Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
kasan: apply write-only mode in kasan kunit testcases
When KASAN is configured in write-only mode, fetch/load operations do not
trigger tag check faults.
As a result, the outcome of some test cases may differ compared to when
KASAN is configured without write-only mode.
Therefore, by modifying pre-exist testcases check the write only makes tag
check fault (TCF) where writing is perform in "allocated memory" but tag
is invalid (i.e) redzone write in atomic_set() testcases. Otherwise check
the invalid fetch/read doesn't generate TCF.
Also, skip some testcases affected by initial value (i.e) atomic_cmpxchg()
testcase maybe successd if it passes valid atomic_t address and invalid
oldaval address. In this case, if invalid atomic_t doesn't have the same
oldval, it won't trigger write operation so the test will pass.
Link: https://lkml.kernel.org/r/20250916222755.466009-3-yeoreum.yun@arm.com
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
Reviewed-by: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Breno Leitao <leitao@debian.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Dmitriy Vyukov <dvyukov@google.com>
Cc: D Scott Phillips <scott@os.amperecomputing.com>
Cc: Hardevsinh Palaniya <hardevsinh.palaniya@siliconsignals.io>
Cc: James Morse <james.morse@arm.com>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Kalesh Singh <kaleshsingh@google.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Oliver Upton <oliver.upton@linux.dev>
Cc: Pankaj Gupta <pankaj.gupta@amd.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Yang Shi <yang@os.amperecomputing.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
authored by
Yeoreum Yun
and committed by
Andrew Morton
2b79cb3e
31d8edb5
+136
-69
+136
-69
mm/kasan/kasan_test_c.c
+136
-69
mm/kasan/kasan_test_c.c
···
94
94
}
95
95
96
96
/**
97
-
* KUNIT_EXPECT_KASAN_FAIL - check that the executed expression produces a
98
-
* KASAN report; causes a KUnit test failure otherwise.
97
+
* KUNIT_EXPECT_KASAN_RESULT - checks whether the executed expression
98
+
* produces a KASAN report; causes a KUnit test failure when the result
99
+
* is different from @fail.
99
100
*
100
101
* @test: Currently executing KUnit test.
101
-
* @expression: Expression that must produce a KASAN report.
102
+
* @expr: Expression to be tested.
103
+
* @expr_str: Expression to be tested encoded as a string.
104
+
* @fail: Whether expression should produce a KASAN report.
102
105
*
103
106
* For hardware tag-based KASAN, when a synchronous tag fault happens, tag
104
107
* checking is auto-disabled. When this happens, this test handler reenables
···
113
110
* Use READ/WRITE_ONCE() for the accesses and compiler barriers around the
114
111
* expression to prevent that.
115
112
*
116
-
* In between KUNIT_EXPECT_KASAN_FAIL checks, test_status.report_found is kept
113
+
* In between KUNIT_EXPECT_KASAN_RESULT checks, test_status.report_found is kept
117
114
* as false. This allows detecting KASAN reports that happen outside of the
118
115
* checks by asserting !test_status.report_found at the start of
119
-
* KUNIT_EXPECT_KASAN_FAIL and in kasan_test_exit.
116
+
* KUNIT_EXPECT_KASAN_RESULT and in kasan_test_exit.
120
117
*/
121
-
#define KUNIT_EXPECT_KASAN_FAIL(test, expression) do { \
118
+
#define KUNIT_EXPECT_KASAN_RESULT(test, expr, expr_str, fail) \
119
+
do { \
122
120
if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) && \
123
121
kasan_sync_fault_possible()) \
124
122
migrate_disable(); \
125
123
KUNIT_EXPECT_FALSE(test, READ_ONCE(test_status.report_found)); \
126
124
barrier(); \
127
-
expression; \
125
+
expr; \
128
126
barrier(); \
129
127
if (kasan_async_fault_possible()) \
130
128
kasan_force_async_fault(); \
131
-
if (!READ_ONCE(test_status.report_found)) { \
132
-
KUNIT_FAIL(test, KUNIT_SUBTEST_INDENT "KASAN failure " \
133
-
"expected in \"" #expression \
134
-
"\", but none occurred"); \
129
+
if (READ_ONCE(test_status.report_found) != fail) { \
130
+
KUNIT_FAIL(test, KUNIT_SUBTEST_INDENT "KASAN failure" \
131
+
"%sexpected in \"" expr_str \
132
+
"\", but %soccurred", \
133
+
(fail ? " " : " not "), \
134
+
(test_status.report_found ? \
135
+
"" : "none ")); \
135
136
} \
136
137
if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) && \
137
138
kasan_sync_fault_possible()) { \
···
147
140
WRITE_ONCE(test_status.report_found, false); \
148
141
WRITE_ONCE(test_status.async_fault, false); \
149
142
} while (0)
143
+
144
+
/*
145
+
* KUNIT_EXPECT_KASAN_FAIL - check that the executed expression produces a
146
+
* KASAN report; causes a KUnit test failure otherwise.
