On Sat, Oct 2, 2021 at 9:36 AM Daniel Latypov dlatypov@google.com wrote:

When a user filters by a suite and not a test, e.g. $ ./tools/testing/kunit/kunit.py run 'suite_name'

it hits this code const int len = strlen(filter_glob); ... parsed->suite_glob = kmalloc(len, GFP_KERNEL); which fails to allocate space for the terminating NULL.

Somehow, it seems like we can't easily reproduce this under UML, so the existing `parse_filter_test()` didn't catch this.

Fix this by allocating `len + 1` and switch to kzalloc() just to be a bit more defensive. We're only going to run this code once per kernel boot, and it should never be very long.

Also update the unit tests to be a bit more cautious. This bug showed up as a NULL pointer dereference here:

...

KUNIT_EXPECT_STREQ(test, (const char *)filtered.start[0][0]->name, "suite0");

`filtered.start[0][0]` was NULL, and `name` is at offset 0 in the struct, so `...->name` was also NULL.

Fixes: 3b29021ddd10 ("kunit: tool: allow filtering test cases via glob") Reported-by: kernel test robot oliver.sang@intel.com Signed-off-by: Daniel Latypov dlatypov@google.com

---

Nice catch. I guess this is why we're all going to be switching to rust one day. :-)

The fix looks good, and I ran it under KASAN just to be sure, and it passed.

Reviewed-by: David Gow davidgow@google.com

-- David

lib/kunit/executor.c | 2 +- lib/kunit/executor_test.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/kunit/executor.c b/lib/kunit/executor.c index bab3ab940acc..1d7fecd33261 100644 --- a/lib/kunit/executor.c +++ b/lib/kunit/executor.c @@ -33,7 +33,7 @@ static void kunit_parse_filter_glob(struct kunit_test_filter *parsed, const char *period = strchr(filter_glob, '.');

    if (!period) {

•           parsed->suite_glob = kmalloc(len, GFP_KERNEL);
  

•           parsed->suite_glob = kzalloc(len + 1, GFP_KERNEL);
            parsed->test_glob = NULL;
            strcpy(parsed->suite_glob, filter_glob);
            return;
  

diff --git a/lib/kunit/executor_test.c b/lib/kunit/executor_test.c index e6323f398dfa..7d2b8dc668b1 100644 --- a/lib/kunit/executor_test.c +++ b/lib/kunit/executor_test.c @@ -149,6 +149,7 @@ static void filter_suites_test(struct kunit *test)

    KUNIT_ASSERT_NOT_ERR_OR_NULL(test, filtered.start);
    KUNIT_ASSERT_NOT_ERR_OR_NULL(test, filtered.start[0]);

•   KUNIT_ASSERT_NOT_ERR_OR_NULL(test, filtered.start[0][0]);
    KUNIT_EXPECT_STREQ(test, (const char *)filtered.start[0][0]->name, "suite0");
  

}

base-commit: 3b29021ddd10cfb6b2565c623595bd3b02036f33

2.33.0.800.g4c38ced690-goog