_cache_free(s, p);

	ptr_addr = (unsigned long *)(p + s->offset);
	tmp = *ptr_addr;
	p[s->offset] = 0x12;

	/*
	 * Expecting three errors.
	 * One for the corrupted freechain and the other one for the wrong
	 * count of objects in use. The third error is fixing broken cache.
	 */
	validate_slab_cache(s);
	KUNIT_EXPECT_EQ(test, 3, slab_errors);

	/*
	 * Try to repair corrupted freepointer.
	 * Still expecting two errors. The first for the wrong count
	 * of objects in use.
	 * The second error is for fixing broken cache.
	 */
	*ptr_addr = tmp;
	slab_errors = 0;

	validate_slab_cache(s);
	KUNIT_EXPECT_EQ(test, 2, slab_errors);

	/*
	 * Previous validation repaired the count of objects in use.
	 * Now expecting no error.
	 */
	slab_errors = 0;
	validate_slab_cache(s);
	KUNIT_EXPECT_EQ(test, 0, slab_errors);

	kmem_cache_destroy(s);
}

static void test_first_word(struct kunit *test)
{
	struct kmem_cache *s = test_kmem_cache_create("TestSlub_1th_word_free",
							64, SLAB_POISON);
	u8 *p = kmem_cache_alloc(s, GFP_KERNEL);

	kmem_cache_free(s, p);
	*p = 0x78;

	validate_slab_cache(s);
	KUNIT_EXPECT_EQ(test, 2, slab_errors);

	kmem_cache_destroy(s);
}

static void test_clobber_50th_byte(struct kunit *test)
{
	struct kmem_cache *s = test_kmem_cache_create("TestSlub_50th_word_free",
							64, SLAB_POISON);
	u8 *p = kmem_cache_alloc(s, GFP_KERNEL);

	kmem_cache_free(s, p);
	p[50] = 0x9a;

	validate_slab_cache(s);
	KUNIT_EXPECT_EQ(test, 2, slab_errors);

	kmem_cache_destroy(s);
}
#endif

static void test_clobber_redzone_free(struct kunit *test)
{
	struct kmem_cache *s = test_kmem_cache_create("TestSlub_RZ_free", 64,
							SLAB_RED_ZONE);
	u8 *p = kmem_cache_alloc(s, GFP_KERNEL);

	kasan_disable_current();
	kmem_cache_free(s, p);
	p[64] = 0xab;

	validate_slab_cache(s);
	KUNIT_EXPECT_EQ(test, 2, slab_errors);

	kasan_enable_current();
	kmem_cache_destroy(s);
}

static void test_kmalloc_redzone_access(struct kunit *test)
{
	struct kmem_cache *s = test_kmem_cache_create("TestSlub_RZ_kmalloc", 32,
				SLAB_KMALLOC|SLAB_STORE_USER|SLAB_RED_ZONE);
	u8 *p = kmalloc_trace(s, GFP_KERNEL, 18);

	kasan_disable_current();

	/* Suppress the -Warray-bounds warning */
	OPTIMIZER_HIDE_VAR(p);
	p[18] = 0xab;
	p[19] = 0xab;

	validate_slab_cache(s);
	KUNIT_EXPECT_EQ(test, 2, slab_errors);

	kasan_enable_current();
	kmem_cache_free(s, p);
	kmem_cache_destroy(s);
}

static int test_init(struct kunit *test)
{
	slab_errors = 0;

	kunit_add_named_resource(test, NULL, NULL, &resource,
					"slab_errors", &slab_errors);
	return 0;
}

static struct kunit_case test_cases[] = {
	KUNIT_CASE(test_clobber_zone),

#ifndef CONFIG_KASAN
	KUNIT_CASE(test_next_pointer),
	KUNIT_CASE(test_first_word),
	KUNIT_CASE(test_clobber_50th_byte),
#endif

	KUNIT_CASE(test_clobber_redzone_free),
	KUNIT_CASE(test_kmalloc_redzone_access),
	{}
};

static struct kunit_suite test_suite = {
	.name = "slub_test",
	.init = test_init,
	.test_cases = test_cases,
};
kunit_test_suite(test_suite);

