:::::: :::::: Manual check reason: "low confidence static check first_new_problem: mm/kfence/kfence_test.c:160:2: warning: Value stored to 'cur' is never read [clang-analyzer-deadcode.DeadStores]" ::::::
CC: [email protected] CC: [email protected] BCC: [email protected] CC: [email protected] TO: Sven Schnelle <[email protected]> CC: Heiko Carstens <[email protected]> tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: ff6992735ade75aae3e35d16b17da1008d753d28 commit: e41ba1115a351dd037c21ac75660638219d51485 s390: add support for KFENCE date: 12 months ago :::::: branch date: 19 hours ago :::::: commit date: 12 months ago config: s390-randconfig-c005-20220717 (https://download.01.org/0day-ci/archive/20220718/[email protected]/config) compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project 45067f8fbf61284839c739807c2da2e2505661eb) reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # install s390 cross compiling tool for clang build # apt-get install binutils-s390x-linux-gnu # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e41ba1115a351dd037c21ac75660638219d51485 git remote add linus https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git git fetch --no-tags linus master git checkout e41ba1115a351dd037c21ac75660638219d51485 # save the config file COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=s390 clang-analyzer If you fix the issue, kindly add following tag where applicable Reported-by: kernel test robot <[email protected]> clang-analyzer warnings: (new ones prefixed by >>) ^ mm/kfence/report.c:189:43: note: Left side of '&&' is false if (WARN_ON(type != KFENCE_ERROR_INVALID && !meta)) ^ mm/kfence/report.c:189:6: note: Taking false branch if (WARN_ON(type != KFENCE_ERROR_INVALID && !meta)) ^ arch/s390/include/asm/bug.h:54:2: note: expanded from macro 'WARN_ON' if (__builtin_constant_p(__ret_warn_on)) { \ ^ mm/kfence/report.c:189:6: note: Taking false branch if (WARN_ON(type != KFENCE_ERROR_INVALID && !meta)) ^ arch/s390/include/asm/bug.h:58:3: note: expanded from macro 'WARN_ON' if (unlikely(__ret_warn_on)) \ ^ mm/kfence/report.c:189:2: note: Taking false branch if (WARN_ON(type != KFENCE_ERROR_INVALID && !meta)) ^ mm/kfence/report.c:192:6: note: 'meta' is null if (meta) ^~~~ mm/kfence/report.c:192:2: note: Taking false branch if (meta) ^ mm/kfence/report.c:203:2: note: Dereference of null pointer lockdep_off(); ^ include/linux/lockdep.h:171:2: note: expanded from macro 'lockdep_off' current->lockdep_recursion += LOCKDEP_OFF; \ ^~~~~~~ arch/s390/include/asm/current.h:17:45: note: expanded from macro 'current' #define current ((struct task_struct *const)S390_lowcore.current_task) ^~~~~~~~~~~~~~~~~~~~~~~~~ arch/s390/include/asm/lowcore.h:200:22: note: expanded from macro 'S390_lowcore' #define S390_lowcore (*((struct lowcore *) 0)) ^ Suppressed 20 warnings (8 in non-user code, 12 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 27 warnings generated. arch/s390/include/asm/preempt.h:100:29: warning: Dereference of null pointer [clang-analyzer-core.NullDereference] S390_lowcore.preempt_count += val; ^ mm/kfence/kfence_test.c:662:2: note: Assuming 'test_cache' is non-null KUNIT_EXPECT_TRUE(test, test_cache); /* Want memcache. */ ^ include/kunit/test.h:1313:2: note: expanded from macro 'KUNIT_EXPECT_TRUE' KUNIT_TRUE_ASSERTION(test, KUNIT_EXPECTATION, condition) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:829:2: note: expanded from macro 'KUNIT_TRUE_ASSERTION' KUNIT_TRUE_MSG_ASSERTION(test, assert_type, condition, NULL) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:821:2: note: expanded from macro 'KUNIT_TRUE_MSG_ASSERTION' KUNIT_UNARY_ASSERTION(test, \ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:811:5: note: expanded from macro 'KUNIT_UNARY_ASSERTION' !!