On Sat, 6 Jul 2024 at 12:55, Stephen Boyd sboyd@kernel.org wrote:
Introduce KUnit resource wrappers around platform_driver_register(), platform_device_alloc(), and platform_device_add() so that test authors can register platform drivers/devices from their tests and have the drivers/devices automatically be unregistered when the test is done.
This makes test setup code simpler when a platform driver or platform device is needed. Add a few test cases at the same time to make sure the APIs work as intended.
Cc: Brendan Higgins brendan.higgins@linux.dev Reviewed-by: David Gow davidgow@google.com Cc: Rae Moar rmoar@google.com Reviewed-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Cc: "Rafael J. Wysocki" rafael@kernel.org Signed-off-by: Stephen Boyd sboyd@kernel.org
Hmm... this is failing under KASAN for me. I'll take a closer look next week, but in case there's anything super-obvious, here's the report:
[15:54:33] BUG: KASAN: slab-use-after-free in kobject_put+0x224/0x280 [15:54:33] Read of size 1 at addr ffff888002ca484c by task kunit_try_catch/226 [15:54:33] [15:54:33] CPU: 0 PID: 226 Comm: kunit_try_catch Tainted: G D N 6.10.0-rc1-g21fbb4cfd3cc #25 [15:54:33] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [15:54:33] Call Trace: [15:54:33] <TASK> [15:54:33] dump_stack_lvl+0x3f/0x50 [15:54:33] print_report+0xcd/0x620 [15:54:33] ? kobject_put+0x224/0x280 [15:54:33] kasan_report+0xde/0x110 [15:54:33] ? kobject_put+0x224/0x280 [15:54:33] kobject_put+0x224/0x280 [15:54:33] kunit_remove_resource+0x12c/0x1d0 [15:54:33] kunit_cleanup+0x8d/0x130 [15:54:33] ? __pfx_kunit_try_run_case_cleanup+0x10/0x10 [15:54:33] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [15:54:33] kunit_generic_run_threadfn_adapter+0x7b/0xe0 [15:54:33] kthread+0x289/0x360 [15:54:33] ? __pfx_kthread+0x10/0x10 [15:54:33] ret_from_fork+0x2f/0x70 [15:54:33] ? __pfx_kthread+0x10/0x10 [15:54:33] ret_from_fork_asm+0x19/0x30 [15:54:33] </TASK> [15:54:33] [15:54:33] Allocated by task 225: [15:54:33] kasan_save_stack+0x33/0x60 [15:54:33] kasan_save_track+0x14/0x30 [15:54:33] __kasan_kmalloc+0x8f/0xa0 [15:54:33] platform_device_alloc+0x26/0x200 [15:54:33] kunit_platform_device_alloc_init+0x52/0xc0 [15:54:33] __kunit_add_resource+0x98/0x1e0 [15:54:33] kunit_platform_device_alloc+0xe7/0x170 [15:54:33] kunit_platform_device_add_test+0x91/0x560 [15:54:33] kunit_try_run_case+0x1ad/0x490 [15:54:33] kunit_generic_run_threadfn_adapter+0x7b/0xe0 [15:54:33] kthread+0x289/0x360 [15:54:33] ret_from_fork+0x2f/0x70 [15:54:33] ret_from_fork_asm+0x19/0x30 [15:54:33] [15:54:33] Freed by task 226: [15:54:33] kasan_save_stack+0x33/0x60 [15:54:33] kasan_save_track+0x14/0x30 [15:54:33] kasan_save_free_info+0x3b/0x60 [15:54:33] __kasan_slab_free+0x101/0x160 [15:54:33] kfree+0x94/0x190 [15:54:33] device_release+0x9a/0x210 [15:54:33] kobject_put+0x150/0x280 [15:54:33] kunit_remove_resource+0x12c/0x1d0 [15:54:33] kunit_cleanup+0x8d/0x130 [15:54:33] kunit_generic_run_threadfn_adapter+0x7b/0xe0 [15:54:33] kthread+0x289/0x360 [15:54:33] ret_from_fork+0x2f/0x70 [15:54:33] ret_from_fork_asm+0x19/0x30 [15:54:33] [15:54:33] The buggy address belongs to the object at ffff888002ca4800 [15:54:33] which belongs to the cache kmalloc-1k of size 1024 [15:54:33] The buggy address is located 76 bytes inside of [15:54:33] freed 1024-byte region [ffff888002ca4800, ffff888002ca4c00) [15:54:33] [15:54:33] The buggy address belongs to the physical page: [15:54:33] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2ca4 [15:54:33] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [15:54:33] flags: 