MODULE_LICENSE("GPL");
Commit	Line	Data
1f9f78b1 OG	1	// SPDX-License-Identifier: GPL-2.0
1f9f78b1 OG	2	#include <kunit/test.h>
909c6475	3	#include <kunit/test-bug.h>
1f9f78b1 OG	4	#include <linux/mm.h>
	5	#include <linux/slab.h>
	6	#include <linux/module.h>
	7	#include <linux/kernel.h>
	8	#include "../mm/slab.h"
	9
	10	static struct kunit_resource resource;
	11	static int slab_errors;
	12
4d9dd4b0 FT	13	/*
	14	* Wrapper function for kmem_cache_create(), which reduces 2 parameters:
	15	* 'align' and 'ctor', and sets SLAB_SKIP_KFENCE flag to avoid getting an
	16	* object from kfence pool, where the operation could be caught by both
	17	* our test and kfence sanity check.
	18	*/
	19	static struct kmem_cache test_kmem_cache_create(const char name,
	20	unsigned int size, slab_flags_t flags)
	21	{
	22	struct kmem_cache *s = kmem_cache_create(name, size, 0,
	23	(flags \| SLAB_NO_USER_FLAGS), NULL);
	24	s->flags \|= SLAB_SKIP_KFENCE;
	25	return s;
	26	}
	27
1f9f78b1 OG	28	static void test_clobber_zone(struct kunit *test)
1f9f78b1 OG	29	{
4d9dd4b0 FT	30	struct kmem_cache *s = test_kmem_cache_create("TestSlub_RZ_alloc", 64,
4d9dd4b0 FT	31	SLAB_RED_ZONE);
1f9f78b1 OG	32	u8 *p = kmem_cache_alloc(s, GFP_KERNEL);
	33
	34	kasan_disable_current();
	35	p[64] = 0x12;
	36
	37	validate_slab_cache(s);
	38	KUNIT_EXPECT_EQ(test, 2, slab_errors);
	39
	40	kasan_enable_current();
	41	kmem_cache_free(s, p);
	42	kmem_cache_destroy(s);
	43	}
	44
	45	#ifndef CONFIG_KASAN
	46	static void test_next_pointer(struct kunit *test)
	47	{
4d9dd4b0 FT	48	struct kmem_cache *s = test_kmem_cache_create("TestSlub_next_ptr_free",
4d9dd4b0 FT	49	64, SLAB_POISON);
1f9f78b1 OG	50	u8 *p = kmem_cache_alloc(s, GFP_KERNEL);
	51	unsigned long tmp;
	52	unsigned long *ptr_addr;
	53
	54	kmem_cache_free(s, p);
	55
	56	ptr_addr = (unsigned long *)(p + s->offset);
	57	tmp = *ptr_addr;
	58	p[s->offset] = 0x12;
	59
	60	/*
	61	* Expecting three errors.
	62	* One for the corrupted freechain and the other one for the wrong
	63	* count of objects in use. The third error is fixing broken cache.
	64	*/
	65	validate_slab_cache(s);
	66	KUNIT_EXPECT_EQ(test, 3, slab_errors);
	67
	68	/*
	69	* Try to repair corrupted freepointer.
	70	* Still expecting two errors. The first for the wrong count
	71	* of objects in use.
	72	* The second error is for fixing broken cache.
	73	*/
	74	*ptr_addr = tmp;
	75	slab_errors = 0;
	76
	77	validate_slab_cache(s);
	78	KUNIT_EXPECT_EQ(test, 2, slab_errors);
	79
	80	/*
	81	* Previous validation repaired the count of objects in use.
	82	* Now expecting no error.
	83	*/
	84	slab_errors = 0;
	85	validate_slab_cache(s);
	86	KUNIT_EXPECT_EQ(test, 0, slab_errors);
	87
	88	kmem_cache_destroy(s);
