path: root/mm/kasan/kasan_test.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 *
 * Copyright (c) 2014 Samsung Electronics Co., Ltd.
 * Author: Andrey Ryabinin <a.ryabinin@samsung.com>
 */

#define pr_fmt(fmt) "kasan_test: " fmt

#include <kunit/test.h>
#include <linux/bitops.h>
#include <linux/delay.h>
#include <linux/io.h>
#include <linux/kasan.h>
#include <linux/kernel.h>
#include <linux/mm.h>
#include <linux/mman.h>
#include <linux/module.h>
#include <linux/printk.h>
#include <linux/random.h>
#include <linux/set_memory.h>
#include <linux/slab.h>
#include <linux/string.h>
#include <linux/tracepoint.h>
#include <linux/uaccess.h>
#include <linux/vmalloc.h>
#include <trace/events/printk.h>

#include <asm/page.h>

#include "kasan.h"

#define OOB_TAG_OFF (IS_ENABLED(CONFIG_KASAN_GENERIC) ? 0 : KASAN_GRANULE_SIZE)

static bool multishot;

/* Fields set based on lines observed in the console. */
static struct {
	bool report_found;
	bool async_fault;
} test_status;

/*
 * Some tests use these global variables to store return values from function
 * calls that could otherwise be eliminated by the compiler as dead code.
 */
void *kasan_ptr_result;
int kasan_int_result;

/* Probe for console output: obtains test_status lines of interest. */
static void probe_console(void *ignore, const char *buf, size_t len)
{
	if (strnstr(buf, "BUG: KASAN: ", len))
		WRITE_ONCE(test_status.report_found, true);
	else if (strnstr(buf, "Asynchronous fault: ", len))
		WRITE_ONCE(test_status.async_fault, true);
}

static void register_tracepoints(struct tracepoint *tp, void *ignore)
{
	check_trace_callback_type_console(probe_console);
	if (!strcmp(tp->name, "console"))
		WARN_ON(tracepoint_probe_register(tp, probe_console, NULL));
}

static void unregister_tracepoints(struct tracepoint *tp, void *ignore)
{
	if (!strcmp(tp->name, "console"))
		tracepoint_probe_unregister(tp, probe_console, NULL);
}

static int kasan_suite_init(struct kunit_suite *suite)
{
	if (!kasan_enabled()) {
		pr_err("Can't run KASAN tests with KASAN disabled");
		return -1;
	}

	/* Stop failing KUnit tests on KASAN reports. */
	kasan_kunit_test_suite_start();

	/*
	 * Temporarily enable multi-shot mode. Otherwise, KASAN would only
	 * report the first detected bug and panic the kernel if panic_on_warn
	 * is enabled.
	 */
	multishot = kasan_save_enable_multi_shot();

	/*
	 * Because we want to be able to build the test as a module, we need to
	 * iterate through all known tracepoints, since the static registration
	 * won't work here.
	 */
	for_each_kernel_tracepoint(register_tracepoints, NULL);
	return 0;
}

static void kasan_suite_exit(struct kunit_suite *suite)
{
	kasan_kunit_test_suite_end();
	kasan_restore_multi_shot(multishot);
	for_each_kernel_tracepoint(unregister_tracepoints, NULL);
	tracepoint_synchronize_unregister();
}

static void kasan_test_exit(struct kunit *test)
{
	KUNIT_EXPECT_FALSE(test, READ_ONCE(test_status.report_found));
}

/**
 * KUNIT_EXPECT_KASAN_FAIL() - check that the executed expression produces a
 * KASAN report; causes a test failure otherwise. This relies on a KUnit
 * resource named "kasan_status". Do not use this name for KUnit resources
 * outside of KASAN tests.
 *
 * For hardware tag-based KASAN, when a synchronous tag fault happens, tag
 * checking is auto-disabled. When this happens, this test handler reenables
 * tag checking. As tag checking can be only disabled or enabled per CPU,
 * this handler disables migration (preemption).
 *
 * Since the compiler doesn't see that the expression can change the test_status
 * fields, it can reorder or optimize away the accesses to those fields.
 * Use READ/WRITE_ONCE() for the accesses and compiler barriers around the
 * expression to prevent that.
 *
 * In between KUNIT_EXPECT_KASAN_FAIL checks, test_status.report_found is kept
 * as false. This allows detecting KASAN reports that happen outside of the
 * checks by asserting !test_status.report_found at the start of
 * KUNIT_EXPECT_KASAN_FAIL and in kasan_test_exit.
 */
#define KUNIT_EXPECT_KASAN_FAIL(test, expression) do {			\
	if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) &&				\
	    kasan_sync_fault_possible())				\
		migrate_disable();					\
	KUNIT_EXPECT_FALSE(test, READ_ONCE(test_status.report_found));	\
	barrier();							\
	expression;							\
	barrier();							\
	if (kasan_async_fault_possible())				\
		kasan_force_async_fault();				\
	if (!READ_ONCE(test_status.report_found)) {			\
		KUNIT_FAIL(test, KUNIT_SUBTEST_INDENT "KASAN failure "	\
				"expected in \"" #expression		\
				 "\", but none occurred");		\
	}								\
	if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) &&				\
	    kasan_sync_fault_possible()) {				\
		if (READ_ONCE(test_status.report_found) &&		\
		    !READ_ONCE(test_status.async_fault))		\
			kasan_enable_tagging();				\
		migrate_enable();					\
	}								\
	WRITE_ONCE(test_status.report_found, false);			\
	WRITE_ONCE(test_status.async_fault, false);			\
} while (0)

#define KASAN_TEST_NEEDS_CONFIG_ON(test, config) do {			\
	if (!IS_ENABLED(config))					\
		kunit_skip((test), "Test requires " #config "=y");	\
} while (0)

#define KASAN_TEST_NEEDS_CONFIG_OFF(test, config) do {			\
	if (IS_ENABLED(config))						\
		kunit_skip((test), "Test requires " #config "=n");	\
} while (0)

#define KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test) do {		\
	if (IS_ENABLED(CONFIG_KASAN_HW_TAGS))				\
		break;  /* No compiler instrumentation. */		\
	if (IS_ENABLED(