- Linux-kselftest-mirror - lists.linaro.org

[PATCH v3 4.19 1/2] test_firmware: fix a memory leak with reqs buffer

by Mirsad Todorovac

[ commit be37bed754ed90b2655382f93f9724b3c1aae847 upstream ] Dan Carpenter spotted that test_fw_config->reqs will be leaked if trigger_batched_requests_store() is called two or more times. The same appears with trigger_batched_requests_async_store(). This bug wasn't triggered by the tests, but observed by Dan's visual inspection of the code. The recommended workaround was to return -EBUSY if test_fw_config->reqs is already allocated. Fixes: c92316bf8e94 ("test_firmware: add batched firmware tests") Cc: Luis Chamberlain <mcgrof(a)kernel.org> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: Russ Weight <russell.h.weight(a)intel.com> Cc: Tianfei Zhang <tianfei.zhang(a)intel.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Colin Ian King <colin.i.king(a)gmail.com> Cc: Randy Dunlap <rdunlap(a)infradead.org> Cc: linux-kselftest(a)vger.kernel.org Cc: stable(a)vger.kernel.org # v4.19 Suggested-by: Dan Carpenter <error27(a)gmail.com> Suggested-by: Takashi Iwai <tiwai(a)suse.de> Link: https://lore.kernel.org/r/20230509084746.48259-2-mirsad.todorovac@alu.unizg… Signed-off-by: Mirsad Todorovac <mirsad.todorovac(a)alu.unizg.hr> [ This is a backport to v4.19 stable branch without a change in code from the 5.4+ patch ] --- v2: no changes to commit. minor clarifications with versioning for the patchwork. v1: patch sumbmitted verbatim from the 5.4+ branch to 4.19 lib/test_firmware.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/lib/test_firmware.c b/lib/test_firmware.c index f4cc874021da..e4688821eab8 100644 --- a/lib/test_firmware.c +++ b/lib/test_firmware.c @@ -618,6 +618,11 @@ static ssize_t trigger_batched_requests_store(struct device *dev, mutex_lock(&test_fw_mutex); + if (test_fw_config->reqs) { + rc = -EBUSY; + goto out_bail; + } + test_fw_config->reqs = vzalloc(array3_size(sizeof(struct test_batched_req), test_fw_config->num_requests, 2)); @@ -721,6 +726,11 @@ ssize_t trigger_batched_requests_async_store(struct device *dev, mutex_lock(&test_fw_mutex); + if (test_fw_config->reqs) { + rc = -EBUSY; + goto out_bail; + } + test_fw_config->reqs = vzalloc(array3_size(sizeof(struct test_batched_req), test_fw_config->num_requests, 2)); -- 2.34.1

2 years, 1 month

1
0
0 0

[PATCH v3 net-next 0/5] selftests: openvswitch: add flow programming cases

by Aaron Conole

The openvswitch selftests currently contain a few cases for managing the datapath, which includes creating datapath instances, adding interfaces, and doing some basic feature / upcall tests. This is useful to validate the control path. Add the ability to program some of the more common flows with actions. This can be improved overtime to include regression testing, etc. v2->v3: 1. Dropped support for ipv6 in nat() case 2. Fixed a spelling mistake in 2/5 commit message. v1->v2: 1. Fix issue when parsing ipv6 in the NAT action 2. Fix issue calculating length during ctact parsing 3. Fix error message when invalid bridge is passed 4. Fold in Adrian's patch to support key masks Aaron Conole (4): selftests: openvswitch: add an initial flow programming case selftests: openvswitch: add a test for ipv4 forwarding selftests: openvswitch: add basic ct test case parsing selftests: openvswitch: add ct-nat test case with ipv4 Adrian Moreno (1): selftests: openvswitch: support key masks .../selftests/net/openvswitch/openvswitch.sh | 223 +++++++ .../selftests/net/openvswitch/ovs-dpctl.py | 588 +++++++++++++++++- 2 files changed, 787 insertions(+), 24 deletions(-) -- 2.40.1

2 years, 1 month

4
9
0 0

[PATCH v3 0/3] kunit: Expose some built-in features to modules

by Janusz Krzysztofik

Submit the top-level headers also from the kunit test module notifier initialization callback, so external tools that are parsing dmesg for kunit test output are able to tell how many test suites should be expected and whether to continue parsing after complete output from the first test suite is collected. Extend kunit module notifier initialization callback with a processing path for only listing the tests provided by a module if the kunit action parameter is set to "list", so external tools can obtain a list of test cases to be executed in advance and can make a better job on assigning kernel messages interleaved with kunit output to specific tests. Use test filtering functions in kunit module notifier callback functions, so external tools are able to execute individual test cases from kunit test modules in order to still better isolate their potential impact on kernel messages that appear interleaved with output from other tests. v3: Fix CONFIG_GLOB, required by filtering fuctions, not selected when building as a module. v2: Fix new name of a structure moved to kunit namespace not updated across all uses. Janusz Krzysztofik (3): kunit: Report the count of test suites in a module kunit: Make 'list' action available to kunit test modules kunit: Allow kunit test modules to use test filtering include/kunit/test.h | 14 +++++++++++ lib/kunit/Kconfig | 2 +- lib/kunit/executor.c | 57 +++++++++++++++++++++++++------------------- lib/kunit/test.c | 57 +++++++++++++++++++++++++++++++++++++++++++- 4 files changed, 104 insertions(+), 26 deletions(-) -- 2.41.0

