kasan: add test for SLAB_TYPESAFE_BY_RCU quarantine skipping

Verify that KASAN does not quarantine objects in SLAB_TYPESAFE_BY_RCU
slabs if CONFIG_SLUB_RCU_DEBUG is off.

[jannh@google.com: v2]
Link: https://lkml.kernel.org/r/20250729-kasan-tsbrcu-noquarantine-test-v2-1-d16bd99309c9@google.com
[jannh@google.com: make comment more verbose]
Link: https://lkml.kernel.org/r/20250814-kasan-tsbrcu-noquarantine-test-v3-1-9e9110009b4e@google.com
Link: https://lkml.kernel.org/r/20250728-kasan-tsbrcu-noquarantine-test-v1-1-fa24d9ab7f41@google.com
Signed-off-by: Jann Horn <jannh@google.com>
Suggested-by: Andrey Konovalov <andreyknvl@gmail.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitriy Vyukov <dvyukov@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/mm/kasan/kasan_test_c.c b/mm/kasan/kasan_test_c.c
index f4b17984b627a6d31fd2e92eff4c572b6638a5c4..4cf2b5f8d6c1459d8d2d0a2ea09574d0a92dbf84 100644 (file)
--- a/mm/kasan/kasan_test_c.c
+++ b/mm/kasan/kasan_test_c.c
@@ -1073,6 +1073,45 @@ static void kmem_cache_rcu_uaf(struct kunit *test)
        kmem_cache_destroy(cache);
 }
 
+/*
+ * Check that SLAB_TYPESAFE_BY_RCU objects are immediately reused when
+ * CONFIG_SLUB_RCU_DEBUG is off, and stay at the same address.
+ * Without this, KASAN builds would be unable to trigger bugs caused by
+ * SLAB_TYPESAFE_BY_RCU users handling reycled objects improperly.
+ */
+static void kmem_cache_rcu_reuse(struct kunit *test)
+{
+       char *p, *p2;
+       struct kmem_cache *cache;
+
+       KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_SLUB_RCU_DEBUG);
+
+       cache = kmem_cache_create("test_cache", 16, 0, SLAB_TYPESAFE_BY_RCU,
+                                 NULL);
+       KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
+
+       migrate_disable();
+       p = kmem_cache_alloc(cache, GFP_KERNEL);
+       if (!p) {
+               kunit_err(test, "Allocation failed: %s\n", __func__);
+               goto out;
+       }
+
+       kmem_cache_free(cache, p);
+       p2 = kmem_cache_alloc(cache, GFP_KERNEL);
+       if (!p2) {
+               kunit_err(test, "Allocation failed: %s\n", __func__);
+               goto out;
+       }
+       KUNIT_EXPECT_PTR_EQ(test, p, p2);
+
+       kmem_cache_free(cache, p2);
+
+out:
+       migrate_enable();
+       kmem_cache_destroy(cache);
+}
+
 static void kmem_cache_double_destroy(struct kunit *test)
 {
        struct kmem_cache *cache;
@@ -2106,6 +2145,7 @@ static struct kunit_case kasan_kunit_test_cases[] = {
        KUNIT_CASE(kmem_cache_double_free),
        KUNIT_CASE(kmem_cache_invalid_free),
        KUNIT_CASE(kmem_cache_rcu_uaf),
+       KUNIT_CASE(kmem_cache_rcu_reuse),
        KUNIT_CASE(kmem_cache_double_destroy),
        KUNIT_CASE(kmem_cache_accounted),
        KUNIT_CASE(kmem_cache_bulk),