mm/kasan/kasan_test_c.c
Source file repositories/reference/linux-study-clean/mm/kasan/kasan_test_c.c
File Facts
- System
- Linux kernel
- Corpus path
mm/kasan/kasan_test_c.c- Extension
.c- Size
- 63932 bytes
- Lines
- 2298
- Domain
- Core OS
- Bucket
- Memory Management
- Inferred role
- Core OS: implementation source
- Status
- source implementation candidate
Why This File Exists
Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.
- Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.
- Touches user memory; correctness depends on fault-safe copying and privilege boundary handling.
- Uses kernel synchronization; read lock ordering, sleepability, and interrupt context assumptions before translating.
- Allocates kernel memory; connect allocation flags and lifetime to context constraints.
- Defines or uses C structs; map object ownership, embedded links, reference counts, and lock ownership.
Dependency Surface
kunit/test.hlinux/bitops.hlinux/delay.hlinux/io.hlinux/kasan.hlinux/kernel.hlinux/mempool.hlinux/mm.hlinux/mman.hlinux/module.hlinux/printk.hlinux/random.hlinux/set_memory.hlinux/slab.hlinux/string.hlinux/tracepoint.hlinux/uaccess.hlinux/vmalloc.htrace/events/printk.hasm/page.hkasan.h
Detected Declarations
function probe_consolefunction kasan_suite_initfunction kasan_suite_exitfunction kasan_test_exitfunction kasan_sync_fault_possiblefunction kmalloc_oob_rightfunction kmalloc_oob_leftfunction kmalloc_node_oob_rightfunction kmalloc_track_caller_oob_rightfunction kmallocfunction kmallocfunction kmalloc_large_uaffunction kmalloc_large_invalid_freefunction page_alloc_oob_rightfunction page_alloc_uaffunction krealloc_more_oob_helperfunction krealloc_less_oob_helperfunction krealloc_more_oobfunction krealloc_less_oobfunction krealloc_large_more_oobfunction krealloc_large_less_oobfunction kreallocfunction kmalloc_oob_16function kmalloc_uaf_16function kmalloc_oob_memset_2function kmalloc_oob_memset_4function kmalloc_oob_memset_8function kmalloc_oob_memset_16function kmalloc_oob_in_memsetfunction kmalloc_memmove_negative_sizefunction kmalloc_memmove_invalid_sizefunction kmalloc_uaffunction kmalloc_uaf_memsetfunction kmalloc_uaf2function kmalloc_uaf3function kasan_atomics_helperfunction kasan_atomicsfunction kmalloc_double_kzfreefunction ksize_unpoisons_memoryfunction ksize_uaffunction rcu_uaf_reclaimfunction rcu_uaffunction workqueue_uaf_workfunction workqueue_uaffunction kfree_via_pagefunction kfree_via_physfunction kmem_cache_oobfunction kmem_cache_double_free
Annotated Snippet
kasan_sync_fault_possible()) { \
if (READ_ONCE(test_status.report_found) && \
!READ_ONCE(test_status.async_fault)) \
kasan_enable_hw_tags(); \
migrate_enable(); \
} \
WRITE_ONCE(test_status.report_found, false); \
WRITE_ONCE(test_status.async_fault, false); \
} while (0)
/*
* KUNIT_EXPECT_KASAN_FAIL - check that the executed expression produces a
* KASAN report; causes a KUnit test failure otherwise.
*
* @test: Currently executing KUnit test.
* @expr: Expression that must produce a KASAN report.
*/
#define KUNIT_EXPECT_KASAN_FAIL(test, expr) \
KUNIT_EXPECT_KASAN_RESULT(test, expr, #expr, true)
/*
* KUNIT_EXPECT_KASAN_FAIL_READ - check that the executed expression
* produces a KASAN report when the write-only mode is not enabled;
* causes a KUnit test failure otherwise.
*
* Note: At the moment, this macro does not check whether the produced
* KASAN report is a report about a bad read access. It is only intended
* for checking the write-only KASAN mode functionality without failing
* KASAN tests.
*
* @test: Currently executing KUnit test.
* @expr: Expression that must only produce a KASAN report
* when the write-only mode is not enabled.
*/
#define KUNIT_EXPECT_KASAN_FAIL_READ(test, expr) \
KUNIT_EXPECT_KASAN_RESULT(test, expr, #expr, \
!kasan_write_only_enabled()) \
#define KASAN_TEST_NEEDS_CONFIG_ON(test, config) do { \
if (!IS_ENABLED(config)) \
kunit_skip((test), "Test requires " #config "=y"); \
} while (0)
#define KASAN_TEST_NEEDS_CONFIG_OFF(test, config) do { \
if (IS_ENABLED(config)) \
kunit_skip((test), "Test requires " #config "=n"); \
} while (0)
#define KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test) do { \
if (IS_ENABLED(CONFIG_KASAN_HW_TAGS)) \
break; /* No compiler instrumentation. */ \
if (IS_ENABLED(CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX)) \
break; /* Should always be instrumented! */ \
if (IS_ENABLED(CONFIG_GENERIC_ENTRY)) \
kunit_skip((test), "Test requires checked mem*()"); \
} while (0)
static void kmalloc_oob_right(struct kunit *test)
{
char *ptr;
size_t size = 128 - KASAN_GRANULE_SIZE - 5;
ptr = kmalloc(size, GFP_KERNEL);
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
OPTIMIZER_HIDE_VAR(ptr);
/*
* An unaligned access past the requested kmalloc size.
* Only generic KASAN can precisely detect these.
*/
if (IS_ENABLED(CONFIG_KASAN_GENERIC))
KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 'x');
/*
* An aligned access into the first out-of-bounds granule that falls
* within the aligned kmalloc object.
*/
KUNIT_EXPECT_KASAN_FAIL(test, ptr[size + 5] = 'y');
/* Out-of-bounds access past the aligned kmalloc object. */
KUNIT_EXPECT_KASAN_FAIL_READ(test, ptr[0] =
ptr[size + KASAN_GRANULE_SIZE + 5]);
kfree(ptr);
}
static void kmalloc_oob_left(struct kunit *test)
{
char *ptr;
size_t size = 15;
Annotation
- Immediate include surface: `kunit/test.h`, `linux/bitops.h`, `linux/delay.h`, `linux/io.h`, `linux/kasan.h`, `linux/kernel.h`, `linux/mempool.h`, `linux/mm.h`.
- Detected declarations: `function probe_console`, `function kasan_suite_init`, `function kasan_suite_exit`, `function kasan_test_exit`, `function kasan_sync_fault_possible`, `function kmalloc_oob_right`, `function kmalloc_oob_left`, `function kmalloc_node_oob_right`, `function kmalloc_track_caller_oob_right`, `function kmalloc`.
- Atlas domain: Core OS / Memory Management.
- Implementation status: source implementation candidate.
- This snippet crosses the user/kernel memory boundary; validate fault handling and access checks before translating the pattern.
- Synchronization appears in or near this file; preserve lock ordering, sleepability, and interrupt-context constraints.
Implementation Notes
- This generated page is the file-by-file coverage layer; curated subsystem chapters should link here when they synthesize a multi-file control flow.
- Core OS pages should be promoted from atlas-only to deep-reviewed when they explain data structures, invariants, locking, lifecycle, and C implementation snippets.
- Driver-family pages are intentionally pattern-oriented unless they are part of the selected PCIe/NVMe representative device path.