]> git.ipfire.org Git - thirdparty/linux.git/commit
kunit: fix use-after-free in debugfs when using kunit.filter
authorFlorian Schmaus <florian.schmaus@codasip.com>
Thu, 7 May 2026 08:48:54 +0000 (10:48 +0200)
committerShuah Khan <skhan@linuxfoundation.org>
Thu, 21 May 2026 16:45:49 +0000 (10:45 -0600)
commitfb6988b83b4cafe8db63999c1ddff1b7c66d2ff5
tree88e4838ebbce302f5b274ba9bf2cc2ffe0f8e768
parent8f80b5b227ef9ea422080487715c841856339aed
kunit: fix use-after-free in debugfs when using kunit.filter

When the kernel is booted with a kunit filter (e.g.,
kunit.filter="speed!=slow"), the kunit executor dynamically allocates
copies of the filtered test suites using kmalloc/kmemdup.

During the initial boot execution, kunit_debugfs_create_suite() creates
debugfs files (such as /sys/kernel/debug/kunit/<suite>/run) and
permanently stores a pointer to the dynamically allocated suite in the
inode's i_private field.

Previously, the executor freed this dynamically allocated suite_set
immediately after executing the boot-time tests. Because the debugfs
nodes were not destroyed, any subsequent interaction with the debugfs
`run` file from userspace triggered a use-after-free (UAF). On systems
with architectural capabilities, like CHERI RISC-V, this resulted in
an immediate fatal hardware exception due to the invalidation of the
capability tags on the reclaimed memory. On other architectures, it
resulted in silent memory corruption.

Fix this UAF by properly coupling the lifetime of the filtered suite
memory allocation to the lifetime of the kunit subsystem and its
associated VFS nodes. Ownership of the boot-time suite_set is now
transferred to a global tracker ('kunit_boot_suites'), and the memory
is cleanly released in kunit_exit() during module teardown.

Link: https://lore.kernel.org/r/20260507084854.233984-1-florian.schmaus@codasip.com
Fixes: e2219db280e3 ("kunit: add debugfs /sys/kernel/debug/kunit/<suite>/results display")
Signed-off-by: Florian Schmaus <florian.schmaus@codasip.com>
Reviewed-by: Martin Kaiser <martin@kaiser.cx>
Reviewed-by: David Gow <david@davidgow.net>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
include/kunit/test.h
lib/kunit/executor.c
lib/kunit/test.c