1 // SPDX-License-Identifier: GPL-2.0-only
45 	 * Temporarily enable multi-shot mode and set panic_on_warn=0.  in kasan_test_init()
59  * KUNIT_EXPECT_KASAN_FAIL() - Causes a test failure when the expression does
81 	size_t size = 123;  in kmalloc_oob_right()  local
83 	ptr = kmalloc(size, GFP_KERNEL);  in kmalloc_oob_right()
86 	KUNIT_EXPECT_KASAN_FAIL(test, ptr[size + OOB_TAG_OFF] = 'x');  in kmalloc_oob_right()
93 	size_t size = 15;  in kmalloc_oob_left()  local
95 	ptr = kmalloc(size, GFP_KERNEL);  in kmalloc_oob_left()
98 	KUNIT_EXPECT_KASAN_FAIL(test, *ptr = *(ptr - 1));  in kmalloc_oob_left()
105 	size_t size = 4096;  in kmalloc_node_oob_right()  local
107 	ptr = kmalloc_node(size, GFP_KERNEL, 0);  in kmalloc_node_oob_right()
110 	KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0);  in kmalloc_node_oob_right()
117 	size_t size = KMALLOC_MAX_CACHE_SIZE + 10;  in kmalloc_pagealloc_oob_right()  local
124 	/* Allocate a chunk that does not fit into a SLUB cache to trigger  in kmalloc_pagealloc_oob_right()
127 	ptr = kmalloc(size, GFP_KERNEL);  in kmalloc_pagealloc_oob_right()
130 	KUNIT_EXPECT_KASAN_FAIL(test, ptr[size + OOB_TAG_OFF] = 0);  in kmalloc_pagealloc_oob_right()
137 	size_t size = KMALLOC_MAX_CACHE_SIZE + 10;  in kmalloc_pagealloc_uaf()  local
144 	ptr = kmalloc(size, GFP_KERNEL);  in kmalloc_pagealloc_uaf()
154 	size_t size = KMALLOC_MAX_CACHE_SIZE + 10;  in kmalloc_pagealloc_invalid_free()  local
161 	ptr = kmalloc(size, GFP_KERNEL);  in kmalloc_pagealloc_invalid_free()
170 	size_t size = KMALLOC_MAX_CACHE_SIZE - 256;  in kmalloc_large_oob_right()  local
174 	ptr = kmalloc(size, GFP_KERNEL);  in kmalloc_large_oob_right()
177 	KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0);  in kmalloc_large_oob_right()
225 	ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL);  in kmalloc_oob_16()
256 	size_t size = 8;  in kmalloc_oob_memset_2()  local
258 	ptr = kmalloc(size, GFP_KERNEL);  in kmalloc_oob_memset_2()
268 	size_t size = 8;  in kmalloc_oob_memset_4()  local
270 	ptr = kmalloc(size, GFP_KERNEL);  in kmalloc_oob_memset_4()
281 	size_t size = 8;  in kmalloc_oob_memset_8()  local
283 	ptr = kmalloc(size, GFP_KERNEL);  in kmalloc_oob_memset_8()
293 	size_t size = 16;  in kmalloc_oob_memset_16()  local
295 	ptr = kmalloc(size, GFP_KERNEL);  in kmalloc_oob_memset_16()
305 	size_t size = 666;  in kmalloc_oob_in_memset()  local
307 	ptr = kmalloc(size, GFP_KERNEL);  in kmalloc_oob_in_memset()
310 	KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr, 0, size + 5 + OOB_TAG_OFF));  in kmalloc_oob_in_memset()
317 	size_t size = 64;  in kmalloc_memmove_invalid_size()  local
318 	volatile size_t invalid_size = -2;  in kmalloc_memmove_invalid_size()
320 	ptr = kmalloc(size, GFP_KERNEL);  in kmalloc_memmove_invalid_size()
333 	size_t size = 10;  in kmalloc_uaf()  local
335 	ptr = kmalloc(size, GFP_KERNEL);  in kmalloc_uaf()
345 	size_t size = 33;  in kmalloc_uaf_memset()  local
347 	ptr = kmalloc(size, GFP_KERNEL);  in kmalloc_uaf_memset()
351 	KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr, 0, size));  in kmalloc_uaf_memset()
357 	size_t size = 43;  in kmalloc_uaf2()  local
359 	ptr1 = kmalloc(size, GFP_KERNEL);  in kmalloc_uaf2()
364 	ptr2 = kmalloc(size, GFP_KERNEL);  in kmalloc_uaf2()
376 	size_t size = 8;  in kfree_via_page()  local
380 	ptr = kmalloc(size, GFP_KERNEL);  in kfree_via_page()
391 	size_t size = 8;  in kfree_via_phys()  local
394 	ptr = kmalloc(size, GFP_KERNEL);  in kfree_via_phys()
404 	size_t size = 200;  in kmem_cache_oob()  local
405 	struct kmem_cache *cache = kmem_cache_create("test_cache",  in kmem_cache_oob()  local
406 						size, 0,  in kmem_cache_oob()
408 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);  in kmem_cache_oob()
