Re: [PATCH v6 5/8] platform: Add test managed platform_device/driver APIs

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sat, 6 Jul 2024 at 12:55, Stephen Boyd <sboyd@xxxxxxxxxx> wrote:
>
> Introduce KUnit resource wrappers around platform_driver_register(),
> platform_device_alloc(), and platform_device_add() so that test authors
> can register platform drivers/devices from their tests and have the
> drivers/devices automatically be unregistered when the test is done.
>
> This makes test setup code simpler when a platform driver or platform
> device is needed. Add a few test cases at the same time to make sure the
> APIs work as intended.
>
> Cc: Brendan Higgins <brendan.higgins@xxxxxxxxx>
> Reviewed-by: David Gow <davidgow@xxxxxxxxxx>
> Cc: Rae Moar <rmoar@xxxxxxxxxx>
> Reviewed-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> Cc: "Rafael J. Wysocki" <rafael@xxxxxxxxxx>
> Signed-off-by: Stephen Boyd <sboyd@xxxxxxxxxx>
> ---

Hmm... this is failing under KASAN for me. I'll take a closer look
next week, but in case there's anything super-obvious, here's the
report:

> [15:54:33] BUG: KASAN: slab-use-after-free in kobject_put+0x224/0x280
> [15:54:33] Read of size 1 at addr ffff888002ca484c by task kunit_try_catch/226
> [15:54:33]
> [15:54:33] CPU: 0 PID: 226 Comm: kunit_try_catch Tainted: G      D          N 6.10.0-rc1-g21fbb4cfd3cc #25
> [15:54:33] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [15:54:33] Call Trace:
> [15:54:33]  <TASK>
> [15:54:33]  dump_stack_lvl+0x3f/0x50
> [15:54:33]  print_report+0xcd/0x620
> [15:54:33]  ? kobject_put+0x224/0x280
> [15:54:33]  kasan_report+0xde/0x110
> [15:54:33]  ? kobject_put+0x224/0x280
> [15:54:33]  kobject_put+0x224/0x280
> [15:54:33]  kunit_remove_resource+0x12c/0x1d0
> [15:54:33]  kunit_cleanup+0x8d/0x130
> [15:54:33]  ? __pfx_kunit_try_run_case_cleanup+0x10/0x10
> [15:54:33]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
> [15:54:33]  kunit_generic_run_threadfn_adapter+0x7b/0xe0
> [15:54:33]  kthread+0x289/0x360
> [15:54:33]  ? __pfx_kthread+0x10/0x10
> [15:54:33]  ret_from_fork+0x2f/0x70
> [15:54:33]  ? __pfx_kthread+0x10/0x10
> [15:54:33]  ret_from_fork_asm+0x19/0x30
> [15:54:33]  </TASK>
> [15:54:33]
> [15:54:33] Allocated by task 225:
> [15:54:33]  kasan_save_stack+0x33/0x60
> [15:54:33]  kasan_save_track+0x14/0x30
> [15:54:33]  __kasan_kmalloc+0x8f/0xa0
> [15:54:33]  platform_device_alloc+0x26/0x200
> [15:54:33]  kunit_platform_device_alloc_init+0x52/0xc0
> [15:54:33]  __kunit_add_resource+0x98/0x1e0
> [15:54:33]  kunit_platform_device_alloc+0xe7/0x170
> [15:54:33]  kunit_platform_device_add_test+0x91/0x560
> [15:54:33]  kunit_try_run_case+0x1ad/0x490
> [15:54:33]  kunit_generic_run_threadfn_adapter+0x7b/0xe0
> [15:54:33]  kthread+0x289/0x360
> [15:54:33]  ret_from_fork+0x2f/0x70
> [15:54:33]  ret_from_fork_asm+0x19/0x30
> [15:54:33]
> [15:54:33] Freed by task 226:
> [15:54:33]  kasan_save_stack+0x33/0x60
> [15:54:33]  kasan_save_track+0x14/0x30
> [15:54:33]  kasan_save_free_info+0x3b/0x60
> [15:54:33]  __kasan_slab_free+0x101/0x160
> [15:54:33]  kfree+0x94/0x190
> [15:54:33]  device_release+0x9a/0x210
> [15:54:33]  kobject_put+0x150/0x280
> [15:54:33]  kunit_remove_resource+0x12c/0x1d0
> [15:54:33]  kunit_cleanup+0x8d/0x130
> [15:54:33]  kunit_generic_run_threadfn_adapter+0x7b/0xe0
> [15:54:33]  kthread+0x289/0x360
> [15:54:33]  ret_from_fork+0x2f/0x70
> [15:54:33]  ret_from_fork_asm+0x19/0x30
> [15:54:33]
> [15:54:33] The buggy address belongs to the object at ffff888002ca4800
> [15:54:33]  which belongs to the cache kmalloc-1k of size 1024
> [15:54:33] The buggy address is located 76 bytes inside of
> [15:54:33]  freed 1024-byte region [ffff888002ca4800, ffff888002ca4c00)
> [15:54:33]
> [15:54:33] The buggy address belongs to the physical page:
> [15:54:33] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2ca4
> [15:54:33] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> [15:54:33] flags: 0x4000000000000040(head|zone=1)
> [15:54:33] page_type: 0xffffefff(slab)
