All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] kunit: fix too small allocation when using suite-only kunit.filter_glob
@ 2021-10-02  1:36 Daniel Latypov
  2021-10-02  2:30 ` David Gow
  2021-10-04 21:58 ` Brendan Higgins
  0 siblings, 2 replies; 3+ messages in thread
From: Daniel Latypov @ 2021-10-02  1:36 UTC (permalink / raw)
  To: brendanhiggins, davidgow
  Cc: linux-kernel, kunit-dev, linux-kselftest, skhan, Daniel Latypov,
	kernel test robot

When a user filters by a suite and not a test, e.g.
$ ./tools/testing/kunit/kunit.py run 'suite_name'

it hits this code
  const int len = strlen(filter_glob);
  ...
  parsed->suite_glob = kmalloc(len, GFP_KERNEL);
which fails to allocate space for the terminating NULL.

Somehow, it seems like we can't easily reproduce this under UML, so the
existing `parse_filter_test()` didn't catch this.

Fix this by allocating `len + 1` and switch to kzalloc() just to be a
bit more defensive. We're only going to run this code once per kernel
boot, and it should never be very long.

Also update the unit tests to be a bit more cautious.
This bug showed up as a NULL pointer dereference here:
>  KUNIT_EXPECT_STREQ(test, (const char *)filtered.start[0][0]->name, "suite0");
`filtered.start[0][0]` was NULL, and `name` is at offset 0 in the struct,
so `...->name` was also NULL.

Fixes: 3b29021ddd10 ("kunit: tool: allow filtering test cases via glob")
Reported-by: kernel test robot <oliver.sang@intel.com>
Signed-off-by: Daniel Latypov <dlatypov@google.com>
---
 lib/kunit/executor.c      | 2 +-
 lib/kunit/executor_test.c | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/kunit/executor.c b/lib/kunit/executor.c
index bab3ab940acc..1d7fecd33261 100644
--- a/lib/kunit/executor.c
+++ b/lib/kunit/executor.c
@@ -33,7 +33,7 @@ static void kunit_parse_filter_glob(struct kunit_test_filter *parsed,
 	const char *period = strchr(filter_glob, '.');
 
 	if (!period) {
-		parsed->suite_glob = kmalloc(len, GFP_KERNEL);
+		parsed->suite_glob = kzalloc(len + 1, GFP_KERNEL);
 		parsed->test_glob = NULL;
 		strcpy(parsed->suite_glob, filter_glob);
 		return;
diff --git a/lib/kunit/executor_test.c b/lib/kunit/executor_test.c
index e6323f398dfa..7d2b8dc668b1 100644
--- a/lib/kunit/executor_test.c
+++ b/lib/kunit/executor_test.c
@@ -149,6 +149,7 @@ static void filter_suites_test(struct kunit *test)
 
 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, filtered.start);
 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, filtered.start[0]);
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, filtered.start[0][0]);
 	KUNIT_EXPECT_STREQ(test, (const char *)filtered.start[0][0]->name, "suite0");
 }
 

base-commit: 3b29021ddd10cfb6b2565c623595bd3b02036f33
-- 
2.33.0.800.g4c38ced690-goog


^ permalink raw reply related	[flat|nested] 3+ messages in thread

* Re: [PATCH] kunit: fix too small allocation when using suite-only kunit.filter_glob
  2021-10-02  1:36 [PATCH] kunit: fix too small allocation when using suite-only kunit.filter_glob Daniel Latypov
@ 2021-10-02  2:30 ` David Gow
  2021-10-04 21:58 ` Brendan Higgins
  1 sibling, 0 replies; 3+ messages in thread
From: David Gow @ 2021-10-02  2:30 UTC (permalink / raw)
  To: Daniel Latypov
  Cc: Brendan Higgins, Linux Kernel Mailing List, KUnit Development,
	open list:KERNEL SELFTEST FRAMEWORK, Shuah Khan,
	kernel test robot

On Sat, Oct 2, 2021 at 9:36 AM Daniel Latypov <dlatypov@google.com> wrote:
>
> When a user filters by a suite and not a test, e.g.
> $ ./tools/testing/kunit/kunit.py run 'suite_name'
>
> it hits this code
>   const int len = strlen(filter_glob);
>   ...
>   parsed->suite_glob = kmalloc(len, GFP_KERNEL);
> which fails to allocate space for the terminating NULL.
>
> Somehow, it seems like we can't easily reproduce this under UML, so the
> existing `parse_filter_test()` didn't catch this.
>
> Fix this by allocating `len + 1` and switch to kzalloc() just to be a
> bit more defensive. We're only going to run this code once per kernel
> boot, and it should never be very long.
>
> Also update the unit tests to be a bit more cautious.
> This bug showed up as a NULL pointer dereference here:
> >  KUNIT_EXPECT_STREQ(test, (const char *)filtered.start[0][0]->name, "suite0");
> `filtered.start[0][0]` was NULL, and `name` is at offset 0 in the struct,
> so `...->name` was also NULL.
>
> Fixes: 3b29021ddd10 ("kunit: tool: allow filtering test cases via glob")
> Reported-by: kernel test robot <oliver.sang@intel.com>
> Signed-off-by: Daniel Latypov <dlatypov@google.com>
> ---

Nice catch. I guess this is why we're all going to be switching to
rust one day. :-)

The fix looks good, and I ran it under KASAN just to be sure, and it passed.

