[thirdparty/linux.git] / lib / test_kasan.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 *
 * Copyright (c) 2014 Samsung Electronics Co., Ltd.
 * Author: Andrey Ryabinin <a.ryabinin@samsung.com>
 */

#define pr_fmt(fmt) "kasan test: %s " fmt, __func__

#include <linux/bitops.h>
#include <linux/delay.h>
#include <linux/kasan.h>
#include <linux/kernel.h>
#include <linux/mm.h>
#include <linux/mman.h>
#include <linux/module.h>
#include <linux/printk.h>
#include <linux/slab.h>
#include <linux/string.h>
#include <linux/uaccess.h>
#include <linux/io.h>
#include <linux/vmalloc.h>

#include <asm/page.h>

/*
 * Note: test functions are marked noinline so that their names appear in
 * reports.
 */

static noinline void __init kmalloc_oob_right(void)
{
	char *ptr;
	size_t size = 123;

	pr_info("out-of-bounds to right\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	ptr[size] = 'x';
	kfree(ptr);
}

static noinline void __init kmalloc_oob_left(void)
{
	char *ptr;
	size_t size = 15;

	pr_info("out-of-bounds to left\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	*ptr = *(ptr - 1);
	kfree(ptr);
}

static noinline void __init kmalloc_node_oob_right(void)
{
	char *ptr;
	size_t size = 4096;

	pr_info("kmalloc_node(): out-of-bounds to right\n");
	ptr = kmalloc_node(size, GFP_KERNEL, 0);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	ptr[size] = 0;
	kfree(ptr);
}

#ifdef CONFIG_SLUB
static noinline void __init kmalloc_pagealloc_oob_right(void)
{
	char *ptr;
	size_t size = KMALLOC_MAX_CACHE_SIZE + 10;

	/* Allocate a chunk that does not fit into a SLUB cache to trigger
	 * the page allocator fallback.
	 */
	pr_info("kmalloc pagealloc allocation: out-of-bounds to right\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	ptr[size] = 0;
	kfree(ptr);
}

static noinline void __init kmalloc_pagealloc_uaf(void)
{
	char *ptr;
	size_t size = KMALLOC_MAX_CACHE_SIZE + 10;

	pr_info("kmalloc pagealloc allocation: use-after-free\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	kfree(ptr);
	ptr[0] = 0;
}

static noinline void __init kmalloc_pagealloc_invalid_free(void)
{
	char *ptr;
	size_t size = KMALLOC_MAX_CACHE_SIZE + 10;

	pr_info("kmalloc pagealloc allocation: invalid-free\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	kfree(ptr + 1);
}
#endif

static noinline void __init kmalloc_large_oob_right(void)
{
	char *ptr;
	size_t size = KMALLOC_MAX_CACHE_SIZE - 256;
	/* Allocate a chunk that is large enough, but still fits into a slab
	 * and does not trigger the page allocator fallback in SLUB.
	 */
	pr_info("kmalloc large allocation: out-of-bounds to right\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	ptr[size] = 0;
	kfree(ptr);
}

static noinline void __init kmalloc_oob_krealloc_more(void)
{
	char *ptr1, *ptr2;
	size_t size1 = 17;
	size_t size2 = 19;

	pr_info("out-of-bounds after krealloc more\n");
	ptr1 = kmalloc(size1, GFP_KERNEL);
	ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
	if (!ptr1 || !ptr2) {
		pr_err("Allocation failed\n");
		kfree(ptr1);
		kfree(ptr2);
		return;
	}

	ptr2[size2] = 'x';
	kfree(ptr2);
}

static noinline void __init kmalloc_oob_krealloc_less(void)
{
	char *ptr1, *ptr2;
	size_t size1 = 17;
	size_t size2 = 15;

	pr_info("out-of-bounds after krealloc less\n");
	ptr1 = kmalloc(size1, GFP_KERNEL);
	ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
	if (!ptr1 || !ptr2) {
		pr_err("Allocation failed\n");
		kfree(ptr1);
		return;
	}
	ptr2[size2] = 'x';
	kfree(ptr2);
}

static noinline void __init kmalloc_oob_16(void)
{
	struct {
		u64 words[2];
	} *ptr1, *ptr2;

	pr_info("kmalloc out-of-bounds for 16-bytes access\n");
	ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL);
	ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
	if (!ptr1 || !ptr2) {
		pr_err("Allocation failed\n");
		kfree(ptr1);
		kfree(ptr2);
		return;
	}
	*ptr1 = *ptr2;
	kfree(ptr1);
	kfree(ptr2);
}

static noinline void __init kmalloc_oob_memset_2(void)
{
	char *ptr;
	size_t size = 8;

	pr_info("out-of-bounds in memset2\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	memset(ptr+7, 0, 2);
	kfree(ptr);
}

static noinline void __init kmalloc_oob_memset_4(void)
{
	char *ptr;
	size_t size = 8;

	pr_info("out-of-bounds in memset4\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	memset(ptr+5, 0, 4);
	kfree(ptr);
}


static noinline void __init kmalloc_oob_memset_8(void)
{
	char *ptr;
	size_t size = 8;

	pr_info("out-of-bounds in memset8\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	memset(ptr+1, 0, 8);
	kfree(ptr);
}

static noinline void __init kmalloc_oob_memset_16(void)
{
	char *ptr;
	size_t size = 16;

	pr_info("out-of-bounds in memset16\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	memset(ptr+1, 0, 16);
	kfree(ptr);
}

static noinline void __init kmalloc_oob_in_memset(void)
{
	char *ptr;
	size_t size = 666;

	pr_info("out-of-bounds in memset\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	memset(ptr, 0, size+5);
	kfree(ptr);
}

static noinline void __init kmalloc_memmove_invalid_size(void)
{
	char *ptr;
	size_t size = 64;
	volatile size_t invalid_size = -2;

	pr_info("invalid size in memmove\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	memset((char *)ptr, 0, 64);
	memmove((char *)ptr, (char *)ptr + 4, invalid_size);
	kfree(ptr);
}

static noinline void __init kmalloc_uaf(void)
{
	char *ptr;
	size_t size = 10;

	pr_info("use-after-free\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	kfree(ptr);
	*(ptr + 8) = 'x';
}