147
+
*
148
+
* @test: Currently executing KUnit test.
149
+
* @expr: Expression that must produce a KASAN report.
150
+
*/
151
+
#define KUNIT_EXPECT_KASAN_FAIL(test, expr) \
152
+
KUNIT_EXPECT_KASAN_RESULT(test, expr, #expr, true)
153
+
154
+
/*
155
+
* KUNIT_EXPECT_KASAN_FAIL_READ - check that the executed expression
156
+
* produces a KASAN report when the write-only mode is not enabled;
157
+
* causes a KUnit test failure otherwise.
158
+
*
159
+
* Note: At the moment, this macro does not check whether the produced
160
+
* KASAN report is a report about a bad read access. It is only intended
161
+
* for checking the write-only KASAN mode functionality without failing
162
+
* KASAN tests.
163
+
*
164
+
* @test: Currently executing KUnit test.
165
+
* @expr: Expression that must only produce a KASAN report
166
+
* when the write-only mode is not enabled.
167
+
*/
168
+
#define KUNIT_EXPECT_KASAN_FAIL_READ(test, expr) \
169
+
KUNIT_EXPECT_KASAN_RESULT(test, expr, #expr, \
170
+
!kasan_write_only_enabled()) \
150
171
151
172
#define KASAN_TEST_NEEDS_CONFIG_ON(test, config) do { \
152
173
if (!IS_ENABLED(config)) \
···
218
183
KUNIT_EXPECT_KASAN_FAIL(test, ptr[size + 5] = 'y');
219
184
220
185
/* Out-of-bounds access past the aligned kmalloc object. */
221
-
KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] =
222
-
ptr[size + KASAN_GRANULE_SIZE + 5]);
186
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, ptr[0] =
187
+
ptr[size + KASAN_GRANULE_SIZE + 5]);
223
188
224
189
kfree(ptr);
225
190
}
···
233
198
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
234
199
235
200
OPTIMIZER_HIDE_VAR(ptr);
236
-
KUNIT_EXPECT_KASAN_FAIL(test, *ptr = *(ptr - 1));
201
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, *ptr = *(ptr - 1));
237
202
kfree(ptr);
238
203
}
239
204
···
246
211
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
247
212
248
213
OPTIMIZER_HIDE_VAR(ptr);
249
-
KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = ptr[size]);
214
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, ptr[0] = ptr[size]);
250
215
kfree(ptr);
251
216
}
252
217
···
326
291
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
327
292
kfree(ptr);
328
293
329
-
KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]);
294
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[0]);
330
295
}
331
296
332
297
static void kmalloc_large_invalid_free(struct kunit *test)
···
358
323
ptr = page_address(pages);
359
324
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
360
325
361
-
KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = ptr[size]);
326
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, ptr[0] = ptr[size]);
362
327
free_pages((unsigned long)ptr, order);
363
328
}
364
329
···
373
338
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
374
339
free_pages((unsigned long)ptr, order);
375
340
376
-
KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]);
341
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[0]);
377
342
}
378
343
379
344
static void krealloc_more_oob_helper(struct kunit *test,
···
493
458
494
459
