[PATCH] mm/slub, kunit: Use inverted data to corrupt kmem cache

[PATCH] mm/slub, kunit: Use inverted data to corrupt kmem cache

[Guenter Roeck]

Two failure patterns are seen randomly when running slub_kunit tests with
CONFIG_SLAB_FREELIST_RANDOM and CONFIG_SLAB_FREELIST_HARDENED enabled.

Pattern 1:
     # test_clobber_zone: pass:1 fail:0 skip:0 total:1
     ok 1 test_clobber_zone
     # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:72
     Expected 3 == slab_errors, but
         slab_errors == 0 (0x0)
     # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:84
     Expected 2 == slab_errors, but
         slab_errors == 0 (0x0)
     # test_next_pointer: pass:0 fail:1 skip:0 total:1
     not ok 2 test_next_pointer

In this case, test_next_pointer() overwrites p[s->offset], but the data
at p[s->offset] is already 0x12.

Pattern 2:
     ok 1 test_clobber_zone
     # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:72
     Expected 3 == slab_errors, but
         slab_errors == 2 (0x2)
     # test_next_pointer: pass:0 fail:1 skip:0 total:1
     not ok 2 test_next_pointer

In this case, p[s->offset] has a value other than 0x12, but one of the
expected failures is nevertheless missing.

Invert data instead of writing a fixed value to corrupt the cache data
structures to fix the problem.

Fixes: 1f9f78b1b376 ("mm/slub, kunit: add a KUnit test for SLUB debugging functionality")
Cc: Oliver Glitta <glittao@gmail.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
CC: Daniel Latypov <dlatypov@google.com>
Cc: Marco Elver <elver@google.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
---
 lib/slub_kunit.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/slub_kunit.c b/lib/slub_kunit.c
index d4a3730b08fa..4ce960438806 100644
--- a/lib/slub_kunit.c
+++ b/lib/slub_kunit.c
@@ -55,7 +55,7 @@ static void test_next_pointer(struct kunit *test)
 
 	ptr_addr = (unsigned long *)(p + s->offset);
 	tmp = *ptr_addr;
-	p[s->offset] = 0x12;
+	p[s->offset] = ~p[s->offset];
 
 	/*
 	 * Expecting three errors.
-- 
2.39.2

Re: [PATCH] mm/slub, kunit: Use inverted data to corrupt kmem cache

[Vlastimil Babka]

On 4/2/24 3:38 PM, Guenter Roeck wrote:
> Two failure patterns are seen randomly when running slub_kunit tests with
> CONFIG_SLAB_FREELIST_RANDOM and CONFIG_SLAB_FREELIST_HARDENED enabled.
> 
> Pattern 1:
>      # test_clobber_zone: pass:1 fail:0 skip:0 total:1
>      ok 1 test_clobber_zone
>      # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:72
>      Expected 3 == slab_errors, but
>          slab_errors == 0 (0x0)
>      # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:84
>      Expected 2 == slab_errors, but
>          slab_errors == 0 (0x0)
>      # test_next_pointer: pass:0 fail:1 skip:0 total:1
>      not ok 2 test_next_pointer
> 
> In this case, test_next_pointer() overwrites p[s->offset], but the data
> at p[s->offset] is already 0x12.
> 
> Pattern 2:
>      ok 1 test_clobber_zone
>      # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:72
>      Expected 3 == slab_errors, but
>          slab_errors == 2 (0x2)
>      # test_next_pointer: pass:0 fail:1 skip:0 total:1
>      not ok 2 test_next_pointer
> 
> In this case, p[s->offset] has a value other than 0x12, but one of the
> expected failures is nevertheless missing.
> 
> Invert data instead of writing a fixed value to corrupt the cache data
> structures to fix the problem.
> 
> Fixes: 1f9f78b1b376 ("mm/slub, kunit: add a KUnit test for SLUB debugging functionality")
> Cc: Oliver Glitta <glittao@gmail.com>
> Cc: Vlastimil Babka <vbabka@suse.cz>
> CC: Daniel Latypov <dlatypov@google.com>
> Cc: Marco Elver <elver@google.com>
> Signed-off-by: Guenter Roeck <linux@roeck-us.net>

Added to slab/for-next, thanks.

> ---
>  lib/slub_kunit.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/lib/slub_kunit.c b/lib/slub_kunit.c
> index d4a3730b08fa..4ce960438806 100644
> --- a/lib/slub_kunit.c
> +++ b/lib/slub_kunit.c
> @@ -55,7 +55,7 @@ static void test_next_pointer(struct kunit *test)
>  
>  	ptr_addr = (unsigned long *)(p + s->offset);
>  	tmp = *ptr_addr;
> -	p[s->offset] = 0x12;
> +	p[s->offset] = ~p[s->offset];
>  
>  	/*
>  	 * Expecting three errors.