| Message ID | 20211002013635.2076371-1-dlatypov@google.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | cd94fbc2cafb61cc1394cdba3f92b99ce07b03ae |
| Delegated to: | Brendan Higgins |
| Headers | show |
| Series | kunit: fix too small allocation when using suite-only kunit.filter_glob | expand |
On Sat, Oct 2, 2021 at 9:36 AM Daniel Latypov <dlatypov@google.com> wrote: > > When a user filters by a suite and not a test, e.g. > $ ./tools/testing/kunit/kunit.py run 'suite_name' > > it hits this code > const int len = strlen(filter_glob); > ... > parsed->suite_glob = kmalloc(len, GFP_KERNEL); > which fails to allocate space for the terminating NULL. > > Somehow, it seems like we can't easily reproduce this under UML, so the > existing `parse_filter_test()` didn't catch this. > > Fix this by allocating `len + 1` and switch to kzalloc() just to be a > bit more defensive. We're only going to run this code once per kernel > boot, and it should never be very long. > > Also update the unit tests to be a bit more cautious. > This bug showed up as a NULL pointer dereference here: > > KUNIT_EXPECT_STREQ(test, (const char *)filtered.start[0][0]->name, "suite0"); > `filtered.start[0][0]` was NULL, and `name` is at offset 0 in the struct, > so `...->name` was also NULL. > > Fixes: 3b29021ddd10 ("kunit: tool: allow filtering test cases via glob") > Reported-by: kernel test robot <oliver.sang@intel.com> > Signed-off-by: Daniel Latypov <dlatypov@google.com> > --- Nice catch. I guess this is why we're all going to be switching to rust one day. :-) The fix looks good, and I ran it under KASAN just to be sure, and it passed. Reviewed-by: David Gow <davidgow@google.com> -- David > lib/kunit/executor.c | 2 +- > lib/kunit/executor_test.c | 1 + > 2 files changed, 2 insertions(+), 1 deletion(-) > > diff --git a/lib/kunit/executor.c b/lib/kunit/executor.c > index bab3ab940acc..1d7fecd33261 100644 > --- a/lib/kunit/executor.c > +++ b/lib/kunit/executor.c > @@ -33,7 +33,7 @@ static void kunit_parse_filter_glob(struct kunit_test_filter *parsed, > const char *period = strchr(filter_glob, '.'); > > if (!period) { > - parsed->suite_glob = kmalloc(len, GFP_KERNEL); > + parsed->suite_glob = kzalloc(len + 1, GFP_KERNEL); > parsed->test_glob = NULL; > strcpy(parsed->suite_glob, filter_glob); > return; > diff --git a/lib/kunit/executor_test.c b/lib/kunit/executor_test.c > index e6323f398dfa..7d2b8dc668b1 100644 > --- a/lib/kunit/executor_test.c > +++ b/lib/kunit/executor_test.c > @@ -149,6 +149,7 @@ static void filter_suites_test(struct kunit *test) > > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, filtered.start); > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, filtered.start[0]); > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, filtered.start[0][0]); > KUNIT_EXPECT_STREQ(test, (const char *)filtered.start[0][0]->name, "suite0"); > } > > > base-commit: 3b29021ddd10cfb6b2565c623595bd3b02036f33 > -- > 2.33.0.800.g4c38ced690-goog >
On Fri, Oct 1, 2021 at 6:36 PM Daniel Latypov <dlatypov@google.com> wrote: > > When a user filters by a suite and not a test, e.g. > $ ./tools/testing/kunit/kunit.py run 'suite_name' > > it hits this code > const int len = strlen(filter_glob); > ... > parsed->suite_glob = kmalloc(len, GFP_KERNEL); > which fails to allocate space for the terminating NULL. > > Somehow, it seems like we can't easily reproduce this under UML, so the > existing `parse_filter_test()` didn't catch this. > > Fix this by allocating `len + 1` and switch to kzalloc() just to be a > bit more defensive. We're only going to run this code once per kernel > boot, and it should never be very long. > > Also update the unit tests to be a bit more cautious. > This bug showed up as a NULL pointer dereference here: > > KUNIT_EXPECT_STREQ(test, (const char *)filtered.start[0][0]->name, "suite0"); > `filtered.start[0][0]` was NULL, and `name` is at offset 0 in the struct, > so `...->name` was also NULL. > > Fixes: 3b29021ddd10 ("kunit: tool: allow filtering test cases via glob") > Reported-by: kernel test robot <oliver.sang@intel.com> > Signed-off-by: Daniel Latypov <dlatypov@google.com> Acked-by: Brendan Higgins <brendanhiggins@google.com>
diff --git a/lib/kunit/executor.c b/lib/kunit/executor.c index bab3ab940acc..1d7fecd33261 100644 --- a/lib/kunit/executor.c +++ b/lib/kunit/executor.c @@ -33,7 +33,7 @@ static void kunit_parse_filter_glob(struct kunit_test_filter *parsed, const char *period = strchr(filter_glob, '.'); if (!period) { - parsed->suite_glob = kmalloc(len, GFP_KERNEL); + parsed->suite_glob = kzalloc(len + 1, GFP_KERNEL); parsed->test_glob = NULL; strcpy(parsed->suite_glob, filter_glob); return; diff --git a/lib/kunit/executor_test.c b/lib/kunit/executor_test.c index e6323f398dfa..7d2b8dc668b1 100644 --- a/lib/kunit/executor_test.c +++ b/lib/kunit/executor_test.c @@ -149,6 +149,7 @@ static void filter_suites_test(struct kunit *test) KUNIT_ASSERT_NOT_ERR_OR_NULL(test, filtered.start); KUNIT_ASSERT_NOT_ERR_OR_NULL(test, filtered.start[0]); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, filtered.start[0][0]); KUNIT_EXPECT_STREQ(test, (const char *)filtered.start[0][0]->name, "suite0"); }