Re: [PATCH slab/for-next v4 1/8] mm/slab, slub_kunit: register kprobe to trigger _nolock APIs

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] The globally registered kprobe pre-handler executes system-wide on all CPUs, causing non-test tasks to inadvertently execute KUnit test logic and concurrently mutate the test thread's stack-allocated context.
- [Medium] The refactoring to `kmalloc_obj(*objects[j], gfp)` incorrectly evaluates the allocation size to 1 byte instead of the intended 64 bytes.
--

--- Patch [1]: [PATCH slab/for-next v4 1/8] mm/slab, slub_kunit: register kprobe to trigger _nolock APIs ---
commit 632627083aa5c71fb7be8b45f24099b08c94d6a7
Author: Harry Yoo (Oracle) <[email protected]>

mm/slab, slub_kunit: register kprobe to trigger _nolock APIs

This commit registers a kprobe pre-handler in slub_kunit to invoke and
test kmalloc_nolock() and kfree_nolock() from within the slab allocator.
It adds a wrapper for lockdep_assert_held() to attach the kprobe, and
refactors the test allocation loop into a shared helper function.

Link: https://lore.kernel.org/linux-mm/[email protected] [1]
Link: https://lore.kernel.org/linux-mm/[email protected]  [2]

> diff --git a/lib/tests/slub_kunit.c b/lib/tests/slub_kunit.c
> index fa6d31dbca166..a391467c1aa6e 100644
> --- a/lib/tests/slub_kunit.c
> +++ b/lib/tests/slub_kunit.c

[ ... ]

> @@ -302,26 +303,40 @@ struct test_nolock_context {
>  	int callback_count;
>  	int alloc_ok;
>  	int alloc_fail;
> +#ifdef CONFIG_PERF_EVENTS
>  	struct perf_event *event;
> +#endif
> +#if defined(CONFIG_KPROBES) && defined(CONFIG_SMP)
> +	struct kprobe kprobe;
> +#endif
>  };
>  
> -static struct perf_event_attr hw_attr = {
> -	.type = PERF_TYPE_HARDWARE,
> -	.config = PERF_COUNT_HW_CPU_CYCLES,
> -	.size = sizeof(struct perf_event_attr),
> -	.pinned = 1,
> -	.disabled = 1,
> -	.freq = 1,
> -	.sample_freq = 100000,
> -};
> +static void test_kmalloc_kfree(void)
> +{
> +	int i, j;
> +
> +	for (i = 0; i < NR_ITERATIONS; i++) {
> +		for (j = 0; j < NR_OBJECTS; j++) {
> +			gfp_t gfp = (i % 2) ? GFP_KERNEL : GFP_KERNEL_ACCOUNT;
>  
> -static void overflow_handler_test_kmalloc_kfree_nolock(struct perf_event *event,
> -						       struct perf_sample_data *data,
> -						       struct pt_regs *regs)
> +			objects[j] = kmalloc_obj(*objects[j], gfp);

[Severity: Medium]
Does this refactoring unintentionally reduce the allocation size to 1 byte?

Since objects is declared as an array of void *, the dereferenced type
of *objects[j] is void. The kmalloc_obj() macro evaluates
sizeof(typeof(VAR_OR_TYPE)), which resolves to sizeof(void). Under GCC,
sizeof(void) evaluates to 1.

Does this silently reduce the test coverage by targeting kmalloc-8 instead
of the original 64-byte allocations targeted in the previous code?

> +			if (!objects[j]) {
> +				j--;
> +				while (j >= 0)
> +					kfree(objects[j--]);
> +				return;
> +			}
> +		}
> +

[ ... ]

> +#if defined(CONFIG_KPROBES) && defined(CONFIG_SMP)
> +static int slab_kprobe_pre_handler(struct kprobe *p, struct pt_regs *regs)
> +{
> +	struct test_nolock_context *ctx;
> +
> +	ctx = container_of(p, struct test_nolock_context, kprobe);
> +	test_nolock(ctx);
> +	return 0;
> +}

[Severity: High]
Does this kprobe pre-handler execute for all CPUs system-wide?

Since this function is invoked via the kprobe attached to
slab_attach_kprobe_locked(), and there is no check ensuring
current == test_task, it appears any non-test task executing SLUB
slowpaths (like add_partial or remove_full) will also trigger this
handler.

Could this allow unrelated tasks to inadvertently execute test_nolock()
from arbitrary contexts and concurrently mutate the test thread's
stack-allocated ctx, causing a data race on ctx->alloc_ok and
ctx->callback_count?

> +
> +static bool register_slab_kprobes(struct test_nolock_context *ctx)
> +{
> +	ctx->kprobe.symbol_name = "slab_attach_kprobe_locked";
> +	ctx->kprobe.pre_handler = slab_kprobe_pre_handler;
> +
> +	if (register_kprobe(&ctx->kprobe))
> +		return false;
> +	return true;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1