<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux.git/lib/kunit, branch v6.6.16</title>
<subtitle>Clone of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git</subtitle>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/'/>
<entry>
<title>kunit: run test suites only after module initialization completes</title>
<updated>2024-02-05T20:14:34+00:00</updated>
<author>
<name>Marco Pagani</name>
<email>marpagan@redhat.com</email>
</author>
<published>2024-01-10T15:59:47+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=8e4319a4e9fdff4af8fea2b587a67970ccc82810'/>
<id>8e4319a4e9fdff4af8fea2b587a67970ccc82810</id>
<content type='text'>
[ Upstream commit a1af6a2bfa0cb46d70b7df5352993e750da6c79b ]

Commit 2810c1e99867 ("kunit: Fix wild-memory-access bug in
kunit_free_suite_set()") fixed a wild-memory-access bug that could have
happened during the loading phase of test suites built and executed as
loadable modules. However, it also introduced a problematic side effect
that causes test suites modules to crash when they attempt to register
fake devices.

When a module is loaded, it traverses the MODULE_STATE_UNFORMED and
MODULE_STATE_COMING states before reaching the normal operating state
MODULE_STATE_LIVE. Finally, when the module is removed, it moves to
MODULE_STATE_GOING before being released. However, if the loading
function load_module() fails between complete_formation() and
do_init_module(), the module goes directly from MODULE_STATE_COMING to
MODULE_STATE_GOING without passing through MODULE_STATE_LIVE.

This behavior was causing kunit_module_exit() to be called without
having first executed kunit_module_init(). Since kunit_module_exit() is
responsible for freeing the memory allocated by kunit_module_init()
through kunit_filter_suites(), this behavior was resulting in a
wild-memory-access bug.

Commit 2810c1e99867 ("kunit: Fix wild-memory-access bug in
kunit_free_suite_set()") fixed this issue by running the tests when the
module is still in MODULE_STATE_COMING. However, modules in that state
are not fully initialized, lacking sysfs kobjects. Therefore, if a test
module attempts to register a fake device, it will inevitably crash.

This patch proposes a different approach to fix the original
wild-memory-access bug while restoring the normal module execution flow
by making kunit_module_exit() able to detect if kunit_module_init() has
previously initialized the tests suite set. In this way, test modules
can once again register fake devices without crashing.

This behavior is achieved by checking whether mod-&gt;kunit_suites is a
virtual or direct mapping address. If it is a virtual address, then
kunit_module_init() has allocated the suite_set in kunit_filter_suites()
using kmalloc_array(). On the contrary, if mod-&gt;kunit_suites is still
pointing to the original address that was set when looking up the
.kunit_test_suites section of the module, then the loading phase has
failed and there's no memory to be freed.

v4:
- rebased on 6.8
- noted that kunit_filter_suites() must return a virtual address
v3:
- add a comment to clarify why the start address is checked
v2:
- add include &lt;linux/mm.h&gt;

Fixes: 2810c1e99867 ("kunit: Fix wild-memory-access bug in kunit_free_suite_set()")
Reviewed-by: David Gow &lt;davidgow@google.com&gt;
Tested-by: Rae Moar &lt;rmoar@google.com&gt;
Tested-by: Richard Fitzgerald &lt;rf@opensource.cirrus.com&gt;
Reviewed-by: Javier Martinez Canillas &lt;javierm@redhat.com&gt;
Signed-off-by: Marco Pagani &lt;marpagan@redhat.com&gt;
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit a1af6a2bfa0cb46d70b7df5352993e750da6c79b ]

Commit 2810c1e99867 ("kunit: Fix wild-memory-access bug in
kunit_free_suite_set()") fixed a wild-memory-access bug that could have
happened during the loading phase of test suites built and executed as
loadable modules. However, it also introduced a problematic side effect
that causes test suites modules to crash when they attempt to register
fake devices.

When a module is loaded, it traverses the MODULE_STATE_UNFORMED and
MODULE_STATE_COMING states before reaching the normal operating state
MODULE_STATE_LIVE. Finally, when the module is removed, it moves to
MODULE_STATE_GOING before being released. However, if the loading
function load_module() fails between complete_formation() and
do_init_module(), the module goes directly from MODULE_STATE_COMING to
MODULE_STATE_GOING without passing through MODULE_STATE_LIVE.

This behavior was causing kunit_module_exit() to be called without
having first executed kunit_module_init(). Since kunit_module_exit() is
responsible for freeing the memory allocated by kunit_module_init()
through kunit_filter_suites(), this behavior was resulting in a
wild-memory-access bug.

Commit 2810c1e99867 ("kunit: Fix wild-memory-access bug in
kunit_free_suite_set()") fixed this issue by running the tests when the
module is still in MODULE_STATE_COMING. However, modules in that state
are not fully initialized, lacking sysfs kobjects. Therefore, if a test
module attempts to register a fake device, it will inevitably crash.

This patch proposes a different approach to fix the original
wild-memory-access bug while restoring the normal module execution flow
by making kunit_module_exit() able to detect if kunit_module_init() has
previously initialized the tests suite set. In this way, test modules
can once again register fake devices without crashing.

This behavior is achieved by checking whether mod-&gt;kunit_suites is a
virtual or direct mapping address. If it is a virtual address, then
kunit_module_init() has allocated the suite_set in kunit_filter_suites()
using kmalloc_array(). On the contrary, if mod-&gt;kunit_suites is still
pointing to the original address that was set when looking up the
.kunit_test_suites section of the module, then the loading phase has
failed and there's no memory to be freed.

v4:
- rebased on 6.8
- noted that kunit_filter_suites() must return a virtual address
v3:
- add a comment to clarify why the start address is checked
v2:
- add include &lt;linux/mm.h&gt;

Fixes: 2810c1e99867 ("kunit: Fix wild-memory-access bug in kunit_free_suite_set()")
Reviewed-by: David Gow &lt;davidgow@google.com&gt;
Tested-by: Rae Moar &lt;rmoar@google.com&gt;
Tested-by: Richard Fitzgerald &lt;rf@opensource.cirrus.com&gt;
Reviewed-by: Javier Martinez Canillas &lt;javierm@redhat.com&gt;
Signed-off-by: Marco Pagani &lt;marpagan@redhat.com&gt;
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>kunit: debugfs: Fix unchecked dereference in debugfs_print_results()</title>
<updated>2024-01-25T23:35:15+00:00</updated>
<author>
<name>Richard Fitzgerald</name>
<email>rf@opensource.cirrus.com</email>
</author>
<published>2023-10-30T10:47:58+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=5e990887803420f2d50b510bd1203d66ecb7d40a'/>
<id>5e990887803420f2d50b510bd1203d66ecb7d40a</id>
<content type='text'>
[ Upstream commit 34dfd5bb2e5507e69d9b6d6c90f546600c7a4977 ]

Move the call to kunit_suite_has_succeeded() after the check that
the kunit_suite pointer is valid.

