Skip to content

Commit b1080c6

Browse files
groecktehcaster
authored andcommitted
mm/slub, kunit: Use inverted data to corrupt kmem cache
Two failure patterns are seen randomly when running slub_kunit tests with CONFIG_SLAB_FREELIST_RANDOM and CONFIG_SLAB_FREELIST_HARDENED enabled. Pattern 1: # test_clobber_zone: pass:1 fail:0 skip:0 total:1 ok 1 test_clobber_zone # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:72 Expected 3 == slab_errors, but slab_errors == 0 (0x0) # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:84 Expected 2 == slab_errors, but slab_errors == 0 (0x0) # test_next_pointer: pass:0 fail:1 skip:0 total:1 not ok 2 test_next_pointer In this case, test_next_pointer() overwrites p[s->offset], but the data at p[s->offset] is already 0x12. Pattern 2: ok 1 test_clobber_zone # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:72 Expected 3 == slab_errors, but slab_errors == 2 (0x2) # test_next_pointer: pass:0 fail:1 skip:0 total:1 not ok 2 test_next_pointer In this case, p[s->offset] has a value other than 0x12, but one of the expected failures is nevertheless missing. Invert data instead of writing a fixed value to corrupt the cache data structures to fix the problem. Fixes: 1f9f78b ("mm/slub, kunit: add a KUnit test for SLUB debugging functionality") Cc: Oliver Glitta <[email protected]> Cc: Vlastimil Babka <[email protected]> CC: Daniel Latypov <[email protected]> Cc: Marco Elver <[email protected]> Signed-off-by: Guenter Roeck <[email protected]> Signed-off-by: Vlastimil Babka <[email protected]>
1 parent ff99b18 commit b1080c6

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

lib/slub_kunit.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ static void test_next_pointer(struct kunit *test)
5555

5656
ptr_addr = (unsigned long *)(p + s->offset);
5757
tmp = *ptr_addr;
58-
p[s->offset] = 0x12;
58+
p[s->offset] = ~p[s->offset];
5959

6060
/*
6161
* Expecting three errors.

0 commit comments

Comments
 (0)