2 years, 1 month

3
10
0 0

[PATCH v1 1/1] test_firmware: prevent race conditions by a correct implementation of locking

by Mirsad Todorovac

NOTE: This patch is tested against 5.4 stable NOTE: This is a patch for the 5.4 stable branch, not for the torvalds tree. The torvalds tree, and stable tree 5.10, 5.15, 6.1 and 6.4 branches were fixed in the separate commit ID 4acfe3dfde68 ("test_firmware: prevent race conditions by a correct implementation of locking") which was incompatible with 5.4 Dan Carpenter spotted a race condition in a couple of situations like these in the test_firmware driver: static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg) { u8 val; int ret; ret = kstrtou8(buf, 10, &val); if (ret) return ret; mutex_lock(&test_fw_mutex); *(u8 *)cfg = val; mutex_unlock(&test_fw_mutex); /* Always return full write size even if we didn't consume all */ return size; } static ssize_t config_num_requests_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count) { int rc; mutex_lock(&test_fw_mutex); if (test_fw_config->reqs) { pr_err("Must call release_all_firmware prior to changing config\n"); rc = -EINVAL; mutex_unlock(&test_fw_mutex); goto out; } mutex_unlock(&test_fw_mutex); // NOTE: HERE is the race!!! Function can be preempted! // test_fw_config->reqs can change between the release of // the lock about and acquire of the lock in the // test_dev_config_update_u8() rc = test_dev_config_update_u8(buf, count, &test_fw_config->num_requests); out: return rc; } static ssize_t config_read_fw_idx_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count) { return test_dev_config_update_u8(buf, count, &test_fw_config->read_fw_idx); } The function test_dev_config_update_u8() is called from both the locked and the unlocked context, function config_num_requests_store() and config_read_fw_idx_store() which can both be called asynchronously as they are driver's methods, while test_dev_config_update_u8() and siblings change their argument pointed to by u8 *cfg or similar pointer. To avoid deadlock on test_fw_mutex, the lock is dropped before calling test_dev_config_update_u8() and re-acquired within test_dev_config_update_u8() itself, but alas this creates a race condition. Having two locks wouldn't assure a race-proof mutual exclusion. This situation is best avoided by the introduction of a new, unlocked function __test_dev_config_update_u8() which can be called from the locked context and reducing test_dev_config_update_u8() to: static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg) { int ret; mutex_lock(&test_fw_mutex); ret = __test_dev_config_update_u8(buf, size, cfg); mutex_unlock(&test_fw_mutex); return ret; } doing the locking and calling the unlocked primitive, which enables both locked and unlocked versions without duplication of code. Fixes: c92316bf8e948 ("test_firmware: add batched firmware tests") Cc: Luis R. Rodriguez <mcgrof(a)kernel.org> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: Russ Weight <russell.h.weight(a)intel.com> Cc: Takashi Iwai <tiwai(a)suse.de> Cc: Tianfei Zhang <tianfei.zhang(a)intel.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Colin Ian King <colin.i.king(a)gmail.com> Cc: Randy Dunlap <rdunlap(a)infradead.org> Cc: linux-kselftest(a)vger.kernel.org Cc: stable(a)vger.kernel.org # v5.4 Suggested-by: Dan Carpenter <error27(a)gmail.com> Link: https://lore.kernel.org/r/20230509084746.48259-1-mirsad.todorovac@alu.unizg… Signed-off-by: Mirsad Todorovac <mirsad.todorovac(a)alu.unizg.hr> --- lib/test_firmware.c | 37 ++++++++++++++++++++++++++++--------- 1 file changed, 28 insertions(+), 9 deletions(-) diff --git a/lib/test_firmware.c b/lib/test_firmware.c index 38553944e967..92d7195d5b5b 100644 --- a/lib/test_firmware.c +++ b/lib/test_firmware.c @@ -301,16 +301,26 @@ static ssize_t config_test_show_str(char *dst, return len; } -static int test_dev_config_update_bool(const char *buf, size_t size, - bool *cfg) +static inline int __test_dev_config_update_bool(const char *buf, size_t size, + bool *cfg) { int ret; - mutex_lock(&test_fw_mutex); if (strtobool(buf, cfg) < 0) ret = -EINVAL; else ret = size; + + return ret; +} + +static int test_dev_config_update_bool(const char *buf, size_t size, + bool *cfg) +{ + int ret; + + mutex_lock(&test_fw_mutex); + ret = __test_dev_config_update_bool(buf, size, cfg); mutex_unlock(&test_fw_mutex); return ret; @@ -340,7 +350,7 @@ static ssize_t test_dev_config_show_int(char *buf, int cfg) return snprintf(buf, PAGE_SIZE, "%d\n", val); } -static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg) +static inline int __test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg) { int ret; long new; @@ -352,14 +362,23 @@ static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg) if (new > U8_MAX) return -EINVAL; - mutex_lock(&test_fw_mutex); *(u8 *)cfg = new; - mutex_unlock(&test_fw_mutex); /* Always return full write size even if we didn't consume all */ return size; } +static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg) +{ + int ret; + + mutex_lock(&test_fw_mutex); + ret = __test_dev_config_update_u8(buf, size, cfg); + mutex_unlock(&test_fw_mutex); + + return ret; +} + static ssize_t test_dev_config_show_u8(char *buf, u8 cfg) { u8 val; @@ -392,10 +411,10 @@ static ssize_t config_num_requests_store(struct device *dev, mutex_unlock(&test_fw_mutex); goto out; } - mutex_unlock(&test_fw_mutex); - rc = test_dev_config_update_u8(buf, count, - &test_fw_config->num_requests); + rc = __test_dev_config_update_u8(buf, count, + &test_fw_config->num_requests); + mutex_unlock(&test_fw_mutex); out: return rc; -- 2.34.1

