Greg Kroah-Hartman
598cf27219
Link: https://lore.kernel.org/r/20260217200002.683975158@linuxfoundation.org Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com> Tested-by: Peter Schneider <pschneider1968@googlemail.com> Tested-by: Jon Hunter <jonathanh@nvidia.com> Tested-by: Salvatore Bonaccorso <carnil@debian.org> Tested-by: Brett A C Sheffield <bacs@librecast.net> Tested-by: Mark Brown <broonie@kernel.org> Tested-by: Luna Jernberg <droidbittin@gmail.com> Tested-by: Ronald Warsow <rwarsow@gmx.de> Tested-by: Justin M. Forbes <jforbes@fedoraproject.org> Tested-by: Ron Economos <re@w6rz.net> Tested-by: Miguel Ojeda <ojeda@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
23 lines
592 B
Rust
23 lines
592 B
Rust
// SPDX-License-Identifier: GPL-2.0
|
|
|
|
//! Helper crate for KASAN testing.
|
|
//!
|
|
//! Provides behavior to check the sanitization of Rust code.
|
|
|
|
use core::ptr::addr_of_mut;
|
|
use kernel::prelude::*;
|
|
|
|
/// Trivial UAF - allocate a big vector, grab a pointer partway through,
|
|
/// drop the vector, and touch it.
|
|
#[no_mangle]
|
|
pub extern "C" fn kasan_test_rust_uaf() -> u8 {
|
|
let mut v: KVec<u8> = KVec::new();
|
|
for _ in 0..4096 {
|
|
v.push(0x42, GFP_KERNEL).unwrap();
|
|
}
|
|
let ptr: *mut u8 = addr_of_mut!(v[2048]);
|
|
drop(v);
|
|
// SAFETY: Incorrect, on purpose.
|
|
unsafe { *ptr }
|
|
}
|