This was found by smatch:

 lib/kunit/debugfs.c:66 debugfs_print_results() warn: variable
 dereferenced before check 'suite' (see line 63)

Signed-off-by: Richard Fitzgerald &lt;rf@opensource.cirrus.com&gt;
Reported-by: Dan Carpenter &lt;dan.carpenter@linaro.org&gt;
Fixes: 38289a26e1b8 ("kunit: fix debugfs code to use enum kunit_status, not bool")
Reviewed-by: Rae Moar &lt;rmoar@google.com&gt;
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 34dfd5bb2e5507e69d9b6d6c90f546600c7a4977 ]

Move the call to kunit_suite_has_succeeded() after the check that
the kunit_suite pointer is valid.

This was found by smatch:

 lib/kunit/debugfs.c:66 debugfs_print_results() warn: variable
 dereferenced before check 'suite' (see line 63)

Signed-off-by: Richard Fitzgerald &lt;rf@opensource.cirrus.com&gt;
Reported-by: Dan Carpenter &lt;dan.carpenter@linaro.org&gt;
Fixes: 38289a26e1b8 ("kunit: fix debugfs code to use enum kunit_status, not bool")
Reviewed-by: Rae Moar &lt;rmoar@google.com&gt;
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>kunit: Reset suite counter right before running tests</title>
<updated>2024-01-20T10:51:37+00:00</updated>
<author>
<name>Michal Wajdeczko</name>
<email>michal.wajdeczko@intel.com</email>
</author>
<published>2023-10-04T20:57:00+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=b12a331178d4c7dcc3d1a2323f86f5de33c5ba9c'/>
<id>b12a331178d4c7dcc3d1a2323f86f5de33c5ba9c</id>
<content type='text'>
[ Upstream commit 2e3c94aed51eabbe9c1c0ee515371ea5441c2fa7 ]

Today we reset the suite counter as part of the suite cleanup,
called from the module exit callback, but it might not work that
well as one can try to collect results without unloading a previous
test (either unintentionally or due to dependencies).

For easy reproduction try to load the kunit-test.ko and then
collect and parse results from the kunit-example-test.ko load.
Parser will complain about mismatch of expected test number:

[ ] KTAP version 1
[ ] 1..1
[ ]     # example: initializing suite
[ ]     KTAP version 1
[ ]     # Subtest: example
..
[ ] # example: pass:5 fail:0 skip:4 total:9
[ ] # Totals: pass:6 fail:0 skip:6 total:12
[ ] ok 7 example

[ ] [ERROR] Test: example: Expected test number 1 but found 7
[ ] ===================== [PASSED] example =====================
[ ] ============================================================
[ ] Testing complete. Ran 12 tests: passed: 6, skipped: 6, errors: 1

Since we are now printing suite test plan on every module load,
right before running suite tests, we should make sure that suite
counter will also start from 1. Easiest solution seems to be move
counter reset to the __kunit_test_suites_init() function.

Signed-off-by: Michal Wajdeczko &lt;michal.wajdeczko@intel.com&gt;
Cc: David Gow &lt;davidgow@google.com&gt;
Cc: Rae Moar &lt;rmoar@google.com&gt;
Reviewed-by: David Gow &lt;davidgow@google.com&gt;
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 2e3c94aed51eabbe9c1c0ee515371ea5441c2fa7 ]

Today we reset the suite counter as part of the suite cleanup,
called from the module exit callback, but it might not work that
well as one can try to collect results without unloading a previous
test (either unintentionally or due to dependencies).

For easy reproduction try to load the kunit-test.ko and then
collect and parse results from the kunit-example-test.ko load.
Parser will complain about mismatch of expected test number:

[ ] KTAP version 1
[ ] 1..1
[ ]     # example: initializing suite
[ ]     KTAP version 1
[ ]     # Subtest: example
..
[ ] # example: pass:5 fail:0 skip:4 total:9
[ ] # Totals: pass:6 fail:0 skip:6 total:12
[ ] ok 7 example

[ ] [ERROR] Test: example: Expected test number 1 but found 7
[ ] ===================== [PASSED] example =====================
[ ] ============================================================
[ ] Testing complete. Ran 12 tests: passed: 6, skipped: 6, errors: 1

Since we are now printing suite test plan on every module load,
right before running suite tests, we should make sure that suite
counter will also start from 1. Easiest solution seems to be move
counter reset to the __kunit_test_suites_init() function.

Signed-off-by: Michal Wajdeczko &lt;michal.wajdeczko@intel.com&gt;
Cc: David Gow &lt;davidgow@google.com&gt;
Cc: Rae Moar &lt;rmoar@google.com&gt;
Reviewed-by: David Gow &lt;davidgow@google.com&gt;
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>kunit: Warn if tests are slow</title>
<updated>2024-01-20T10:51:37+00:00</updated>
<author>
<name>Maxime Ripard</name>
<email>mripard@kernel.org</email>
</author>
<published>2023-10-26T08:59:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=858c0840ef02e9f49dba3860a6c6d06d181de43d'/>
<id>858c0840ef02e9f49dba3860a6c6d06d181de43d</id>
<content type='text'>
[ Upstream commit f8f2847f739dc899d0e563eac01299dadefa64ff ]

Kunit recently gained support to setup attributes, the first one being
the speed of a given test, then allowing to filter out slow tests.

A slow test is defined in the documentation as taking more than one
second. There's an another speed attribute called "super slow" but whose
definition is less clear.

Add support to the test runner to check the test execution time, and
report tests that should be marked as slow but aren't.

Signed-off-by: Maxime Ripard &lt;mripard@kernel.org&gt;
Reviewed-by: David Gow &lt;davidgow@google.com&gt;
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit f8f2847f739dc899d0e563eac01299dadefa64ff ]

Kunit recently gained support to setup attributes, the first one being
the speed of a given test, then allowing to filter out slow tests.