KUNIT_EXPECT_KASAN_FAIL(test, ptr2 = krealloc(ptr1, size2, GFP_KERNEL));
495
460
KUNIT_ASSERT_NULL(test, ptr2);
496
-
KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)ptr1);
461
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, *(volatile char *)ptr1);
497
462
}
498
463
499
464
static void kmalloc_oob_16(struct kunit *test)
···
536
501
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
537
502
kfree(ptr2);
538
503
539
-
KUNIT_EXPECT_KASAN_FAIL(test, *ptr1 = *ptr2);
504
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, *ptr1 = *ptr2);
540
505
kfree(ptr1);
541
506
}
542
507
···
675
640
memset((char *)ptr, 0, 64);
676
641
OPTIMIZER_HIDE_VAR(ptr);
677
642
OPTIMIZER_HIDE_VAR(invalid_size);
678
-
KUNIT_EXPECT_KASAN_FAIL(test,
679
-
memmove((char *)ptr, (char *)ptr + 4, invalid_size));
643
+
KUNIT_EXPECT_KASAN_FAIL_READ(test,
644
+
memmove((char *)ptr, (char *)ptr + 4, invalid_size));
680
645
kfree(ptr);
681
646
}
682
647
···
689
654
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
690
655
691
656
kfree(ptr);
692
-
KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[8]);
657
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[8]);
693
658
}
694
659
695
660
static void kmalloc_uaf_memset(struct kunit *test)
···
736
701
goto again;
737
702
}
738
703
739
-
KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr1)[40]);
704
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr1)[40]);
740
705
KUNIT_EXPECT_PTR_NE(test, ptr1, ptr2);
741
706
742
707
kfree(ptr2);
···
762
727
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
763
728
kfree(ptr2);
764
729
765
-
KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr1)[8]);
730
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr1)[8]);
766
731
}
767
732
768
733
static void kasan_atomics_helper(struct kunit *test, void *unsafe, void *safe)
769
734
{
770
735
int *i_unsafe = unsafe;
771
736
772
-
KUNIT_EXPECT_KASAN_FAIL(test, READ_ONCE(*i_unsafe));
737
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, READ_ONCE(*i_unsafe));
773
738
KUNIT_EXPECT_KASAN_FAIL(test, WRITE_ONCE(*i_unsafe, 42));
774
-
KUNIT_EXPECT_KASAN_FAIL(test, smp_load_acquire(i_unsafe));
739
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, smp_load_acquire(i_unsafe));
775
740
KUNIT_EXPECT_KASAN_FAIL(test, smp_store_release(i_unsafe, 42));
776
741
777
-
KUNIT_EXPECT_KASAN_FAIL(test, atomic_read(unsafe));
742
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, atomic_read(unsafe));
778
743
KUNIT_EXPECT_KASAN_FAIL(test, atomic_set(unsafe, 42));
779
744
KUNIT_EXPECT_KASAN_FAIL(test, atomic_add(42, unsafe));
780
745
KUNIT_EXPECT_KASAN_FAIL(test, atomic_sub(42, unsafe));
···
787
752
KUNIT_EXPECT_KASAN_FAIL(test, atomic_xchg(unsafe, 42));
788
753
KUNIT_EXPECT_KASAN_FAIL(test, atomic_cmpxchg(unsafe, 21, 42));
789
754
KUNIT_EXPECT_KASAN_FAIL(test, atomic_try_cmpxchg(unsafe, safe, 42));
790
-
KUNIT_EXPECT_KASAN_FAIL(test, atomic_try_cmpxchg(safe, unsafe, 42));
755
+
/*
756
+
* The result of the test below may vary due to garbage values of
757
+
* unsafe in write-only mode.
758
+
* Therefore, skip this test when KASAN is configured in write-only mode.
