On Wed, Mar 25, 2020 at 5:13 PM <glider@xxxxxxxxxx> wrote:
>
> The initial commit adds several tests that trigger KMSAN warnings in
> simple cases.
> To use, build the kernel with CONFIG_TEST_KMSAN and do
> `insmod test_kmsan.ko`
>
> Signed-off-by: Alexander Potapenko <glider@xxxxxxxxxx>
> To: Alexander Potapenko <glider@xxxxxxxxxx>
> Cc: Vegard Nossum <vegard.nossum@xxxxxxxxxx>
> Cc: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
> Cc: Marco Elver <elver@xxxxxxxxxx>
> Cc: Andrey Konovalov <andreyknvl@xxxxxxxxxx>
> Cc: linux-mm@xxxxxxxxx
> ---
> v2:
> - added printk_test()
> v4:
> - test_kmsan: don't report -Wuninitialized warnings in the test
> - test_kmsan.c: addressed comments by Andrey Konovalov
>
> Change-Id: I287e86ae83a82b770f2baa46e5bbdce1dfa65195
> ---
> lib/Makefile | 2 +
> lib/test_kmsan.c | 229 +++++++++++++++++++++++++++++++++++++++++++++++
> 2 files changed, 231 insertions(+)
> create mode 100644 lib/test_kmsan.c
>
> diff --git a/lib/Makefile b/lib/Makefile
> index ab68a86743607..d8058c5c05826 100644
> --- a/lib/Makefile
> +++ b/lib/Makefile
> @@ -68,6 +68,8 @@ CFLAGS_test_kasan.o += $(call cc-disable-warning, vla)
> obj-$(CONFIG_TEST_UBSAN) += test_ubsan.o
> CFLAGS_test_ubsan.o += $(call cc-disable-warning, vla)
> UBSAN_SANITIZE_test_ubsan.o := y
> +obj-$(CONFIG_TEST_KMSAN) += test_kmsan.o
> +CFLAGS_test_kmsan.o += $(call cc-disable-warning, uninitialized)
> obj-$(CONFIG_TEST_KSTRTOX) += test-kstrtox.o
> obj-$(CONFIG_TEST_LIST_SORT) += test_list_sort.o
> obj-$(CONFIG_TEST_MIN_HEAP) += test_min_heap.o
> diff --git a/lib/test_kmsan.c b/lib/test_kmsan.c
> new file mode 100644
> index 0000000000000..f1780ed0cd315
> --- /dev/null
> +++ b/lib/test_kmsan.c
> @@ -0,0 +1,229 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * Module for testing KMSAN.
> + *
> + * Copyright (C) 2017-2019 Google LLC
> + * Author: Alexander Potapenko <glider@xxxxxxxxxx>
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License version 2 as
> + * published by the Free Software Foundation.
> + *
> + */
> +
> +/*
> + * Tests below use noinline and volatile to work around compiler optimizations
> + * that may mask KMSAN bugs.
> + */
> +#define pr_fmt(fmt) "kmsan test: %s : " fmt, __func__
> +
> +#include <linux/mm.h>
> +#include <linux/module.h>
> +#include <linux/printk.h>
> +#include <linux/slab.h>
> +#include <linux/kmsan-checks.h>
> +
> +#define CHECK(x) \
> + do { \
> + if (x) \
> + pr_info(#x " is true\n"); \
> + else \
> + pr_info(#x " is false\n"); \
> + } while (0)
> +
> +int signed_sum3(int a, int b, int c)
static here and below.
Also makes sense to move this function closer to uninit_multiple_args_test().
> +{
> + return a + b + c;
> +}
> +
> +noinline void uninit_kmalloc_test(void)
> +{
> + int *ptr;
> +
> + pr_info("-----------------------------\n");
> + pr_info("uninitialized kmalloc test (UMR report)\n");
> + ptr = kmalloc(sizeof(int), GFP_KERNEL);
> + pr_info("kmalloc returned %p\n", ptr);
> + CHECK(*ptr);
kfree(ptr) here and below.
In KASAN tests we also check that kmalloc() succeeds, but I don't have
a strong opinion on whether we should do that.