A slow test is defined in the documentation as taking more than one
second. There's an another speed attribute called "super slow" but whose
definition is less clear.

Add support to the test runner to check the test execution time, and
report tests that should be marked as slow but aren't.

Signed-off-by: Maxime Ripard &lt;mripard@kernel.org&gt;
Reviewed-by: David Gow &lt;davidgow@google.com&gt;
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>kunit: test: Fix the possible memory leak in executor_test</title>
<updated>2023-11-20T10:59:15+00:00</updated>
<author>
<name>Jinjie Ruan</name>
<email>ruanjinjie@huawei.com</email>
</author>
<published>2023-09-27T09:03:50+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=a2431a39590f2ce2d68109458f3fa3f49a6e3534'/>
<id>a2431a39590f2ce2d68109458f3fa3f49a6e3534</id>
<content type='text'>
[ Upstream commit 8040345fdae4cb256c5d981f91ae0f22bea8adcc ]

When CONFIG_KUNIT_ALL_TESTS=y, making CONFIG_DEBUG_KMEMLEAK=y and
CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN=y, the below memory leak is detected.

If kunit_filter_suites() succeeds, not only copy but also filtered_suite
and filtered_suite-&gt;test_cases should be freed.

So as Rae suggested, to avoid the suite set never be freed when
KUNIT_ASSERT_EQ() fails and exits after kunit_filter_suites() succeeds,
update kfree_at_end() func to free_suite_set_at_end() to use
kunit_free_suite_set() to free them as kunit_module_exit() and
kunit_run_all_tests() do it. As the second arg got of
free_suite_set_at_end() is a local variable, copy it for free to avoid
wild-memory-access. After applying this patch, the following memory leak
is never detected.

unreferenced object 0xffff8881001de400 (size 1024):
  comm "kunit_try_catch", pid 1396, jiffies 4294720452 (age 932.801s)
  hex dump (first 32 bytes):
    73 75 69 74 65 32 00 00 00 00 00 00 00 00 00 00  suite2..........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;ffffffff817db753&gt;] __kmalloc_node_track_caller+0x53/0x150
    [&lt;ffffffff817bd242&gt;] kmemdup+0x22/0x50
    [&lt;ffffffff829e961d&gt;] kunit_filter_suites+0x44d/0xcc0
    [&lt;ffffffff829eb69f&gt;] filter_suites_test+0x12f/0x360
    [&lt;ffffffff829e802a&gt;] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [&lt;ffffffff81236fc6&gt;] kthread+0x2b6/0x380
    [&lt;ffffffff81096afd&gt;] ret_from_fork+0x2d/0x70
    [&lt;ffffffff81003511&gt;] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff8881052cd388 (size 192):
  comm "kunit_try_catch", pid 1396, jiffies 4294720452 (age 932.801s)
  hex dump (first 32 bytes):
    a0 85 9e 82 ff ff ff ff 80 cd 7c 84 ff ff ff ff  ..........|.....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;ffffffff817dbad2&gt;] __kmalloc+0x52/0x150
    [&lt;ffffffff829e9651&gt;] kunit_filter_suites+0x481/0xcc0
    [&lt;ffffffff829eb69f&gt;] filter_suites_test+0x12f/0x360
    [&lt;ffffffff829e802a&gt;] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [&lt;ffffffff81236fc6&gt;] kthread+0x2b6/0x380
    [&lt;ffffffff81096afd&gt;] ret_from_fork+0x2d/0x70
    [&lt;ffffffff81003511&gt;] ret_from_fork_asm+0x11/0x20

unreferenced object 0xffff888100da8400 (size 1024):
  comm "kunit_try_catch", pid 1398, jiffies 4294720454 (age 781.945s)
  hex dump (first 32 bytes):
    73 75 69 74 65 32 00 00 00 00 00 00 00 00 00 00  suite2..........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;ffffffff817db753&gt;] __kmalloc_node_track_caller+0x53/0x150
    [&lt;ffffffff817bd242&gt;] kmemdup+0x22/0x50
    [&lt;ffffffff829e961d&gt;] kunit_filter_suites+0x44d/0xcc0
    [&lt;ffffffff829eb13f&gt;] filter_suites_test_glob_test+0x12f/0x560
    [&lt;ffffffff829e802a&gt;] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [&lt;ffffffff81236fc6&gt;] kthread+0x2b6/0x380
    [&lt;ffffffff81096afd&gt;] ret_from_fork+0x2d/0x70
    [&lt;ffffffff81003511&gt;] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888105117878 (size 96):
  comm "kunit_try_catch", pid 1398, jiffies 4294720454 (age 781.945s)
  hex dump (first 32 bytes):
    a0 85 9e 82 ff ff ff ff a0 ac 7c 84 ff ff ff ff  ..........|.....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;ffffffff817dbad2&gt;] __kmalloc+0x52/0x150
    [&lt;ffffffff829e9651&gt;] kunit_filter_suites+0x481/0xcc0
    [&lt;ffffffff829eb13f&gt;] filter_suites_test_glob_test+0x12f/0x560
    [&lt;ffffffff829e802a&gt;] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [&lt;ffffffff81236fc6&gt;] kthread+0x2b6/0x380
    [&lt;ffffffff81096afd&gt;] ret_from_fork+0x2d/0x70
    [&lt;ffffffff81003511&gt;] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888102c31c00 (size 1024):
  comm "kunit_try_catch", pid 1404, jiffies 4294720460 (age 781.948s)
  hex dump (first 32 bytes):
    6e 6f 72 6d 61 6c 5f 73 75 69 74 65 00 00 00 00  normal_suite....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;ffffffff817db753&gt;] __kmalloc_node_track_caller+0x53/0x150
    [&lt;ffffffff817bd242&gt;] kmemdup+0x22/0x50
    [&lt;ffffffff829ecf17&gt;] kunit_filter_attr_tests+0xf7/0x860
    [&lt;ffffffff829e99ff&gt;] kunit_filter_suites+0x82f/0xcc0
    [&lt;ffffffff829ea975&gt;] filter_attr_test+0x195/0x5f0
    [&lt;ffffffff829e802a&gt;] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [&lt;ffffffff81236fc6&gt;] kthread+0x2b6/0x380
    [&lt;ffffffff81096afd&gt;] ret_from_fork+0x2d/0x70
    [&lt;ffffffff81003511&gt;] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff8881052cd250 (size 192):
  comm "kunit_try_catch", pid 1404, jiffies 4294720460 (age 781.948s)
  hex dump (first 32 bytes):
    a0 85 9e 82 ff ff ff ff 00 a9 7c 84 ff ff ff ff  ..........|.....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;ffffffff817dbad2&gt;] __kmalloc+0x52/0x150
    [&lt;ffffffff829ecfc1&gt;] kunit_filter_attr_tests+0x1a1/0x860
    [&lt;ffffffff829e99ff&gt;] kunit_filter_suites+0x82f/0xcc0
    [&lt;ffffffff829ea975&gt;] filter_attr_test+0x195/0x5f0
    [&lt;ffffffff829e802a&gt;] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [&lt;ffffffff81236fc6&gt;] kthread+0x2b6/0x380
    [&lt;ffffffff81096afd&gt;] ret_from_fork+0x2d/0x70
    [&lt;ffffffff81003511&gt;] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888104f4e400 (size 1024):
  comm "kunit_try_catch", pid 1408, jiffies 4294720464 (age 781.944s)
  hex dump (first 32 bytes):
    73 75 69 74 65 00 00 00 00 00 00 00 00 00 00 00  suite...........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;ffffffff817db753&gt;] __kmalloc_node_track_caller+0x53/0x150
    [&lt;ffffffff817bd242&gt;] kmemdup+0x22/0x50
    [&lt;ffffffff829ecf17&gt;] kunit_filter_attr_tests+0xf7/0x860
    [&lt;ffffffff829e99ff&gt;] kunit_filter_suites+0x82f/0xcc0
    [&lt;ffffffff829e9fc3&gt;] filter_attr_skip_test+0x133/0x6e0
    [&lt;ffffffff829e802a&gt;] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [&lt;ffffffff81236fc6&gt;] kthread+0x2b6/0x380
    [&lt;ffffffff81096afd&gt;] ret_from_fork+0x2d/0x70
    [&lt;ffffffff81003511&gt;] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff8881052cc620 (size 192):
  comm "kunit_try_catch", pid 1408, jiffies 4294720464 (age 781.944s)
  hex dump (first 32 bytes):
    a0 85 9e 82 ff ff ff ff c0 a8 7c 84 ff ff ff ff  ..........|.....
    00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00  ................
  backtrace:
    [&lt;ffffffff817dbad2&gt;] __kmalloc+0x52/0x150
    [&lt;ffffffff829ecfc1&gt;] kunit_filter_attr_tests+0x1a1/0x860
    [&lt;ffffffff829e99ff&gt;] kunit_filter_suites+0x82f/0xcc0
    [&lt;ffffffff829e9fc3&gt;] filter_attr_skip_test+0x133/0x6e0
    [&lt;ffffffff829e802a&gt;] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [&lt;ffffffff81236fc6&gt;] kthread+0x2b6/0x380
    [&lt;ffffffff81096afd&gt;] ret_from_fork+0x2d/0x70
    [&lt;ffffffff81003511&gt;] ret_from_fork_asm+0x11/0x20

Fixes: e5857d396f35 ("kunit: flatten kunit_suite*** to kunit_suite** in .kunit_test_suites")
Fixes: 76066f93f1df ("kunit: add tests for filtering attributes")
Signed-off-by: Jinjie Ruan &lt;ruanjinjie@huawei.com&gt;
Suggested-by: Rae Moar &lt;rmoar@google.com&gt;
Reviewed-by: David Gow &lt;davidgow@google.com&gt;
Suggested-by: David Gow &lt;davidgow@google.com&gt;
Reported-by: kernel test robot &lt;lkp@intel.com&gt;
Closes: https://lore.kernel.org/oe-kbuild-all/202309142251.uJ8saAZv-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202309270433.wGmFRGjd-lkp@intel.com/
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 8040345fdae4cb256c5d981f91ae0f22bea8adcc ]

When CONFIG_KUNIT_ALL_TESTS=y, making CONFIG_DEBUG_KMEMLEAK=y and
CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN=y, the below memory leak is detected.

If kunit_filter_suites() succeeds, not only copy but also filtered_suite
and filtered_suite-&gt;test_cases should be freed.

So as Rae suggested, to avoid the suite set never be freed when
KUNIT_ASSERT_EQ() fails and exits after kunit_filter_suites() succeeds,
update kfree_at_end() func to free_suite_set_at_end() to use
kunit_free_suite_set() to free them as kunit_module_exit() and
kunit_run_all_tests() do it. As the second arg got of
free_suite_set_at_end() is a local variable, copy it for free to avoid
wild-memory-access. After applying this patch, the following memory leak
is never detected.

unreferenced object 0xffff8881001de400 (size 1024):
  comm "kunit_try_catch", pid 1396, jiffies 4294720452 (age 932.801s)
  hex dump (first 32 bytes):
    73 75 69 74 65 32 00 00 00 00 00 00 00 00 00 00  suite2..........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;ffffffff817db753&gt;] __kmalloc_node_track_caller+0x53/0x150
    [&lt;ffffffff817bd242&gt;] kmemdup+0x22/0x50
    [&lt;ffffffff829e961d&gt;] kunit_filter_suites+0x44d/0xcc0
    [&lt;ffffffff829eb69f&gt;] filter_suites_test+0x12f/0x360
    [&lt;ffffffff829e802a&gt;] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [&lt;ffffffff81236fc6&gt;] kthread+0x2b6/0x380
    [&lt;ffffffff81096afd&gt;] ret_from_fork+0x2d/0x70
    [&lt;ffffffff81003511&gt;] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff8881052cd388 (size 192):
  comm "kunit_try_catch", pid 1396, jiffies 4294720452 (age 932.801s)
  hex dump (first 32 bytes):
    a0 85 9e 82 ff ff ff ff 80 cd 7c 84 ff ff ff ff  ..........|.....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;ffffffff817dbad2&gt;] __kmalloc+0x52/0x150
    [&lt;ffffffff829e9651&gt;] kunit_filter_suites+0x481/0xcc0
    [&lt;ffffffff829eb69f&gt;] filter_suites_test+0x12f/0x360
    [&lt;ffffffff829e802a&gt;] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [&lt;ffffffff81236fc6&gt;] kthread+0x2b6/0x380
    [&lt;ffffffff81096afd&gt;] ret_from_fork+0x2d/0x70
    [&lt;ffffffff81003511&gt;] ret_from_fork_asm+0x11/0x20