759
+
*/
760
+
if (!kasan_write_only_enabled())
761
+
KUNIT_EXPECT_KASAN_FAIL(test, atomic_try_cmpxchg(safe, unsafe, 42));
791
762
KUNIT_EXPECT_KASAN_FAIL(test, atomic_sub_and_test(42, unsafe));
792
763
KUNIT_EXPECT_KASAN_FAIL(test, atomic_dec_and_test(unsafe));
793
764
KUNIT_EXPECT_KASAN_FAIL(test, atomic_inc_and_test(unsafe));
794
765
KUNIT_EXPECT_KASAN_FAIL(test, atomic_add_negative(42, unsafe));
795
-
KUNIT_EXPECT_KASAN_FAIL(test, atomic_add_unless(unsafe, 21, 42));
796
-
KUNIT_EXPECT_KASAN_FAIL(test, atomic_inc_not_zero(unsafe));
797
-
KUNIT_EXPECT_KASAN_FAIL(test, atomic_inc_unless_negative(unsafe));
798
-
KUNIT_EXPECT_KASAN_FAIL(test, atomic_dec_unless_positive(unsafe));
799
-
KUNIT_EXPECT_KASAN_FAIL(test, atomic_dec_if_positive(unsafe));
766
+
/*
767
+
* The result of the test below may vary due to garbage values of
768
+
* unsafe in write-only mode.
769
+
* Therefore, skip this test when KASAN is configured in write-only mode.
770
+
*/
771
+
if (!kasan_write_only_enabled()) {
772
+
KUNIT_EXPECT_KASAN_FAIL(test, atomic_add_unless(unsafe, 21, 42));
773
+
KUNIT_EXPECT_KASAN_FAIL(test, atomic_inc_not_zero(unsafe));
774
+
KUNIT_EXPECT_KASAN_FAIL(test, atomic_inc_unless_negative(unsafe));
775
+
KUNIT_EXPECT_KASAN_FAIL(test, atomic_dec_unless_positive(unsafe));
776
+
KUNIT_EXPECT_KASAN_FAIL(test, atomic_dec_if_positive(unsafe));
777
+
}
800
778
801
-
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_read(unsafe));
779
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, atomic_long_read(unsafe));
802
780
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_set(unsafe, 42));
803
781
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_add(42, unsafe));
804
782
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_sub(42, unsafe));
···
824
776
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_xchg(unsafe, 42));
825
777
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_cmpxchg(unsafe, 21, 42));
826
778
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_try_cmpxchg(unsafe, safe, 42));
827
-
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_try_cmpxchg(safe, unsafe, 42));
779
+
/*
780
+
* The result of the test below may vary due to garbage values of
781
+
* unsafe in write-only mode.
782
+
* Therefore, skip this test when KASAN is configured in write-only mode.
783
+
*/
784
+
if (!kasan_write_only_enabled())
785
+
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_try_cmpxchg(safe, unsafe, 42));
828
786
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_sub_and_test(42, unsafe));
829
787
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_dec_and_test(unsafe));
830
788
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_inc_and_test(unsafe));
831
789
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_add_negative(42, unsafe));
832
-
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_add_unless(unsafe, 21, 42));
833
-
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_inc_not_zero(unsafe));
834
-
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_inc_unless_negative(unsafe));
835
-
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_dec_unless_positive(unsafe));
836
-
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_dec_if_positive(unsafe));
790
+
/*
791
+
* The result of the test below may vary due to garbage values of
792
+
* unsafe in write-only mode.
793
+
* Therefore, skip this test when KASAN is configured in write-only mode.