> [15:54:33] raw: 4000000000000040 ffff888001041b00 dead000000000122 0000000000000000
> [15:54:33] raw: 0000000000000000 0000000080080008 00000001ffffefff 0000000000000000
> [15:54:33] head: 4000000000000040 ffff888001041b00 dead000000000122 0000000000000000
> [15:54:33] head: 0000000000000000 0000000080080008 00000001ffffefff 0000000000000000
> [15:54:33] head: 4000000000000002 ffffea00000b2901 ffffffffffffffff 0000000000000000
> [15:54:33] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
> [15:54:33] page dumped because: kasan: bad access detected
> [15:54:33]
> [15:54:33] Memory state around the buggy address:
> [15:54:33]  ffff888002ca4700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [15:54:33]  ffff888002ca4780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [15:54:33] >ffff888002ca4800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [15:54:33]                                               ^
> [15:54:33]  ffff888002ca4880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [15:54:33]  ffff888002ca4900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [15:54:33] ==================================================================
> [15:54:33] ------------[ cut here ]------------
> [15:54:33] refcount_t: underflow; use-after-free.
> [15:54:33] WARNING: CPU: 0 PID: 226 at lib/refcount.c:28 refcount_warn_saturate+0xf2/0x150
> [15:54:33] CPU: 0 PID: 226 Comm: kunit_try_catch Tainted: G    B D          N 6.10.0-rc1-g21fbb4cfd3cc #25
> [15:54:33] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [15:54:33] RIP: 0010:refcount_warn_saturate+0xf2/0x150
> [15:54:33] Code: 3b aa cb 00 01 e8 3e c1 b0 ff 0f 0b eb 91 80 3d 2a aa cb 00 00 75 88 48 c7 c7 40 f3 88 ad c6 05 1a aa cb 00 01 e8 1e c1 b0 ff <0f> 0b e9 6e ff ff ff 80 3d 0a aa cb 00 00 0f 85 61 ff ff ff 48 c7
> [15:54:33] RSP: 0018:ffff88800357fe58 EFLAGS: 00000286
> [15:54:33] RAX: 0000000000000000 RBX: ffff888002ca4848 RCX: 1ffffffff5b920d4
> [15:54:33] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffffadc906a0
> [15:54:33] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff5b920d4
> [15:54:33] R10: 0000000000000003 R11: 0000000000000001 R12: ffff88800111fb28
> [15:54:33] R13: ffff88800111fb28 R14: ffff88800111fb28 R15: 0000000000000286
> [15:54:33] FS:  0000000000000000(0000) GS:ffffffffadc6f000(0000) knlGS:0000000000000000
> [15:54:33] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [15:54:33] CR2: dffffc0000000000 CR3: 000000000a25a000 CR4: 00000000000006f0
> [15:54:33] Call Trace:
> [15:54:33]  <TASK>
> [15:54:33]  ? __warn+0xb0/0x170
> [15:54:33]  ? refcount_warn_saturate+0xf2/0x150
> [15:54:33]  ? report_bug+0x298/0x350
> [15:54:33]  ? handle_bug+0x6d/0x90
> [15:54:33]  ? exc_invalid_op+0x17/0x40
> [15:54:33]  ? asm_exc_invalid_op+0x1a/0x20
> [15:54:33]  ? refcount_warn_saturate+0xf2/0x150
> [15:54:33]  ? refcount_warn_saturate+0xf2/0x150
> [15:54:33]  kunit_remove_resource+0x12c/0x1d0
> [15:54:33]  kunit_cleanup+0x8d/0x130
> [15:54:33]  ? __pfx_kunit_try_run_case_cleanup+0x10/0x10
> [15:54:33]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
> [15:54:33]  kunit_generic_run_threadfn_adapter+0x7b/0xe0
> [15:54:33]  kthread+0x289/0x360
> [15:54:33]  ? __pfx_kthread+0x10/0x10
> [15:54:33]  ret_from_fork+0x2f/0x70
> [15:54:33]  ? __pfx_kthread+0x10/0x10
> [15:54:33]  ret_from_fork_asm+0x19/0x30
> [15:54:33]  </TASK>
> [15:54:33] ---[ end trace 0000000000000000 ]---
> [15:54:33] [FAILED] kunit_platform_device_add_test

It repros here with:
./tools/testing/kunit/kunit.py run --arch x86_64 --kconfig_add
CONFIG_KASAN=y --kconfig_add CONFIG_KASAN_VMALLOC=y
kunit_platform_driver

Seems to otherwise pass on all of my default configs/archs.

Cheers,
-- David

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature


[Index of Archives]     [Linux Wireless]     [Linux Kernel]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Share Photos]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Device Mapper]

  Powered by Linux