unreferenced object 0xffff888100da8400 (size 1024):
  comm "kunit_try_catch", pid 1398, jiffies 4294720454 (age 781.945s)
  hex dump (first 32 bytes):
    73 75 69 74 65 32 00 00 00 00 00 00 00 00 00 00  suite2..........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;ffffffff817db753&gt;] __kmalloc_node_track_caller+0x53/0x150
    [&lt;ffffffff817bd242&gt;] kmemdup+0x22/0x50
    [&lt;ffffffff829e961d&gt;] kunit_filter_suites+0x44d/0xcc0
    [&lt;ffffffff829eb13f&gt;] filter_suites_test_glob_test+0x12f/0x560
    [&lt;ffffffff829e802a&gt;] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [&lt;ffffffff81236fc6&gt;] kthread+0x2b6/0x380
    [&lt;ffffffff81096afd&gt;] ret_from_fork+0x2d/0x70
    [&lt;ffffffff81003511&gt;] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888105117878 (size 96):
  comm "kunit_try_catch", pid 1398, jiffies 4294720454 (age 781.945s)
  hex dump (first 32 bytes):
    a0 85 9e 82 ff ff ff ff a0 ac 7c 84 ff ff ff ff  ..........|.....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;ffffffff817dbad2&gt;] __kmalloc+0x52/0x150
    [&lt;ffffffff829e9651&gt;] kunit_filter_suites+0x481/0xcc0
    [&lt;ffffffff829eb13f&gt;] filter_suites_test_glob_test+0x12f/0x560
    [&lt;ffffffff829e802a&gt;] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [&lt;ffffffff81236fc6&gt;] kthread+0x2b6/0x380
    [&lt;ffffffff81096afd&gt;] ret_from_fork+0x2d/0x70
    [&lt;ffffffff81003511&gt;] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888102c31c00 (size 1024):
  comm "kunit_try_catch", pid 1404, jiffies 4294720460 (age 781.948s)
  hex dump (first 32 bytes):
    6e 6f 72 6d 61 6c 5f 73 75 69 74 65 00 00 00 00  normal_suite....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;ffffffff817db753&gt;] __kmalloc_node_track_caller+0x53/0x150
    [&lt;ffffffff817bd242&gt;] kmemdup+0x22/0x50
    [&lt;ffffffff829ecf17&gt;] kunit_filter_attr_tests+0xf7/0x860
    [&lt;ffffffff829e99ff&gt;] kunit_filter_suites+0x82f/0xcc0
    [&lt;ffffffff829ea975&gt;] filter_attr_test+0x195/0x5f0
    [&lt;ffffffff829e802a&gt;] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [&lt;ffffffff81236fc6&gt;] kthread+0x2b6/0x380
    [&lt;ffffffff81096afd&gt;] ret_from_fork+0x2d/0x70
    [&lt;ffffffff81003511&gt;] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff8881052cd250 (size 192):
  comm "kunit_try_catch", pid 1404, jiffies 4294720460 (age 781.948s)
  hex dump (first 32 bytes):
    a0 85 9e 82 ff ff ff ff 00 a9 7c 84 ff ff ff ff  ..........|.....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;ffffffff817dbad2&gt;] __kmalloc+0x52/0x150
    [&lt;ffffffff829ecfc1&gt;] kunit_filter_attr_tests+0x1a1/0x860
    [&lt;ffffffff829e99ff&gt;] kunit_filter_suites+0x82f/0xcc0
    [&lt;ffffffff829ea975&gt;] filter_attr_test+0x195/0x5f0
    [&lt;ffffffff829e802a&gt;] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [&lt;ffffffff81236fc6&gt;] kthread+0x2b6/0x380
    [&lt;ffffffff81096afd&gt;] ret_from_fork+0x2d/0x70
    [&lt;ffffffff81003511&gt;] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888104f4e400 (size 1024):
  comm "kunit_try_catch", pid 1408, jiffies 4294720464 (age 781.944s)
  hex dump (first 32 bytes):
    73 75 69 74 65 00 00 00 00 00 00 00 00 00 00 00  suite...........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;ffffffff817db753&gt;] __kmalloc_node_track_caller+0x53/0x150
    [&lt;ffffffff817bd242&gt;] kmemdup+0x22/0x50
    [&lt;ffffffff829ecf17&gt;] kunit_filter_attr_tests+0xf7/0x860
    [&lt;ffffffff829e99ff&gt;] kunit_filter_suites+0x82f/0xcc0
    [&lt;ffffffff829e9fc3&gt;] filter_attr_skip_test+0x133/0x6e0
    [&lt;ffffffff829e802a&gt;] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [&lt;ffffffff81236fc6&gt;] kthread+0x2b6/0x380
    [&lt;ffffffff81096afd&gt;] ret_from_fork+0x2d/0x70
    [&lt;ffffffff81003511&gt;] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff8881052cc620 (size 192):
  comm "kunit_try_catch", pid 1408, jiffies 4294720464 (age 781.944s)
  hex dump (first 32 bytes):
    a0 85 9e 82 ff ff ff ff c0 a8 7c 84 ff ff ff ff  ..........|.....
    00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00  ................
  backtrace:
    [&lt;ffffffff817dbad2&gt;] __kmalloc+0x52/0x150
    [&lt;ffffffff829ecfc1&gt;] kunit_filter_attr_tests+0x1a1/0x860
    [&lt;ffffffff829e99ff&gt;] kunit_filter_suites+0x82f/0xcc0
    [&lt;ffffffff829e9fc3&gt;] filter_attr_skip_test+0x133/0x6e0
    [&lt;ffffffff829e802a&gt;] kunit_generic_run_threadfn_adapter+0x4a/0x90
    [&lt;ffffffff81236fc6&gt;] kthread+0x2b6/0x380
    [&lt;ffffffff81096afd&gt;] ret_from_fork+0x2d/0x70
    [&lt;ffffffff81003511&gt;] ret_from_fork_asm+0x11/0x20