static noinline void __init kmalloc_uaf_memset(void)
{
	char *ptr;
	size_t size = 33;

	pr_info("use-after-free in memset\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	kfree(ptr);
	memset(ptr, 0, size);
}

static noinline void __init kmalloc_uaf2(void)
{
	char *ptr1, *ptr2;
	size_t size = 43;

	pr_info("use-after-free after another kmalloc\n");
	ptr1 = kmalloc(size, GFP_KERNEL);
	if (!ptr1) {
		pr_err("Allocation failed\n");
		return;
	}

	kfree(ptr1);
	ptr2 = kmalloc(size, GFP_KERNEL);
	if (!ptr2) {
		pr_err("Allocation failed\n");
		return;
	}

	ptr1[40] = 'x';
	if (ptr1 == ptr2)
		pr_err("Could not detect use-after-free: ptr1 == ptr2\n");
	kfree(ptr2);
}

static noinline void __init kfree_via_page(void)
{
	char *ptr;
	size_t size = 8;
	struct page *page;
	unsigned long offset;

	pr_info("invalid-free false positive (via page)\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	page = virt_to_page(ptr);
	offset = offset_in_page(ptr);
	kfree(page_address(page) + offset);
}

static noinline void __init kfree_via_phys(void)
{
	char *ptr;
	size_t size = 8;
	phys_addr_t phys;

	pr_info("invalid-free false positive (via phys)\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	phys = virt_to_phys(ptr);
	kfree(phys_to_virt(phys));
}

static noinline void __init kmem_cache_oob(void)
{
	char *p;
	size_t size = 200;
	struct kmem_cache *cache = kmem_cache_create("test_cache",
						size, 0,
						0, NULL);
	if (!cache) {
		pr_err("Cache allocation failed\n");
		return;
	}
	pr_info("out-of-bounds in kmem_cache_alloc\n");
	p = kmem_cache_alloc(cache, GFP_KERNEL);
	if (!p) {
		pr_err("Allocation failed\n");
		kmem_cache_destroy(cache);
		return;
	}

	*p = p[size];
	kmem_cache_free(cache, p);
	kmem_cache_destroy(cache);
}

static noinline void __init memcg_accounted_kmem_cache(void)
{
	int i;
	char *p;
	size_t size = 200;
	struct kmem_cache *cache;

	cache = kmem_cache_create("test_cache", size, 0, SLAB_ACCOUNT, NULL);
	if (!cache) {
		pr_err("Cache allocation failed\n");
		return;
	}

	pr_info("allocate memcg accounted object\n");
	/*
	 * Several allocations with a delay to allow for lazy per memcg kmem
	 * cache creation.
	 */
	for (i = 0; i < 5; i++) {
		p = kmem_cache_alloc(cache, GFP_KERNEL);
		if (!p)
			goto free_cache;

		kmem_cache_free(cache, p);
		msleep(100);
	}

free_cache:
	kmem_cache_destroy(cache);
}

static char global_array[10];

static noinline void __init kasan_global_oob(void)
{
	volatile int i = 3;
	char *p = &global_array[ARRAY_SIZE(global_array) + i];

	pr_info("out-of-bounds global variable\n");
	*(volatile char *)p;
}

static noinline void __init kasan_stack_oob(void)
{
	char stack_array[10];
	volatile int i = 0;
	char *p = &stack_array[ARRAY_SIZE(stack_array) + i];

	pr_info("out-of-bounds on stack\n");
	*(volatile char *)p;
}

static noinline void __init ksize_unpoisons_memory(void)
{
	char *ptr;
	size_t size = 123, real_size;

	pr_info("ksize() unpoisons the whole allocated chunk\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}
	real_size = ksize(ptr);
	/* This access doesn't trigger an error. */
	ptr[size] = 'x';
	/* This one does. */
	ptr[real_size] = 'y';
	kfree(ptr);
}

static noinline void __init copy_user_test(void)
{
	char *kmem;
	char __user *usermem;
	size_t size = 10;
	int unused;

	kmem = kmalloc(size, GFP_KERNEL);
	if (!kmem)
		return;

	usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE,
			    PROT_READ | PROT_WRITE | PROT_EXEC,
			    MAP_ANONYMOUS | MAP_PRIVATE, 0);
	if (IS_ERR(usermem)) {
		pr_err("Failed to allocate user memory\n");
		kfree(kmem);
		return;
	}

	pr_info("out-of-bounds in copy_from_user()\n");
	unused = copy_from_user(kmem, usermem, size + 1);

	pr_info("out-of-bounds in copy_to_user()\n");
	unused = copy_to_user(usermem, kmem, size + 1);

	pr_info("out-of-bounds in __copy_from_user()\n");
	unused = __copy_from_user(kmem, usermem, size + 1);

	pr_info("out-of-bounds in __copy_to_user()\n");
	unused = __copy_to_user(usermem, kmem, size + 1);

	pr_info("out-of-bounds in __copy_from_user_inatomic()\n");
	unused = __copy_from_user_inatomic(kmem, usermem, size + 1);

	pr_info("out-of-bounds in __copy_to_user_inatomic()\n");
	unused = __copy_to_user_inatomic(usermem, kmem, size + 1);

	pr_info("out-of-bounds in strncpy_from_user()\n");
	unused = strncpy_from_user(kmem, usermem, size + 1);

	vm_munmap((unsigned long)usermem, PAGE_SIZE);
	kfree(kmem);
}

static noinline void __init kasan_alloca_oob_left(void)
{
	volatile int i = 10;
	char alloca_array[i];
	char *p = alloca_array - 1;

	pr_info("out-of-bounds to left on alloca\n");
	*(volatile char *)p;
}

static noinline void __init kasan_alloca_oob_right(void)
{
	volatile int i = 10;
	char alloca_array[i];
	char *p = alloca_array + i;

	pr_info("out-of-bounds to right on alloca\n");
	*(volatile char *)p;
}

static noinline void __init kmem_cache_double_free(void)
{
	char *p;
	size_t size = 200;
	struct kmem_cache *cache;

