tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

kasan: add test for SLAB_TYPESAFE_BY_RCU quarantine skipping

Verify that KASAN does not quarantine objects in SLAB_TYPESAFE_BY_RCU
slabs if CONFIG_SLUB_RCU_DEBUG is off.

[jannh@google.com: v2]
Link: https://lkml.kernel.org/r/20250729-kasan-tsbrcu-noquarantine-test-v2-1-d16bd99309c9@google.com
[jannh@google.com: make comment more verbose]
Link: https://lkml.kernel.org/r/20250814-kasan-tsbrcu-noquarantine-test-v3-1-9e9110009b4e@google.com
Link: https://lkml.kernel.org/r/20250728-kasan-tsbrcu-noquarantine-test-v1-1-fa24d9ab7f41@google.com
Signed-off-by: Jann Horn <jannh@google.com>
Suggested-by: Andrey Konovalov <andreyknvl@gmail.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitriy Vyukov <dvyukov@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

authored by

Jann Horn and committed by
Andrew Morton e5eb3246 56b060d0

+40
+40
mm/kasan/kasan_test_c.c
··· 1073 1073 kmem_cache_destroy(cache); 1074 1074 } 1075 1075 1076 + /* 1077 + * Check that SLAB_TYPESAFE_BY_RCU objects are immediately reused when 1078 + * CONFIG_SLUB_RCU_DEBUG is off, and stay at the same address. 1079 + * Without this, KASAN builds would be unable to trigger bugs caused by 1080 + * SLAB_TYPESAFE_BY_RCU users handling reycled objects improperly. 1081 + */ 1082 + static void kmem_cache_rcu_reuse(struct kunit *test) 1083 + { 1084 + char *p, *p2; 1085 + struct kmem_cache *cache; 1086 + 1087 + KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_SLUB_RCU_DEBUG); 1088 + 1089 + cache = kmem_cache_create("test_cache", 16, 0, SLAB_TYPESAFE_BY_RCU, 1090 + NULL); 1091 + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); 1092 + 1093 + migrate_disable(); 1094 + p = kmem_cache_alloc(cache, GFP_KERNEL); 1095 + if (!p) { 1096 + kunit_err(test, "Allocation failed: %s\n", __func__); 1097 + goto out; 1098 + } 1099 + 1100 + kmem_cache_free(cache, p); 1101 + p2 = kmem_cache_alloc(cache, GFP_KERNEL); 1102 + if (!p2) { 1103 + kunit_err(test, "Allocation failed: %s\n", __func__); 1104 + goto out; 1105 + } 1106 + KUNIT_EXPECT_PTR_EQ(test, p, p2); 1107 + 1108 + kmem_cache_free(cache, p2); 1109 + 1110 + out: 1111 + migrate_enable(); 1112 + kmem_cache_destroy(cache); 1113 + } 1114 + 1076 1115 static void kmem_cache_double_destroy(struct kunit *test) 1077 1116 { 1078 1117 struct kmem_cache *cache; ··· 2145 2106 KUNIT_CASE(kmem_cache_double_free), 2146 2107 KUNIT_CASE(kmem_cache_invalid_free), 2147 2108 KUNIT_CASE(kmem_cache_rcu_uaf), 2109 + KUNIT_CASE(kmem_cache_rcu_reuse), 2148 2110 KUNIT_CASE(kmem_cache_double_destroy), 2149 2111 KUNIT_CASE(kmem_cache_accounted), 2150 2112 KUNIT_CASE(kmem_cache_bulk),