1 // SPDX-License-Identifier: GPL-2.0-only
4 * Copyright (c) 2014 Samsung Electronics Co., Ltd.
5 * Author: Andrey Ryabinin <a.ryabinin@samsung.com>
8 #include <linux/bitops.h>
9 #include <linux/delay.h>
10 #include <linux/kasan.h>
11 #include <linux/kernel.h>
13 #include <linux/mman.h>
14 #include <linux/module.h>
15 #include <linux/printk.h>
16 #include <linux/slab.h>
17 #include <linux/string.h>
18 #include <linux/uaccess.h>
20 #include <linux/vmalloc.h>
24 #include <kunit/test.h>
26 #include "../mm/kasan/kasan.h"
28 #define OOB_TAG_OFF (IS_ENABLED(CONFIG_KASAN_GENERIC) ? 0 : KASAN_SHADOW_SCALE_SIZE)
31 * We assign some test results to these globals to make sure the tests
32 * are not eliminated as dead code.
35 void *kasan_ptr_result;
38 static struct kunit_resource resource;
39 static struct kunit_kasan_expectation fail_data;
40 static bool multishot;
42 static int kasan_test_init(struct kunit *test)
45 * Temporarily enable multi-shot mode and set panic_on_warn=0.
46 * Otherwise, we'd only get a report for the first case.
48 multishot = kasan_save_enable_multi_shot();
53 static void kasan_test_exit(struct kunit *test)
55 kasan_restore_multi_shot(multishot);
59 * KUNIT_EXPECT_KASAN_FAIL() - Causes a test failure when the expression does
60 * not cause a KASAN error. This uses a KUnit resource named "kasan_data." Do
61 * Do not use this name for a KUnit resource outside here.
64 #define KUNIT_EXPECT_KASAN_FAIL(test, condition) do { \
65 fail_data.report_expected = true; \
66 fail_data.report_found = false; \
67 kunit_add_named_resource(test, \
71 "kasan_data", &fail_data); \
73 KUNIT_EXPECT_EQ(test, \
74 fail_data.report_expected, \
75 fail_data.report_found); \
78 static void kmalloc_oob_right(struct kunit *test)
83 ptr = kmalloc(size, GFP_KERNEL);
84 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
86 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size + OOB_TAG_OFF] = 'x');
90 static void kmalloc_oob_left(struct kunit *test)
95 ptr = kmalloc(size, GFP_KERNEL);
96 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
98 KUNIT_EXPECT_KASAN_FAIL(test, *ptr = *(ptr - 1));
102 static void kmalloc_node_oob_right(struct kunit *test)
107 ptr = kmalloc_node(size, GFP_KERNEL, 0);
108 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
110 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0);
114 static void kmalloc_pagealloc_oob_right(struct kunit *test)
117 size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
119 if (!IS_ENABLED(CONFIG_SLUB)) {
120 kunit_info(test, "CONFIG_SLUB is not enabled.");
124 /* Allocate a chunk that does not fit into a SLUB cache to trigger
125 * the page allocator fallback.
127 ptr = kmalloc(size, GFP_KERNEL);
128 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
130 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size + OOB_TAG_OFF] = 0);
134 static void kmalloc_pagealloc_uaf(struct kunit *test)
137 size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
139 if (!IS_ENABLED(CONFIG_SLUB)) {
140 kunit_info(test, "CONFIG_SLUB is not enabled.");
144 ptr = kmalloc(size, GFP_KERNEL);
145 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
148 KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = 0);
151 static void kmalloc_pagealloc_invalid_free(struct kunit *test)
154 size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
156 if (!IS_ENABLED(CONFIG_SLUB)) {
157 kunit_info(test, "CONFIG_SLUB is not enabled.");
161 ptr = kmalloc(size, GFP_KERNEL);
162 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
164 KUNIT_EXPECT_KASAN_FAIL(test, kfree(ptr + 1));
167 static void kmalloc_large_oob_right(struct kunit *test)
170 size_t size = KMALLOC_MAX_CACHE_SIZE - 256;
171 /* Allocate a chunk that is large enough, but still fits into a slab
172 * and does not trigger the page allocator fallback in SLUB.