	cache = kmem_cache_create("test_cache", size, 0, 0, NULL);
	if (!cache) {
		pr_err("Cache allocation failed\n");
		return;
	}
	pr_info("double-free on heap object\n");
	p = kmem_cache_alloc(cache, GFP_KERNEL);
	if (!p) {
		pr_err("Allocation failed\n");
		kmem_cache_destroy(cache);
		return;
	}

	kmem_cache_free(cache, p);
	kmem_cache_free(cache, p);
	kmem_cache_destroy(cache);
}

static noinline void __init kmem_cache_invalid_free(void)
{
	char *p;
	size_t size = 200;
	struct kmem_cache *cache;

	cache = kmem_cache_create("test_cache", size, 0, SLAB_TYPESAFE_BY_RCU,
				  NULL);
	if (!cache) {
		pr_err("Cache allocation failed\n");
		return;
	}
	pr_info("invalid-free of heap object\n");
	p = kmem_cache_alloc(cache, GFP_KERNEL);
	if (!p) {
		pr_err("Allocation failed\n");
		kmem_cache_destroy(cache);
		return;
	}

	/* Trigger invalid free, the object doesn't get freed */
	kmem_cache_free(cache, p + 1);

	/*
	 * Properly free the object to prevent the "Objects remaining in
	 * test_cache on __kmem_cache_shutdown" BUG failure.
	 */
	kmem_cache_free(cache, p);

	kmem_cache_destroy(cache);
}

static noinline void __init kasan_memchr(void)
{
	char *ptr;
	size_t size = 24;

	pr_info("out-of-bounds in memchr\n");
	ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
	if (!ptr)
		return;

	memchr(ptr, '1', size + 1);
	kfree(ptr);
}

static noinline void __init kasan_memcmp(void)
{
	char *ptr;
	size_t size = 24;
	int arr[9];

	pr_info("out-of-bounds in memcmp\n");
	ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
	if (!ptr)
		return;

	memset(arr, 0, sizeof(arr));
	memcmp(ptr, arr, size+1);
	kfree(ptr);
}

static noinline void __init kasan_strings(void)
{
	char *ptr;
	size_t size = 24;

	pr_info("use-after-free in strchr\n");
	ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
	if (!ptr)
		return;

	kfree(ptr);

	/*
	 * Try to cause only 1 invalid access (less spam in dmesg).
	 * For that we need ptr to point to zeroed byte.
	 * Skip metadata that could be stored in freed object so ptr
	 * will likely point to zeroed byte.
	 */
	ptr += 16;
	strchr(ptr, '1');

	pr_info("use-after-free in strrchr\n");
	strrchr(ptr, '1');

	pr_info("use-after-free in strcmp\n");
	strcmp(ptr, "2");

	pr_info("use-after-free in strncmp\n");
	strncmp(ptr, "2", 1);

	pr_info("use-after-free in strlen\n");
	strlen(ptr);

	pr_info("use-after-free in strnlen\n");
	strnlen(ptr, 1);
}

static noinline void __init kasan_bitops(void)
{
	/*
	 * Allocate 1 more byte, which causes kzalloc to round up to 16-bytes;
	 * this way we do not actually corrupt other memory.
	 */
	long *bits = kzalloc(sizeof(*bits) + 1, GFP_KERNEL);
	if (!bits)
		return;

	/*
	 * Below calls try to access bit within allocated memory; however, the
	 * below accesses are still out-of-bounds, since bitops are defined to
	 * operate on the whole long the bit is in.
	 */
	pr_info("out-of-bounds in set_bit\n");
	set_bit(BITS_PER_LONG, bits);

	pr_info("out-of-bounds in __set_bit\n");
	__set_bit(BITS_PER_LONG, bits);

	pr_info("out-of-bounds in clear_bit\n");
	clear_bit(BITS_PER_LONG, bits);

	pr_info("out-of-bounds in __clear_bit\n");
	__clear_bit(BITS_PER_LONG, bits);

	pr_info("out-of-bounds in clear_bit_unlock\n");
	clear_bit_unlock(BITS_PER_LONG, bits);

	pr_info("out-of-bounds in __clear_bit_unlock\n");
	__clear_bit_unlock(BITS_PER_LONG, bits);

	pr_info("out-of-bounds in change_bit\n");
	change_bit(BITS_PER_LONG, bits);

	pr_info("out-of-bounds in __change_bit\n");
	__change_bit(BITS_PER_LONG, bits);

	/*
	 * Below calls try to access bit beyond allocated memory.
	 */
	pr_info("out-of-bounds in test_and_set_bit\n");
	test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);

	pr_info("out-of-bounds in __test_and_set_bit\n");
	__test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);

	pr_info("out-of-bounds in test_and_set_bit_lock\n");
	test_and_set_bit_lock(BITS_PER_LONG + BITS_PER_BYTE, bits);

	pr_info("out-of-bounds in test_and_clear_bit\n");
	test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);

	pr_info("out-of-bounds in __test_and_clear_bit\n");
	__test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);

	pr_info("out-of-bounds in test_and_change_bit\n");
	test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);

	pr_info("out-of-bounds in __test_and_change_bit\n");
	__test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);

	pr_info("out-of-bounds in test_bit\n");
	(void)test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);

#if defined(clear_bit_unlock_is_negative_byte)
	pr_info("out-of-bounds in clear_bit_unlock_is_negative_byte\n");
	clear_bit_unlock_is_negative_byte(BITS_PER_LONG + BITS_PER_BYTE, bits);
#endif
	kfree(bits);
}

static noinline void __init kmalloc_double_kzfree(void)
{
	char *ptr;
	size_t size = 16;

	pr_info("double-free (kzfree)\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	kzfree(ptr);
	kzfree(ptr);
}

#ifdef CONFIG_KASAN_VMALLOC
static noinline void __init vmalloc_oob(void)
{
	void *area;

	pr_info("vmalloc out-of-bounds\n");

	/*
	 * We have to be careful not to hit the guard page.
	 * The MMU will catch that and crash us.
	 */
	area = vmalloc(3000);
	if (!area) {
		pr_err("Allocation failed\n");
		return;
	}