Reviewed-by: David Gow <davidgow@google.com>

-- David

>  lib/kunit/executor.c      | 2 +-
>  lib/kunit/executor_test.c | 1 +
>  2 files changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/lib/kunit/executor.c b/lib/kunit/executor.c
> index bab3ab940acc..1d7fecd33261 100644
> --- a/lib/kunit/executor.c
> +++ b/lib/kunit/executor.c
> @@ -33,7 +33,7 @@ static void kunit_parse_filter_glob(struct kunit_test_filter *parsed,
>         const char *period = strchr(filter_glob, '.');
>
>         if (!period) {
> -               parsed->suite_glob = kmalloc(len, GFP_KERNEL);
> +               parsed->suite_glob = kzalloc(len + 1, GFP_KERNEL);
>                 parsed->test_glob = NULL;
>                 strcpy(parsed->suite_glob, filter_glob);
>                 return;
> diff --git a/lib/kunit/executor_test.c b/lib/kunit/executor_test.c
> index e6323f398dfa..7d2b8dc668b1 100644
> --- a/lib/kunit/executor_test.c
> +++ b/lib/kunit/executor_test.c
> @@ -149,6 +149,7 @@ static void filter_suites_test(struct kunit *test)
>
>         KUNIT_ASSERT_NOT_ERR_OR_NULL(test, filtered.start);
>         KUNIT_ASSERT_NOT_ERR_OR_NULL(test, filtered.start[0]);
> +       KUNIT_ASSERT_NOT_ERR_OR_NULL(test, filtered.start[0][0]);
>         KUNIT_EXPECT_STREQ(test, (const char *)filtered.start[0][0]->name, "suite0");
>  }
>
>
> base-commit: 3b29021ddd10cfb6b2565c623595bd3b02036f33
> --
> 2.33.0.800.g4c38ced690-goog
>

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] kunit: fix too small allocation when using suite-only kunit.filter_glob
  2021-10-02  1:36 [PATCH] kunit: fix too small allocation when using suite-only kunit.filter_glob Daniel Latypov
  2021-10-02  2:30 ` David Gow
@ 2021-10-04 21:58 ` Brendan Higgins
  1 sibling, 0 replies; 3+ messages in thread
From: Brendan Higgins @ 2021-10-04 21:58 UTC (permalink / raw)
  To: Daniel Latypov
  Cc: davidgow, linux-kernel, kunit-dev, linux-kselftest, skhan,
	kernel test robot

On Fri, Oct 1, 2021 at 6:36 PM Daniel Latypov <dlatypov@google.com> wrote:
>
> When a user filters by a suite and not a test, e.g.
> $ ./tools/testing/kunit/kunit.py run 'suite_name'
>
> it hits this code
>   const int len = strlen(filter_glob);
>   ...
>   parsed->suite_glob = kmalloc(len, GFP_KERNEL);
> which fails to allocate space for the terminating NULL.
>
> Somehow, it seems like we can't easily reproduce this under UML, so the
> existing `parse_filter_test()` didn't catch this.
>
> Fix this by allocating `len + 1` and switch to kzalloc() just to be a
> bit more defensive. We're only going to run this code once per kernel
> boot, and it should never be very long.
>
> Also update the unit tests to be a bit more cautious.
> This bug showed up as a NULL pointer dereference here:
> >  KUNIT_EXPECT_STREQ(test, (const char *)filtered.start[0][0]->name, "suite0");
> `filtered.start[0][0]` was NULL, and `name` is at offset 0 in the struct,
> so `...->name` was also NULL.
>
> Fixes: 3b29021ddd10 ("kunit: tool: allow filtering test cases via glob")
> Reported-by: kernel test robot <oliver.sang@intel.com>
> Signed-off-by: Daniel Latypov <dlatypov@google.com>

Acked-by: Brendan Higgins <brendanhiggins@google.com>

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2021-10-04 21:59 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-02  1:36 [PATCH] kunit: fix too small allocation when using suite-only kunit.filter_glob Daniel Latypov
2021-10-02  2:30 ` David Gow
2021-10-04 21:58 ` Brendan Higgins

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.