On Wed, May 04, 2022 at 11:00:38AM +0800, David Gow wrote:
> On Wed, May 4, 2022 at 9:47 AM Kees Cook <keescook@xxxxxxxxxxxx> wrote:
> >
> > Add tests for the new flexible array structure helpers. These can be run
> > with:
> >
> > make ARCH=um mrproper
> > ./tools/testing/kunit/kunit.py config
>
> Nit: it shouldn't be necessary to run kunit.py config separately:
> kunit.py run will configure the kernel if necessary.
Ah yes, I think you mentioned this before. I'll adjust the commit log.
>
> > ./tools/testing/kunit/kunit.py run flex_array
> >
> > Cc: David Gow <davidgow@xxxxxxxxxx>
> > Cc: kunit-dev@xxxxxxxxxxxxxxxx
> > Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
> > ---
>
> This looks pretty good to me: it certainly worked on the different
> setups I tried (um, x86_64, x86_64+KASAN).
>
> A few minor nitpicks inline, mostly around minor config-y things, or
> things which weren't totally clear on my first read-through.
>
> Hopefully one day, with the various stubbing features or something
> similar, we'll be able to check against allocation failures in
> flex_dup(), too, but otherwise nothing seems too obviously missing.
>
> Reviewed-by: David Gow <davidgow@xxxxxxxxxx>
Great; thanks for the review and testing!
>
> -- David
>
> > lib/Kconfig.debug | 12 +-
> > lib/Makefile | 1 +
> > lib/flex_array_kunit.c | 523 +++++++++++++++++++++++++++++++++++++++++
> > 3 files changed, 531 insertions(+), 5 deletions(-)
> > create mode 100644 lib/flex_array_kunit.c
> >
> > diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
> > index 9077bb38bc93..8bae6b169c50 100644
> > --- a/lib/Kconfig.debug
> > +++ b/lib/Kconfig.debug
> > @@ -2551,11 +2551,6 @@ config OVERFLOW_KUNIT_TEST
> > Builds unit tests for the check_*_overflow(), size_*(), allocation, and
> > related functions.
> >
> > - For more information on KUnit and unit tests in general please refer
> > - to the KUnit documentation in Documentation/dev-tools/kunit/.
> > -
> > - If unsure, say N.
> > -
>
> Nit: while I'm not against removing some of this boilerplate, is it
> better suited for a separate commit?
Make sense, yes. I'll drop this for now.
>
> > config STACKINIT_KUNIT_TEST
> > tristate "Test level of stack variable initialization" if !KUNIT_ALL_TESTS
> > depends on KUNIT
> > @@ -2567,6 +2562,13 @@ config STACKINIT_KUNIT_TEST
> > CONFIG_GCC_PLUGIN_STRUCTLEAK, CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF,
> > or CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL.
> >
> > +config FLEX_ARRAY_KUNIT_TEST
> > + tristate "Test flex_*() family of helper functions at runtime" if !KUNIT_ALL_TESTS
> > + depends on KUNIT
> > + default KUNIT_ALL_TESTS
> > + help
> > + Builds unit tests for flexible array copy helper functions.
> > +
>
> Nit: checkpatch warns that the description here may be insufficient:
> WARNING: please write a help paragraph that fully describes the config symbol
Yeah, I don't know anything to put here that isn't just more
boilerplate, so I'm choosing to ignore this for now. :)
> > [...]
> > +struct normal {
> > + size_t datalen;
> > + u32 data[];
> > +};
> > +
> > +struct decl_normal {
> > + DECLARE_FLEX_ARRAY_ELEMENTS_COUNT(size_t, datalen);
> > + DECLARE_FLEX_ARRAY_ELEMENTS(u32, data);
> > +};
> > +
> > +struct aligned {
> > + unsigned short datalen;
> > + char data[] __aligned(__alignof__(u64));
> > +};
> > +
> > +struct decl_aligned {
> > + DECLARE_FLEX_ARRAY_ELEMENTS_COUNT(unsigned short, datalen);
> > + DECLARE_FLEX_ARRAY_ELEMENTS(char, data) __aligned(__alignof__(u64));
> > +};
> > +
> > +static void struct_test(struct kunit *test)
> > +{
> > + COMPARE_STRUCTS(struct normal, struct decl_normal);
> > + COMPARE_STRUCTS(struct aligned, struct decl_aligned);
> > +}
>
> If I understand it, the purpose of this is to ensure that structs both
> with and without the flexible array declaration have the same memory
> layout?
>
> If so, any chance of a comment briefly stating that's the purpose (or
> renaming this test struct_layout_test())?
Yeah, good idea; I'll improve the naming.
>
> Also, would it make sense to do the same with the struct with internal
> padding below?
Heh, yes, good point! :)
> [...]
> > +#define CHECK_COPY(ptr) do { \
> > + typeof(*(ptr)) *_cc_dst = (ptr); \
> > + KUNIT_EXPECT_EQ(test, _cc_dst->induce_padding, 0); \
> > + memcpy(&padding, &_cc_dst->induce_padding + sizeof(_cc_dst->induce_padding), \
> > + sizeof(padding)); \
> > + /* Padding should be zero too. */ \
> > + KUNIT_EXPECT_EQ(test, padding, 0); \
> > + KUNIT_EXPECT_EQ(test, src->count, _cc_dst->count); \
> > + KUNIT_EXPECT_EQ(test, _cc_dst->count, TEST_TARGET); \
> > + for (i = 0; i < _cc_dst->count - 1; i++) { \
> > + /* 'A' is 0x41, and here repeated in a u32. */ \
>
> Would it be simpler to just note that the magic value is 0x41, rather
> than have it be the character 'A'?
Yeah, now fixed.
> [...]
> > + CHECK_COPY(&encap->fas);
> > + /* Check that items external to "fas" are zero. */
> > + KUNIT_EXPECT_EQ(test, encap->flags, 0);
> > + KUNIT_EXPECT_EQ(test, encap->junk, 0);
> > + kfree(encap);
> > +#undef MAGIC_WORD
>
> MAGIC_WORD isn't defined (or used) for flux_dup_test? Is it worth
> using it (or something similar) for the 'A' / 0x14141414 and the
> CHECK_COPY() macro?
Oops, yes. Fixed.
Thanks again!
-Kees
--
Kees Cook