(condition) == !!expected_true, \ ~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:773:7: note: expanded from macro 'KUNIT_ASSERTION' pass, \ ^~~~ mm/kfence/kfence_test.c:662:2: note: Loop condition is false. Exiting loop KUNIT_EXPECT_TRUE(test, test_cache); /* Want memcache. */ ^ include/kunit/test.h:1313:2: note: expanded from macro 'KUNIT_EXPECT_TRUE' KUNIT_TRUE_ASSERTION(test, KUNIT_EXPECTATION, condition) ^ include/kunit/test.h:829:2: note: expanded from macro 'KUNIT_TRUE_ASSERTION' KUNIT_TRUE_MSG_ASSERTION(test, assert_type, condition, NULL) ^ include/kunit/test.h:821:2: note: expanded from macro 'KUNIT_TRUE_MSG_ASSERTION' KUNIT_UNARY_ASSERTION(test, \ ^ include/kunit/test.h:810:2: note: expanded from macro 'KUNIT_UNARY_ASSERTION' KUNIT_ASSERTION(test, \ ^ include/kunit/test.h:769:74: note: expanded from macro 'KUNIT_ASSERTION' #define KUNIT_ASSERTION(test, pass, assert_class, INITIALIZER, fmt, ...) do { \ ^ mm/kfence/kfence_test.c:667:2: note: Calling 'rcu_read_lock' rcu_read_lock(); ^~~~~~~~~~~~~~~ include/linux/rcupdate.h:685:2: note: Calling '__rcu_read_lock' __rcu_read_lock(); ^~~~~~~~~~~~~~~~~ include/linux/rcupdate.h:68:2: note: Calling '__preempt_count_add' preempt_disable(); ^ include/linux/preempt.h:177:2: note: expanded from macro 'preempt_disable' preempt_count_inc(); \ ^~~~~~~~~~~~~~~~~~~ include/linux/preempt.h:170:29: note: expanded from macro 'preempt_count_inc' #define preempt_count_inc() preempt_count_add(1) ^~~~~~~~~~~~~~~~~~~~ include/linux/preempt.h:162:32: note: expanded from macro 'preempt_count_add' #define preempt_count_add(val) __preempt_count_add(val) ^~~~~~~~~~~~~~~~~~~~~~~~ arch/s390/include/asm/preempt.h:100:29: note: Dereference of null pointer S390_lowcore.preempt_count += val; ^ >> mm/kfence/kfence_test.c:160:2: warning: Value stored to 'cur' is never read >> [clang-analyzer-deadcode.DeadStores] cur += scnprintf(cur, end - cur, " 0x%p", (void *)addr); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/kfence/kfence_test.c:160:2: note: Value stored to 'cur' is never read cur += scnprintf(cur, end - cur, " 0x%p", (void *)addr); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> mm/kfence/kfence_test.c:160:9: warning: Use of memory after it is freed >> [clang-analyzer-unix.Malloc] cur += scnprintf(cur, end - cur, " 0x%p", (void *)addr); ^ mm/kfence/kfence_test.c:391:2: note: Calling 'test_free' test_free(expect.addr); /* Double-free. */ ^~~~~~~~~~~~~~~~~~~~~~ mm/kfence/kfence_test.c:217:6: note: Assuming 'test_cache' is null if (test_cache) ^~~~~~~~~~ mm/kfence/kfence_test.c:217:2: note: Taking false branch if (test_cache) ^ mm/kfence/kfence_test.c:220:3: note: Memory is released kfree(ptr); ^~~~~~~~~~ mm/kfence/kfence_test.c:391:2: note: Returning; memory was released via 1st parameter test_free(expect.addr); /* Double-free. */ ^~~~~~~~~~~~~~~~~~~~~~ mm/kfence/kfence_test.c:392:26: note: Calling 'report_matches' KUNIT_EXPECT_TRUE(test, report_matches(&expect)); ^ include/kunit/test.h:1313:48: note: expanded from macro 'KUNIT_EXPECT_TRUE' KUNIT_TRUE_ASSERTION(test, KUNIT_EXPECTATION, condition) ^~~~~~~~~ include/kunit/test.h:829:46: note: expanded from macro 'KUNIT_TRUE_ASSERTION' KUNIT_TRUE_MSG_ASSERTION(test, assert_type, condition, NULL) ^~~~~~~~~ include/kunit/test.h:823:10: note: expanded from macro 'KUNIT_TRUE_MSG_ASSERTION' condition, \ ^~~~~~~~~ include/kunit/test.h:811:7: note: expanded from macro 'KUNIT_UNARY_ASSERTION' !!