kasan: add tests for call_rcu stack recording
Test call_rcu() call stack recording and verify whether it correctly is printed in KASAN report. Signed-off-by: Walter Wu <walter-zh.wu@mediatek.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Tested-by: Dmitry Vyukov <dvyukov@google.com> Reviewed-by: Dmitry Vyukov <dvyukov@google.com> Reviewed-by: Andrey Konovalov <andreyknvl@google.com> Cc: Andrey Ryabinin <aryabinin@virtuozzo.com> Cc: Alexander Potapenko <glider@google.com> Cc: Matthias Brugger <matthias.bgg@gmail.com> Cc: Joel Fernandes <joel@joelfernandes.org> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Josh Triplett <josh@joshtriplett.org> Cc: Lai Jiangshan <jiangshanlai@gmail.com> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: "Paul E . McKenney" <paulmck@kernel.org> Link: http://lkml.kernel.org/r/20200601051045.1294-1-walter-zh.wu@mediatek.com Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
committed by
Linus Torvalds
parent
e4b7818b9a
commit
387d6e4668
@@ -801,6 +801,35 @@ static noinline void __init vmalloc_oob(void)
|
|||||||
static void __init vmalloc_oob(void) {}
|
static void __init vmalloc_oob(void) {}
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
|
static struct kasan_rcu_info {
|
||||||
|
int i;
|
||||||
|
struct rcu_head rcu;
|
||||||
|
} *global_rcu_ptr;
|
||||||
|
|
||||||
|
static noinline void __init kasan_rcu_reclaim(struct rcu_head *rp)
|
||||||
|
{
|
||||||
|
struct kasan_rcu_info *fp = container_of(rp,
|
||||||
|
struct kasan_rcu_info, rcu);
|
||||||
|
|
||||||
|
kfree(fp);
|
||||||
|
fp->i = 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
static noinline void __init kasan_rcu_uaf(void)
|
||||||
|
{
|
||||||
|
struct kasan_rcu_info *ptr;
|
||||||
|
|
||||||
|
pr_info("use-after-free in kasan_rcu_reclaim\n");
|
||||||
|
ptr = kmalloc(sizeof(struct kasan_rcu_info), GFP_KERNEL);
|
||||||
|
if (!ptr) {
|
||||||
|
pr_err("Allocation failed\n");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
global_rcu_ptr = rcu_dereference_protected(ptr, NULL);
|
||||||
|
call_rcu(&global_rcu_ptr->rcu, kasan_rcu_reclaim);
|
||||||
|
}
|
||||||
|
|
||||||
static int __init kmalloc_tests_init(void)
|
static int __init kmalloc_tests_init(void)
|
||||||
{
|
{
|
||||||
/*
|
/*
|
||||||
@@ -848,6 +877,7 @@ static int __init kmalloc_tests_init(void)
|
|||||||
kasan_bitops();
|
kasan_bitops();
|
||||||
kmalloc_double_kzfree();
|
kmalloc_double_kzfree();
|
||||||
vmalloc_oob();
|
vmalloc_oob();
|
||||||
|
kasan_rcu_uaf();
|
||||||
|
|
||||||
kasan_restore_multi_shot(multishot);
|
kasan_restore_multi_shot(multishot);
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user