	((volatile char *)area)[3100];
	vfree(area);
}
#else
static void __init vmalloc_oob(void) {}
#endif

static int __init kmalloc_tests_init(void)
{
	/*
	 * Temporarily enable multi-shot mode. Otherwise, we'd only get a
	 * report for the first case.
	 */
	bool multishot = kasan_save_enable_multi_shot();

	kmalloc_oob_right();
	kmalloc_oob_left();
	kmalloc_node_oob_right();
#ifdef CONFIG_SLUB
	kmalloc_pagealloc_oob_right();
	kmalloc_pagealloc_uaf();
	kmalloc_pagealloc_invalid_free();
#endif
	kmalloc_large_oob_right();
	kmalloc_oob_krealloc_more();
	kmalloc_oob_krealloc_less();
	kmalloc_oob_16();
	kmalloc_oob_in_memset();
	kmalloc_oob_memset_2();
	kmalloc_oob_memset_4();
	kmalloc_oob_memset_8();
	kmalloc_oob_memset_16();
	kmalloc_memmove_invalid_size();
	kmalloc_uaf();
	kmalloc_uaf_memset();
	kmalloc_uaf2();
	kfree_via_page();
	kfree_via_phys();
	kmem_cache_oob();
	memcg_accounted_kmem_cache();
	kasan_stack_oob();
	kasan_global_oob();
	kasan_alloca_oob_left();
	kasan_alloca_oob_right();
	ksize_unpoisons_memory();
	copy_user_test();
	kmem_cache_double_free();
	kmem_cache_invalid_free();
	kasan_memchr();
	kasan_memcmp();
	kasan_strings();
	kasan_bitops();
	kmalloc_double_kzfree();
	vmalloc_oob();

	kasan_restore_multi_shot(multishot);