Fixes: e5857d396f35 ("kunit: flatten kunit_suite*** to kunit_suite** in .kunit_test_suites")
Fixes: 76066f93f1df ("kunit: add tests for filtering attributes")
Signed-off-by: Jinjie Ruan &lt;ruanjinjie@huawei.com&gt;
Suggested-by: Rae Moar &lt;rmoar@google.com&gt;
Reviewed-by: David Gow &lt;davidgow@google.com&gt;
Suggested-by: David Gow &lt;davidgow@google.com&gt;
Reported-by: kernel test robot &lt;lkp@intel.com&gt;
Closes: https://lore.kernel.org/oe-kbuild-all/202309142251.uJ8saAZv-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202309270433.wGmFRGjd-lkp@intel.com/
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>kunit: Fix possible memory leak in kunit_filter_suites()</title>
<updated>2023-11-20T10:59:15+00:00</updated>
<author>
<name>Jinjie Ruan</name>
<email>ruanjinjie@huawei.com</email>
</author>
<published>2023-09-27T09:03:49+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=71edfc95113890ef872544c947b1f113519da8f4'/>
<id>71edfc95113890ef872544c947b1f113519da8f4</id>
<content type='text'>
[ Upstream commit 24de14c98b37ea40a7e493dfd0d93b400b6efbca ]

If the outer layer for loop is iterated more than once and it fails not
in the first iteration, the filtered_suite and filtered_suite-&gt;test_cases
allocated in the last kunit_filter_attr_tests() in last inner for loop
is leaked.

So add a new free_filtered_suite err label and free the filtered_suite
and filtered_suite-&gt;test_cases so far. And change kmalloc_array of copy
to kcalloc to Clear the copy to make the kfree safe.

Fixes: 529534e8cba3 ("kunit: Add ability to filter attributes")
Signed-off-by: Jinjie Ruan &lt;ruanjinjie@huawei.com&gt;
Reviewed-by: Rae Moar &lt;rmoar@google.com&gt;
Reviewed-by: David Gow &lt;davidgow@google.com&gt;
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 24de14c98b37ea40a7e493dfd0d93b400b6efbca ]

If the outer layer for loop is iterated more than once and it fails not
in the first iteration, the filtered_suite and filtered_suite-&gt;test_cases
allocated in the last kunit_filter_attr_tests() in last inner for loop
is leaked.

So add a new free_filtered_suite err label and free the filtered_suite
and filtered_suite-&gt;test_cases so far. And change kmalloc_array of copy
to kcalloc to Clear the copy to make the kfree safe.

Fixes: 529534e8cba3 ("kunit: Add ability to filter attributes")
Signed-off-by: Jinjie Ruan &lt;ruanjinjie@huawei.com&gt;
Reviewed-by: Rae Moar &lt;rmoar@google.com&gt;
Reviewed-by: David Gow &lt;davidgow@google.com&gt;
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>kunit: Fix the wrong kfree of copy for kunit_filter_suites()</title>
<updated>2023-11-20T10:59:15+00:00</updated>
<author>
<name>Jinjie Ruan</name>
<email>ruanjinjie@huawei.com</email>
</author>
<published>2023-09-27T09:03:48+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=421058c75b8339d5d898a8cde36e058cdf85393e'/>
<id>421058c75b8339d5d898a8cde36e058cdf85393e</id>
<content type='text'>
[ Upstream commit e44679515a7b803cf0143dc9de3d2ecbe907f939 ]

If the outer layer for loop is iterated more than once and it fails not
in the first iteration, the copy pointer has been moved. So it should free
the original copy's backup copy_start.

Fixes: abbf73816b6f ("kunit: fix possible memory leak in kunit_filter_suites()")
Signed-off-by: Jinjie Ruan &lt;ruanjinjie@huawei.com&gt;
Reviewed-by: Rae Moar &lt;rmoar@google.com&gt;
Reviewed-by: David Gow &lt;davidgow@google.com&gt;
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit e44679515a7b803cf0143dc9de3d2ecbe907f939 ]

If the outer layer for loop is iterated more than once and it fails not
in the first iteration, the copy pointer has been moved. So it should free
the original copy's backup copy_start.

Fixes: abbf73816b6f ("kunit: fix possible memory leak in kunit_filter_suites()")
Signed-off-by: Jinjie Ruan &lt;ruanjinjie@huawei.com&gt;
Reviewed-by: Rae Moar &lt;rmoar@google.com&gt;
Reviewed-by: David Gow &lt;davidgow@google.com&gt;
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>kunit: Fix missed memory release in kunit_free_suite_set()</title>
<updated>2023-11-20T10:59:15+00:00</updated>
<author>
<name>Jinjie Ruan</name>
<email>ruanjinjie@huawei.com</email>
</author>
<published>2023-09-27T09:03:47+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=3fc7c7079f6a6183de8605e7501c368dccd77f7b'/>
<id>3fc7c7079f6a6183de8605e7501c368dccd77f7b</id>
<content type='text'>
[ Upstream commit a6074cf0126b0bee51ab77a15930dc24a4d5db90 ]

modprobe cpumask_kunit and rmmod cpumask_kunit, kmemleak detect
a suspected memory leak as below.

If kunit_filter_suites() in kunit_module_init() succeeds, the
suite_set.start will not be NULL and the kunit_free_suite_set() in
kunit_module_exit() should free all the memory which has not
been freed. However the test_cases in suites is left out.

unreferenced object 0xffff54ac47e83200 (size 512):
  comm "modprobe", pid 592, jiffies 4294913238 (age 1367.612s)
  hex dump (first 32 bytes):
    84 13 1a f0 d3 b6 ff ff 30 68 1a f0 d3 b6 ff ff  ........0h......
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;000000008dec63a2&gt;] slab_post_alloc_hook+0xb8/0x368
    [&lt;00000000ec280d8e&gt;] __kmem_cache_alloc_node+0x174/0x290
    [&lt;00000000896c7740&gt;] __kmalloc+0x60/0x2c0
    [&lt;000000007a50fa06&gt;] kunit_filter_suites+0x254/0x5b8
    [&lt;0000000078cc98e2&gt;] kunit_module_notify+0xf4/0x240
    [&lt;0000000033cea952&gt;] notifier_call_chain+0x98/0x17c
    [&lt;00000000973d05cc&gt;] notifier_call_chain_robust+0x4c/0xa4
    [&lt;000000005f95895f&gt;] blocking_notifier_call_chain_robust+0x4c/0x74
    [&lt;0000000048e36fa7&gt;] load_module+0x1a2c/0x1c40
    [&lt;0000000004eb8a91&gt;] init_module_from_file+0x94/0xcc
    [&lt;0000000037dbba28&gt;] idempotent_init_module+0x184/0x278
    [&lt;00000000161b75cb&gt;] __arm64_sys_finit_module+0x68/0xa8
    [&lt;000000006dc1669b&gt;] invoke_syscall+0x44/0x100
    [&lt;00000000fa87e304&gt;] el0_svc_common.constprop.1+0x68/0xe0
    [&lt;000000009d8ad866&gt;] do_el0_svc+0x1c/0x28
    [&lt;000000005b83c607&gt;] el0_svc+0x3c/0xc4

Fixes: a127b154a8f2 ("kunit: tool: allow filtering test cases via glob")
Signed-off-by: Jinjie Ruan &lt;ruanjinjie@huawei.com&gt;
Reviewed-by: Rae Moar &lt;rmoar@google.com&gt;
Reviewed-by: David Gow &lt;davidgow@google.com&gt;
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit a6074cf0126b0bee51ab77a15930dc24a4d5db90 ]

modprobe cpumask_kunit and rmmod cpumask_kunit, kmemleak detect
a suspected memory leak as below.

