diff -drupN a/lib/test_kasan.c b/lib/test_kasan.c --- a/lib/test_kasan.c 2018-08-06 17:23:04.000000000 +0300 +++ b/lib/test_kasan.c 2022-06-12 05:28:14.000000000 +0300 @@ -19,6 +19,7 @@ #include #include #include +#include /* * Note: test functions are marked noinline so that their names appear in @@ -439,8 +440,34 @@ static noinline void __init use_after_sc p[1023] = 1; } +static noinline void __init kasan_alloca_oob_left(void) +{ + volatile int i = 10; + char alloca_array[i]; + char *p = alloca_array - 1; + + pr_info("out-of-bounds to left on alloca\n"); + *(volatile char *)p; +} + +static noinline void __init kasan_alloca_oob_right(void) +{ + volatile int i = 10; + char alloca_array[i]; + char *p = alloca_array + i; + + pr_info("out-of-bounds to right on alloca\n"); + *(volatile char *)p; +} + static int __init kmalloc_tests_init(void) { + /* + * Temporarily enable multi-shot mode. Otherwise, we'd only get a + * report for the first case. + */ + bool multishot = kasan_save_enable_multi_shot(); + kmalloc_oob_right(); kmalloc_oob_left(); kmalloc_node_oob_right(); @@ -462,9 +489,14 @@ static int __init kmalloc_tests_init(voi kmem_cache_oob(); kasan_stack_oob(); kasan_global_oob(); + kasan_alloca_oob_left(); + kasan_alloca_oob_right(); ksize_unpoisons_memory(); copy_user_test(); use_after_scope_test(); + + kasan_restore_multi_shot(multishot); + return -EAGAIN; }