	return -EAGAIN;
}

module_init(kmalloc_tests_init);
MODULE_LICENSE("GPL");
Commit	Line	Data
d2912cb1	1	// SPDX-License-Identifier: GPL-2.0-only
3f15801c AR	2	/*
	3	*
	4	* Copyright (c) 2014 Samsung Electronics Co., Ltd.
	5	* Author: Andrey Ryabinin <a.ryabinin@samsung.com>
3f15801c AR	6	*/
	7
	8	#define pr_fmt(fmt) "kasan test: %s " fmt, __func__
	9
19a33ca6	10	#include <linux/bitops.h>
0386bf38	11	#include <linux/delay.h>
19a33ca6	12	#include <linux/kasan.h>
3f15801c	13	#include <linux/kernel.h>
eae08dca	14	#include <linux/mm.h>
19a33ca6 ME	15	#include <linux/mman.h>
19a33ca6 ME	16	#include <linux/module.h>
3f15801c AR	17	#include <linux/printk.h>
	18	#include <linux/slab.h>
	19	#include <linux/string.h>
eae08dca	20	#include <linux/uaccess.h>
b92a953c	21	#include <linux/io.h>
06513916	22	#include <linux/vmalloc.h>
b92a953c MR	23
b92a953c MR	24	#include <asm/page.h>
3f15801c	25
828347f8 DV	26	/*
	27	* Note: test functions are marked noinline so that their names appear in
	28	* reports.
	29	*/
	30
3f15801c AR	31	static noinline void __init kmalloc_oob_right(void)
	32	{
	33	char *ptr;
	34	size_t size = 123;
	35
	36	pr_info("out-of-bounds to right\n");
	37	ptr = kmalloc(size, GFP_KERNEL);
	38	if (!ptr) {
	39	pr_err("Allocation failed\n");
	40	return;
	41	}
	42
	43	ptr[size] = 'x';
	44	kfree(ptr);
	45	}
	46
	47	static noinline void __init kmalloc_oob_left(void)
	48	{
	49	char *ptr;
	50	size_t size = 15;
	51
	52	pr_info("out-of-bounds to left\n");
	53	ptr = kmalloc(size, GFP_KERNEL);
	54	if (!ptr) {
	55	pr_err("Allocation failed\n");
	56	return;
	57	}
	58
	59	ptr = (ptr - 1);
	60	kfree(ptr);
	61	}
	62
	63	static noinline void __init kmalloc_node_oob_right(void)
	64	{
	65	char *ptr;
	66	size_t size = 4096;
	67
	68	pr_info("kmalloc_node(): out-of-bounds to right\n");
	69	ptr = kmalloc_node(size, GFP_KERNEL, 0);
	70	if (!ptr) {
	71	pr_err("Allocation failed\n");
	72	return;
	73	}
	74
	75	ptr[size] = 0;
	76	kfree(ptr);
	77	}
	78
e6e8379c AP	79	#ifdef CONFIG_SLUB
e6e8379c AP	80	static noinline void __init kmalloc_pagealloc_oob_right(void)
3f15801c AR	81	{
	82	char *ptr;
	83	size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
	84
e6e8379c AP	85	/* Allocate a chunk that does not fit into a SLUB cache to trigger
	86	* the page allocator fallback.
	87	*/
	88	pr_info("kmalloc pagealloc allocation: out-of-bounds to right\n");
	89	ptr = kmalloc(size, GFP_KERNEL);
	90	if (!ptr) {
	91	pr_err("Allocation failed\n");
	92	return;
	93	}
	94
	95	ptr[size] = 0;
	96	kfree(ptr);
	97	}
47adccce DV	98
	99	static noinline void __init kmalloc_pagealloc_uaf(void)
	100	{
	101	char *ptr;
	102	size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
	103
	104	pr_info("kmalloc pagealloc allocation: use-after-free\n");
	105	ptr = kmalloc(size, GFP_KERNEL);
	106	if (!ptr) {
	107	pr_err("Allocation failed\n");
	108	return;
	109	}
	110
	111	kfree(ptr);
	112	ptr[0] = 0;
	113	}
	114
	115	static noinline void __init kmalloc_pagealloc_invalid_free(void)
	116	{
	117	char *ptr;
	118	size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
	119
	120	pr_info("kmalloc pagealloc allocation: invalid-free\n");
	121	ptr = kmalloc(size, GFP_KERNEL);
	122	if (!ptr) {
	123	pr_err("Allocation failed\n");
	124	return;
	125	}
	126
	127	kfree(ptr + 1);
	128	}
e6e8379c AP	129	#endif
	130
	131	static noinline void __init kmalloc_large_oob_right(void)
	132	{
	133	char *ptr;
	134	size_t size = KMALLOC_MAX_CACHE_SIZE - 256;
	135	/* Allocate a chunk that is large enough, but still fits into a slab
	136	* and does not trigger the page allocator fallback in SLUB.
	137	*/
3f15801c AR	138	pr_info("kmalloc large allocation: out-of-bounds to right\n");
	139	ptr = kmalloc(size, GFP_KERNEL);
	140	if (!ptr) {
	141	pr_err("Allocation failed\n");
	142	return;
	143	}
	144
	145	ptr[size] = 0;
	146	kfree(ptr);
	147	}
	148
	149	static noinline void __init kmalloc_oob_krealloc_more(void)
	150	{
	151	char ptr1, ptr2;
	152	size_t size1 = 17;
	153	size_t size2 = 19;
	154
	155	pr_info("out-of-bounds after krealloc more\n");
	156	ptr1 = kmalloc(size1, GFP_KERNEL);
	157	ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
	158	if (!ptr1 \|\| !ptr2) {
	159	pr_err("Allocation failed\n");
	160	kfree(ptr1);
3e21d9a5	161	kfree(ptr2);
3f15801c AR	162	return;
	163	}
	164
	165	ptr2[size2] = 'x';
	166	kfree(ptr2);
	167	}
	168
	169	static noinline void __init kmalloc_oob_krealloc_less(void)
	170	{
	171	char ptr1, ptr2;
	172	size_t size1 = 17;
	173	size_t size2 = 15;
	174
	175	pr_info("out-of-bounds after krealloc less\n");
	176	ptr1 = kmalloc(size1, GFP_KERNEL);
	177	ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
	178	if (!ptr1 \|\| !ptr2) {
	179	pr_err("Allocation failed\n");
	180	kfree(ptr1);
	181	return;
	182	}
6b4a35fc	183	ptr2[size2] = 'x';
3f15801c AR	184	kfree(ptr2);
	185	}
	186
	187	static noinline void __init kmalloc_oob_16(void)
	188	{
	189	struct {
	190	u64 words[2];
	191	} ptr1, ptr2;
	192
	193	pr_info("kmalloc out-of-bounds for 16-bytes access\n");
	194	ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL);
	195	ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
	196	if (!ptr1 \|\| !ptr2) {
	197	pr_err("Allocation failed\n");
	198	kfree(ptr1);
	199	kfree(ptr2);
	200	return;
	201	}
	202	ptr1 = ptr2;
	203	kfree(ptr1);
	204	kfree(ptr2);
	205	}
	206
f523e737 WL	207	static noinline void __init kmalloc_oob_memset_2(void)
	208	{
	209	char *ptr;
	210	size_t size = 8;
	211
	212	pr_info("out-of-bounds in memset2\n");
	213	ptr = kmalloc(size, GFP_KERNEL);
	214	if (!ptr) {