If kunit_filter_suites() in kunit_module_init() succeeds, the
suite_set.start will not be NULL and the kunit_free_suite_set() in
kunit_module_exit() should free all the memory which has not
been freed. However the test_cases in suites is left out.

unreferenced object 0xffff54ac47e83200 (size 512):
  comm "modprobe", pid 592, jiffies 4294913238 (age 1367.612s)
  hex dump (first 32 bytes):
    84 13 1a f0 d3 b6 ff ff 30 68 1a f0 d3 b6 ff ff  ........0h......
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;000000008dec63a2&gt;] slab_post_alloc_hook+0xb8/0x368
    [&lt;00000000ec280d8e&gt;] __kmem_cache_alloc_node+0x174/0x290
    [&lt;00000000896c7740&gt;] __kmalloc+0x60/0x2c0
    [&lt;000000007a50fa06&gt;] kunit_filter_suites+0x254/0x5b8
    [&lt;0000000078cc98e2&gt;] kunit_module_notify+0xf4/0x240
    [&lt;0000000033cea952&gt;] notifier_call_chain+0x98/0x17c
    [&lt;00000000973d05cc&gt;] notifier_call_chain_robust+0x4c/0xa4
    [&lt;000000005f95895f&gt;] blocking_notifier_call_chain_robust+0x4c/0x74
    [&lt;0000000048e36fa7&gt;] load_module+0x1a2c/0x1c40
    [&lt;0000000004eb8a91&gt;] init_module_from_file+0x94/0xcc
    [&lt;0000000037dbba28&gt;] idempotent_init_module+0x184/0x278
    [&lt;00000000161b75cb&gt;] __arm64_sys_finit_module+0x68/0xa8
    [&lt;000000006dc1669b&gt;] invoke_syscall+0x44/0x100
    [&lt;00000000fa87e304&gt;] el0_svc_common.constprop.1+0x68/0xe0
    [&lt;000000009d8ad866&gt;] do_el0_svc+0x1c/0x28
    [&lt;000000005b83c607&gt;] el0_svc+0x3c/0xc4

Fixes: a127b154a8f2 ("kunit: tool: allow filtering test cases via glob")
Signed-off-by: Jinjie Ruan &lt;ruanjinjie@huawei.com&gt;
Reviewed-by: Rae Moar &lt;rmoar@google.com&gt;
Reviewed-by: David Gow &lt;davidgow@google.com&gt;
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>kunit: Fix possible memory leak in kunit_filter_suites()</title>
<updated>2023-09-05T18:30:06+00:00</updated>
<author>
<name>Jinjie Ruan</name>
<email>ruanjinjie@huawei.com</email>
</author>
<published>2023-09-03T07:10:28+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=9076bc476d7ebf0565903c4b048442131825c1c3'/>
<id>9076bc476d7ebf0565903c4b048442131825c1c3</id>
<content type='text'>
If both filter_glob and filters are not NULL, and kunit_parse_glob_filter()
succeed, but kcalloc parsed_filters fails, the suite_glob and test_glob of
parsed kzalloc in kunit_parse_glob_filter() will be leaked.

As Rae suggested, assign -ENOMEM to *err to correctly free copy and goto
free_parsed_glob to free the suite/test_glob of parsed.

Fixes: 1c9fd080dffe ("kunit: fix uninitialized variables bug in attributes filtering")
Signed-off-by: Jinjie Ruan &lt;ruanjinjie@huawei.com&gt;
Suggested-by: Rae Moar &lt;rmoar@google.com&gt;
Reviewed-by: David Gow &lt;davidgow@google.com&gt;
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
If both filter_glob and filters are not NULL, and kunit_parse_glob_filter()
succeed, but kcalloc parsed_filters fails, the suite_glob and test_glob of
parsed kzalloc in kunit_parse_glob_filter() will be leaked.

As Rae suggested, assign -ENOMEM to *err to correctly free copy and goto
free_parsed_glob to free the suite/test_glob of parsed.

Fixes: 1c9fd080dffe ("kunit: fix uninitialized variables bug in attributes filtering")
Signed-off-by: Jinjie Ruan &lt;ruanjinjie@huawei.com&gt;
Suggested-by: Rae Moar &lt;rmoar@google.com&gt;
Reviewed-by: David Gow &lt;davidgow@google.com&gt;
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>kunit: Fix possible null-ptr-deref in kunit_parse_glob_filter()</title>
<updated>2023-09-05T18:30:01+00:00</updated>
<author>
<name>Jinjie Ruan</name>
<email>ruanjinjie@huawei.com</email>
</author>
<published>2023-09-03T07:10:27+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=2b56a4b79b7b3086e842d39611db4e19b19dbe2a'/>
<id>2b56a4b79b7b3086e842d39611db4e19b19dbe2a</id>
<content type='text'>
Inject fault while probing kunit-example-test.ko, if kzalloc fails
in kunit_parse_glob_filter(), strcpy() or strncpy() to NULL will
cause below null-ptr-deref bug. So check NULL for kzalloc() and
return int instead of void for kunit_parse_glob_filter().

