Messages in this thread | | | Date | Mon, 21 Sep 2020 10:13:25 -0700 | From | "Paul E. McKenney" <> | Subject | Re: [PATCH v3 10/10] kfence: add test suite |
| |
On Mon, Sep 21, 2020 at 03:26:11PM +0200, Marco Elver wrote: > Add KFENCE test suite, testing various error detection scenarios. Makes > use of KUnit for test organization. Since KFENCE's interface to obtain > error reports is via the console, the test verifies that KFENCE outputs > expected reports to the console. > > Reviewed-by: Dmitry Vyukov <dvyukov@google.com> > Co-developed-by: Alexander Potapenko <glider@google.com> > Signed-off-by: Alexander Potapenko <glider@google.com> > Signed-off-by: Marco Elver <elver@google.com>
[ . . . ]
> +/* Test SLAB_TYPESAFE_BY_RCU works. */ > +static void test_memcache_typesafe_by_rcu(struct kunit *test) > +{ > + const size_t size = 32; > + struct expect_report expect = { > + .type = KFENCE_ERROR_UAF, > + .fn = test_memcache_typesafe_by_rcu, > + }; > + > + setup_test_cache(test, size, SLAB_TYPESAFE_BY_RCU, NULL); > + KUNIT_EXPECT_TRUE(test, test_cache); /* Want memcache. */ > + > + expect.addr = test_alloc(test, size, GFP_KERNEL, ALLOCATE_ANY); > + *expect.addr = 42; > + > + rcu_read_lock(); > + test_free(expect.addr); > + KUNIT_EXPECT_EQ(test, *expect.addr, (char)42); > + rcu_read_unlock();
It won't happen very often, but memory really could be freed at this point, especially in CONFIG_RCU_STRICT_GRACE_PERIOD=y kernels ...
> + /* No reports yet, memory should not have been freed on access. */ > + KUNIT_EXPECT_FALSE(test, report_available());
... so the above statement needs to go before the rcu_read_unlock().
> + rcu_barrier(); /* Wait for free to happen. */
But you are quite right that the memory is not -guaranteed- to be freed until we get here.
Thanx, Paul
| |