summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorDaniel Latypov <dlatypov@google.com>2022-07-22 20:15:33 +0300
committerShuah Khan <skhan@linuxfoundation.org>2022-10-07 19:15:50 +0300
commite562e309d1d4ac05457c1454b6007071f13b5684 (patch)
tree9d67b7dca7e81d3c428f93b7cb6b4d0f7de24f49 /lib
parent047a8a0a2da716fecfd325d21ccf509c431992d9 (diff)
downloadlinux-e562e309d1d4ac05457c1454b6007071f13b5684.tar.xz
kunit: make kunit_kfree() not segfault on invalid inputs
kunit_kfree() can only work on data ("resources") allocated by KUnit. Currently for code like this, > void *ptr = kmalloc(4, GFP_KERNEL); > kunit_kfree(test, ptr); kunit_kfree() will segfault. It'll try and look up the kunit_resource associated with `ptr` and get a NULL back, but it won't check for this. This means we also segfault if you double-free. Change kunit_kfree() so it'll notice these invalid pointers and respond by failing the test. Implementation: kunit_destroy_resource() does what kunit_kfree() does, but is more generic and returns -ENOENT when it can't find the resource. Sadly, unlike just letting it crash, this means we don't get a stack trace. But kunit_kfree() is so infrequently used it shouldn't be hard to track down the bad callsite anyways. After this change, the above code gives: > # example_simple_test: EXPECTATION FAILED at lib/kunit/test.c:702 > kunit_kfree: 00000000626ec200 already freed or not allocated by kunit Signed-off-by: Daniel Latypov <dlatypov@google.com> Reviewed-by: David Gow <davidgow@google.com> Reviewed-by: Brendan Higgins <brendanhiggins@google.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Diffstat (limited to 'lib')
-rw-r--r--lib/kunit/test.c14
1 files changed, 2 insertions, 12 deletions
diff --git a/lib/kunit/test.c b/lib/kunit/test.c
index 0f9c1fb32da7..0e9ff5d8fe84 100644
--- a/lib/kunit/test.c
+++ b/lib/kunit/test.c
@@ -722,18 +722,8 @@ static inline bool kunit_kfree_match(struct kunit *test,
void kunit_kfree(struct kunit *test, const void *ptr)
{
- struct kunit_resource *res;
-
- res = kunit_find_resource(test, kunit_kfree_match, (void *)ptr);
-
- /*
- * Removing the resource from the list of resources drops the
- * reference count to 1; the final put will trigger the free.
- */
- kunit_remove_resource(test, res);
-
- kunit_put_resource(res);
-
+ if (kunit_destroy_resource(test, kunit_kfree_match, (void *)ptr))
+ KUNIT_FAIL(test, "kunit_kfree: %px already freed or not allocated by kunit", ptr);
}
EXPORT_SYMBOL_GPL(kunit_kfree);