794
+
*/
795
+
if (!kasan_write_only_enabled()) {
796
+
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_add_unless(unsafe, 21, 42));
797
+
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_inc_not_zero(unsafe));
798
+
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_inc_unless_negative(unsafe));
799
+
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_dec_unless_positive(unsafe));
800
+
KUNIT_EXPECT_KASAN_FAIL(test, atomic_long_dec_if_positive(unsafe));
801
+
}
837
802
}
838
803
839
804
static void kasan_atomics(struct kunit *test)
···
903
842
/* These must trigger a KASAN report. */
904
843
if (IS_ENABLED(CONFIG_KASAN_GENERIC))
905
844
KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size]);
906
-
KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size + 5]);
907
-
KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[real_size - 1]);
845
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[size + 5]);
846
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[real_size - 1]);
908
847
909
848
kfree(ptr);
910
849
}
···
924
863
925
864
OPTIMIZER_HIDE_VAR(ptr);
926
865
KUNIT_EXPECT_KASAN_FAIL(test, ksize(ptr));
927
-
KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]);
928
-
KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size]);
866
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[0]);
867
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[size]);
929
868
}
930
869
931
870
/*
···
960
899
global_rcu_ptr = rcu_dereference_protected(
961
900
(struct kasan_rcu_info __rcu *)ptr, NULL);
962
901
963
-
KUNIT_EXPECT_KASAN_FAIL(test,
964
-
call_rcu(&global_rcu_ptr->rcu, rcu_uaf_reclaim);
965
-
rcu_barrier());
902
+
KUNIT_EXPECT_KASAN_FAIL_READ(test,
903
+
call_rcu(&global_rcu_ptr->rcu, rcu_uaf_reclaim);
904
+
rcu_barrier());
966
905
}
967
906
968
907
static void workqueue_uaf_work(struct work_struct *work)
···
985
924
queue_work(workqueue, work);
986
925
destroy_workqueue(workqueue);
987
926
988
-
KUNIT_EXPECT_KASAN_FAIL(test,
989
-
((volatile struct work_struct *)work)->data);
927
+
KUNIT_EXPECT_KASAN_FAIL_READ(test,
928
+
((volatile struct work_struct *)work)->data);
990
929
}
991
930
992
931
static void kfree_via_page(struct kunit *test)
···
1033
972
return;
1034
973
}
1035
974
1036
-
KUNIT_EXPECT_KASAN_FAIL(test, *p = p[size + OOB_TAG_OFF]);
975
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, *p = p[size + OOB_TAG_OFF]);
1037
976
1038
977
kmem_cache_free(cache, p);
1039
978
kmem_cache_destroy(cache);
···
1129
1068
*/
1130
1069
rcu_barrier();
1131
1070
1132
-
KUNIT_EXPECT_KASAN_FAIL(test, READ_ONCE(*p));
1071
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, READ_ONCE(*p));
1133
1072
1134
1073
kmem_cache_destroy(cache);
1135
1074
}
···
1307
1246
KUNIT_EXPECT_KASAN_FAIL(test,
1308
1247
((volatile char *)&elem[size])[0]);
1309
1248
else
1310
-
KUNIT_EXPECT_KASAN_FAIL(test,
1249
+
KUNIT_EXPECT_KASAN_FAIL_READ(test,
1311
1250
((volatile char *)&elem[round_up(size, KASAN_GRANULE_SIZE)])[0]);
1312
1251
1313
1252
mempool_free(elem, pool);
···
1373
1312
mempool_free(elem, pool);
1374
1313
1375
1314
ptr = page ? page_address((struct page *)elem) : elem;
1376
-
KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]);
1315
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)ptr)[0]);
1377
1316
}
1378
1317
1379
1318
static void mempool_kmalloc_uaf(struct kunit *test)
···
1632
1571
1633
1572
OPTIMIZER_HIDE_VAR(ptr);
1634
1573
OPTIMIZER_HIDE_VAR(size);
1635
-
KUNIT_EXPECT_KASAN_FAIL(test,
1574
+
KUNIT_EXPECT_KASAN_FAIL_READ(test,
1636
1575
kasan_ptr_result = memchr(ptr, '1', size + 1));
1637
1576
1638
1577
kfree(ptr);
···
1659
1598
1660
1599
OPTIMIZER_HIDE_VAR(ptr);
1661
1600
OPTIMIZER_HIDE_VAR(size);
1662
-
KUNIT_EXPECT_KASAN_FAIL(test,
1601
+
KUNIT_EXPECT_KASAN_FAIL_READ(test,
1663
1602
kasan_int_result = memcmp(ptr, arr, size+1));
1664
1603
kfree(ptr);
1665
1604
}
···
1696
1635
strscpy(ptr, src + 1, KASAN_GRANULE_SIZE));
1697
1636
1698
1637
/* strscpy should fail if the first byte is unreadable. */
1699
-
KUNIT_EXPECT_KASAN_FAIL(test, strscpy(ptr, src + KASAN_GRANULE_SIZE,
1638
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, strscpy(ptr, src + KASAN_GRANULE_SIZE,
1700
1639
KASAN_GRANULE_SIZE));
1701
1640
1702
1641
kfree(src);
···
1709
1648
* will likely point to zeroed byte.