(condition) == !!expected_true, \ ^~~~~~~~~ include/kunit/test.h:773:7: note: expanded from macro 'KUNIT_ASSERTION' pass, \ ^~~~ mm/kfence/kfence_test.c:100:2: note: Taking false branch if (!report_available()) ^ mm/kfence/kfence_test.c:108:2: note: Control jumps to 'case KFENCE_ERROR_INVALID_FREE:' at line 124 switch (r->type) { ^ mm/kfence/kfence_test.c:126:3: note: Execution continues on line 129 break; ^ mm/kfence/kfence_test.c:132:6: note: Assuming 'cur' is null if (cur) ^~~ mm/kfence/kfence_test.c:132:2: note: Taking false branch if (cur) ^ mm/kfence/kfence_test.c:139:2: note: Control jumps to 'case KFENCE_ERROR_INVALID_FREE:' at line 155 switch (r->type) { ^ mm/kfence/kfence_test.c:157:3: note: Execution continues on line 160 break; ^ mm/kfence/kfence_test.c:160:9: note: Use of memory after it is freed cur += scnprintf(cur, end - cur, " 0x%p", (void *)addr); ^ ~~~~~~~~~~~~ mm/kfence/kfence_test.c:376:2: warning: Use of memory after it is freed [clang-analyzer-unix.Malloc] READ_ONCE(*expect.addr); ^ include/asm-generic/rwonce.h:50:2: note: expanded from macro 'READ_ONCE' __READ_ONCE(x); \ ^~~~~~~~~~~~~~ include/asm-generic/rwonce.h:44:24: note: expanded from macro '__READ_ONCE' #define __READ_ONCE(x) (*(const volatile __unqual_scalar_typeof(x) *)&(x)) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/kfence/kfence_test.c:375:2: note: Calling 'test_free' test_free(expect.addr); ^~~~~~~~~~~~~~~~~~~~~~ mm/kfence/kfence_test.c:217:6: note: Assuming 'test_cache' is null if (test_cache) ^~~~~~~~~~ mm/kfence/kfence_test.c:217:2: note: Taking false branch if (test_cache) ^ mm/kfence/kfence_test.c:220:3: note: Memory is released kfree(ptr); ^~~~~~~~~~ mm/kfence/kfence_test.c:375:2: note: Returning; memory was released via 1st parameter test_free(expect.addr); ^~~~~~~~~~~~~~~~~~~~~~ mm/kfence/kfence_test.c:376:2: note: Left side of '||' is true READ_ONCE(*expect.addr); ^ include/asm-generic/rwonce.h:49:2: note: expanded from macro 'READ_ONCE' compiletime_assert_rwonce_type(x); \ ^ include/asm-generic/rwonce.h:36:21: note: expanded from macro 'compiletime_assert_rwonce_type' compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \ ^ include/linux/compiler_types.h:290:29: note: expanded from macro '__native_word' (sizeof(t) == sizeof(char) || sizeof(t) == sizeof(short) || \ ^ mm/kfence/kfence_test.c:376:2: note: Taking false branch READ_ONCE(*expect.addr); ^ include/asm-generic/rwonce.h:49:2: note: expanded from macro 'READ_ONCE' compiletime_assert_rwonce_type(x); \ ^ include/asm-generic/rwonce.h:36:2: note: expanded from macro 'compiletime_assert_rwonce_type' compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \ ^ include/linux/compiler_types.h:328:2: note: expanded from macro 'compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^ include/linux/compiler_types.h:316:2: note: expanded from macro '_compiletime_assert' __compiletime_assert(condition, msg, prefix, suffix) ^ include/linux/compiler_types.h:308:3: note: expanded from macro '__compiletime_assert' if (!