	215	pr_err("Allocation failed\n");
	216	return;
	217	}
	218
	219	memset(ptr+7, 0, 2);
	220	kfree(ptr);
	221	}
	222
	223	static noinline void __init kmalloc_oob_memset_4(void)
	224	{
	225	char *ptr;
	226	size_t size = 8;
	227
	228	pr_info("out-of-bounds in memset4\n");
	229	ptr = kmalloc(size, GFP_KERNEL);
	230	if (!ptr) {
	231	pr_err("Allocation failed\n");
	232	return;
	233	}
	234
	235	memset(ptr+5, 0, 4);
	236	kfree(ptr);
	237	}
	238
	239
	240	static noinline void __init kmalloc_oob_memset_8(void)
	241	{
	242	char *ptr;
	243	size_t size = 8;
	244
	245	pr_info("out-of-bounds in memset8\n");
	246	ptr = kmalloc(size, GFP_KERNEL);
	247	if (!ptr) {
	248	pr_err("Allocation failed\n");
	249	return;
	250	}
	251
	252	memset(ptr+1, 0, 8);
	253	kfree(ptr);
	254	}
	255
	256	static noinline void __init kmalloc_oob_memset_16(void)
	257	{
	258	char *ptr;
	259	size_t size = 16;
	260
	261	pr_info("out-of-bounds in memset16\n");
	262	ptr = kmalloc(size, GFP_KERNEL);
	263	if (!ptr) {
	264	pr_err("Allocation failed\n");
	265	return;
	266	}
	267
	268	memset(ptr+1, 0, 16);
	269	kfree(ptr);
	270	}
271
3f15801c AR	272	static noinline void __init kmalloc_oob_in_memset(void)
	273	{
	274	char *ptr;
	275	size_t size = 666;
	276
	277	pr_info("out-of-bounds in memset\n");
	278	ptr = kmalloc(size, GFP_KERNEL);
	279	if (!ptr) {
	280	pr_err("Allocation failed\n");
	281	return;
	282	}
	283
	284	memset(ptr, 0, size+5);
	285	kfree(ptr);
	286	}
	287
98f3b56f WW	288	static noinline void __init kmalloc_memmove_invalid_size(void)
	289	{
	290	char *ptr;
	291	size_t size = 64;
	292	volatile size_t invalid_size = -2;
	293
	294	pr_info("invalid size in memmove\n");
	295	ptr = kmalloc(size, GFP_KERNEL);
	296	if (!ptr) {
	297	pr_err("Allocation failed\n");
	298	return;
	299	}
	300
	301	memset((char *)ptr, 0, 64);
	302	memmove((char )ptr, (char )ptr + 4, invalid_size);
	303	kfree(ptr);
	304	}
	305
3f15801c AR	306	static noinline void __init kmalloc_uaf(void)
	307	{
	308	char *ptr;
	309	size_t size = 10;
	310
	311	pr_info("use-after-free\n");
	312	ptr = kmalloc(size, GFP_KERNEL);
	313	if (!ptr) {
	314	pr_err("Allocation failed\n");
	315	return;
	316	}
	317
	318	kfree(ptr);
	319	*(ptr + 8) = 'x';
	320	}
	321
	322	static noinline void __init kmalloc_uaf_memset(void)
	323	{
	324	char *ptr;
	325	size_t size = 33;
	326
	327	pr_info("use-after-free in memset\n");
	328	ptr = kmalloc(size, GFP_KERNEL);
	329	if (!ptr) {
	330	pr_err("Allocation failed\n");
	331	return;
	332	}
	333
	334	kfree(ptr);
	335	memset(ptr, 0, size);
	336	}
	337
	338	static noinline void __init kmalloc_uaf2(void)
	339	{
	340	char ptr1, ptr2;
	341	size_t size = 43;
	342
	343	pr_info("use-after-free after another kmalloc\n");
	344	ptr1 = kmalloc(size, GFP_KERNEL);
	345	if (!ptr1) {
	346	pr_err("Allocation failed\n");
	347	return;
	348	}
	349
	350	kfree(ptr1);
	351	ptr2 = kmalloc(size, GFP_KERNEL);
	352	if (!ptr2) {
	353	pr_err("Allocation failed\n");
	354	return;
	355	}
	356
	357	ptr1[40] = 'x';
9dcadd38 AP	358	if (ptr1 == ptr2)
9dcadd38 AP	359	pr_err("Could not detect use-after-free: ptr1 == ptr2\n");
3f15801c AR	360	kfree(ptr2);
	361	}
	362
b92a953c MR	363	static noinline void __init kfree_via_page(void)
	364	{
	365	char *ptr;
	366	size_t size = 8;
	367	struct page *page;
	368	unsigned long offset;
	369
	370	pr_info("invalid-free false positive (via page)\n");
	371	ptr = kmalloc(size, GFP_KERNEL);
	372	if (!ptr) {
	373	pr_err("Allocation failed\n");
	374	return;
	375	}
	376
	377	page = virt_to_page(ptr);
	378	offset = offset_in_page(ptr);
	379	kfree(page_address(page) + offset);
	380	}
	381
	382	static noinline void __init kfree_via_phys(void)
	383	{
	384	char *ptr;
	385	size_t size = 8;
	386	phys_addr_t phys;
	387
	388	pr_info("invalid-free false positive (via phys)\n");
	389	ptr = kmalloc(size, GFP_KERNEL);
	390	if (!ptr) {
	391	pr_err("Allocation failed\n");
	392	return;
	393	}
	394
	395	phys = virt_to_phys(ptr);
	396	kfree(phys_to_virt(phys));
	397	}
	398
3f15801c AR	399	static noinline void __init kmem_cache_oob(void)
	400	{
	401	char *p;
	402	size_t size = 200;
	403	struct kmem_cache *cache = kmem_cache_create("test_cache",
	404	size, 0,
	405	0, NULL);
	406	if (!cache) {
	407	pr_err("Cache allocation failed\n");
	408	return;
	409	}
	410	pr_info("out-of-bounds in kmem_cache_alloc\n");
	411	p = kmem_cache_alloc(cache, GFP_KERNEL);
	412	if (!p) {
	413	pr_err("Allocation failed\n");
	414	kmem_cache_destroy(cache);
	415	return;
	416	}
	417
	418	*p = p[size];
	419	kmem_cache_free(cache, p);
	420	kmem_cache_destroy(cache);
	421	}
	422
0386bf38 GT	423	static noinline void __init memcg_accounted_kmem_cache(void)
	424	{
	425	int i;
	426	char *p;
	427	size_t size = 200;
	428	struct kmem_cache *cache;
	429
	430	cache = kmem_cache_create("test_cache", size, 0, SLAB_ACCOUNT, NULL);
	431	if (!cache) {
	432	pr_err("Cache allocation failed\n");
	433	return;
	434	}
	435
	436	pr_info("allocate memcg accounted object\n");
	437	/*
	438	* Several allocations with a delay to allow for lazy per memcg kmem
	439	* cache creation.
	440	*/
	441	for (i = 0; i < 5; i++) {
	442	p = kmem_cache_alloc(cache, GFP_KERNEL);
dc2bf000	443	if (!p)
0386bf38	444	goto free_cache;
dc2bf000	445
0386bf38 GT	446	kmem_cache_free(cache, p);
	447	msleep(100);
	448	}
	449
	450	free_cache:
	451	kmem_cache_destroy(cache);
	452	}
	453
3f15801c AR	454	static char global_array[10];
	455
	456	static noinline void __init kasan_global_oob(void)
	457	{
	458	volatile int i = 3;
	459	char *p = &global_array[ARRAY_SIZE(global_array) + i];
