Commit e562e309 authored by Daniel Latypov's avatar Daniel Latypov Committed by Shuah Khan

kunit: make kunit_kfree() not segfault on invalid inputs

kunit_kfree() can only work on data ("resources") allocated by KUnit.

Currently for code like this,
> void *ptr = kmalloc(4, GFP_KERNEL);
> kunit_kfree(test, ptr);
kunit_kfree() will segfault.

It'll try and look up the kunit_resource associated with `ptr` and get a
NULL back, but it won't check for this. This means we also segfault if
you double-free.

Change kunit_kfree() so it'll notice these invalid pointers and respond
by failing the test.

Implementation: kunit_destroy_resource() does what kunit_kfree() does,
but is more generic and returns -ENOENT when it can't find the resource.
Sadly, unlike just letting it crash, this means we don't get a stack
trace. But kunit_kfree() is so infrequently used it shouldn't be hard to
track down the bad callsite anyways.

After this change, the above code gives:
> # example_simple_test: EXPECTATION FAILED at lib/kunit/test.c:702
> kunit_kfree: 00000000626ec200 already freed or not allocated by kunit
Signed-off-by: default avatarDaniel Latypov <dlatypov@google.com>
Reviewed-by: default avatarDavid Gow <davidgow@google.com>
Reviewed-by: default avatarBrendan Higgins <brendanhiggins@google.com>
Signed-off-by: default avatarShuah Khan <skhan@linuxfoundation.org>
parent 047a8a0a
...@@ -722,18 +722,8 @@ static inline bool kunit_kfree_match(struct kunit *test, ...@@ -722,18 +722,8 @@ static inline bool kunit_kfree_match(struct kunit *test,
void kunit_kfree(struct kunit *test, const void *ptr) void kunit_kfree(struct kunit *test, const void *ptr)
{ {
struct kunit_resource *res; if (kunit_destroy_resource(test, kunit_kfree_match, (void *)ptr))
KUNIT_FAIL(test, "kunit_kfree: %px already freed or not allocated by kunit", ptr);
res = kunit_find_resource(test, kunit_kfree_match, (void *)ptr);
/*
* Removing the resource from the list of resources drops the
* reference count to 1; the final put will trigger the free.
*/
kunit_remove_resource(test, res);
kunit_put_resource(res);
} }
EXPORT_SYMBOL_GPL(kunit_kfree); EXPORT_SYMBOL_GPL(kunit_kfree);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment