]> Git Repo - linux.git/blob - lib/slub_kunit.c
Linux 6.14-rc3
[linux.git] / lib / slub_kunit.c
1 // SPDX-License-Identifier: GPL-2.0
2 #include <kunit/test.h>
3 #include <kunit/test-bug.h>
4 #include <linux/mm.h>
5 #include <linux/slab.h>
6 #include <linux/module.h>
7 #include <linux/kernel.h>
8 #include <linux/rcupdate.h>
9 #include "../mm/slab.h"
10
11 static struct kunit_resource resource;
12 static int slab_errors;
13
14 /*
15  * Wrapper function for kmem_cache_create(), which reduces 2 parameters:
16  * 'align' and 'ctor', and sets SLAB_SKIP_KFENCE flag to avoid getting an
17  * object from kfence pool, where the operation could be caught by both
18  * our test and kfence sanity check.
19  */
20 static struct kmem_cache *test_kmem_cache_create(const char *name,
21                                 unsigned int size, slab_flags_t flags)
22 {
23         struct kmem_cache *s = kmem_cache_create(name, size, 0,
24                                         (flags | SLAB_NO_USER_FLAGS), NULL);
25         s->flags |= SLAB_SKIP_KFENCE;
26         return s;
27 }
28
29 static void test_clobber_zone(struct kunit *test)
30 {
31         struct kmem_cache *s = test_kmem_cache_create("TestSlub_RZ_alloc", 64,
32                                                         SLAB_RED_ZONE);
33         u8 *p = kmem_cache_alloc(s, GFP_KERNEL);
34
35         kasan_disable_current();
36         p[64] = 0x12;
37
38         validate_slab_cache(s);
39         KUNIT_EXPECT_EQ(test, 2, slab_errors);
40
41         kasan_enable_current();
42         kmem_cache_free(s, p);
43         kmem_cache_destroy(s);
44 }
45
46 #ifndef CONFIG_KASAN
47 static void test_next_pointer(struct kunit *test)
48 {
49         struct kmem_cache *s = test_kmem_cache_create("TestSlub_next_ptr_free",
50                                                         64, SLAB_POISON);
51         u8 *p = kmem_cache_alloc(s, GFP_KERNEL);
52         unsigned long tmp;
53         unsigned long *ptr_addr;
54
55         kmem_cache_free(s, p);
56
57         ptr_addr = (unsigned long *)(p + s->offset);
58         tmp = *ptr_addr;
59         p[s->offset] = ~p[s->offset];
60
61         /*
62          * Expecting three errors.
63          * One for the corrupted freechain and the other one for the wrong
64          * count of objects in use. The third error is fixing broken cache.
65          */
66         validate_slab_cache(s);
67         KUNIT_EXPECT_EQ(test, 3, slab_errors);
68
69         /*
70          * Try to repair corrupted freepointer.
71          * Still expecting two errors. The first for the wrong count
72          * of objects in use.
73          * The second error is for fixing broken cache.
74          */
75         *ptr_addr = tmp;
76         slab_errors = 0;
77
78         validate_slab_cache(s);
79         KUNIT_EXPECT_EQ(test, 2, slab_errors);
80
81         /*
82          * Previous validation repaired the count of objects in use.
83          * Now expecting no error.
84          */
85         slab_errors = 0;
86         validate_slab_cache(s);
87         KUNIT_EXPECT_EQ(test, 0, slab_errors);
88
89         kmem_cache_destroy(s);
90 }
91
92 static void test_first_word(struct kunit *test)
93 {
94         struct kmem_cache *s = test_kmem_cache_create("TestSlub_1th_word_free",
95                                                         64, SLAB_POISON);
96         u8 *p = kmem_cache_alloc(s, GFP_KERNEL);
97
98         kmem_cache_free(s, p);
99         *p = 0x78;
100
101         validate_slab_cache(s);
102         KUNIT_EXPECT_EQ(test, 2, slab_errors);
103
104         kmem_cache_destroy(s);
105 }
106
107 static void test_clobber_50th_byte(struct kunit *test)
108 {
109         struct kmem_cache *s = test_kmem_cache_create("TestSlub_50th_word_free",
110                                                         64, SLAB_POISON);
111         u8 *p = kmem_cache_alloc(s, GFP_KERNEL);
112
113         kmem_cache_free(s, p);
114         p[50] = 0x9a;
115
116         validate_slab_cache(s);
117         KUNIT_EXPECT_EQ(test, 2, slab_errors);
118
119         kmem_cache_destroy(s);
120 }
121 #endif
122
123 static void test_clobber_redzone_free(struct kunit *test)
124 {
125         struct kmem_cache *s = test_kmem_cache_create("TestSlub_RZ_free", 64,
126                                                         SLAB_RED_ZONE);
127         u8 *p = kmem_cache_alloc(s, GFP_KERNEL);
128
129         kasan_disable_current();
130         kmem_cache_free(s, p);
131         p[64] = 0xab;
132
133         validate_slab_cache(s);