174 ptr = kmalloc(size, GFP_KERNEL);
175 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
177 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0);
181 static void kmalloc_oob_krealloc_more(struct kunit *test)
187 ptr1 = kmalloc(size1, GFP_KERNEL);
188 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
190 ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
191 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
193 KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size2 + OOB_TAG_OFF] = 'x');
197 static void kmalloc_oob_krealloc_less(struct kunit *test)
203 ptr1 = kmalloc(size1, GFP_KERNEL);
204 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
206 ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
207 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
209 KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size2 + OOB_TAG_OFF] = 'x');
213 static void kmalloc_oob_16(struct kunit *test)
219 /* This test is specifically crafted for the generic mode. */
220 if (!IS_ENABLED(CONFIG_KASAN_GENERIC)) {
221 kunit_info(test, "CONFIG_KASAN_GENERIC required\n");
225 ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL);
226 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
228 ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
229 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
231 KUNIT_EXPECT_KASAN_FAIL(test, *ptr1 = *ptr2);
236 static void kmalloc_uaf_16(struct kunit *test)
242 ptr1 = kmalloc(sizeof(*ptr1), GFP_KERNEL);
243 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
245 ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
246 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
249 KUNIT_EXPECT_KASAN_FAIL(test, *ptr1 = *ptr2);
253 static void kmalloc_oob_memset_2(struct kunit *test)
258 ptr = kmalloc(size, GFP_KERNEL);
259 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
261 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + 7 + OOB_TAG_OFF, 0, 2));
265 static void kmalloc_oob_memset_4(struct kunit *test)
270 ptr = kmalloc(size, GFP_KERNEL);
271 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
273 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + 5 + OOB_TAG_OFF, 0, 4));
278 static void kmalloc_oob_memset_8(struct kunit *test)
283 ptr = kmalloc(size, GFP_KERNEL);
284 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
286 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + 1 + OOB_TAG_OFF, 0, 8));
290 static void kmalloc_oob_memset_16(struct kunit *test)
295 ptr = kmalloc(size, GFP_KERNEL);
296 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
298 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + 1 + OOB_TAG_OFF, 0, 16));
302 static void kmalloc_oob_in_memset(struct kunit *test)
307 ptr = kmalloc(size, GFP_KERNEL);
308 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
310 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr, 0, size + 5 + OOB_TAG_OFF));
314 static void kmalloc_memmove_invalid_size(struct kunit *test)
318 volatile size_t invalid_size = -2;
320 ptr = kmalloc(size, GFP_KERNEL);
321 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
323 memset((char *)ptr, 0, 64);
325 KUNIT_EXPECT_KASAN_FAIL(test,
326 memmove((char *)ptr, (char *)ptr + 4, invalid_size));
330 static void kmalloc_uaf(struct kunit *test)
335 ptr = kmalloc(size, GFP_KERNEL);
336 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
339 KUNIT_EXPECT_KASAN_FAIL(test, *(ptr + 8) = 'x');
342 static void kmalloc_uaf_memset(struct kunit *test)
347 ptr = kmalloc(size, GFP_KERNEL);
348 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
351 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr, 0, size));
354 static void kmalloc_uaf2(struct kunit *test)
359 ptr1 = kmalloc(size, GFP_KERNEL);
360 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
364 ptr2 = kmalloc(size, GFP_KERNEL);
365 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
367 KUNIT_EXPECT_KASAN_FAIL(test, ptr1[40] = 'x');
368 KUNIT_EXPECT_PTR_NE(test, ptr1, ptr2);
373 static void kfree_via_page(struct kunit *test)
378 unsigned long offset;
380 ptr = kmalloc(size, GFP_KERNEL);
381 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
383 page = virt_to_page(ptr);
384 offset = offset_in_page(ptr);
385 kfree(page_address(page) + offset);
388 static void kfree_via_phys(struct kunit *test)
394 ptr = kmalloc(size, GFP_KERNEL);
395 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
397 phys = virt_to_phys(ptr);
398 kfree(phys_to_virt(phys));
401 static void kmem_cache_oob(struct kunit *test)
405 struct kmem_cache *cache = kmem_cache_create("test_cache",
408 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
409 p = kmem_cache_alloc(cache, GFP_KERNEL);
411 kunit_err(test, "Allocation failed: %s\n", __func__);
412 kmem_cache_destroy(cache);
416 KUNIT_EXPECT_KASAN_FAIL(test, *p = p[size + OOB_TAG_OFF]);
417 kmem_cache_free(cache, p);
418 kmem_cache_destroy(cache);
421 static void memcg_accounted_kmem_cache(struct kunit *test)
426 struct kmem_cache *cache;
428 cache = kmem_cache_create("test_cache", size, 0, SLAB_ACCOUNT, NULL);
429 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
432 * Several allocations with a delay to allow for lazy per memcg kmem
435 for (i = 0; i < 5; i++) {
436 p = kmem_cache_alloc(cache, GFP_KERNEL);
440 kmem_cache_free(cache, p);
445 kmem_cache_destroy(cache);
448 static char global_array[10];
450 static void kasan_global_oob(struct kunit *test)
453 * Deliberate out-of-bounds access. To prevent CONFIG_UBSAN_LOCAL_BOUNDS
454 * from failing here and panicing the kernel, access the array via a
455 * volatile pointer, which will prevent the compiler from being able to
456 * determine the array bounds.