2 years, 1 month

2
4
0 0

[PATCH v3] selftests: cgroup: fix test_kmem_basic slab1 check

by Lucas Karpinski

test_kmem_basic creates 100,000 negative dentries, with each one mapping to a slab object. After memory.high is set, these are reclaimed through the shrink_slab function call which reclaims all 100,000 entries. The test passes the majority of the time because when slab1 is calculated, it is often above 0, however, 0 is also an acceptable value. Signed-off-by: Lucas Karpinski <lkarpins(a)redhat.com> --- v3: rebased on mm-unstable tools/testing/selftests/cgroup/test_kmem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/cgroup/test_kmem.c b/tools/testing/selftests/cgroup/test_kmem.c index 1b2cec9d18a4..67cc0182058d 100644 --- a/tools/testing/selftests/cgroup/test_kmem.c +++ b/tools/testing/selftests/cgroup/test_kmem.c @@ -75,7 +75,7 @@ static int test_kmem_basic(const char *root) sleep(1); slab1 = cg_read_key_long(cg, "memory.stat", "slab "); - if (slab1 <= 0) + if (slab1 < 0) goto cleanup; current = cg_read_long(cg, "memory.current"); -- 2.41.0

2 years, 1 month

2
1
0 0

[PATCH bpf-next v10 0/5] bpf: Force to MPTCP

by Geliang Tang

As is described in the "How to use MPTCP?" section in MPTCP wiki [1]: "Your app should create sockets with IPPROTO_MPTCP as the proto: ( socket(AF_INET, SOCK_STREAM, IPPROTO_MPTCP); ). Legacy apps can be forced to create and use MPTCP sockets instead of TCP ones via the mptcpize command bundled with the mptcpd daemon." But the mptcpize (LD_PRELOAD technique) command has some limitations [2]: - it doesn't work if the application is not using libc (e.g. GoLang apps) - in some envs, it might not be easy to set env vars / change the way apps are launched, e.g. on Android - mptcpize needs to be launched with all apps that want MPTCP: we could have more control from BPF to enable MPTCP only for some apps or all the ones of a netns or a cgroup, etc. - it is not in BPF, we cannot talk about it at netdev conf. So this patchset attempts to use BPF to implement functions similer to mptcpize. The main idea is to add a hook in sys_socket() to change the protocol id from IPPROTO_TCP (or 0) to IPPROTO_MPTCP. [1] https://github.com/multipath-tcp/mptcp_net-next/wiki [2] https://github.com/multipath-tcp/mptcp_net-next/issues/79 v10: - drop "#ifdef CONFIG_BPF_JIT". - include vmlinux.h and bpf_tracing_net.h to avoid defining some macros. - drop unneeded checks for mptcp. v9: - update comment for 'update_socket_protocol'. v8: - drop the additional checks on the 'protocol' value after the 'update_socket_protocol()' call. v7: - add __weak and __diag_* for update_socket_protocol. v6: - add update_socket_protocol. v5: - add bpf_mptcpify helper. v4: - use lsm_cgroup/socket_create v3: - patch 8: char cmd[128]; -> char cmd[256]; v2: - Fix build selftests errors reported by CI Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/79 Geliang Tang (5): bpf: Add update_socket_protocol hook selftests/bpf: Use random netns name for mptcp selftests/bpf: Add two mptcp netns helpers selftests/bpf: Drop unneeded checks for mptcp selftests/bpf: Add mptcpify test net/mptcp/bpf.c | 15 ++ net/socket.c | 24 ++++ .../testing/selftests/bpf/prog_tests/mptcp.c | 129 +++++++++++++++--- tools/testing/selftests/bpf/progs/mptcpify.c | 20 +++ 4 files changed, 169 insertions(+), 19 deletions(-) create mode 100644 tools/testing/selftests/bpf/progs/mptcpify.c -- 2.35.3