134         KUNIT_EXPECT_EQ(test, 2, slab_errors);
135
136         kasan_enable_current();
137         kmem_cache_destroy(s);
138 }
139
140 static void test_kmalloc_redzone_access(struct kunit *test)
141 {
142         struct kmem_cache *s = test_kmem_cache_create("TestSlub_RZ_kmalloc", 32,
143                                 SLAB_KMALLOC|SLAB_STORE_USER|SLAB_RED_ZONE);
144         u8 *p = alloc_hooks(__kmalloc_cache_noprof(s, GFP_KERNEL, 18));
145
146         kasan_disable_current();
147
148         /* Suppress the -Warray-bounds warning */
149         OPTIMIZER_HIDE_VAR(p);
150         p[18] = 0xab;
151         p[19] = 0xab;
152
153         validate_slab_cache(s);
154         KUNIT_EXPECT_EQ(test, 2, slab_errors);
155
156         kasan_enable_current();
157         kmem_cache_free(s, p);
158         kmem_cache_destroy(s);
159 }
160
161 struct test_kfree_rcu_struct {
162         struct rcu_head rcu;
163 };
164
165 static void test_kfree_rcu(struct kunit *test)
166 {
167         struct kmem_cache *s;
168         struct test_kfree_rcu_struct *p;
169
170         if (IS_BUILTIN(CONFIG_SLUB_KUNIT_TEST))
171                 kunit_skip(test, "can't do kfree_rcu() when test is built-in");
172
173         s = test_kmem_cache_create("TestSlub_kfree_rcu",
174                                    sizeof(struct test_kfree_rcu_struct),
175                                    SLAB_NO_MERGE);
176         p = kmem_cache_alloc(s, GFP_KERNEL);
177
178         kfree_rcu(p, rcu);
179         kmem_cache_destroy(s);
180
181         KUNIT_EXPECT_EQ(test, 0, slab_errors);
182 }
183
184 static void test_leak_destroy(struct kunit *test)
185 {
186         struct kmem_cache *s = test_kmem_cache_create("TestSlub_leak_destroy",
187                                                         64, SLAB_NO_MERGE);
188         kmem_cache_alloc(s, GFP_KERNEL);
189
190         kmem_cache_destroy(s);
191
192         KUNIT_EXPECT_EQ(test, 2, slab_errors);
193 }
194
195 static void test_krealloc_redzone_zeroing(struct kunit *test)
196 {
197         u8 *p;
198         int i;
199         struct kmem_cache *s = test_kmem_cache_create("TestSlub_krealloc", 64,
200                                 SLAB_KMALLOC|SLAB_STORE_USER|SLAB_RED_ZONE);
201
202         p = alloc_hooks(__kmalloc_cache_noprof(s, GFP_KERNEL, 48));
203         memset(p, 0xff, 48);
204
205         kasan_disable_current();
206         OPTIMIZER_HIDE_VAR(p);
207
208         /* Test shrink */
209         p = krealloc(p, 40, GFP_KERNEL | __GFP_ZERO);
210         for (i = 40; i < 64; i++)
211                 KUNIT_EXPECT_EQ(test, p[i], SLUB_RED_ACTIVE);
212
213         /* Test grow within the same 64B kmalloc object */
214         p = krealloc(p, 56, GFP_KERNEL | __GFP_ZERO);
215         for (i = 40; i < 56; i++)
216                 KUNIT_EXPECT_EQ(test, p[i], 0);
217         for (i = 56; i < 64; i++)
218                 KUNIT_EXPECT_EQ(test, p[i], SLUB_RED_ACTIVE);
219
220         validate_slab_cache(s);
221         KUNIT_EXPECT_EQ(test, 0, slab_errors);
222
223         memset(p, 0xff, 56);
224         /* Test grow with allocating a bigger 128B object */
225         p = krealloc(p, 112, GFP_KERNEL | __GFP_ZERO);
226         for (i = 0; i < 56; i++)
227                 KUNIT_EXPECT_EQ(test, p[i], 0xff);
228         for (i = 56; i < 112; i++)
229                 KUNIT_EXPECT_EQ(test, p[i], 0);
230
231         kfree(p);
232         kasan_enable_current();
233         kmem_cache_destroy(s);
234 }
235
236 static int test_init(struct kunit *test)
237 {
238         slab_errors = 0;
239
240         kunit_add_named_resource(test, NULL, NULL, &resource,
241                                         "slab_errors", &slab_errors);
242         return 0;
243 }
244
245 static struct kunit_case test_cases[] = {
246         KUNIT_CASE(test_clobber_zone),
247
248 #ifndef CONFIG_KASAN
249         KUNIT_CASE(test_next_pointer),
250         KUNIT_CASE(test_first_word),
251         KUNIT_CASE(test_clobber_50th_byte),
252 #endif
253
254         KUNIT_CASE(test_clobber_redzone_free),
255         KUNIT_CASE(test_kmalloc_redzone_access),
256         KUNIT_CASE(test_kfree_rcu),
257         KUNIT_CASE(test_leak_destroy),
258         KUNIT_CASE(test_krealloc_redzone_zeroing),
259         {}
260 };
261
262 static struct kunit_suite test_suite = {
263         .name = "slub_test",
264         .init = test_init,
265         .test_cases = test_cases,
266 };
267 kunit_test_suite(test_suite);
268
269 MODULE_LICENSE("GPL");
This page took 0.045395 seconds and 4 git commands to generate.