1 // SPDX-License-Identifier: GPL-2.0-only
64 		return -1;  in kasan_suite_init()
71 	 * Temporarily enable multi-shot mode. Otherwise, KASAN would only  in kasan_suite_init()
95  * KUNIT_EXPECT_KASAN_FAIL - check that the executed expression produces a
101  * For hardware tag-based KASAN, when a synchronous tag fault happens, tag
102  * checking is auto-disabled. When this happens, this test handler reenables
164 	size_t size = 128 - KASAN_GRANULE_SIZE - 5;  in kmalloc_oob_right()
178 	 * An aligned access into the first out-of-bounds granule that falls  in kmalloc_oob_right()
183 	/* Out-of-bounds access past the aligned kmalloc object. */  in kmalloc_oob_right()
199 	KUNIT_EXPECT_KASAN_FAIL(test, *ptr = *(ptr - 1));  in kmalloc_oob_left()
217  * Check that KASAN detects an out-of-bounds access for a big object allocated
223 	size_t size = KMALLOC_MAX_CACHE_SIZE - 256;  in kmalloc_big_oob_right()
285 	 * out-of-bounds detection is not guaranteed.  in page_alloc_oob_right()
319 	middle = size1 + (size2 - size1) / 2;  in krealloc_more_oob_helper()
327 	/* Suppress -Warray-bounds warnings. */  in krealloc_more_oob_helper()
331 	ptr2[size1 - 1] = 'x';  in krealloc_more_oob_helper()
334 	ptr2[size2 - 1] = 'x';  in krealloc_more_oob_helper()
354 	middle = size2 + (size1 - size2) / 2;  in krealloc_less_oob_helper()
362 	/* Suppress -Warray-bounds warnings. */  in krealloc_less_oob_helper()
366 	ptr2[size2 - 1] = 'x';  in krealloc_less_oob_helper()
385 	KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size1 - 1] = 'x');  in krealloc_less_oob_helper()
414  * Check that krealloc() detects a use-after-free, returns NULL,
444 	ptr1 = RELOC_HIDE(kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL), 0);  in kmalloc_oob_16()
485 	size_t size = 128 - KASAN_GRANULE_SIZE;  in kmalloc_oob_memset_2()
496 	KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 1, 0, memset_size));  in kmalloc_oob_memset_2()
503 	size_t size = 128 - KASAN_GRANULE_SIZE;  in kmalloc_oob_memset_4()
514 	KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 3, 0, memset_size));  in kmalloc_oob_memset_4()
521 	size_t size = 128 - KASAN_GRANULE_SIZE;  in kmalloc_oob_memset_8()
532 	KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 7, 0, memset_size));  in kmalloc_oob_memset_8()
539 	size_t size = 128 - KASAN_GRANULE_SIZE;  in kmalloc_oob_memset_16()
550 	KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 15, 0, memset_size));  in kmalloc_oob_memset_16()
557 	size_t size = 128 - KASAN_GRANULE_SIZE;  in kmalloc_oob_in_memset()
575 	size_t invalid_size = -2;  in kmalloc_memmove_negative_size()
580 	 * Hardware tag-based mode doesn't check memmove for negative size.  in kmalloc_memmove_negative_size()
581 	 * As a result, this test introduces a side-effect memory corruption,  in kmalloc_memmove_negative_size()
664 	 * For tag-based KASAN ptr1 and ptr2 tags might happen to be the same.  in kmalloc_uaf2()
679  * Check that KASAN detects use-after-free when another object was allocated in
680  * the same slot. Relevant for the tag-based modes, which do not use quarantine.