> +}
> +noinline void init_kmalloc_test(void)
> +{
> + int *ptr;
> +
> + pr_info("-----------------------------\n");
> + pr_info("initialized kmalloc test (no reports)\n");
> + ptr = kmalloc(sizeof(int), GFP_KERNEL);
> + memset(ptr, 0, sizeof(int));
> + pr_info("kmalloc returned %p\n", ptr);
> + CHECK(*ptr);
> +}
> +
> +noinline void init_kzalloc_test(void)
> +{
> + int *ptr;
> +
> + pr_info("-----------------------------\n");
> + pr_info("initialized kzalloc test (no reports)\n");
> + ptr = kzalloc(sizeof(int), GFP_KERNEL);
> + pr_info("kzalloc returned %p\n", ptr);
> + CHECK(*ptr);
> +}
> +
> +noinline void uninit_multiple_args_test(void)
> +{
> + volatile int a;
> + volatile char b = 3, c;
> +
> + pr_info("-----------------------------\n");
> + pr_info("uninitialized local passed to fn (UMR report)\n");
> + CHECK(signed_sum3(a, b, c));
> +}
> +
> +noinline void uninit_stack_var_test(void)
> +{
> + int cond;
> +
> + pr_info("-----------------------------\n");
> + pr_info("uninitialized stack variable (UMR report)\n");
> + CHECK(cond);
> +}
> +
> +noinline void init_stack_var_test(void)
> +{
> + volatile int cond = 1;
> +
> + pr_info("-----------------------------\n");
> + pr_info("initialized stack variable (no reports)\n");
> + CHECK(cond);
> +}
> +
> +noinline void two_param_fn_2(int arg1, int arg2)
> +{
> + CHECK(arg1);
> + CHECK(arg2);
> +}
> +
> +noinline void one_param_fn(int arg)
> +{
> + two_param_fn_2(arg, arg);
> + CHECK(arg);
> +}
> +
> +noinline void two_param_fn(int arg1, int arg2)
> +{
> + int init = 0;
> +
> + one_param_fn(init);
> + CHECK(arg1);
> + CHECK(arg2);
> +}
> +
> +noinline void params_test(void)
> +{
> + volatile int uninit, init = 1;
> +
> + pr_info("-----------------------------\n");
> + pr_info("uninit passed through a function parameter (UMR report)\n");
> + two_param_fn(uninit, init);
> +}
> +
> +noinline void do_uninit_local_array(char *array, int start, int stop)
> +{
> + int i;
> + volatile char uninit;
> +
> + for (i = start; i < stop; i++)
> + array[i] = uninit;
> +}
> +
> +noinline void uninit_kmsan_check_memory_test(void)
> +{
> + volatile char local_array[8];
> +
> + pr_info("-----------------------------\n");
> + pr_info("kmsan_check_memory() called on uninit local (UMR report)\n");
> + do_uninit_local_array((char *)local_array, 5, 7);
> +
> + kmsan_check_memory((char *)local_array, 8);
> +}
> +
> +noinline void init_kmsan_vmap_vunmap_test(void)
> +{
> + const int npages = 2;
> + struct page *pages[npages];
> + void *vbuf;
> + int i;
> +
> + pr_info("-----------------------------\n");
> + pr_info("pages initialized via vmap (no reports)\n");
> +
> + for (i = 0; i < npages; i++)
> + pages[i] = alloc_page(GFP_KERNEL);
> + vbuf = vmap(pages, npages, VM_MAP, PAGE_KERNEL);
> + memset(vbuf, 0xfe, npages * PAGE_SIZE);
> + for (i = 0; i < npages; i++)
> + kmsan_check_memory(page_address(pages[i]), PAGE_SIZE);
> +
> + if (vbuf)
> + vunmap(vbuf);
> + for (i = 0; i < npages; i++)
> + if (pages[i])
> + __free_page(pages[i]);
> +}
> +
> +noinline void init_vmalloc_test(void)
> +{
> + char *buf;
> + int npages = 8, i;
> +
> + pr_info("-----------------------------\n");
> + pr_info("pages initialized via vmap (no reports)\n");
> + buf = vmalloc(PAGE_SIZE * npages);
> + buf[0] = 1;
> + memset(buf, 0xfe, PAGE_SIZE * npages);
> + CHECK(buf[0]);
> + for (i = 0; i < npages; i++)
> + kmsan_check_memory(&buf[PAGE_SIZE * i], PAGE_SIZE);
> + vfree(buf);
> +}
> +
> +noinline void uaf_test(void)
> +{
> + volatile int *var;
> +
> + pr_info("-----------------------------\n");
> + pr_info("use-after-free in kmalloc-ed buffer (UMR report)\n");
> + var = kmalloc(80, GFP_KERNEL);
> + var[3] = 0xfeedface;
> + kfree((int *)var);
> + CHECK(var[3]);
> +}
> +
> +noinline void printk_test(void)
> +{
> + volatile int uninit;
> +
> + pr_info("-----------------------------\n");
> + pr_info("uninit local passed to pr_info() (UMR report)\n");
> + pr_info("%px contains %d\n", &uninit, uninit);
> +}
> +
> +static noinline int __init kmsan_tests_init(void)
> +{
> + uninit_kmalloc_test();
> + init_kmalloc_test();
> + init_kzalloc_test();
> + uninit_multiple_args_test();
> + uninit_stack_var_test();
> + init_stack_var_test();
> + params_test();
> + uninit_kmsan_check_memory_test();
> + init_kmsan_vmap_vunmap_test();
> + init_vmalloc_test();
> + uaf_test();
> + printk_test();
> + return -EAGAIN;
> +}
> +
> +module_init(kmsan_tests_init);
> +MODULE_LICENSE("GPL");
> --
> 2.25.1.696.g5e7596f4ac-goog
>