	460
	461	pr_info("out-of-bounds global variable\n");
	462	(volatile char )p;
	463	}
	464
	465	static noinline void __init kasan_stack_oob(void)
	466	{
	467	char stack_array[10];
	468	volatile int i = 0;
	469	char *p = &stack_array[ARRAY_SIZE(stack_array) + i];
	470
	471	pr_info("out-of-bounds on stack\n");
	472	(volatile char )p;
	473	}
	474
96fe805f AP	475	static noinline void __init ksize_unpoisons_memory(void)
	476	{
	477	char *ptr;
48c23239	478	size_t size = 123, real_size;
96fe805f AP	479
	480	pr_info("ksize() unpoisons the whole allocated chunk\n");
	481	ptr = kmalloc(size, GFP_KERNEL);
	482	if (!ptr) {
	483	pr_err("Allocation failed\n");
	484	return;
	485	}
	486	real_size = ksize(ptr);
	487	/* This access doesn't trigger an error. */
	488	ptr[size] = 'x';
	489	/* This one does. */
	490	ptr[real_size] = 'y';
	491	kfree(ptr);
	492	}
	493
eae08dca AR	494	static noinline void __init copy_user_test(void)
	495	{
	496	char *kmem;
	497	char __user *usermem;
	498	size_t size = 10;
	499	int unused;
	500
	501	kmem = kmalloc(size, GFP_KERNEL);
	502	if (!kmem)
	503	return;
	504
	505	usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE,
	506	PROT_READ \| PROT_WRITE \| PROT_EXEC,
	507	MAP_ANONYMOUS \| MAP_PRIVATE, 0);
	508	if (IS_ERR(usermem)) {
	509	pr_err("Failed to allocate user memory\n");
	510	kfree(kmem);
	511	return;
	512	}
	513
	514	pr_info("out-of-bounds in copy_from_user()\n");
	515	unused = copy_from_user(kmem, usermem, size + 1);
	516
	517	pr_info("out-of-bounds in copy_to_user()\n");
	518	unused = copy_to_user(usermem, kmem, size + 1);
	519
	520	pr_info("out-of-bounds in __copy_from_user()\n");
	521	unused = __copy_from_user(kmem, usermem, size + 1);
	522
	523	pr_info("out-of-bounds in __copy_to_user()\n");
	524	unused = __copy_to_user(usermem, kmem, size + 1);
	525
	526	pr_info("out-of-bounds in __copy_from_user_inatomic()\n");
	527	unused = __copy_from_user_inatomic(kmem, usermem, size + 1);
	528
	529	pr_info("out-of-bounds in __copy_to_user_inatomic()\n");
	530	unused = __copy_to_user_inatomic(usermem, kmem, size + 1);
	531
	532	pr_info("out-of-bounds in strncpy_from_user()\n");
	533	unused = strncpy_from_user(kmem, usermem, size + 1);
	534
	535	vm_munmap((unsigned long)usermem, PAGE_SIZE);
	536	kfree(kmem);
	537	}
	538
00a14294 PL	539	static noinline void __init kasan_alloca_oob_left(void)
	540	{
	541	volatile int i = 10;
	542	char alloca_array[i];
	543	char *p = alloca_array - 1;
	544
	545	pr_info("out-of-bounds to left on alloca\n");
	546	(volatile char )p;
	547	}
	548
	549	static noinline void __init kasan_alloca_oob_right(void)
	550	{
	551	volatile int i = 10;
	552	char alloca_array[i];
	553	char *p = alloca_array + i;
	554
	555	pr_info("out-of-bounds to right on alloca\n");
	556	(volatile char )p;
	557	}
	558
b1d57289 DV	559	static noinline void __init kmem_cache_double_free(void)
	560	{
	561	char *p;
	562	size_t size = 200;
	563	struct kmem_cache *cache;
	564
	565	cache = kmem_cache_create("test_cache", size, 0, 0, NULL);
	566	if (!cache) {
	567	pr_err("Cache allocation failed\n");
	568	return;
	569	}
	570	pr_info("double-free on heap object\n");
	571	p = kmem_cache_alloc(cache, GFP_KERNEL);
	572	if (!p) {
	573	pr_err("Allocation failed\n");
	574	kmem_cache_destroy(cache);
	575	return;
	576	}
	577
	578	kmem_cache_free(cache, p);
	579	kmem_cache_free(cache, p);
	580	kmem_cache_destroy(cache);
	581	}
	582
	583	static noinline void __init kmem_cache_invalid_free(void)
	584	{
	585	char *p;
	586	size_t size = 200;
	587	struct kmem_cache *cache;
	588
	589	cache = kmem_cache_create("test_cache", size, 0, SLAB_TYPESAFE_BY_RCU,
	590	NULL);
	591	if (!cache) {
	592	pr_err("Cache allocation failed\n");
	593	return;
	594	}
	595	pr_info("invalid-free of heap object\n");
	596	p = kmem_cache_alloc(cache, GFP_KERNEL);
	597	if (!p) {
	598	pr_err("Allocation failed\n");
	599	kmem_cache_destroy(cache);
	600	return;
	601	}
	602
91c93ed0	603	/* Trigger invalid free, the object doesn't get freed */
b1d57289	604	kmem_cache_free(cache, p + 1);
91c93ed0 AK	605
	606	/*
	607	* Properly free the object to prevent the "Objects remaining in
	608	* test_cache on __kmem_cache_shutdown" BUG failure.
	609	*/
	610	kmem_cache_free(cache, p);
	611
b1d57289 DV	612	kmem_cache_destroy(cache);
	613	}
	614
0c96350a AR	615	static noinline void __init kasan_memchr(void)
	616	{
	617	char *ptr;
	618	size_t size = 24;
	619
	620	pr_info("out-of-bounds in memchr\n");
	621	ptr = kmalloc(size, GFP_KERNEL \| __GFP_ZERO);
	622	if (!ptr)
	623	return;
	624
	625	memchr(ptr, '1', size + 1);
	626	kfree(ptr);
	627	}
	628
	629	static noinline void __init kasan_memcmp(void)
	630	{
	631	char *ptr;
	632	size_t size = 24;
	633	int arr[9];
	634
	635	pr_info("out-of-bounds in memcmp\n");
	636	ptr = kmalloc(size, GFP_KERNEL \| __GFP_ZERO);
	637	if (!ptr)
	638	return;
	639
	640	memset(arr, 0, sizeof(arr));
	641	memcmp(ptr, arr, size+1);
	642	kfree(ptr);
	643	}
	644
	645	static noinline void __init kasan_strings(void)
	646	{
	647	char *ptr;
	648	size_t size = 24;
	649
	650	pr_info("use-after-free in strchr\n");
	651	ptr = kmalloc(size, GFP_KERNEL \| __GFP_ZERO);
	652	if (!ptr)
	653	return;
	654
	655	kfree(ptr);
	656
	657	/*
	658	* Try to cause only 1 invalid access (less spam in dmesg).
	659	* For that we need ptr to point to zeroed byte.
	660	* Skip metadata that could be stored in freed object so ptr
	661	* will likely point to zeroed byte.
	662	*/
	663	ptr += 16;
	664	strchr(ptr, '1');
	665
	666	pr_info("use-after-free in strrchr\n");
