mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/lib/kunit
History
Ruan Jinjie 5a175d369c kunit: fix wild-memory-access bug in kunit_filter_suites() 
As for kunit_filter_suites(), When the filters arg = NULL, such as
the call of kunit_filter_suites(&suite_set, "suite2", NULL, NULL, &err)
in filter_suites_test() tese case in kunit, both filter_count and
parsed_filters will not be initialized.

So it's possible to enter kunit_filter_attr_tests(), and the use of
uninitialized parsed_filters will cause below wild-memory-access.

 RIP: 0010:kunit_filter_suites+0x780/0xa40
 Code: fe ff ff e8 42 87 4d ff 41 83 c6 01 49 83 c5 10 49 89 dc 44 39 74 24 50 0f 8e 81 fe ff ff e8 27 87 4d ff 4c 89 e8 48 c1 e8 03 <66> 42 83 3c 38 00 0f 85 af 01 00 00 49 8b 75 00 49 8b 55 08 4c 89
 RSP: 0000:ff1100010743fc38 EFLAGS: 00010203
 RAX: 03fc4400041d0ff1 RBX: ff1100010389a900 RCX: ffffffff9f940ad9
 RDX: ff11000107429740 RSI: 0000000000000000 RDI: ff110001037ec920
 RBP: ff1100010743fd50 R08: 0000000000000000 R09: ffe21c0020e87f1e
 R10: 0000000000000003 R11: 0000000000032001 R12: ff110001037ec800
 R13: 1fe2200020e87f8c R14: 0000000000000000 R15: dffffc0000000000
 FS:  0000000000000000(0000) GS:ff1100011b000000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: ff11000115201000 CR3: 0000000113066001 CR4: 0000000000771ef0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 PKRU: 55555554
 Call Trace:
  <TASK>
  ? die_addr+0x3c/0xa0
  ? exc_general_protection+0x148/0x220
  ? asm_exc_general_protection+0x26/0x30
  ? kunit_filter_suites+0x779/0xa40
  ? kunit_filter_suites+0x780/0xa40
  ? kunit_filter_suites+0x779/0xa40
  ? __pfx_kunit_filter_suites+0x10/0x10
  ? __pfx_kfree+0x10/0x10
  ? kunit_add_action_or_reset+0x3d/0x50
  filter_suites_test+0x1b7/0x440
  ? __pfx_filter_suites_test+0x10/0x10
  ? __pfx___schedule+0x10/0x10
  ? try_to_wake_up+0xa8e/0x1210
  ? _raw_spin_lock_irqsave+0x86/0xe0
  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
  ? set_cpus_allowed_ptr+0x7c/0xb0
  kunit_try_run_case+0x119/0x270
  ? __kthread_parkme+0xdc/0x160
  ? __pfx_kunit_try_run_case+0x10/0x10
  kunit_generic_run_threadfn_adapter+0x4e/0xa0
  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
  kthread+0x2c7/0x3c0
  ? __pfx_kthread+0x10/0x10
  ret_from_fork+0x2c/0x70
  ? __pfx_kthread+0x10/0x10
  ret_from_fork_asm+0x1b/0x30
  </TASK>
 Modules linked in:
 Dumping ftrace buffer:
    (ftrace buffer empty)
 ---[ end trace 0000000000000000 ]---
 RIP: 0010:kunit_filter_suites+0x780/0xa40
 Code: fe ff ff e8 42 87 4d ff 41 83 c6 01 49 83 c5 10 49 89 dc 44 39 74 24 50 0f 8e 81 fe ff ff e8 27 87 4d ff 4c 89 e8 48 c1 e8 03 <66> 42 83 3c 38 00 0f 85 af 01 00 00 49 8b 75 00 49 8b 55 08 4c 89
 RSP: 0000:ff1100010743fc38 EFLAGS: 00010203
 RAX: 03fc4400041d0ff1 RBX: ff1100010389a900 RCX: ffffffff9f940ad9
 RDX: ff11000107429740 RSI: 0000000000000000 RDI: ff110001037ec920
 RBP: ff1100010743fd50 R08: 0000000000000000 R09: ffe21c0020e87f1e
 R10: 0000000000000003 R11: 0000000000032001 R12: ff110001037ec800
 R13: 1fe2200020e87f8c R14: 0000000000000000 R15: dffffc0000000000
 FS:  0000000000000000(0000) GS:ff1100011b000000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: ff11000115201000 CR3: 0000000113066001 CR4: 0000000000771ef0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 PKRU: 55555554
 Kernel panic - not syncing: Fatal exception
 Dumping ftrace buffer:
    (ftrace buffer empty)
 Kernel Offset: 0x1da00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
 Rebooting in 1 seconds..

Fixes: 529534e8cb ("kunit: Add ability to filter attributes")
Signed-off-by: Ruan Jinjie <ruanjinjie@huawei.com>
Reviewed-by: David Gow <davidgow@google.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
 		2023-07-31 08:27:05 -06:00
..
.kunitconfig kunit: tool: make --kunitconfig accept dirs, add lib/kunit fragment 2021-04-02 14:14:36 -06:00
Kconfig kunit: add kunit.enable to enable/disable KUnit test 2022-09-30 13:17:39 -06:00
Makefile kunit: Add test attributes API structure 2023-07-26 13:28:57 -06:00
assert.c kunit: fix bug in KUNIT_EXPECT_MEMEQ 2023-01-30 14:46:46 -07:00
attributes.c kunit: Add ability to filter attributes 2023-07-26 13:29:15 -06:00
debugfs.c kunit: include debugfs header file 2023-06-09 17:44:16 -07:00
debugfs.h kunit: add debugfs /sys/kernel/debug/kunit/<suite>/results display 2020-03-26 14:07:18 -06:00
executor.c kunit: fix wild-memory-access bug in kunit_filter_suites() 2023-07-31 08:27:05 -06:00
executor_test.c kunit: add tests for filtering attributes 2023-07-26 13:29:41 -06:00
hooks-impl.h kunit: Add printf attribute to fail_current_test_impl 2023-02-08 18:08:14 -07:00
hooks.c kunit: Add "hooks" to call into KUnit when it's built as a module 2023-02-08 14:26:25 -07:00
kunit-example-test.c kunit: Add speed attribute 2023-07-26 13:29:04 -06:00
kunit-test.c kunit: Add kunit_add_action() to defer a call until test exit 2023-05-25 08:52:55 -06:00
resource.c kunit: Add kunit_add_action() to defer a call until test exit 2023-05-25 08:52:55 -06:00
static_stub.c kunit: Expose 'static stub' API to redirect functions 2023-02-08 14:28:17 -07:00
string-stream-test.c kunit: allow kunit tests to be loaded as a module 2020-01-09 16:42:29 -07:00
string-stream.c kunit: alloc_string_stream_fragment error handling bug fix 2022-12-26 16:01:36 -07:00
string-stream.h kunit: drop test pointer in string_stream_fragment 2022-10-07 10:15:33 -06:00
test.c kunit: Add ability to filter attributes 2023-07-26 13:29:15 -06:00
try-catch-impl.h kunit: hide unexported try-catch interface in try-catch-impl.h 2020-01-09 16:42:09 -07:00
try-catch.c kunit: make kunit_test_timeout compatible with comment 2022-03-22 15:57:11 -07:00