0x4000000000000040(head|zone=1) [15:54:33] page_type: 0xffffefff(slab) [15:54:33] raw: 4000000000000040 ffff888001041b00 dead000000000122 0000000000000000 [15:54:33] raw: 0000000000000000 0000000080080008 00000001ffffefff 0000000000000000 [15:54:33] head: 4000000000000040 ffff888001041b00 dead000000000122 0000000000000000 [15:54:33] head: 0000000000000000 0000000080080008 00000001ffffefff 0000000000000000 [15:54:33] head: 4000000000000002 ffffea00000b2901 ffffffffffffffff 0000000000000000 [15:54:33] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 [15:54:33] page dumped because: kasan: bad access detected [15:54:33] [15:54:33] Memory state around the buggy address: [15:54:33] ffff888002ca4700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [15:54:33] ffff888002ca4780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [15:54:33] >ffff888002ca4800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [15:54:33] ^ [15:54:33] ffff888002ca4880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [15:54:33] ffff888002ca4900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [15:54:33] ================================================================== [15:54:33] ------------[ cut here ]------------ [15:54:33] refcount_t: underflow; use-after-free. [15:54:33] WARNING: CPU: 0 PID: 226 at lib/refcount.c:28 refcount_warn_saturate+0xf2/0x150 [15:54:33] CPU: 0 PID: 226 Comm: kunit_try_catch Tainted: G B D N 6.10.0-rc1-g21fbb4cfd3cc #25 [15:54:33] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [15:54:33] RIP: 0010:refcount_warn_saturate+0xf2/0x150 [15:54:33] Code: 3b aa cb 00 01 e8 3e c1 b0 ff 0f 0b eb 91 80 3d 2a aa cb 00 00 75 88 48 c7 c7 40 f3 88 ad c6 05 1a aa cb 00 01 e8 1e c1 b0 ff <0f> 0b e9 6e ff ff ff 80 3d 0a aa cb 00 00 0f 85 61 ff ff ff 48 c7 [15:54:33] RSP: 0018:ffff88800357fe58 EFLAGS: 00000286 [15:54:33] RAX: 0000000000000000 RBX: ffff888002ca4848 RCX: 1ffffffff5b920d4 [15:54:33] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffffadc906a0 [15:54:33] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff5b920d4 [15:54:33] R10: 0000000000000003 R11: 0000000000000001 R12: ffff88800111fb28 [15:54:33] R13: ffff88800111fb28 R14: ffff88800111fb28 R15: 0000000000000286 [15:54:33] FS: 0000000000000000(0000) GS:ffffffffadc6f000(0000) knlGS:0000000000000000 [15:54:33] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [15:54:33] CR2: dffffc0000000000 CR3: 000000000a25a000 CR4: 00000000000006f0 [15:54:33] Call Trace: [15:54:33] <TASK> [15:54:33] ? __warn+0xb0/0x170 [15:54:33] ? refcount_warn_saturate+0xf2/0x150 [15:54:33] ? report_bug+0x298/0x350 [15:54:33] ? handle_bug+0x6d/0x90 [15:54:33] ? exc_invalid_op+0x17/0x40 [15:54:33] ? asm_exc_invalid_op+0x1a/0x20 [15:54:33] ? refcount_warn_saturate+0xf2/0x150 [15:54:33] ? refcount_warn_saturate+0xf2/0x150 [15:54:33] kunit_remove_resource+0x12c/0x1d0 [15:54:33] kunit_cleanup+0x8d/0x130 [15:54:33] ? __pfx_kunit_try_run_case_cleanup+0x10/0x10 [15:54:33] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [15:54:33] kunit_generic_run_threadfn_adapter+0x7b/0xe0 [15:54:33] kthread+0x289/0x360 [15:54:33] ? __pfx_kthread+0x10/0x10 [15:54:33] ret_from_fork+0x2f/0x70 [15:54:33] ? __pfx_kthread+0x10/0x10 [15:54:33] ret_from_fork_asm+0x19/0x30 [15:54:33] </TASK> [15:54:33] ---[ end trace 0000000000000000 ]--- [15:54:33] [FAILED] kunit_platform_device_add_test
It repros here with: ./tools/testing/kunit/kunit.py run --arch x86_64 --kconfig_add CONFIG_KASAN=y --kconfig_add CONFIG_KASAN_VMALLOC=y kunit_platform_driver
Seems to otherwise pass on all of my default configs/archs.
Cheers, -- David