409 	p = kmem_cache_alloc(cache, GFP_KERNEL);  in kmem_cache_oob()
412 		kmem_cache_destroy(cache);  in kmem_cache_oob()
416 	KUNIT_EXPECT_KASAN_FAIL(test, *p = p[size + OOB_TAG_OFF]);  in kmem_cache_oob()
417 	kmem_cache_free(cache, p);  in kmem_cache_oob()
418 	kmem_cache_destroy(cache);  in kmem_cache_oob()
425 	size_t size = 200;  in memcg_accounted_kmem_cache()  local
426 	struct kmem_cache *cache;  in memcg_accounted_kmem_cache()  local
428 	cache = kmem_cache_create("test_cache", size, 0, SLAB_ACCOUNT, NULL);  in memcg_accounted_kmem_cache()
429 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);  in memcg_accounted_kmem_cache()
433 	 * cache creation.  in memcg_accounted_kmem_cache()
436 		p = kmem_cache_alloc(cache, GFP_KERNEL);  in memcg_accounted_kmem_cache()
440 		kmem_cache_free(cache, p);  in memcg_accounted_kmem_cache()
445 	kmem_cache_destroy(cache);  in memcg_accounted_kmem_cache()
467 	size_t size = 123, real_size;  in ksize_unpoisons_memory()  local
469 	ptr = kmalloc(size, GFP_KERNEL);  in ksize_unpoisons_memory()
473 	ptr[size] = 'x';  in ksize_unpoisons_memory()
497 	char *p = alloca_array - 1;  in kasan_alloca_oob_left()
536 	size_t size = 200;  in kmem_cache_double_free()  local
537 	struct kmem_cache *cache;  in kmem_cache_double_free()  local
539 	cache = kmem_cache_create("test_cache", size, 0, 0, NULL);  in kmem_cache_double_free()
540 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);  in kmem_cache_double_free()
542 	p = kmem_cache_alloc(cache, GFP_KERNEL);  in kmem_cache_double_free()
545 		kmem_cache_destroy(cache);  in kmem_cache_double_free()
549 	kmem_cache_free(cache, p);  in kmem_cache_double_free()
550 	KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p));  in kmem_cache_double_free()
551 	kmem_cache_destroy(cache);  in kmem_cache_double_free()
557 	size_t size = 200;  in kmem_cache_invalid_free()  local
558 	struct kmem_cache *cache;  in kmem_cache_invalid_free()  local
560 	cache = kmem_cache_create("test_cache", size, 0, SLAB_TYPESAFE_BY_RCU,  in kmem_cache_invalid_free()
562 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);  in kmem_cache_invalid_free()
564 	p = kmem_cache_alloc(cache, GFP_KERNEL);  in kmem_cache_invalid_free()
567 		kmem_cache_destroy(cache);  in kmem_cache_invalid_free()
572 	KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p + 1));  in kmem_cache_invalid_free()
578 	kmem_cache_free(cache, p);  in kmem_cache_invalid_free()
580 	kmem_cache_destroy(cache);  in kmem_cache_invalid_free()
586 	size_t size = 24;  in kasan_memchr()  local
596 		size = round_up(size, OOB_TAG_OFF);  in kasan_memchr()
598 	ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);  in kasan_memchr()
602 		kasan_ptr_result = memchr(ptr, '1', size + 1));  in kasan_memchr()
610 	size_t size = 24;  in kasan_memcmp()  local
621 		size = round_up(size, OOB_TAG_OFF);  in kasan_memcmp()
623 	ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);  in kasan_memcmp()
628 		kasan_int_result = memcmp(ptr, arr, size+1));  in kasan_memcmp()
635 	size_t size = 24;  in kasan_strings()  local
644 	ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);  in kasan_strings()
709 	 * Allocate 1 more byte, which causes kzalloc to round up to 16-bytes;  in kasan_bitops_generic()
717 	 * below accesses are still out-of-bounds, since bitops are defined to  in kasan_bitops_generic()
734 	/* This test is specifically crafted for the tag-based mode. */  in kasan_bitops_tags()
740 	/* Allocation size will be rounded to up granule size, which is 16. */  in kasan_bitops_tags()
754 	size_t size = 16;  in kmalloc_double_kzfree()  local
756 	ptr = kmalloc(size, GFP_KERNEL);  in kmalloc_double_kzfree()