2 years, 1 month

2
8
0 0

[PATCH bpf-next v9 0/4] bpf: Force to MPTCP

by Geliang Tang

As is described in the "How to use MPTCP?" section in MPTCP wiki [1]: "Your app should create sockets with IPPROTO_MPTCP as the proto: ( socket(AF_INET, SOCK_STREAM, IPPROTO_MPTCP); ). Legacy apps can be forced to create and use MPTCP sockets instead of TCP ones via the mptcpize command bundled with the mptcpd daemon." But the mptcpize (LD_PRELOAD technique) command has some limitations [2]: - it doesn't work if the application is not using libc (e.g. GoLang apps) - in some envs, it might not be easy to set env vars / change the way apps are launched, e.g. on Android - mptcpize needs to be launched with all apps that want MPTCP: we could have more control from BPF to enable MPTCP only for some apps or all the ones of a netns or a cgroup, etc. - it is not in BPF, we cannot talk about it at netdev conf. So this patchset attempts to use BPF to implement functions similer to mptcpize. The main idea is to add a hook in sys_socket() to change the protocol id from IPPROTO_TCP (or 0) to IPPROTO_MPTCP. [1] https://github.com/multipath-tcp/mptcp_net-next/wiki [2] https://github.com/multipath-tcp/mptcp_net-next/issues/79 v9: - update comment for 'update_socket_protocol'. v8: - drop the additional checks on the 'protocol' value after the 'update_socket_protocol()' call. v7: - add __weak and __diag_* for update_socket_protocol. v6: - add update_socket_protocol. v5: - add bpf_mptcpify helper. v4: - use lsm_cgroup/socket_create v3: - patch 8: char cmd[128]; -> char cmd[256]; v2: - Fix build selftests errors reported by CI Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/79 Geliang Tang (4): bpf: Add update_socket_protocol hook selftests/bpf: Use random netns name for mptcp selftests/bpf: Add two mptcp netns helpers selftests/bpf: Add mptcpify test net/mptcp/bpf.c | 17 +++ net/socket.c | 24 ++++ .../testing/selftests/bpf/prog_tests/mptcp.c | 125 ++++++++++++++++-- tools/testing/selftests/bpf/progs/mptcpify.c | 25 ++++ 4 files changed, 182 insertions(+), 9 deletions(-) create mode 100644 tools/testing/selftests/bpf/progs/mptcpify.c -- 2.35.3