	667	strrchr(ptr, '1');
	668
	669	pr_info("use-after-free in strcmp\n");
	670	strcmp(ptr, "2");
	671
	672	pr_info("use-after-free in strncmp\n");
	673	strncmp(ptr, "2", 1);
	674
	675	pr_info("use-after-free in strlen\n");
	676	strlen(ptr);
	677
	678	pr_info("use-after-free in strnlen\n");
679	strnlen(ptr, 1);
680	}
681
19a33ca6 ME	682	static noinline void __init kasan_bitops(void)
	683	{
	684	/*
	685	* Allocate 1 more byte, which causes kzalloc to round up to 16-bytes;
	686	* this way we do not actually corrupt other memory.
	687	*/
	688	long bits = kzalloc(sizeof(bits) + 1, GFP_KERNEL);
	689	if (!bits)
	690	return;
	691
	692	/*
	693	* Below calls try to access bit within allocated memory; however, the
	694	* below accesses are still out-of-bounds, since bitops are defined to
	695	* operate on the whole long the bit is in.
	696	*/
	697	pr_info("out-of-bounds in set_bit\n");
	698	set_bit(BITS_PER_LONG, bits);
	699
	700	pr_info("out-of-bounds in __set_bit\n");
	701	__set_bit(BITS_PER_LONG, bits);
	702
	703	pr_info("out-of-bounds in clear_bit\n");
	704	clear_bit(BITS_PER_LONG, bits);
	705
	706	pr_info("out-of-bounds in __clear_bit\n");
	707	__clear_bit(BITS_PER_LONG, bits);
	708
	709	pr_info("out-of-bounds in clear_bit_unlock\n");
	710	clear_bit_unlock(BITS_PER_LONG, bits);
	711
	712	pr_info("out-of-bounds in __clear_bit_unlock\n");
	713	__clear_bit_unlock(BITS_PER_LONG, bits);
	714
	715	pr_info("out-of-bounds in change_bit\n");
	716	change_bit(BITS_PER_LONG, bits);
	717
	718	pr_info("out-of-bounds in __change_bit\n");
	719	__change_bit(BITS_PER_LONG, bits);
	720
	721	/*
	722	* Below calls try to access bit beyond allocated memory.
	723	*/
	724	pr_info("out-of-bounds in test_and_set_bit\n");
	725	test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
	726
	727	pr_info("out-of-bounds in __test_and_set_bit\n");
	728	__test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
	729
	730	pr_info("out-of-bounds in test_and_set_bit_lock\n");
	731	test_and_set_bit_lock(BITS_PER_LONG + BITS_PER_BYTE, bits);
	732
	733	pr_info("out-of-bounds in test_and_clear_bit\n");
	734	test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
	735
	736	pr_info("out-of-bounds in __test_and_clear_bit\n");
	737	__test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
	738
	739	pr_info("out-of-bounds in test_and_change_bit\n");
	740	test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
	741
	742	pr_info("out-of-bounds in __test_and_change_bit\n");
	743	__test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
	744
	745	pr_info("out-of-bounds in test_bit\n");
746	(void)test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
747
748	#if defined(clear_bit_unlock_is_negative_byte)
749	pr_info("out-of-bounds in clear_bit_unlock_is_negative_byte\n");
750	clear_bit_unlock_is_negative_byte(BITS_PER_LONG + BITS_PER_BYTE, bits);
751	#endif
752	kfree(bits);
753	}
754
bb104ed7 ME	755	static noinline void __init kmalloc_double_kzfree(void)
	756	{
	757	char *ptr;
	758	size_t size = 16;
	759
	760	pr_info("double-free (kzfree)\n");
	761	ptr = kmalloc(size, GFP_KERNEL);
	762	if (!ptr) {
	763	pr_err("Allocation failed\n");
	764	return;
	765	}
	766
	767	kzfree(ptr);
	768	kzfree(ptr);
	769	}
	770
06513916 DA	771	#ifdef CONFIG_KASAN_VMALLOC
	772	static noinline void __init vmalloc_oob(void)
	773	{
	774	void *area;
	775
	776	pr_info("vmalloc out-of-bounds\n");
	777
	778	/*
	779	* We have to be careful not to hit the guard page.
	780	* The MMU will catch that and crash us.
	781	*/
	782	area = vmalloc(3000);
	783	if (!area) {
	784	pr_err("Allocation failed\n");
	785	return;
	786	}
	787
	788	((volatile char *)area)[3100];
	789	vfree(area);
	790	}
	791	#else
	792	static void __init vmalloc_oob(void) {}
	793	#endif
	794
3f15801c AR	795	static int __init kmalloc_tests_init(void)
3f15801c AR	796	{
b0845ce5 MR	797	/*
	798	* Temporarily enable multi-shot mode. Otherwise, we'd only get a
	799	* report for the first case.
	800	*/
	801	bool multishot = kasan_save_enable_multi_shot();
	802
3f15801c AR	803	kmalloc_oob_right();
	804	kmalloc_oob_left();
	805	kmalloc_node_oob_right();
e6e8379c AP	806	#ifdef CONFIG_SLUB
e6e8379c AP	807	kmalloc_pagealloc_oob_right();
47adccce DV	808	kmalloc_pagealloc_uaf();
47adccce DV	809	kmalloc_pagealloc_invalid_free();
e6e8379c	810	#endif
9789d8e0	811	kmalloc_large_oob_right();
3f15801c AR	812	kmalloc_oob_krealloc_more();
	813	kmalloc_oob_krealloc_less();
	814	kmalloc_oob_16();
	815	kmalloc_oob_in_memset();
f523e737 WL	816	kmalloc_oob_memset_2();
	817	kmalloc_oob_memset_4();
	818	kmalloc_oob_memset_8();
	819	kmalloc_oob_memset_16();
98f3b56f	820	kmalloc_memmove_invalid_size();
3f15801c AR	821	kmalloc_uaf();
	822	kmalloc_uaf_memset();
	823	kmalloc_uaf2();
b92a953c MR	824	kfree_via_page();
b92a953c MR	825	kfree_via_phys();
3f15801c	826	kmem_cache_oob();
0386bf38	827	memcg_accounted_kmem_cache();
3f15801c AR	828	kasan_stack_oob();
3f15801c AR	829	kasan_global_oob();
00a14294 PL	830	kasan_alloca_oob_left();
00a14294 PL	831	kasan_alloca_oob_right();
96fe805f	832	ksize_unpoisons_memory();
eae08dca	833	copy_user_test();
b1d57289 DV	834	kmem_cache_double_free();
b1d57289 DV	835	kmem_cache_invalid_free();
0c96350a AR	836	kasan_memchr();
	837	kasan_memcmp();
	838	kasan_strings();
19a33ca6	839	kasan_bitops();
bb104ed7	840	kmalloc_double_kzfree();
06513916	841	vmalloc_oob();
b0845ce5 MR	842
	843	kasan_restore_multi_shot(multishot);
	844
3f15801c AR	845	return -EAGAIN;
	846	}
	847
	848	module_init(kmalloc_tests_init);
	849	MODULE_LICENSE("GPL");