	89	}
	90
	91	static void test_first_word(struct kunit *test)
	92	{
4d9dd4b0 FT	93	struct kmem_cache *s = test_kmem_cache_create("TestSlub_1th_word_free",
4d9dd4b0 FT	94	64, SLAB_POISON);
1f9f78b1 OG	95	u8 *p = kmem_cache_alloc(s, GFP_KERNEL);
	96
	97	kmem_cache_free(s, p);
	98	*p = 0x78;
	99
	100	validate_slab_cache(s);
	101	KUNIT_EXPECT_EQ(test, 2, slab_errors);
	102
	103	kmem_cache_destroy(s);
	104	}
	105
	106	static void test_clobber_50th_byte(struct kunit *test)
	107	{
4d9dd4b0 FT	108	struct kmem_cache *s = test_kmem_cache_create("TestSlub_50th_word_free",
4d9dd4b0 FT	109	64, SLAB_POISON);
1f9f78b1 OG	110	u8 *p = kmem_cache_alloc(s, GFP_KERNEL);
	111
	112	kmem_cache_free(s, p);
	113	p[50] = 0x9a;
	114
	115	validate_slab_cache(s);
	116	KUNIT_EXPECT_EQ(test, 2, slab_errors);
	117
	118	kmem_cache_destroy(s);
	119	}
	120	#endif
	121
	122	static void test_clobber_redzone_free(struct kunit *test)
	123	{
4d9dd4b0 FT	124	struct kmem_cache *s = test_kmem_cache_create("TestSlub_RZ_free", 64,
4d9dd4b0 FT	125	SLAB_RED_ZONE);
1f9f78b1 OG	126	u8 *p = kmem_cache_alloc(s, GFP_KERNEL);
	127
	128	kasan_disable_current();
	129	kmem_cache_free(s, p);
	130	p[64] = 0xab;
	131
	132	validate_slab_cache(s);
	133	KUNIT_EXPECT_EQ(test, 2, slab_errors);
	134
	135	kasan_enable_current();
	136	kmem_cache_destroy(s);
	137	}
	138
6cd6d33c FT	139	static void test_kmalloc_redzone_access(struct kunit *test)
	140	{
	141	struct kmem_cache *s = test_kmem_cache_create("TestSlub_RZ_kmalloc", 32,
	142	SLAB_KMALLOC\|SLAB_STORE_USER\|SLAB_RED_ZONE);
	143	u8 *p = kmalloc_trace(s, GFP_KERNEL, 18);
	144
	145	kasan_disable_current();
	146
	147	/* Suppress the -Warray-bounds warning */
	148	OPTIMIZER_HIDE_VAR(p);
	149	p[18] = 0xab;
	150	p[19] = 0xab;
	151
	152	validate_slab_cache(s);
	153	KUNIT_EXPECT_EQ(test, 2, slab_errors);
	154
	155	kasan_enable_current();
	156	kmem_cache_free(s, p);
	157	kmem_cache_destroy(s);
	158	}
	159
1f9f78b1 OG	160	static int test_init(struct kunit *test)
	161	{
	162	slab_errors = 0;
	163
	164	kunit_add_named_resource(test, NULL, NULL, &resource,
	165	"slab_errors", &slab_errors);
	166	return 0;
	167	}
	168
	169	static struct kunit_case test_cases[] = {
	170	KUNIT_CASE(test_clobber_zone),
	171
	172	#ifndef CONFIG_KASAN
	173	KUNIT_CASE(test_next_pointer),
	174	KUNIT_CASE(test_first_word),
	175	KUNIT_CASE(test_clobber_50th_byte),
	176	#endif
	177
	178	KUNIT_CASE(test_clobber_redzone_free),
6cd6d33c	179	KUNIT_CASE(test_kmalloc_redzone_access),
1f9f78b1 OG	180	{}
	181	};
	182
	183	static struct kunit_suite test_suite = {
	184	.name = "slub_test",
	185	.init = test_init,
	186	.test_cases = test_cases,
	187	};
	188	kunit_test_suite(test_suite);
	189
	190	MODULE_LICENSE("GPL");