2 years, 1 month

2
11
0 0

[PATCH -next v2] kunit: fix uninitialized variables bug in attributes filtering

by Rae Moar

Fix smatch warnings regarding uninitialized variables in the filtering patch of the new KUnit Attributes feature. Fixes: 529534e8cba3 ("kunit: Add ability to filter attributes") Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/r/202307270610.s0w4NKEn-lkp@intel.com/ Signed-off-by: Rae Moar <rmoar(a)google.com> --- Change since v1: - Changed initialization of filtered to be {NULL, NULL} at the start and only updated when ready to return. - Remove unnecessary +1 in memory allocation for parsed_filters in executor test. Note that this is rebased on top of the recent fix: ("kunit: fix possible memory leak in kunit_filter_suites()"). lib/kunit/attributes.c | 40 +++++++++++++++++---------------------- lib/kunit/executor.c | 18 +++++++++++------- lib/kunit/executor_test.c | 2 +- 3 files changed, 29 insertions(+), 31 deletions(-) diff --git a/lib/kunit/attributes.c b/lib/kunit/attributes.c index d37c40c0ce4f..5e3034b6be99 100644 --- a/lib/kunit/attributes.c +++ b/lib/kunit/attributes.c @@ -102,7 +102,7 @@ static int int_filter(long val, const char *op, int input, int *err) static int attr_enum_filter(void *attr, const char *input, int *err, const char * const str_list[], int max) { - int i, j, input_int; + int i, j, input_int = -1; long test_val = (long)attr; const char *input_val = NULL; @@ -124,7 +124,7 @@ static int attr_enum_filter(void *attr, const char *input, int *err, input_int = j; } - if (!input_int) { + if (input_int < 0) { *err = -EINVAL; pr_err("kunit executor: invalid filter input: %s\n", input); return false; @@ -186,8 +186,10 @@ static void *attr_module_get(void *test_or_suite, bool is_test) // Suites get their module attribute from their first test_case if (test) return ((void *) test->module_name); - else + else if (kunit_suite_num_test_cases(suite) > 0) return ((void *) suite->test_cases[0].module_name); + else + return (void *) ""; } /* List of all Test Attributes */ @@ -221,7 +223,7 @@ const char *kunit_attr_filter_name(struct kunit_attr_filter filter) void kunit_print_attr(void *test_or_suite, bool is_test, unsigned int test_level) { int i; - bool to_free; + bool to_free = false; void *attr; const char *attr_name, *attr_str; struct kunit_suite *suite = is_test ? NULL : test_or_suite; @@ -255,7 +257,7 @@ void kunit_print_attr(void *test_or_suite, bool is_test, unsigned int test_level int kunit_get_filter_count(char *input) { - int i, comma_index, count = 0; + int i, comma_index = 0, count = 0; for (i = 0; input[i]; i++) { if (input[i] == ',') { @@ -272,7 +274,7 @@ int kunit_get_filter_count(char *input) struct kunit_attr_filter kunit_next_attr_filter(char **filters, int *err) { struct kunit_attr_filter filter = {}; - int i, j, comma_index, new_start_index; + int i, j, comma_index = 0, new_start_index = 0; int op_index = -1, attr_index = -1; char op; char *input = *filters; @@ -316,7 +318,7 @@ struct kunit_attr_filter kunit_next_attr_filter(char **filters, int *err) filter.attr = &kunit_attr_list[attr_index]; } - if (comma_index) { + if (comma_index > 0) { input[comma_index] = '\0'; filter.input = input + op_index; input = input + new_start_index; @@ -356,31 +358,22 @@ struct kunit_suite *kunit_filter_attr_tests(const struct kunit_suite *const suit /* Save filtering result on default value */ default_result = filter.attr->filter(filter.attr->attr_default, filter.input, err); - if (*err) { - kfree(copy); - kfree(filtered); - return NULL; - } + if (*err) + goto err; /* Save suite attribute value and filtering result on that value */ suite_val = filter.attr->get_attr((void *)suite, false); suite_result = filter.attr->filter(suite_val, filter.input, err); - if (*err) { - kfree(copy); - kfree(filtered); - return NULL; - } + if (*err) + goto err; /* For each test case, save test case if passes filtering. */ kunit_suite_for_each_test_case(suite, test_case) { test_val = filter.attr->get_attr((void *) test_case, true); test_result = filter.attr->filter(filter.attr->get_attr(test_case, true), filter.input, err); - if (*err) { - kfree(copy); - kfree(filtered); - return NULL; - } + if (*err) + goto err; /* * If attribute value of test case is set, filter on that value. @@ -406,7 +399,8 @@ struct kunit_suite *kunit_filter_attr_tests(const struct kunit_suite *const suit } } - if (n == 0) { +err: + if (n == 0 || *err) { kfree(copy); kfree(filtered); return NULL; diff --git a/lib/kunit/executor.c b/lib/kunit/executor.c index 481901d245d0..dc295150c4e5 100644 --- a/lib/kunit/executor.c +++ b/lib/kunit/executor.c @@ -127,19 +127,18 @@ static struct suite_set kunit_filter_suites(const struct suite_set *suite_set, { int i, j, k; int filter_count = 0; - struct kunit_suite **copy, *filtered_suite, *new_filtered_suite; - struct suite_set filtered; + struct kunit_suite **copy, **copy_start, *filtered_suite, *new_filtered_suite; + struct suite_set filtered = {NULL, NULL}; struct kunit_glob_filter parsed_glob; - struct kunit_attr_filter *parsed_filters; + struct kunit_attr_filter *parsed_filters = NULL; const size_t max = suite_set->end - suite_set->start; copy = kmalloc_array(max, sizeof(*filtered.start), GFP_KERNEL); - filtered.start = copy; if (!copy) { /* won't be able to run anything, return an empty set */ - filtered.end = copy; return filtered; } + copy_start = copy; if (filter_glob) kunit_parse_glob_filter(&parsed_glob, filter_glob); @@ -147,7 +146,11 @@ static struct suite_set kunit_filter_suites(const struct suite_set *suite_set, /* Parse attribute filters */ if (filters) { filter_count = kunit_get_filter_count(filters); - parsed_filters = kcalloc(filter_count + 1, sizeof(*parsed_filters), GFP_KERNEL); + parsed_filters = kcalloc(filter_count, sizeof(*parsed_filters), GFP_KERNEL); + if (!parsed_filters) { + kfree(copy); + return filtered; + } for (j = 0; j < filter_count; j++) parsed_filters[j] = kunit_next_attr_filter(&filters, err); if (*err) @@ -166,7 +169,7 @@ static struct suite_set kunit_filter_suites(const struct suite_set *suite_set, goto err; } } - if (filter_count) { + if (filter_count > 0 && parsed_filters != NULL) { for (k = 0; k < filter_count; k++) { new_filtered_suite = kunit_filter_attr_tests(filtered_suite, parsed_filters[k], filter_action, err); @@ -195,6 +198,7 @@ static struct suite_set kunit_filter_suites(const struct suite_set *suite_set, *copy++ = filtered_suite; } + filtered.start = copy_start; filtered.end = copy; err: diff --git a/lib/kunit/executor_test.c b/lib/kunit/executor_test.c index 01280cb8d451..3e0a1c99cb4e 100644 --- a/lib/kunit/executor_test.c +++ b/lib/kunit/executor_test.c @@ -119,7 +119,7 @@ static void parse_filter_attr_test(struct kunit *test) filter_count = kunit_get_filter_count(filters); KUNIT_EXPECT_EQ(test, filter_count, 2); - parsed_filters = kunit_kcalloc(test, filter_count + 1, sizeof(*parsed_filters), + parsed_filters = kunit_kcalloc(test, filter_count, sizeof(*parsed_filters), GFP_KERNEL); for (j = 0; j < filter_count; j++) { parsed_filters[j] = kunit_next_attr_filter(&filters, &err); base-commit: 3bffe185ad11e408903d2782727877388d08d94e -- 2.41.0.585.gd2178a4bd4-goog

2 years, 1 month

2
1
0 0

[PATCH -next] kunit: fix possible memory leak in kunit_filter_suites()

