drivers/misc/lkdtm_bugs.c

   1 /*
   2  * This is for all the tests related to logic bugs (e.g. bad dereferences,
   3  * bad alignment, bad loops, bad locking, bad scheduling, deep stacks, and
   4  * lockups) along with other things that don't fit well into existing LKDTM
   5  * test source files.
   6  */
   7 #include "lkdtm.h"
   8 #include <linux/list.h>
   9 #include <linux/sched.h>
  10
  11 struct lkdtm_list {
  12         struct list_head node;
  13 };
  14
  15 /*
  16  * Make sure our attempts to over run the kernel stack doesn't trigger
  17  * a compiler warning when CONFIG_FRAME_WARN is set. Then make sure we
  18  * recurse past the end of THREAD_SIZE by default.
  19  */
  20 #if defined(CONFIG_FRAME_WARN) && (CONFIG_FRAME_WARN > 0)
  21 #define REC_STACK_SIZE (CONFIG_FRAME_WARN / 2)
  22 #else
  23 #define REC_STACK_SIZE (THREAD_SIZE / 8)
  24 #endif
  25 #define REC_NUM_DEFAULT ((THREAD_SIZE / REC_STACK_SIZE) * 2)
  26
  27 static int recur_count = REC_NUM_DEFAULT;
  28
  29 static DEFINE_SPINLOCK(lock_me_up);
  30
  31 static int recursive_loop(int remaining)
  32 {
  33         char buf[REC_STACK_SIZE];
  34
  35         /* Make sure compiler does not optimize this away. */
  36         memset(buf, (remaining & 0xff) | 0x1, REC_STACK_SIZE);
  37         if (!remaining)
  38                 return 0;
  39         else
  40                 return recursive_loop(remaining - 1);
  41 }
  42
  43 /* If the depth is negative, use the default, otherwise keep parameter. */
  44 void __init lkdtm_bugs_init(int *recur_param)
  45 {
  46         if (*recur_param < 0)
  47                 *recur_param = recur_count;
  48         else
  49                 recur_count = *recur_param;
  50 }
  51
  52 void lkdtm_PANIC(void)
  53 {
  54         panic("dumptest");
  55 }
  56
  57 void lkdtm_BUG(void)
  58 {
  59         BUG();
  60 }
  61
  62 void lkdtm_WARNING(void)
  63 {
  64         WARN_ON(1);
  65 }
  66
  67 void lkdtm_EXCEPTION(void)
  68 {
  69         *((int *) 0) = 0;
  70 }
  71
  72 void lkdtm_LOOP(void)
  73 {
  74         for (;;)
  75                 ;
  76 }
  77
  78 void lkdtm_OVERFLOW(void)
  79 {
  80         (void) recursive_loop(recur_count);
  81 }
  82
  83 noinline void lkdtm_CORRUPT_STACK(void)
  84 {
  85         /* Use default char array length that triggers stack protection. */
  86         char data[8];
  87
  88         memset((void *)data, 0, 64);
  89 }
  90
  91 void lkdtm_UNALIGNED_LOAD_STORE_WRITE(void)
  92 {
  93         static u8 data[5] __attribute__((aligned(4))) = {1, 2, 3, 4, 5};
  94         u32 *p;
  95         u32 val = 0x12345678;
  96
  97         p = (u32 *)(data + 1);
  98         if (*p == 0)
  99                 val = 0x87654321;
 100         *p = val;
 101 }
 102
 103 void lkdtm_SOFTLOCKUP(void)
 104 {
 105         preempt_disable();
 106         for (;;)
 107                 cpu_relax();
 108 }
 109
 110 void lkdtm_HARDLOCKUP(void)
 111 {
 112         local_irq_disable();
 113         for (;;)
 114                 cpu_relax();
 115 }
 116
 117 void lkdtm_SPINLOCKUP(void)
 118 {
 119         /* Must be called twice to trigger. */
 120         spin_lock(&lock_me_up);
 121         /* Let sparse know we intended to exit holding the lock. */
 122         __release(&lock_me_up);
 123 }
 124
 125 void lkdtm_HUNG_TASK(void)
 126 {
 127         set_current_state(TASK_UNINTERRUPTIBLE);
 128         schedule();
 129 }
 130
 131 void lkdtm_ATOMIC_UNDERFLOW(void)
 132 {
 133         atomic_t under = ATOMIC_INIT(INT_MIN);
 134
 135         pr_info("attempting good atomic increment\n");
 136         atomic_inc(&under);
 137         atomic_dec(&under);
 138
 139         pr_info("attempting bad atomic underflow\n");
 140         atomic_dec(&under);
 141 }
 142
 143 void lkdtm_ATOMIC_OVERFLOW(void)
 144 {
 145         atomic_t over = ATOMIC_INIT(INT_MAX);
 146
 147         pr_info("attempting good atomic decrement\n");
 148         atomic_dec(&over);
 149         atomic_inc(&over);
 150
 151         pr_info("attempting bad atomic overflow\n");
 152         atomic_inc(&over);
 153 }
 154
 155 void lkdtm_CORRUPT_LIST_ADD(void)
 156 {
 157         /*
 158          * Initially, an empty list via LIST_HEAD:
 159          *      test_head.next = &test_head
 160          *      test_head.prev = &test_head
 161          */
 162         LIST_HEAD(test_head);
 163         struct lkdtm_list good, bad;
 164         void *target[2] = { };
 165         void *redirection = &target;
 166
 167         pr_info("attempting good list addition\n");
 168
 169         /*
 170          * Adding to the list performs these actions:
 171          *      test_head.next->prev = &good.node
 172          *      good.node.next = test_head.next
 173          *      good.node.prev = test_head
 174          *      test_head.next = good.node
 175          */
 176         list_add(&good.node, &test_head);
 177
 178         pr_info("attempting corrupted list addition\n");
 179         /*
 180          * In simulating this "write what where" primitive, the "what" is
 181          * the address of &bad.node, and the "where" is the address held
 182          * by "redirection".
 183          */
 184         test_head.next = redirection;
 185         list_add(&bad.node, &test_head);
 186
 187         if (target[0] == NULL && target[1] == NULL)
 188                 pr_err("Overwrite did not happen, but no BUG?!\n");
 189         else
 190                 pr_err("list_add() corruption not detected!\n");
 191 }
 192
 193 void lkdtm_CORRUPT_LIST_DEL(void)
 194 {
 195         LIST_HEAD(test_head);
 196         struct lkdtm_list item;
 197         void *target[2] = { };
 198         void *redirection = &target;
 199
 200         list_add(&item.node, &test_head);
 201
 202         pr_info("attempting good list removal\n");
 203         list_del(&item.node);
 204
 205         pr_info("attempting corrupted list removal\n");
 206         list_add(&item.node, &test_head);
 207
 208         /* As with the list_add() test above, this corrupts "next". */
 209         item.node.next = redirection;
 210         list_del(&item.node);
 211
 212         if (target[0] == NULL && target[1] == NULL)
 213                 pr_err("Overwrite did not happen, but no BUG?!\n");
 214         else
 215                 pr_err("list_del() corruption not detected!\n");
 216 }