458 * This access uses a volatile pointer to char (char *volatile) rather
459 * than the more conventional pointer to volatile char (volatile char *)
460 * because we want to prevent the compiler from making inferences about
461 * the pointer itself (i.e. its array bounds), not the data that it
464 char *volatile array = global_array;
465 char *p = &array[ARRAY_SIZE(global_array) + 3];
467 /* Only generic mode instruments globals. */
468 if (!IS_ENABLED(CONFIG_KASAN_GENERIC)) {
469 kunit_info(test, "CONFIG_KASAN_GENERIC required");
473 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
476 static void ksize_unpoisons_memory(struct kunit *test)
479 size_t size = 123, real_size;
481 ptr = kmalloc(size, GFP_KERNEL);
482 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
483 real_size = ksize(ptr);
484 /* This access doesn't trigger an error. */
487 KUNIT_EXPECT_KASAN_FAIL(test, ptr[real_size] = 'y');
491 static void kasan_stack_oob(struct kunit *test)
493 char stack_array[10];
494 /* See comment in kasan_global_oob. */
495 char *volatile array = stack_array;
496 char *p = &array[ARRAY_SIZE(stack_array) + OOB_TAG_OFF];
498 if (!IS_ENABLED(CONFIG_KASAN_STACK)) {
499 kunit_info(test, "CONFIG_KASAN_STACK is not enabled");
503 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
506 static void kasan_alloca_oob_left(struct kunit *test)
509 char alloca_array[i];
510 /* See comment in kasan_global_oob. */
511 char *volatile array = alloca_array;
514 /* Only generic mode instruments dynamic allocas. */
515 if (!IS_ENABLED(CONFIG_KASAN_GENERIC)) {
516 kunit_info(test, "CONFIG_KASAN_GENERIC required");
520 if (!IS_ENABLED(CONFIG_KASAN_STACK)) {
521 kunit_info(test, "CONFIG_KASAN_STACK is not enabled");
525 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
528 static void kasan_alloca_oob_right(struct kunit *test)
531 char alloca_array[i];
532 /* See comment in kasan_global_oob. */
533 char *volatile array = alloca_array;
536 /* Only generic mode instruments dynamic allocas. */
537 if (!IS_ENABLED(CONFIG_KASAN_GENERIC)) {
538 kunit_info(test, "CONFIG_KASAN_GENERIC required");
542 if (!IS_ENABLED(CONFIG_KASAN_STACK)) {
543 kunit_info(test, "CONFIG_KASAN_STACK is not enabled");
547 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
550 static void kmem_cache_double_free(struct kunit *test)
554 struct kmem_cache *cache;
556 cache = kmem_cache_create("test_cache", size, 0, 0, NULL);
557 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
559 p = kmem_cache_alloc(cache, GFP_KERNEL);
561 kunit_err(test, "Allocation failed: %s\n", __func__);
562 kmem_cache_destroy(cache);
566 kmem_cache_free(cache, p);
567 KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p));
568 kmem_cache_destroy(cache);
571 static void kmem_cache_invalid_free(struct kunit *test)
575 struct kmem_cache *cache;
577 cache = kmem_cache_create("test_cache", size, 0, SLAB_TYPESAFE_BY_RCU,
579 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
581 p = kmem_cache_alloc(cache, GFP_KERNEL);
583 kunit_err(test, "Allocation failed: %s\n", __func__);
584 kmem_cache_destroy(cache);
588 /* Trigger invalid free, the object doesn't get freed */
589 KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p + 1));
592 * Properly free the object to prevent the "Objects remaining in
593 * test_cache on __kmem_cache_shutdown" BUG failure.