by Ruan Jinjie

Inject fault while probing drm_kunit_helpers.ko, if one of kunit_next_attr_filter(), kunit_filter_glob_tests() and kunit_filter_attr_tests() fails, parsed_filters, parsed_glob.suite_glob/test_glob alloced in kunit_parse_glob_filter() is leaked. And the filtered_suite->test_cases alloced in kunit_filter_glob_tests() or kunit_filter_attr_tests() may also be leaked. unreferenced object 0xff110001067e4800 (size 1024): comm "kunit_try_catch", pid 96, jiffies 4294671796 (age 763.547s) hex dump (first 32 bytes): 73 75 69 74 65 32 00 00 00 00 00 00 00 00 00 00 suite2.......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000116e8eba>] __kmalloc_node_track_caller+0x4e/0x140 [<00000000e2f9cce9>] kmemdup+0x2c/0x60 [<000000002a36710b>] kunit_filter_suites+0x3e4/0xa50 [<0000000045779fb9>] filter_suites_test+0x1b7/0x440 [<00000000cd1104a7>] kunit_try_run_case+0x119/0x270 [<00000000c654c917>] kunit_generic_run_threadfn_adapter+0x4e/0xa0 [<00000000d195ac13>] kthread+0x2c7/0x3c0 [<00000000b79c1ee9>] ret_from_fork+0x2c/0x70 [<000000001167f7e6>] ret_from_fork_asm+0x1b/0x30 unreferenced object 0xff11000105d79b00 (size 192): comm "kunit_try_catch", pid 96, jiffies 4294671796 (age 763.547s) hex dump (first 32 bytes): f0 e1 5a 88 ff ff ff ff 60 59 bb 8a ff ff ff ff ..Z.....`Y...... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000000d6e4891>] __kmalloc+0x4d/0x140 [<000000006afe50bd>] kunit_filter_suites+0x424/0xa50 [<0000000045779fb9>] filter_suites_test+0x1b7/0x440 [<00000000cd1104a7>] kunit_try_run_case+0x119/0x270 [<00000000c654c917>] kunit_generic_run_threadfn_adapter+0x4e/0xa0 [<00000000d195ac13>] kthread+0x2c7/0x3c0 [<00000000b79c1ee9>] ret_from_fork+0x2c/0x70 [<000000001167f7e6>] ret_from_fork_asm+0x1b/0x30 unreferenced object 0xff110001067e6000 (size 1024): comm "kunit_try_catch", pid 98, jiffies 4294671798 (age 763.545s) hex dump (first 32 bytes): 73 75 69 74 65 32 00 00 00 00 00 00 00 00 00 00 suite2.......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000116e8eba>] __kmalloc_node_track_caller+0x4e/0x140 [<00000000e2f9cce9>] kmemdup+0x2c/0x60 [<000000002a36710b>] kunit_filter_suites+0x3e4/0xa50 [<00000000f452f130>] filter_suites_test_glob_test+0x1b7/0x660 [<00000000cd1104a7>] kunit_try_run_case+0x119/0x270 [<00000000c654c917>] kunit_generic_run_threadfn_adapter+0x4e/0xa0 [<00000000d195ac13>] kthread+0x2c7/0x3c0 [<00000000b79c1ee9>] ret_from_fork+0x2c/0x70 [<000000001167f7e6>] ret_from_fork_asm+0x1b/0x30 unreferenced object 0xff11000103f3a800 (size 96): comm "kunit_try_catch", pid 98, jiffies 4294671798 (age 763.545s) hex dump (first 32 bytes): f0 e1 5a 88 ff ff ff ff 40 39 bb 8a ff ff ff ff ..Z.....@9...... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000000d6e4891>] __kmalloc+0x4d/0x140 [<000000006afe50bd>] kunit_filter_suites+0x424/0xa50 [<00000000f452f130>] filter_suites_test_glob_test+0x1b7/0x660 [<00000000cd1104a7>] kunit_try_run_case+0x119/0x270 [<00000000c654c917>] kunit_generic_run_threadfn_adapter+0x4e/0xa0 [<00000000d195ac13>] kthread+0x2c7/0x3c0 [<00000000b79c1ee9>] ret_from_fork+0x2c/0x70 [<000000001167f7e6>] ret_from_fork_asm+0x1b/0x30 unreferenced object 0xff11000101a72ac0 (size 16): comm "kunit_try_catch", pid 104, jiffies 4294671814 (age 763.529s) hex dump (first 16 bytes): 00 00 00 00 00 00 00 00 e0 2a a7 01 01 00 11 ff .........