Release 4.14 drivers/misc/lkdtm_bugs.c

Directory: drivers/misc
// SPDX-License-Identifier: GPL-2.0
/*
 * This is for all the tests related to logic bugs (e.g. bad dereferences,
 * bad alignment, bad loops, bad locking, bad scheduling, deep stacks, and
 * lockups) along with other things that don't fit well into existing LKDTM
 * test source files.
 */
#include "lkdtm.h"
#include <linux/list.h>
#include <linux/sched.h>
#include <linux/sched/signal.h>
#include <linux/sched/task_stack.h>
#include <linux/uaccess.h>


struct lkdtm_list {
	
struct list_head node;
};

/*
 * Make sure our attempts to over run the kernel stack doesn't trigger
 * a compiler warning when CONFIG_FRAME_WARN is set. Then make sure we
 * recurse past the end of THREAD_SIZE by default.
 */
#if defined(CONFIG_FRAME_WARN) && (CONFIG_FRAME_WARN > 0)

#define REC_STACK_SIZE (CONFIG_FRAME_WARN / 2)
#else

#define REC_STACK_SIZE (THREAD_SIZE / 8)
#endif

#define REC_NUM_DEFAULT ((THREAD_SIZE / REC_STACK_SIZE) * 2)


static int recur_count = REC_NUM_DEFAULT;

static DEFINE_SPINLOCK(lock_me_up);



static int recursive_loop(int remaining)
{
	char buf[REC_STACK_SIZE];

	/* Make sure compiler does not optimize this away. */
	memset(buf, (remaining & 0xff) | 0x1, REC_STACK_SIZE);
	if (!remaining)
		return 0;
	else
		return recursive_loop(remaining - 1);
}

Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 48 100.00% 1 100.00%
Total 48 100.00% 1 100.00%

/* If the depth is negative, use the default, otherwise keep parameter. */


void __init lkdtm_bugs_init(int *recur_param)
{
	if (*recur_param < 0)
		*recur_param = recur_count;
	else
		recur_count = *recur_param;
}

Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 28 100.00% 1 100.00%
Total 28 100.00% 1 100.00%



void lkdtm_PANIC(void)
{
	panic("dumptest");
}

Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 12 100.00% 1 100.00%
Total 12 100.00% 1 100.00%



void lkdtm_BUG(void)
{
	BUG();
}

Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 10 100.00% 1 100.00%
Total 10 100.00% 1 100.00%



void lkdtm_WARNING(void)
{
	WARN_ON(1);
}

Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 12 100.00% 1 100.00%
Total 12 100.00% 1 100.00%



void lkdtm_EXCEPTION(void)
{
	*((volatile int *) 0) = 0;
}

Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 18 94.74% 1 50.00%
Michael Davidson 1 5.26% 1 50.00%
Total 19 100.00% 2 100.00%



void lkdtm_LOOP(void)
{
	for (;;)
		;
}

Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 13 100.00% 1 100.00%
Total 13 100.00% 1 100.00%



void lkdtm_OVERFLOW(void)
{
	(void) recursive_loop(recur_count);
}

Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 15 100.00% 1 100.00%
Total 15 100.00% 1 100.00%



static noinline void __lkdtm_CORRUPT_STACK(void *stack)
{
	memset(stack, '\xff', 64);
}

Contributors
Person Tokens Prop Commits CommitProp
Arnd Bergmann 19 95.00% 1 50.00%
Kees Cook 1 5.00% 1 50.00%
Total 20 100.00% 2 100.00%

/* This should trip the stack canary, not corrupt the return address. */


noinline void lkdtm_CORRUPT_STACK(void)
{
	/* Use default char array length that triggers stack protection. */
	char data[8] __aligned(sizeof(void *));

	__lkdtm_CORRUPT_STACK(&data);

	pr_info("Corrupted stack containing char array ...\n");
}

Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 30 88.24% 2 50.00%
Arnd Bergmann 2 5.88% 1 25.00%
Michael Ellerman 2 5.88% 1 25.00%
Total 34 100.00% 4 100.00%

/* Same as above but will only get a canary with -fstack-protector-strong */


noinline void lkdtm_CORRUPT_STACK_STRONG(void)
{
	union {
		unsigned short shorts[4];
		unsigned long *ptr;
	} data __aligned(sizeof(void *));

	__lkdtm_CORRUPT_STACK(&data);

	pr_info("Corrupted stack containing union ...\n");
}

Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 41 93.18% 2 66.67%
Michael Ellerman 3 6.82% 1 33.33%
Total 44 100.00% 3 100.00%



void lkdtm_UNALIGNED_LOAD_STORE_WRITE(void)
{
	static u8 data[5] __attribute__((aligned(4))) = {1, 2, 3, 4, 5};
	u32 *p;
	u32 val = 0x12345678;

	p = (u32 *)(data + 1);
	if (*p == 0)
		val = 0x87654321;
	*p = val;
}

Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 72 100.00% 1 100.00%
Total 72 100.00% 1 100.00%



void lkdtm_SOFTLOCKUP(void)
{
	preempt_disable();
	for (;;)
		cpu_relax();
}

Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 18 100.00% 1 100.00%
Total 18 100.00% 1 100.00%



void lkdtm_HARDLOCKUP(void)
{
	local_irq_disable();
	for (;;)
		cpu_relax();
}

Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 18 100.00% 1 100.00%
Total 18 100.00% 1 100.00%



void lkdtm_SPINLOCKUP(void)
{
	/* Must be called twice to trigger. */
	spin_lock(&lock_me_up);
	/* Let sparse know we intended to exit holding the lock. */
	__release(&lock_me_up);
}

Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 21 100.00% 1 100.00%
Total 21 100.00% 1 100.00%



void lkdtm_HUNG_TASK(void)
{
	set_current_state(TASK_UNINTERRUPTIBLE);
	schedule();
}

Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 15 100.00% 1 100.00%
Total 15 100.00% 1 100.00%



void lkdtm_CORRUPT_LIST_ADD(void)
{
	/*
         * Initially, an empty list via LIST_HEAD:
         *      test_head.next = &test_head
         *      test_head.prev = &test_head
         */
	LIST_HEAD(test_head);
	struct lkdtm_list good, bad;
	void *target[2] = { };
	void *redirection = &target;

	pr_info("attempting good list addition\n");

	/*
         * Adding to the list performs these actions:
         *      test_head.next->prev = &good.node
         *      good.node.next = test_head.next
         *      good.node.prev = test_head
         *      test_head.next = good.node
         */
	list_add(&good.node, &test_head);

	pr_info("attempting corrupted list addition\n");
	/*
         * In simulating this "write what where" primitive, the "what" is
         * the address of &bad.node, and the "where" is the address held
         * by "redirection".
         */
	test_head.next = redirection;
	list_add(&bad.node, &test_head);

	if (target[0] == NULL && target[1] == NULL)
		pr_err("Overwrite did not happen, but no BUG?!\n");
	else
		pr_err("list_add() corruption not detected!\n");
}

Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 102 100.00% 1 100.00%
Total 102 100.00% 1 100.00%



void lkdtm_CORRUPT_LIST_DEL(void)
{
	LIST_HEAD(test_head);
	struct lkdtm_list item;
	void *target[2] = { };
	void *redirection = &target;

	list_add(&item.node, &test_head);

	pr_info("attempting good list removal\n");
	list_del(&item.node);

	pr_info("attempting corrupted list removal\n");
	list_add(&item.node, &test_head);

	/* As with the list_add() test above, this corrupts "next". */
	item.node.next = redirection;
	list_del(&item.node);

	if (target[0] == NULL && target[1] == NULL)
		pr_err("Overwrite did not happen, but no BUG?!\n");
	else
		pr_err("list_del() corruption not detected!\n");
}

Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 116 100.00% 1 100.00%
Total 116 100.00% 1 100.00%

/* Test if unbalanced set_fs(KERNEL_DS)/set_fs(USER_DS) check exists. */


void lkdtm_CORRUPT_USER_DS(void)
{
	pr_info("setting bad task size limit\n");
	set_fs(KERNEL_DS);

	/* Make sure we do not keep running with a KERNEL_DS! */
	force_sig(SIGKILL, current);
}

Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 25 100.00% 1 100.00%
Total 25 100.00% 1 100.00%

/* Test that VMAP_STACK is actually allocating with a leading guard page */


void lkdtm_STACK_GUARD_PAGE_LEADING(void)
{
	const unsigned char *stack = task_stack_page(current);
	const unsigned char *ptr = stack - 1;
	volatile unsigned char byte;

	pr_info("attempting bad read from page below current stack\n");

	byte = *ptr;

	pr_err("FAIL: accessed page before stack!\n");
}

Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 48 100.00% 1 100.00%
Total 48 100.00% 1 100.00%

/* Test that VMAP_STACK is actually allocating with a trailing guard page */


void lkdtm_STACK_GUARD_PAGE_TRAILING(void)
{
	const unsigned char *stack = task_stack_page(current);
	const unsigned char *ptr = stack + THREAD_SIZE;
	volatile unsigned char byte;

	pr_info("attempting bad read from page above current stack\n");

	byte = *ptr;

	pr_err("FAIL: accessed page after stack!\n");
}
Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 48 100.00% 1 100.00%
Total 48 100.00% 1 100.00%

Overall Contributors
Person Tokens Prop Commits CommitProp
Kees Cook 786 96.56% 6 60.00%
Arnd Bergmann 21 2.58% 1 10.00%
Michael Ellerman 5 0.61% 1 10.00%
Michael Davidson 1 0.12% 1 10.00%
Greg Kroah-Hartman 1 0.12% 1 10.00%
Total 814 100.00% 10 100.00%
Directory: drivers/misc

Information contained on this website is for historical information purposes only and does not indicate or represent copyright ownership.
Created with cregit.
Person	Tokens	Prop	Commits	CommitProp
Kees Cook	48	100.00%	1	100.00%
Total	48	100.00%	1	100.00%
cregit-Linux how code gets into the kernel

Release 4.14 drivers/misc/lkdtm_bugs.c

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Overall Contributors