 Unable to handle kernel paging request at virtual address dfff800000000000
 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
 Mem abort info:
   ESR = 0x0000000096000005
   EC = 0x25: DABT (current EL), IL = 32 bits
   SET = 0, FnV = 0
   EA = 0, S1PTW = 0
   FSC = 0x05: level 1 translation fault
 Data abort info:
   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
 [dfff800000000000] address between user and kernel address ranges
 Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
 Modules linked in: kunit_example_test cfg80211 rfkill 8021q garp mrp stp llc ipv6 [last unloaded: kunit_example_test]
 CPU: 4 PID: 6047 Comm: modprobe Tainted: G        W        N 6.5.0-next-20230829+ #141
 Hardware name: linux,dummy-virt (DT)
 pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
 pc : strncpy+0x58/0xc0
 lr : kunit_filter_suites+0x15c/0xa84
 sp : ffff800082a17420
 x29: ffff800082a17420 x28: 0000000000000000 x27: 0000000000000004
 x26: 0000000000000000 x25: ffffa847e40a5320 x24: 0000000000000001
 x23: 0000000000000000 x22: 0000000000000001 x21: dfff800000000000
 x20: 000000000000002a x19: 0000000000000000 x18: 00000000750b3b54
 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
 x14: 0000000000000000 x13: 34393178302f3039 x12: ffff7508fcea4ec1
 x11: 1ffff508fcea4ec0 x10: ffff7508fcea4ec0 x9 : dfff800000000000
 x8 : ffff6051b1a7f86a x7 : ffff800082a17270 x6 : 0000000000000002
 x5 : 0000000000000098 x4 : ffff028d9817b250 x3 : 0000000000000000
 x2 : 0000000000000000 x1 : ffffa847e40a5320 x0 : 0000000000000000
 Call trace:
  strncpy+0x58/0xc0
  kunit_filter_suites+0x15c/0xa84
  kunit_module_notify+0x1b0/0x3ac
  blocking_notifier_call_chain+0xc4/0x128
  do_init_module+0x250/0x594
  load_module+0x37b0/0x44b4
  init_module_from_file+0xd4/0x128
  idempotent_init_module+0x2c8/0x524
  __arm64_sys_finit_module+0xac/0x100
  invoke_syscall+0x6c/0x258
  el0_svc_common.constprop.0+0x160/0x22c
  do_el0_svc+0x44/0x5c
  el0_svc+0x38/0x78
  el0t_64_sync_handler+0x13c/0x158
  el0t_64_sync+0x190/0x194
 Code: 5400028a d343fe63 12000a62 39400034 (38f56863)
 ---[ end trace 0000000000000000 ]---
 Kernel panic - not syncing: Oops: Fatal exception
 SMP: stopping secondary CPUs
 Kernel Offset: 0x284761400000 from 0xffff800080000000
 PHYS_OFFSET: 0xfffffd7380000000
 CPU features: 0x88000203,3c020000,1000421b
 Memory Limit: none
 Rebooting in 1 seconds..

Fixes: a127b154a8f2 ("kunit: tool: allow filtering test cases via glob")
Signed-off-by: Jinjie Ruan &lt;ruanjinjie@huawei.com&gt;
Reviewed-by: Rae Moar &lt;rmoar@google.com&gt;
Reviewed-by: David Gow &lt;davidgow@google.com&gt;
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Inject fault while probing kunit-example-test.ko, if kzalloc fails
in kunit_parse_glob_filter(), strcpy() or strncpy() to NULL will
cause below null-ptr-deref bug. So check NULL for kzalloc() and
return int instead of void for kunit_parse_glob_filter().

 Unable to handle kernel paging request at virtual address dfff800000000000
 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
 Mem abort info:
   ESR = 0x0000000096000005
   EC = 0x25: DABT (current EL), IL = 32 bits
   SET = 0, FnV = 0
   EA = 0, S1PTW = 0
   FSC = 0x05: level 1 translation fault
 Data abort info:
   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
 [dfff800000000000] address between user and kernel address ranges
 Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
 Modules linked in: kunit_example_test cfg80211 rfkill 8021q garp mrp stp llc ipv6 [last unloaded: kunit_example_test]
 CPU: 4 PID: 6047 Comm: modprobe Tainted: G        W        N 6.5.0-next-20230829+ #141
 Hardware name: linux,dummy-virt (DT)
 pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
 pc : strncpy+0x58/0xc0
 lr : kunit_filter_suites+0x15c/0xa84
 sp : ffff800082a17420
 x29: ffff800082a17420 x28: 0000000000000000 x27: 0000000000000004
 x26: 0000000000000000 x25: ffffa847e40a5320 x24: 0000000000000001
 x23: 0000000000000000 x22: 0000000000000001 x21: dfff800000000000
 x20: 000000000000002a x19: 0000000000000000 x18: 00000000750b3b54
 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
 x14: 0000000000000000 x13: 34393178302f3039 x12: ffff7508fcea4ec1
 x11: 1ffff508fcea4ec0 x10: ffff7508fcea4ec0 x9 : dfff800000000000
 x8 : ffff6051b1a7f86a x7 : ffff800082a17270 x6 : 0000000000000002
 x5 : 0000000000000098 x4 : ffff028d9817b250 x3 : 0000000000000000
 x2 : 0000000000000000 x1 : ffffa847e40a5320 x0 : 0000000000000000
 Call trace:
  strncpy+0x58/0xc0
  kunit_filter_suites+0x15c/0xa84
  kunit_module_notify+0x1b0/0x3ac
  blocking_notifier_call_chain+0xc4/0x128
  do_init_module+0x250/0x594
  load_module+0x37b0/0x44b4
  init_module_from_file+0xd4/0x128
  idempotent_init_module+0x2c8/0x524
  __arm64_sys_finit_module+0xac/0x100
  invoke_syscall+0x6c/0x258
  el0_svc_common.constprop.0+0x160/0x22c
  do_el0_svc+0x44/0x5c
  el0_svc+0x38/0x78
  el0t_64_sync_handler+0x13c/0x158
  el0t_64_sync+0x190/0x194
 Code: 5400028a d343fe63 12000a62 39400034 (38f56863)
 ---[ end trace 0000000000000000 ]---
 Kernel panic - not syncing: Oops: Fatal exception
 SMP: stopping secondary CPUs
 Kernel Offset: 0x284761400000 from 0xffff800080000000
 PHYS_OFFSET: 0xfffffd7380000000
 CPU features: 0x88000203,3c020000,1000421b
 Memory Limit: none
 Rebooting in 1 seconds..

Fixes: a127b154a8f2 ("kunit: tool: allow filtering test cases via glob")
Signed-off-by: Jinjie Ruan &lt;ruanjinjie@huawei.com&gt;
Reviewed-by: Rae Moar &lt;rmoar@google.com&gt;
Reviewed-by: David Gow &lt;davidgow@google.com&gt;
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