*...... backtrace: [<000000000d6e4891>] __kmalloc+0x4d/0x140 [<00000000c7b724e7>] kunit_filter_suites+0x108/0xa50 [<00000000bad5427d>] filter_attr_test+0x1e9/0x6a0 [<00000000cd1104a7>] kunit_try_run_case+0x119/0x270 [<00000000c654c917>] kunit_generic_run_threadfn_adapter+0x4e/0xa0 [<00000000d195ac13>] kthread+0x2c7/0x3c0 [<00000000b79c1ee9>] ret_from_fork+0x2c/0x70 [<000000001167f7e6>] ret_from_fork_asm+0x1b/0x30 unreferenced object 0xff11000103caf880 (size 32): comm "kunit_try_catch", pid 104, jiffies 4294671814 (age 763.547s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000000d6e4891>] __kmalloc+0x4d/0x140 [<00000000c47b0f75>] kunit_filter_suites+0x189/0xa50 [<00000000bad5427d>] filter_attr_test+0x1e9/0x6a0 [<00000000cd1104a7>] kunit_try_run_case+0x119/0x270 [<00000000c654c917>] kunit_generic_run_threadfn_adapter+0x4e/0xa0 [<00000000d195ac13>] kthread+0x2c7/0x3c0 [<00000000b79c1ee9>] ret_from_fork+0x2c/0x70 [<000000001167f7e6>] ret_from_fork_asm+0x1b/0x30 unreferenced object 0xff11000101a72ae0 (size 16): comm "kunit_try_catch", pid 106, jiffies 4294671823 (age 763.538s) hex dump (first 16 bytes): 00 00 00 00 00 00 00 00 00 2b a7 01 01 00 11 ff .........+...... backtrace: [<000000000d6e4891>] __kmalloc+0x4d/0x140 [<00000000c7b724e7>] kunit_filter_suites+0x108/0xa50 [<0000000096255c51>] filter_attr_empty_test+0x1b0/0x310 [<00000000cd1104a7>] kunit_try_run_case+0x119/0x270 [<00000000c654c917>] kunit_generic_run_threadfn_adapter+0x4e/0xa0 [<00000000d195ac13>] kthread+0x2c7/0x3c0 [<00000000b79c1ee9>] ret_from_fork+0x2c/0x70 [<000000001167f7e6>] ret_from_fork_asm+0x1b/0x30 unreferenced object 0xff11000103caf9c0 (size 32): comm "kunit_try_catch", pid 106, jiffies 4294671823 (age 763.538s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000000d6e4891>] __kmalloc+0x4d/0x140 [<00000000c47b0f75>] kunit_filter_suites+0x189/0xa50 [<0000000096255c51>] filter_attr_empty_test+0x1b0/0x310 [<00000000cd1104a7>] kunit_try_run_case+0x119/0x270 [<00000000c654c917>] kunit_generic_run_threadfn_adapter+0x4e/0xa0 [<00000000d195ac13>] kthread+0x2c7/0x3c0 [<00000000b79c1ee9>] ret_from_fork+0x2c/0x70 [<000000001167f7e6>] ret_from_fork_asm+0x1b/0x30 unreferenced object 0xff11000101a72b00 (size 16): comm "kunit_try_catch", pid 108, jiffies 4294671832 (age 763.529s) hex dump (first 16 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000000d6e4891>] __kmalloc+0x4d/0x140 [<00000000c47b0f75>] kunit_filter_suites+0x189/0xa50 [<00000000881258cc>] filter_attr_skip_test+0x148/0x770 [<00000000cd1104a7>] kunit_try_run_case+0x119/0x270 [<00000000c654c917>] kunit_generic_run_threadfn_adapter+0x4e/0xa0 [<00000000d195ac13>] kthread+0x2c7/0x3c0 [<00000000b79c1ee9>] ret_from_fork+0x2c/0x70 [<000000001167f7e6>] ret_from_fork_asm+0x1b/0x30 Fixes: 5d31f71efcb6 ("kunit: add kunit.filter_glob cmdline option to filter suites") Fixes: 529534e8cba3 ("kunit: Add ability to filter attributes") Signed-off-by: Ruan Jinjie <ruanjinjie(a)huawei.com> --- lib/kunit/executor.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/lib/kunit/executor.c b/lib/kunit/executor.c index 5b5bed1efb93..481901d245d0 100644 --- a/lib/kunit/executor.c +++ b/lib/kunit/executor.c @@ -151,7 +151,7 @@ static struct suite_set kunit_filter_suites(const struct suite_set *suite_set, for (j = 0; j < filter_count; j++) parsed_filters[j] = kunit_next_attr_filter(&filters, err); if (*err) - return filtered; + goto err; } for (i = 0; &suite_set->start[i] != suite_set->end; i++) { @@ -163,7 +163,7 @@ static struct suite_set kunit_filter_suites(const struct suite_set *suite_set, parsed_glob.test_glob); if (IS_ERR(filtered_suite)) { *err = PTR_ERR(filtered_suite); - return filtered; + goto err; } } if (filter_count) { @@ -172,15 +172,18 @@ static struct suite_set kunit_filter_suites(const struct suite_set *suite_set, parsed_filters[k], filter_action, err); /* Free previous copy of suite */ - if (k > 0 || filter_glob) + if (k > 0 || filter_glob) { + kfree(filtered_suite->test_cases); kfree(filtered_suite); + } + filtered_suite = new_filtered_suite; if (*err) - return filtered; + goto err; if (IS_ERR(filtered_suite)) { *err = PTR_ERR(filtered_suite); - return filtered; + goto err; } if (!filtered_suite) break; @@ -194,6 +197,10 @@ static struct suite_set kunit_filter_suites(const struct suite_set *suite_set, } filtered.end = copy; +err: + if (*err) + kfree(copy); + if (filter_glob) { kfree(parsed_glob.suite_glob); kfree(parsed_glob.test_glob); -- 2.34.1

