• Guenter Roeck's avatar
    mm/slub, kunit: Use inverted data to corrupt kmem cache · b1080c66
    Guenter Roeck authored
    Two failure patterns are seen randomly when running slub_kunit tests with
    CONFIG_SLAB_FREELIST_RANDOM and CONFIG_SLAB_FREELIST_HARDENED enabled.
    
    Pattern 1:
         # test_clobber_zone: pass:1 fail:0 skip:0 total:1
         ok 1 test_clobber_zone
         # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:72
         Expected 3 == slab_errors, but
             slab_errors == 0 (0x0)
         # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:84
         Expected 2 == slab_errors, but
             slab_errors == 0 (0x0)
         # test_next_pointer: pass:0 fail:1 skip:0 total:1
         not ok 2 test_next_pointer
    
    In this case, test_next_pointer() overwrites p[s->offset], but the data
    at p[s->offset] is already 0x12.
    
    Pattern 2:
         ok 1 test_clobber_zone
         # test_next_pointer: EXPECTATION FAILED at lib/slub_kunit.c:72
         Expected 3 == slab_errors, but
             slab_errors == 2 (0x2)
         # test_next_pointer: pass:0 fail:1 skip:0 total:1
         not ok 2 test_next_pointer
    
    In this case, p[s->offset] has a value other than 0x12, but one of the
    expected failures is nevertheless missing.
    
    Invert data instead of writing a fixed value to corrupt the cache data
    structures to fix the problem.
    
    Fixes: 1f9f78b1 ("mm/slub, kunit: add a KUnit test for SLUB debugging functionality")
    Cc: Oliver Glitta <glittao@gmail.com>
    Cc: Vlastimil Babka <vbabka@suse.cz>
    CC: Daniel Latypov <dlatypov@google.com>
    Cc: Marco Elver <elver@google.com>
    Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
    Signed-off-by: default avatarVlastimil Babka <vbabka@suse.cz>
    b1080c66
slub_kunit.c 4.34 KB