(condition)) \ ^ mm/kfence/kfence_test.c:376:2: note: Loop condition is false. Exiting loop READ_ONCE(*expect.addr); ^ include/asm-generic/rwonce.h:49:2: note: expanded from macro 'READ_ONCE' compiletime_assert_rwonce_type(x); \ ^ include/asm-generic/rwonce.h:36:2: note: expanded from macro 'compiletime_assert_rwonce_type' compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \ ^ include/linux/compiler_types.h:328:2: note: expanded from macro 'compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^ include/linux/compiler_types.h:316:2: note: expanded from macro '_compiletime_assert' __compiletime_assert(condition, msg, prefix, suffix) ^ include/linux/compiler_types.h:306:2: note: expanded from macro '__compiletime_assert' do { \ ^ mm/kfence/kfence_test.c:376:2: note: Use of memory after it is freed READ_ONCE(*expect.addr); ^ include/asm-generic/rwonce.h:50:2: note: expanded from macro 'READ_ONCE' __READ_ONCE(x); \ ^~~~~~~~~~~~~~ include/asm-generic/rwonce.h:44:24: note: expanded from macro '__READ_ONCE' #define __READ_ONCE(x) (*(const volatile __unqual_scalar_typeof(x) *)&(x)) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/kfence/kfence_test.c:391:2: warning: Use of memory after it is freed [clang-analyzer-unix.Malloc] test_free(expect.addr); /* Double-free. */ ^ ~~~~~~~~~~~ mm/kfence/kfence_test.c:390:2: note: Calling 'test_free' test_free(expect.addr); ^~~~~~~~~~~~~~~~~~~~~~ mm/kfence/kfence_test.c:217:6: note: Assuming 'test_cache' is null if (test_cache) ^~~~~~~~~~ mm/kfence/kfence_test.c:217:2: note: Taking false branch if (test_cache) ^ mm/kfence/kfence_test.c:220:3: note: Memory is released kfree(ptr); ^~~~~~~~~~ mm/kfence/kfence_test.c:390:2: note: Returning; memory was released via 1st parameter test_free(expect.addr); ^~~~~~~~~~~~~~~~~~~~~~ mm/kfence/kfence_test.c:391:2: note: Use of memory after it is freed test_free(expect.addr); /* Double-free. */ ^ ~~~~~~~~~~~ mm/kfence/kfence_test.c:408:2: warning: Use of memory after it is freed [clang-analyzer-unix.Malloc] test_free(buf); /* No error. */ ^ ~~~ mm/kfence/kfence_test.c:407:2: note: Calling 'test_free' test_free(expect.addr); /* Invalid address free. */ ^~~~~~~~~~~~~~~~~~~~~~ mm/kfence/kfence_test.c:217:6: note: Assuming 'test_cache' is null if (test_cache) ^~~~~~~~~~ mm/kfence/kfence_test.c:217:2: note: Taking false branch if (test_cache) ^ mm/kfence/kfence_test.c:220:3: note: Memory is released kfree(ptr); ^~~~~~~~~~ mm/kfence/kfence_test.c:407:2: note: Returning; memory was released test_free(expect.addr); /* Invalid address free. */ ^~~~~~~~~~~~~~~~~~~~~~ mm/kfence/kfence_test.c:408:2: note: Use of memory after it is freed test_free(buf); /* No error. */ ^ ~~~ >> mm/kfence/kfence_test.c:703:10: warning: Array access (from variable 'buf') >> results in a null pointer dereference [clang-analyzer-core.NullDereference] buf[i] = i + 1; ~~~ ^ mm/kfence/kfence_test.c:691:2: note: 'expect.addr' initialized to a null pointer value const struct expect_report expect = { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/kfence/kfence_test.c:697:2: note: 'buf' initialized to a null pointer value char *buf = expect.addr; ^~~~~~~~~ mm/kfence/kfence_test.c:700:2: note: Assuming 'test_cache' is non-null KUNIT_EXPECT_FALSE(test, test_cache); ^ include/kunit/test.h:1332:2: note: expanded from macro 'KUNIT_EXPECT_FALSE' KUNIT_FALSE_ASSERTION(test, KUNIT_EXPECTATION, condition) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:840:2: note: expanded from macro 'KUNIT_FALSE_ASSERTION' KUNIT_FALSE_MSG_ASSERTION(test, assert_type, condition, NULL) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:832:2: note: expanded from macro 'KUNIT_FALSE_MSG_ASSERTION' KUNIT_UNARY_ASSERTION(test, \ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:811:5: note: expanded from macro 'KUNIT_UNARY_ASSERTION' !!