595 kmem_cache_free(cache, p);
597 kmem_cache_destroy(cache);
600 static void kasan_memchr(struct kunit *test)
605 /* See https://bugzilla.kernel.org/show_bug.cgi?id=206337 */
606 if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
608 "str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT");
613 size = round_up(size, OOB_TAG_OFF);
615 ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
616 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
618 KUNIT_EXPECT_KASAN_FAIL(test,
619 kasan_ptr_result = memchr(ptr, '1', size + 1));
624 static void kasan_memcmp(struct kunit *test)
630 /* See https://bugzilla.kernel.org/show_bug.cgi?id=206337 */
631 if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
633 "str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT");
638 size = round_up(size, OOB_TAG_OFF);
640 ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
641 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
642 memset(arr, 0, sizeof(arr));
644 KUNIT_EXPECT_KASAN_FAIL(test,
645 kasan_int_result = memcmp(ptr, arr, size+1));
649 static void kasan_strings(struct kunit *test)
654 /* See https://bugzilla.kernel.org/show_bug.cgi?id=206337 */
655 if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
657 "str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT");
661 ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
662 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
667 * Try to cause only 1 invalid access (less spam in dmesg).
668 * For that we need ptr to point to zeroed byte.
669 * Skip metadata that could be stored in freed object so ptr
670 * will likely point to zeroed byte.
673 KUNIT_EXPECT_KASAN_FAIL(test, kasan_ptr_result = strchr(ptr, '1'));
675 KUNIT_EXPECT_KASAN_FAIL(test, kasan_ptr_result = strrchr(ptr, '1'));
677 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strcmp(ptr, "2"));
679 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strncmp(ptr, "2", 1));
681 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strlen(ptr));
683 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strnlen(ptr, 1));
686 static void kasan_bitops_modify(struct kunit *test, int nr, void *addr)
688 KUNIT_EXPECT_KASAN_FAIL(test, set_bit(nr, addr));
689 KUNIT_EXPECT_KASAN_FAIL(test, __set_bit(nr, addr));
690 KUNIT_EXPECT_KASAN_FAIL(test, clear_bit(nr, addr));
691 KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit(nr, addr));
692 KUNIT_EXPECT_KASAN_FAIL(test, clear_bit_unlock(nr, addr));
693 KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit_unlock(nr, addr));
694 KUNIT_EXPECT_KASAN_FAIL(test, change_bit(nr, addr));
695 KUNIT_EXPECT_KASAN_FAIL(test, __change_bit(nr, addr));
698 static void kasan_bitops_test_and_modify(struct kunit *test, int nr, void *addr)
700 KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit(nr, addr));
701 KUNIT_EXPECT_KASAN_FAIL(test, __test_and_set_bit(nr, addr));
702 KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit_lock(nr, addr));
703 KUNIT_EXPECT_KASAN_FAIL(test, test_and_clear_bit(nr, addr));
704 KUNIT_EXPECT_KASAN_FAIL(test, __test_and_clear_bit(nr, addr));
705 KUNIT_EXPECT_KASAN_FAIL(test, test_and_change_bit(nr, addr));
706 KUNIT_EXPECT_KASAN_FAIL(test, __test_and_change_bit(nr, addr));
707 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = test_bit(nr, addr));
709 #if defined(clear_bit_unlock_is_negative_byte)
710 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result =
711 clear_bit_unlock_is_negative_byte(nr, addr));
715 static void kasan_bitops_generic(struct kunit *test)
719 /* This test is specifically crafted for the generic mode. */
720 if (!IS_ENABLED(CONFIG_KASAN_GENERIC)) {
721 kunit_info(test, "CONFIG_KASAN_GENERIC required\n");
726 * Allocate 1 more byte, which causes kzalloc to round up to 16-bytes;
727 * this way we do not actually corrupt other memory.
729 bits = kzalloc(sizeof(*bits) + 1, GFP_KERNEL);
730 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits);
733 * Below calls try to access bit within allocated memory; however, the
734 * below accesses are still out-of-bounds, since bitops are defined to
735 * operate on the whole long the bit is in.
