Messages in this thread |  | | Date | Thu, 4 Apr 2024 16:20:24 +0200 | | Subject | Re: [PATCH] mm/slub, kunit: Use inverted data to corrupt kmem cache | | From | Vlastimil Babka <> |
| |
On 4/2/24 3:38 PM, Guenter Roeck wrote: > Two failure patterns are seen randomly when running slub_kunit tests with > CONFIG_SLAB_FREELIST_RANDOM and CONFIG_SLAB_FREELIST_HARDENED enabled. > > Pattern 1: > # test_clobber_zone: pass:1 fail:0 skip:0 total:1 > ok 1 test_clobber_zone > # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:72 > Expected 3 == slab_errors, but > slab_errors == 0 (0x0) > # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:84 > Expected 2 == slab_errors, but > slab_errors == 0 (0x0) > # test_next_pointer: pass:0 fail:1 skip:0 total:1 > not ok 2 test_next_pointer > > In this case, test_next_pointer() overwrites p[s->offset], but the data > at p[s->offset] is already 0x12. > > Pattern 2: > ok 1 test_clobber_zone > # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:72 > Expected 3 == slab_errors, but > slab_errors == 2 (0x2) > # test_next_pointer: pass:0 fail:1 skip:0 total:1 > not ok 2 test_next_pointer > > In this case, p[s->offset] has a value other than 0x12, but one of the > expected failures is nevertheless missing. > > Invert data instead of writing a fixed value to corrupt the cache data > structures to fix the problem. > > Fixes: 1f9f78b1b376 ("mm/slub, kunit: add a KUnit test for SLUB debugging functionality") > Cc: Oliver Glitta <glittao@gmail.com> > Cc: Vlastimil Babka <vbabka@suse.cz> > CC: Daniel Latypov <dlatypov@google.com> > Cc: Marco Elver <elver@google.com> > Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Added to slab/for-next, thanks.
> --- > lib/slub_kunit.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/lib/slub_kunit.c b/lib/slub_kunit.c > index d4a3730b08fa..4ce960438806 100644 > --- a/lib/slub_kunit.c > +++ b/lib/slub_kunit.c > @@ -55,7 +55,7 @@ static void test_next_pointer(struct kunit *test) > > ptr_addr = (unsigned long *)(p + s->offset); > tmp = *ptr_addr; > - p[s->offset] = 0x12; > + p[s->offset] = ~p[s->offset]; > > /* > * Expecting three errors.
|  |