2 years, 1 month

3
3
0 0

[PATCH -next] kunit: fix uninitialized variables bug in attributes filtering

by Rae Moar

Fix smatch warnings regarding uninitialized variables in the filtering patch of the new KUnit Attributes feature. Fixes: 529534e8cba3 ("kunit: Add ability to filter attributes") Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/r/202307270610.s0w4NKEn-lkp@intel.com/ Signed-off-by: Rae Moar <rmoar(a)google.com> --- Note that this is rebased on top of the recent fix: ("kunit: fix possible memory leak in kunit_filter_suites()"). lib/kunit/attributes.c | 40 +++++++++++++++++----------------------- lib/kunit/executor.c | 10 +++++++--- 2 files changed, 24 insertions(+), 26 deletions(-) diff --git a/lib/kunit/attributes.c b/lib/kunit/attributes.c index d37c40c0ce4f..5e3034b6be99 100644 --- a/lib/kunit/attributes.c +++ b/lib/kunit/attributes.c @@ -102,7 +102,7 @@ static int int_filter(long val, const char *op, int input, int *err) static int attr_enum_filter(void *attr, const char *input, int *err, const char * const str_list[], int max) { - int i, j, input_int; + int i, j, input_int = -1; long test_val = (long)attr; const char *input_val = NULL; @@ -124,7 +124,7 @@ static int attr_enum_filter(void *attr, const char *input, int *err, input_int = j; } - if (!input_int) { + if (input_int < 0) { *err = -EINVAL; pr_err("kunit executor: invalid filter input: %s\n", input); return false; @@ -186,8 +186,10 @@ static void *attr_module_get(void *test_or_suite, bool is_test) // Suites get their module attribute from their first test_case if (test) return ((void *) test->module_name); - else + else if (kunit_suite_num_test_cases(suite) > 0) return ((void *) suite->test_cases[0].module_name); + else + return (void *) ""; } /* List of all Test Attributes */ @@ -221,7 +223,7 @@ const char *kunit_attr_filter_name(struct kunit_attr_filter filter) void kunit_print_attr(void *test_or_suite, bool is_test, unsigned int test_level) { int i; - bool to_free; + bool to_free = false; void *attr; const char *attr_name, *attr_str; struct kunit_suite *suite = is_test ? NULL : test_or_suite; @@ -255,7 +257,7 @@ void kunit_print_attr(void *test_or_suite, bool is_test, unsigned int test_level int kunit_get_filter_count(char *input) { - int i, comma_index, count = 0; + int i, comma_index = 0, count = 0; for (i = 0; input[i]; i++) { if (input[i] == ',') { @@ -272,7 +274,7 @@ int kunit_get_filter_count(char *input) struct kunit_attr_filter kunit_next_attr_filter(char **filters, int *err) { struct kunit_attr_filter filter = {}; - int i, j, comma_index, new_start_index; + int i, j, comma_index = 0, new_start_index = 0; int op_index = -1, attr_index = -1; char op; char *input = *filters; @@ -316,7 +318,7 @@ struct kunit_attr_filter kunit_next_attr_filter(char **filters, int *err) filter.attr = &kunit_attr_list[attr_index]; } - if (comma_index) { + if (comma_index > 0) { input[comma_index] = '\0'; filter.input = input + op_index; input = input + new_start_index; @@ -356,31 +358,22 @@ struct kunit_suite *kunit_filter_attr_tests(const struct kunit_suite *const suit /* Save filtering result on default value */ default_result = filter.attr->filter(filter.attr->attr_default, filter.input, err); - if (*err) { - kfree(copy); - kfree(filtered); - return NULL; - } + if (*err) + goto err; /* Save suite attribute value and filtering result on that value */ suite_val = filter.attr->get_attr((void *)suite, false); suite_result = filter.attr->filter(suite_val, filter.input, err); - if (*err) { - kfree(copy); - kfree(filtered); - return NULL; - } + if (*err) + goto err; /* For each test case, save test case if passes filtering. */ kunit_suite_for_each_test_case(suite, test_case) { test_val = filter.attr->get_attr((void *) test_case, true); test_result = filter.attr->filter(filter.attr->get_attr(test_case, true), filter.input, err); - if (*err) { - kfree(copy); - kfree(filtered); - return NULL; - } + if (*err) + goto err; /* * If attribute value of test case is set, filter on that value. @@ -406,7 +399,8 @@ struct kunit_suite *kunit_filter_attr_tests(const struct kunit_suite *const suit } } - if (n == 0) { +err: + if (n == 0 || *err) { kfree(copy); kfree(filtered); return NULL; diff --git a/lib/kunit/executor.c b/lib/kunit/executor.c index 481901d245d0..b6e07de2876a 100644 --- a/lib/kunit/executor.c +++ b/lib/kunit/executor.c @@ -130,7 +130,7 @@ static struct suite_set kunit_filter_suites(const struct suite_set *suite_set, struct kunit_suite **copy, *filtered_suite, *new_filtered_suite; struct suite_set filtered; struct kunit_glob_filter parsed_glob; - struct kunit_attr_filter *parsed_filters; + struct kunit_attr_filter *parsed_filters = NULL; const size_t max = suite_set->end - suite_set->start; @@ -147,7 +147,11 @@ static struct suite_set kunit_filter_suites(const struct suite_set *suite_set, /* Parse attribute filters */ if (filters) { filter_count = kunit_get_filter_count(filters); - parsed_filters = kcalloc(filter_count + 1, sizeof(*parsed_filters), GFP_KERNEL); + parsed_filters = kcalloc(filter_count, sizeof(*parsed_filters), GFP_KERNEL); + if (!parsed_filters) { + kfree(copy); + return filtered; + } for (j = 0; j < filter_count; j++) parsed_filters[j] = kunit_next_attr_filter(&filters, err); if (*err) @@ -166,7 +170,7 @@ static struct suite_set kunit_filter_suites(const struct suite_set *suite_set, goto err; } } - if (filter_count) { + if (filter_count > 0 && parsed_filters != NULL) { for (k = 0; k < filter_count; k++) { new_filtered_suite = kunit_filter_attr_tests(filtered_suite, parsed_filters[k], filter_action, err); base-commit: 3bffe185ad11e408903d2782727877388d08d94e -- 2.41.0.585.gd2178a4bd4-goog

2 years, 1 month

2
2
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-kselftest-mirror