737 kasan_bitops_modify(test, BITS_PER_LONG, bits);
740 * Below calls try to access bit beyond allocated memory.
742 kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, bits);
747 static void kasan_bitops_tags(struct kunit *test)
751 /* This test is specifically crafted for the tag-based mode. */
752 if (IS_ENABLED(CONFIG_KASAN_GENERIC)) {
753 kunit_info(test, "CONFIG_KASAN_SW_TAGS required\n");
757 /* kmalloc-64 cache will be used and the last 16 bytes will be the redzone. */
758 bits = kzalloc(48, GFP_KERNEL);
759 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits);
761 /* Do the accesses past the 48 allocated bytes, but within the redone. */
762 kasan_bitops_modify(test, BITS_PER_LONG, (void *)bits + 48);
763 kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, (void *)bits + 48);
768 static void kmalloc_double_kzfree(struct kunit *test)
773 ptr = kmalloc(size, GFP_KERNEL);
774 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
776 kfree_sensitive(ptr);
777 KUNIT_EXPECT_KASAN_FAIL(test, kfree_sensitive(ptr));
780 static void vmalloc_oob(struct kunit *test)
784 if (!IS_ENABLED(CONFIG_KASAN_VMALLOC)) {
785 kunit_info(test, "CONFIG_KASAN_VMALLOC is not enabled.");
790 * We have to be careful not to hit the guard page.
791 * The MMU will catch that and crash us.
793 area = vmalloc(3000);
794 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, area);
796 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)area)[3100]);
800 static struct kunit_case kasan_kunit_test_cases[] = {
801 KUNIT_CASE(kmalloc_oob_right),
802 KUNIT_CASE(kmalloc_oob_left),
803 KUNIT_CASE(kmalloc_node_oob_right),
804 KUNIT_CASE(kmalloc_pagealloc_oob_right),
805 KUNIT_CASE(kmalloc_pagealloc_uaf),
806 KUNIT_CASE(kmalloc_pagealloc_invalid_free),
807 KUNIT_CASE(kmalloc_large_oob_right),
808 KUNIT_CASE(kmalloc_oob_krealloc_more),
809 KUNIT_CASE(kmalloc_oob_krealloc_less),
810 KUNIT_CASE(kmalloc_oob_16),
811 KUNIT_CASE(kmalloc_uaf_16),
812 KUNIT_CASE(kmalloc_oob_in_memset),
813 KUNIT_CASE(kmalloc_oob_memset_2),
814 KUNIT_CASE(kmalloc_oob_memset_4),
815 KUNIT_CASE(kmalloc_oob_memset_8),
816 KUNIT_CASE(kmalloc_oob_memset_16),
817 KUNIT_CASE(kmalloc_memmove_invalid_size),
818 KUNIT_CASE(kmalloc_uaf),
819 KUNIT_CASE(kmalloc_uaf_memset),
820 KUNIT_CASE(kmalloc_uaf2),
821 KUNIT_CASE(kfree_via_page),
822 KUNIT_CASE(kfree_via_phys),
823 KUNIT_CASE(kmem_cache_oob),
824 KUNIT_CASE(memcg_accounted_kmem_cache),
825 KUNIT_CASE(kasan_global_oob),
826 KUNIT_CASE(kasan_stack_oob),
827 KUNIT_CASE(kasan_alloca_oob_left),
828 KUNIT_CASE(kasan_alloca_oob_right),
829 KUNIT_CASE(ksize_unpoisons_memory),
830 KUNIT_CASE(kmem_cache_double_free),
831 KUNIT_CASE(kmem_cache_invalid_free),
832 KUNIT_CASE(kasan_memchr),
833 KUNIT_CASE(kasan_memcmp),
834 KUNIT_CASE(kasan_strings),
835 KUNIT_CASE(kasan_bitops_generic),
836 KUNIT_CASE(kasan_bitops_tags),
837 KUNIT_CASE(kmalloc_double_kzfree),
838 KUNIT_CASE(vmalloc_oob),
842 static struct kunit_suite kasan_kunit_test_suite = {
844 .init = kasan_test_init,
845 .test_cases = kasan_kunit_test_cases,
846 .exit = kasan_test_exit,
849 kunit_test_suite(kasan_kunit_test_suite);
851 MODULE_LICENSE("GPL");