(condition) == !!expected_true, \ ~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:773:7: note: expanded from macro 'KUNIT_ASSERTION' pass, \ ^~~~ mm/kfence/kfence_test.c:700:2: note: Loop condition is false. Exiting loop KUNIT_EXPECT_FALSE(test, test_cache); ^ include/kunit/test.h:1332:2: note: expanded from macro 'KUNIT_EXPECT_FALSE' KUNIT_FALSE_ASSERTION(test, KUNIT_EXPECTATION, condition) ^ include/kunit/test.h:840:2: note: expanded from macro 'KUNIT_FALSE_ASSERTION' KUNIT_FALSE_MSG_ASSERTION(test, assert_type, condition, NULL) ^ include/kunit/test.h:832:2: note: expanded from macro 'KUNIT_FALSE_MSG_ASSERTION' KUNIT_UNARY_ASSERTION(test, \ ^ include/kunit/test.h:810:2: note: expanded from macro 'KUNIT_UNARY_ASSERTION' KUNIT_ASSERTION(test, \ ^ include/kunit/test.h:769:74: note: expanded from macro 'KUNIT_ASSERTION' #define KUNIT_ASSERTION(test, pass, assert_class, INITIALIZER, fmt, ...) do { \ ^ mm/kfence/kfence_test.c:701:2: note: Assuming '__left' is not equal to '__right' KUNIT_EXPECT_EQ(test, ksize(buf), size); /* Precise size match after KFENCE alloc. */ ^ include/kunit/test.h:1353:2: note: expanded from macro 'KUNIT_EXPECT_EQ' KUNIT_BINARY_EQ_ASSERTION(test, KUNIT_EXPECTATION, left, right) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:990:2: note: expanded from macro 'KUNIT_BINARY_EQ_ASSERTION' KUNIT_BINARY_EQ_MSG_ASSERTION(test, \ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:980:2: note: expanded from macro 'KUNIT_BINARY_EQ_MSG_ASSERTION' KUNIT_BASE_EQ_MSG_ASSERTION(test, \ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:891:2: note: expanded from macro 'KUNIT_BASE_EQ_MSG_ASSERTION' KUNIT_BASE_BINARY_ASSERTION(test, \ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:870:4: note: expanded from macro 'KUNIT_BASE_BINARY_ASSERTION' __left op __right, \ ~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:773:7: note: expanded from macro 'KUNIT_ASSERTION' pass, \ ^~~~ mm/kfence/kfence_test.c:701:2: note: Loop condition is false. Exiting loop KUNIT_EXPECT_EQ(test, ksize(buf), size); /* Precise size match after KFENCE alloc. */ ^ include/kunit/test.h:1353:2: note: expanded from macro 'KUNIT_EXPECT_EQ' KUNIT_BINARY_EQ_ASSERTION(test, KUNIT_EXPECTATION, left, right) ^ include/kunit/test.h:990:2: note: expanded from macro 'KUNIT_BINARY_EQ_ASSERTION' KUNIT_BINARY_EQ_MSG_ASSERTION(test, \ ^ include/kunit/test.h:980:2: note: expanded from macro 'KUNIT_BINARY_EQ_MSG_ASSERTION' KUNIT_BASE_EQ_MSG_ASSERTION(test, \ ^ include/kunit/test.h:891:2: note: expanded from macro 'KUNIT_BASE_EQ_MSG_ASSERTION' KUNIT_BASE_BINARY_ASSERTION(test, \ ^ include/kunit/test.h:869:2: note: expanded from macro 'KUNIT_BASE_BINARY_ASSERTION' KUNIT_ASSERTION(test, \ ^ include/kunit/test.h:769:74: note: expanded from macro 'KUNIT_ASSERTION' #define KUNIT_ASSERTION(test, pass, assert_class, INITIALIZER, fmt, ...) do { \ ^ mm/kfence/kfence_test.c:701:2: note: Loop condition is false. Exiting loop