1710
1649
*/
1711
1650
ptr += 16;
1712
-
KUNIT_EXPECT_KASAN_FAIL(test, kasan_ptr_result = strchr(ptr, '1'));
1651
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_ptr_result = strchr(ptr, '1'));
1713
1652
1714
-
KUNIT_EXPECT_KASAN_FAIL(test, kasan_ptr_result = strrchr(ptr, '1'));
1653
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_ptr_result = strrchr(ptr, '1'));
1715
1654
1716
-
KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strcmp(ptr, "2"));
1655
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_int_result = strcmp(ptr, "2"));
1717
1656
1718
-
KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strncmp(ptr, "2", 1));
1657
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_int_result = strncmp(ptr, "2", 1));
1719
1658
1720
-
KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strlen(ptr));
1659
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_int_result = strlen(ptr));
1721
1660
1722
-
KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strnlen(ptr, 1));
1661
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_int_result = strnlen(ptr, 1));
1723
1662
}
1724
1663
1725
1664
static void kasan_bitops_modify(struct kunit *test, int nr, void *addr)
···
1738
1677
{
1739
1678
KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit(nr, addr));
1740
1679
KUNIT_EXPECT_KASAN_FAIL(test, __test_and_set_bit(nr, addr));
1741
-
KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit_lock(nr, addr));
1680
+
/*
1681
+
* When KASAN is running in write-only mode,
1682
+
* a fault won't occur when the bit is set.
1683
+
* Therefore, skip the test_and_set_bit_lock test in write-only mode.
1684
+
*/
1685
+
if (!kasan_write_only_enabled())
1686
+
KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit_lock(nr, addr));
1742
1687
KUNIT_EXPECT_KASAN_FAIL(test, test_and_clear_bit(nr, addr));
1743
1688
KUNIT_EXPECT_KASAN_FAIL(test, __test_and_clear_bit(nr, addr));
1744
1689
KUNIT_EXPECT_KASAN_FAIL(test, test_and_change_bit(nr, addr));
1745
1690
KUNIT_EXPECT_KASAN_FAIL(test, __test_and_change_bit(nr, addr));
1746
-
KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = test_bit(nr, addr));
1691
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, kasan_int_result = test_bit(nr, addr));
1747
1692
if (nr < 7)
1748
1693
KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result =
1749
1694
xor_unlock_is_negative_byte(1 << nr, addr));
···
1873
1806
KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)v_ptr)[size]);
1874
1807
1875
1808
/* An aligned access into the first out-of-bounds granule. */
1876
-
KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)v_ptr)[size + 5]);
1809
+
KUNIT_EXPECT_KASAN_FAIL_READ(test, ((volatile char *)v_ptr)[size + 5]);
1877
1810
1878
1811
/* Check that in-bounds accesses to the physical page are valid. */
1879
1812
page = vmalloc_to_page(v_ptr);
···
2150
2083
2151
2084
KUNIT_EXPECT_KASAN_FAIL(test,
2152
2085
unused = copy_from_user(kmem, usermem, size + 1));
2153
-
KUNIT_EXPECT_KASAN_FAIL(test,
2086
+
KUNIT_EXPECT_KASAN_FAIL_READ(test,
2154
2087
unused = copy_to_user(usermem, kmem, size + 1));
2155
2088
KUNIT_EXPECT_KASAN_FAIL(test,
2156
2089
unused = __copy_from_user(kmem, usermem, size + 1));
2157
-
KUNIT_EXPECT_KASAN_FAIL(test,
2090
+
KUNIT_EXPECT_KASAN_FAIL_READ(test,
2158
2091
unused = __copy_to_user(usermem, kmem, size + 1));
2159
2092
KUNIT_EXPECT_KASAN_FAIL(test,
2160
2093
unused = __copy_from_user_inatomic(kmem, usermem, size + 1));
2161
-
KUNIT_EXPECT_KASAN_FAIL(test,
2094
+
KUNIT_EXPECT_KASAN_FAIL_READ(test,
2162
2095
unused = __copy_to_user_inatomic(usermem, kmem, size + 1));
2163
2096
2164
2097
/*