On Wed, Mar 9, 2022 at 3:19 AM 'Peng Liu' via KUnit Development <kunit-dev@xxxxxxxxxxxxxxxx> wrote: > > Kunit will create a new thread to run an actual test case, and the > main process will wait for the completion of the actual test thread > until overtime. The variable "struct kunit test" has local property > in function kunit_try_catch_run, and will be used in the test case > thread. Task kunit_try_catch_run will free "struct kunit test" when > kunit runs overtime, but the actual test case is still run and an > UAF bug will be triggered. > > The above problem has been both observed in a physical machine and > qemu platform when running kfence kunit tests. The problem can be > triggered when setting CONFIG_KFENCE_NUM_OBJECTS = 65535. Under > this setting, the test case test_gfpzero will cost hours and kunit > will run to overtime. The follows show the panic log. > > BUG: unable to handle page fault for address: ffffffff82d882e9 > > Call Trace: > kunit_log_append+0x58/0xd0 > ... > test_alloc.constprop.0.cold+0x6b/0x8a [kfence_test] > test_gfpzero.cold+0x61/0x8ab [kfence_test] > kunit_try_run_case+0x4c/0x70 > kunit_generic_run_threadfn_adapter+0x11/0x20 > kthread+0x166/0x190 > ret_from_fork+0x22/0x30 > Kernel panic - not syncing: Fatal exception > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > Ubuntu-1.8.2-1ubuntu1 04/01/2014 > > To solve this problem, the test case thread should be stopped when > the kunit frame runs overtime. The stop signal will send in function > kunit_try_catch_run, and test_gfpzero will handle it. > > Signed-off-by: Peng Liu <liupeng256@xxxxxxxxxx> Thanks for taking care of this. Reviewed-by: Brendan Higgins <brendanhiggins@xxxxxxxxxx>