687 	/* This test is specifically crafted for tag-based modes. */  in kmalloc_uaf3()
795 	size_t size = 128 - KASAN_GRANULE_SIZE - 5;  in ksize_unpoisons_memory()
808 	ptr[size - 1] = 'x';  in ksize_unpoisons_memory()
814 	KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[real_size - 1]);  in ksize_unpoisons_memory()
820  * Check that a use-after-free is detected by ksize() and via normal accesses
826 	int size = 128 - KASAN_GRANULE_SIZE;  in ksize_uaf()
857 	((volatile struct kasan_rcu_info *)fp)->i;  in rcu_uaf_reclaim()
871 		call_rcu(&global_rcu_ptr->rcu, rcu_uaf_reclaim);  in rcu_uaf()
896 		((volatile struct work_struct *)work)->data);  in workqueue_uaf()
1021 	/* Free the object - this will internally schedule an RCU callback. */  in kmem_cache_rcu_uaf()
1026 	 * the cache is SLAB_TYPESAFE_BY_RCU and we've been in an RCU read-side  in kmem_cache_rcu_uaf()
1103 		p[i][0] = p[i][size - 1] = 42;  in kmem_cache_bulk()
1122 	 * list when the tests trigger double-free and invalid-free bugs.  in mempool_prepare_kmalloc()
1145 	 * Do not allocate one preallocated element, as we skip the double-free  in mempool_prepare_slab()
1146 	 * and invalid-free tests for slab mempool for simplicity.  in mempool_prepare_slab()
1190 	size_t size = 128 - KASAN_GRANULE_SIZE - 5;  in mempool_kmalloc_oob_right()
1230  * Skip the out-of-bounds test for page mempool. With Generic KASAN, page
1231  * allocations have no redzones, and thus the out-of-bounds detection is not
1233  * the tag-based KASAN modes, the neighboring allocation might have the same
1401  * Skip the invalid-free test for page mempool. The invalid-free detection only
1411 	 * Deliberate out-of-bounds access. To prevent CONFIG_UBSAN_LOCAL_BOUNDS  in kasan_global_oob_right()
1434 	char *p = array - 3;  in kasan_global_oob_left()
1463 	char *p = array - 1;  in kasan_alloca_oob_left()
1617 	 * below accesses are still out-of-bounds, since bitops are defined to  in kasan_bitops_generic()
1634 	/* This test is specifically crafted for tag-based modes. */  in kasan_bitops_tags()
1637 	/* kmalloc-64 cache will be used and the last 16 bytes will be the redzone. */  in kasan_bitops_tags()
1652 	/* This test is intended for tag-based modes. */  in vmalloc_helpers_tags()
1690 	size_t size = PAGE_SIZE / 2 - KASAN_GRANULE_SIZE - 5;  in vmalloc_oob()
1707 	/* Make sure in-bounds accesses are valid. */  in vmalloc_oob()
1709 	v_ptr[size - 1] = 0;  in vmalloc_oob()
1718 	/* An aligned access into the first out-of-bounds granule. */  in vmalloc_oob()
1721 	/* Check that in-bounds accesses to the physical page are valid. */  in vmalloc_oob()
1731 	 * We can't check for use-after-unmap bugs in this nor in the following  in vmalloc_oob()
1743 	 * This test is specifically crafted for the software tag-based mode,  in vmap_tags()
1744 	 * the only tag-based mode that poisons vmap mappings.  in vmap_tags()
1762 	 * We can't check for out-of-bounds bugs in this nor in the following  in vmap_tags()
1770 	/* Make sure that in-bounds accesses through both pointers work. */  in vmap_tags()
1789 	 * This test is specifically crafted for the software tag-based mode,  in vm_map_ram_tags()
1790 	 * the only tag-based mode that poisons vm_map_ram mappings.  in vm_map_ram_tags()
1799 	v_ptr = vm_map_ram(&page, 1, -1);  in vm_map_ram_tags()
1805 	/* Make sure that in-bounds accesses through both pointers work. */  in vm_map_ram_tags()
1815  * KASAN_TAG_KERNEL) range (note: excluding the match-all tag) for tag-based
1858 /* Check that 0xff works as a match-all pointer tag for tag-based modes. */
1884 /* Check that there are no match-all memory tags for tag-based modes. */
1899 		 * For Software Tag-Based KASAN, skip the majority of tag  in match_all_mem_tag()
1903 		    tag >= KASAN_TAG_MIN + 8 && tag <= KASAN_TAG_KERNEL - 8)  in match_all_mem_tag()
1922  * Check that Rust performing a use-after-free using `unsafe` is detected.