KUNIT_EXPECT_EQ(test, ksize(buf), size); /* Precise size match after KFENCE alloc. */ ^ include/kunit/test.h:1353:2: note: expanded from macro 'KUNIT_EXPECT_EQ' KUNIT_BINARY_EQ_ASSERTION(test, KUNIT_EXPECTATION, left, right) ^ include/kunit/test.h:990:2: note: expanded from macro 'KUNIT_BINARY_EQ_ASSERTION' KUNIT_BINARY_EQ_MSG_ASSERTION(test, \ ^ include/kunit/test.h:980:2: note: expanded from macro 'KUNIT_BINARY_EQ_MSG_ASSERTION' KUNIT_BASE_EQ_MSG_ASSERTION(test, \ ^ include/kunit/test.h:891:2: note: expanded from macro 'KUNIT_BASE_EQ_MSG_ASSERTION' KUNIT_BASE_BINARY_ASSERTION(test, \ vim +/cur +160 mm/kfence/kfence_test.c bc8fbc5f305aec Marco Elver 2021-02-25 88 bc8fbc5f305aec Marco Elver 2021-02-25 89 /* Check observed report matches information in @r. */ bc8fbc5f305aec Marco Elver 2021-02-25 90 static bool report_matches(const struct expect_report *r) bc8fbc5f305aec Marco Elver 2021-02-25 91 { f99e12b21b84fe Sven Schnelle 2021-07-28 92 unsigned long addr = (unsigned long)r->addr; bc8fbc5f305aec Marco Elver 2021-02-25 93 bool ret = false; bc8fbc5f305aec Marco Elver 2021-02-25 94 unsigned long flags; bc8fbc5f305aec Marco Elver 2021-02-25 95 typeof(observed.lines) expect; bc8fbc5f305aec Marco Elver 2021-02-25 96 const char *end; bc8fbc5f305aec Marco Elver 2021-02-25 97 char *cur; bc8fbc5f305aec Marco Elver 2021-02-25 98 bc8fbc5f305aec Marco Elver 2021-02-25 99 /* Doubled-checked locking. */ bc8fbc5f305aec Marco Elver 2021-02-25 100 if (!report_available()) bc8fbc5f305aec Marco Elver 2021-02-25 101 return false; bc8fbc5f305aec Marco Elver 2021-02-25 102 bc8fbc5f305aec Marco Elver 2021-02-25 103 /* Generate expected report contents. */ bc8fbc5f305aec Marco Elver 2021-02-25 104 bc8fbc5f305aec Marco Elver 2021-02-25 105 /* Title */ bc8fbc5f305aec Marco Elver 2021-02-25 106 cur = expect[0]; bc8fbc5f305aec Marco Elver 2021-02-25 107 end = &expect[0][sizeof(expect[0]) - 1]; bc8fbc5f305aec Marco Elver 2021-02-25 108 switch (r->type) { bc8fbc5f305aec Marco Elver 2021-02-25 109 case KFENCE_ERROR_OOB: bc8fbc5f305aec Marco Elver 2021-02-25 110 cur += scnprintf(cur, end - cur, "BUG: KFENCE: out-of-bounds %s", bc8fbc5f305aec Marco Elver 2021-02-25 111 get_access_type(r)); bc8fbc5f305aec Marco Elver 2021-02-25 112 break; bc8fbc5f305aec Marco Elver 2021-02-25 113 case KFENCE_ERROR_UAF: bc8fbc5f305aec Marco Elver 2021-02-25 114 cur += scnprintf(cur, end - cur, "BUG: KFENCE: use-after-free %s", bc8fbc5f305aec Marco Elver 2021-02-25 115 get_access_type(r)); bc8fbc5f305aec Marco Elver 2021-02-25 116 break; bc8fbc5f305aec Marco Elver 2021-02-25 117 case KFENCE_ERROR_CORRUPTION: bc8fbc5f305aec Marco Elver 2021-02-25 118 cur += scnprintf(cur, end - cur, "BUG: KFENCE: memory corruption"); bc8fbc5f305aec Marco Elver 2021-02-25 119 break; bc8fbc5f305aec Marco Elver 2021-02-25 120 case KFENCE_ERROR_INVALID: bc8fbc5f305aec Marco Elver 2021-02-25 121 cur += scnprintf(cur, end - cur, "BUG: KFENCE: invalid %s", bc8fbc5f305aec Marco Elver 2021-02-25 122 get_access_type(r)); bc8fbc5f305aec Marco Elver 2021-02-25 123 break; bc8fbc5f305aec Marco Elver 2021-02-25 124 case KFENCE_ERROR_INVALID_FREE: bc8fbc5f305aec Marco Elver 2021-02-25 125 cur += scnprintf(cur, end - cur, "BUG: KFENCE: invalid free"); bc8fbc5f305aec Marco Elver 2021-02-25 126 break; bc8fbc5f305aec Marco Elver 2021-02-25 127 } bc8fbc5f305aec Marco Elver 2021-02-25 128 bc8fbc5f305aec Marco Elver 2021-02-25 129 scnprintf(cur, end - cur, " in %pS", r->fn); bc8fbc5f305aec Marco Elver 2021-02-25 130 /* The exact offset won't match, remove it; also strip module name. */ bc8fbc5f305aec Marco Elver 2021-02-25 131 cur = strchr(expect[0], '+'); bc8fbc5f305aec Marco Elver 2021-02-25 132 if (cur) bc8fbc5f305aec Marco Elver 2021-02-25 133 *cur = '\0'; bc8fbc5f305aec Marco Elver 2021-02-25 134 bc8fbc5f305aec Marco Elver 2021-02-25 135 /* Access information */ bc8fbc5f305aec Marco Elver 2021-02-25 136 cur = expect[1]; bc8fbc5f305aec Marco Elver 2021-02-25 137 end = &expect[1][sizeof(expect[1]) - 1]; bc8fbc5f305aec Marco Elver 2021-02-25 138 bc8fbc5f305aec Marco Elver 2021-02-25 139 switch (r->type) { bc8fbc5f305aec Marco Elver 2021-02-25 140 case KFENCE_ERROR_OOB: bc8fbc5f305aec Marco Elver 2021-02-25 141 cur += scnprintf(cur, end - cur, "Out-of-bounds %s at", get_access_type(r)); f99e12b21b84fe Sven Schnelle 2021-07-28 142 addr = arch_kfence_test_address(addr); bc8fbc5f305aec Marco Elver 2021-02-25 143 break; bc8fbc5f305aec Marco Elver 2021-02-25 144 case KFENCE_ERROR_UAF: bc8fbc5f305aec Marco Elver 2021-02-25 145 cur += scnprintf(cur, end - cur, "Use-after-free %s at", get_access_type(r)); f99e12b21b84fe Sven Schnelle 2021-07-28 146 addr = arch_kfence_test_address(addr); bc8fbc5f305aec Marco Elver 2021-02-25 147 break; bc8fbc5f305aec Marco Elver 2021-02-25 148 case KFENCE_ERROR_CORRUPTION: bc8fbc5f305aec Marco Elver 2021-02-25 149 cur += scnprintf(cur, end - cur, "Corrupted memory at"); bc8fbc5f305aec Marco Elver 2021-02-25 150 break; bc8fbc5f305aec Marco Elver 2021-02-25 151 case KFENCE_ERROR_INVALID: bc8fbc5f305aec Marco Elver 2021-02-25 152 cur += scnprintf(cur, end - cur, "Invalid %s at", get_access_type(r)); f99e12b21b84fe Sven Schnelle 2021-07-28 153 addr = arch_kfence_test_address(addr); bc8fbc5f305aec Marco Elver 2021-02-25 154 break; bc8fbc5f305aec Marco Elver 2021-02-25 155 case KFENCE_ERROR_INVALID_FREE: bc8fbc5f305aec Marco Elver 2021-02-25 156 cur += scnprintf(cur, end - cur, "Invalid free of"); bc8fbc5f305aec Marco Elver 2021-02-25 157 break; bc8fbc5f305aec Marco Elver 2021-02-25 158 } bc8fbc5f305aec Marco Elver 2021-02-25 159 f99e12b21b84fe Sven Schnelle 2021-07-28 @160 cur += scnprintf(cur, end - cur, " 0x%p", (void *)addr); bc8fbc5f305aec Marco Elver 2021-02-25 161 bc8fbc5f305aec Marco Elver 2021-02-25 162 spin_lock_irqsave(&observed.lock, flags); bc8fbc5f305aec Marco Elver 2021-02-25 163 if (!report_available()) bc8fbc5f305aec Marco Elver 2021-02-25 164 goto out; /* A new report is being captured. */ bc8fbc5f305aec Marco Elver 2021-02-25 165 bc8fbc5f305aec Marco Elver 2021-02-25 166 /* Finally match expected output to what we actually observed. */ bc8fbc5f305aec Marco Elver 2021-02-25 167 ret = strstr(observed.lines[0], expect[0]) && strstr(observed.lines[1], expect[1]); bc8fbc5f305aec Marco Elver 2021-02-25 168 out: bc8fbc5f305aec Marco Elver 2021-02-25 169 spin_unlock_irqrestore(&observed.lock, flags); bc8fbc5f305aec Marco Elver 2021-02-25 170 return ret; bc8fbc5f305aec Marco Elver 2021-02-25 171 } bc8fbc5f305aec Marco Elver 2021-02-25 172 bc8fbc5f305aec Marco Elver 2021-02-25 173 /* ===== Test cases ===== */ bc8fbc5f305aec Marco Elver 2021-02-25 174 bc8fbc5f305aec Marco Elver 2021-02-25 175 #define TEST_PRIV_WANT_MEMCACHE ((void *)1) bc8fbc5f305aec Marco Elver 2021-02-25 176 bc8fbc5f305aec Marco Elver 2021-02-25 177 /* Cache used by tests; if NULL, allocate from kmalloc instead. */ bc8fbc5f305aec Marco Elver 2021-02-25 178 static struct kmem_cache *test_cache; bc8fbc5f305aec Marco Elver 2021-02-25 179 bc8fbc5f305aec Marco Elver 2021-02-25 180 static size_t setup_test_cache(struct kunit *test, size_t size, slab_flags_t flags, bc8fbc5f305aec Marco Elver 2021-02-25 181 void (*ctor)(void *)) bc8fbc5f305aec Marco Elver 2021-02-25 182 { bc8fbc5f305aec Marco Elver 2021-02-25 183 if (test->priv != TEST_PRIV_WANT_MEMCACHE) bc8fbc5f305aec Marco Elver 2021-02-25 184 return size; bc8fbc5f305aec Marco Elver 2021-02-25 185 bc8fbc5f305aec Marco Elver 2021-02-25 186 kunit_info(test, "%s: size=%zu, ctor=%ps\n", __func__, size, ctor); bc8fbc5f305aec Marco Elver 2021-02-25 187 bc8fbc5f305aec Marco Elver 2021-02-25 188 /* bc8fbc5f305aec Marco Elver 2021-02-25 189 * Use SLAB_NOLEAKTRACE to prevent merging with existing caches. Any bc8fbc5f305aec Marco Elver 2021-02-25 190 * other flag in SLAB_NEVER_MERGE also works. Use SLAB_ACCOUNT to bc8fbc5f305aec Marco Elver 2021-02-25 191 * allocate via memcg, if enabled. bc8fbc5f305aec Marco Elver 2021-02-25 192 */ bc8fbc5f305aec Marco Elver 2021-02-25 193 flags |= SLAB_NOLEAKTRACE | SLAB_ACCOUNT; bc8fbc5f305aec Marco Elver 2021-02-25 194 test_cache = kmem_cache_create("test", size, 1, flags, ctor); bc8fbc5f305aec Marco Elver 2021-02-25 195 KUNIT_ASSERT_TRUE_MSG(test, test_cache, "could not create cache"); bc8fbc5f305aec Marco Elver 2021-02-25 196 bc8fbc5f305aec Marco Elver 2021-02-25 197 return size; bc8fbc5f305aec Marco Elver 2021-02-25 198 } bc8fbc5f305aec Marco Elver 2021-02-25 199 bc8fbc5f305aec Marco Elver 2021-02-25 200 static void test_cache_destroy(void) bc8fbc5f305aec Marco Elver 2021-02-25 201 { bc8fbc5f305aec Marco Elver 2021-02-25 202 if (!test_cache) bc8fbc5f305aec Marco Elver 2021-02-25 203 return; bc8fbc5f305aec Marco Elver 2021-02-25 204 bc8fbc5f305aec Marco Elver 2021-02-25 205 kmem_cache_destroy(test_cache); bc8fbc5f305aec Marco Elver 2021-02-25 206 test_cache = NULL; bc8fbc5f305aec Marco Elver 2021-02-25 207 } bc8fbc5f305aec Marco Elver 2021-02-25 208 bc8fbc5f305aec Marco Elver 2021-02-25 209 static inline size_t kmalloc_cache_alignment(size_t size) bc8fbc5f305aec Marco Elver 2021-02-25 210 { 588c7fa022d7b2 Hyeonggon Yoo 2021-06-28 211 return kmalloc_caches[kmalloc_type(GFP_KERNEL)][__kmalloc_index(size, false)]->align; bc8fbc5f305aec Marco Elver 2021-02-25 212 } bc8fbc5f305aec Marco Elver 2021-02-25 213 bc8fbc5f305aec Marco Elver 2021-02-25 214 /* Must always inline to match stack trace against caller. */ bc8fbc5f305aec Marco Elver 2021-02-25 215 static __always_inline void test_free(void *ptr) bc8fbc5f305aec Marco Elver 2021-02-25 216 { bc8fbc5f305aec Marco Elver 2021-02-25 217 if (test_cache) bc8fbc5f305aec Marco Elver 2021-02-25 218 kmem_cache_free(test_cache, ptr); bc8fbc5f305aec Marco Elver 2021-02-25 219 else bc8fbc5f305aec Marco Elver 2021-02-25 @220 kfree(ptr); bc8fbc5f305aec Marco Elver 2021-02-25 221 } bc8fbc5f305aec Marco Elver 2021-02-25 222 :::::: The code at line 160 was first introduced by commit :::::: f99e12b21b84feb1fd9d845a15096772f1659461 kfence: add function to mask address bits :::::: TO: Sven Schnelle <[email protected]> :::::: CC: Heiko Carstens <[email protected]> -- 0-DAY CI Kernel Test Service https://01.org/lkp _______________________________________________ kbuild mailing list -- [email protected] To unsubscribe send an email to [email protected]
