2 * This is for all the tests related to copy_to_user() and copy_from_user()
6 #include <linux/slab.h>
7 #include <linux/vmalloc.h>
8 #include <linux/mman.h>
9 #include <linux/uaccess.h>
10 #include <asm/cacheflush.h>
12 static size_t cache_size
= 1024;
13 static struct kmem_cache
*bad_cache
;
15 static const unsigned char test_text
[] = "This is a test.\n";
18 * Instead of adding -Wno-return-local-addr, just pass the stack address
19 * through a function to obfuscate it from the compiler.
21 static noinline
unsigned char *trick_compiler(unsigned char *stack
)
26 static noinline
unsigned char *do_usercopy_stack_callee(int value
)
28 unsigned char buf
[32];
31 /* Exercise stack to avoid everything living in registers. */
32 for (i
= 0; i
< sizeof(buf
); i
++) {
33 buf
[i
] = value
& 0xff;
36 return trick_compiler(buf
);
39 static noinline
void do_usercopy_stack(bool to_user
, bool bad_frame
)
41 unsigned long user_addr
;
42 unsigned char good_stack
[32];
43 unsigned char *bad_stack
;
46 /* Exercise stack to avoid everything living in registers. */
47 for (i
= 0; i
< sizeof(good_stack
); i
++)
48 good_stack
[i
] = test_text
[i
% sizeof(test_text
)];
50 /* This is a pointer to outside our current stack frame. */
52 bad_stack
= do_usercopy_stack_callee((uintptr_t)bad_stack
);
54 /* Put start address just inside stack. */
55 bad_stack
= task_stack_page(current
) + THREAD_SIZE
;
56 bad_stack
-= sizeof(unsigned long);
59 user_addr
= vm_mmap(NULL
, 0, PAGE_SIZE
,
60 PROT_READ
| PROT_WRITE
| PROT_EXEC
,
61 MAP_ANONYMOUS
| MAP_PRIVATE
, 0);
62 if (user_addr
>= TASK_SIZE
) {
63 pr_warn("Failed to allocate user memory\n");
68 pr_info("attempting good copy_to_user of local stack\n");
69 if (copy_to_user((void __user
*)user_addr
, good_stack
,
70 sizeof(good_stack
))) {
71 pr_warn("copy_to_user failed unexpectedly?!\n");
75 pr_info("attempting bad copy_to_user of distant stack\n");
76 if (copy_to_user((void __user
*)user_addr
, bad_stack
,
77 sizeof(good_stack
))) {
78 pr_warn("copy_to_user failed, but lacked Oops\n");
83 * There isn't a safe way to not be protected by usercopy
84 * if we're going to write to another thread's stack.
89 pr_info("attempting good copy_from_user of local stack\n");
90 if (copy_from_user(good_stack
, (void __user
*)user_addr
,
91 sizeof(good_stack
))) {
92 pr_warn("copy_from_user failed unexpectedly?!\n");
96 pr_info("attempting bad copy_from_user of distant stack\n");
97 if (copy_from_user(bad_stack
, (void __user
*)user_addr
,
98 sizeof(good_stack
))) {
99 pr_warn("copy_from_user failed, but lacked Oops\n");
105 vm_munmap(user_addr
, PAGE_SIZE
);
108 static void do_usercopy_heap_size(bool to_user
)
110 unsigned long user_addr
;
111 unsigned char *one
, *two
;
112 const size_t size
= 1024;
114 one
= kmalloc(size
, GFP_KERNEL
);
115 two
= kmalloc(size
, GFP_KERNEL
);
117 pr_warn("Failed to allocate kernel memory\n");
121 user_addr
= vm_mmap(NULL
, 0, PAGE_SIZE
,
122 PROT_READ
| PROT_WRITE
| PROT_EXEC
,
123 MAP_ANONYMOUS
| MAP_PRIVATE
, 0);
124 if (user_addr
>= TASK_SIZE
) {
125 pr_warn("Failed to allocate user memory\n");
129 memset(one
, 'A', size
);
130 memset(two
, 'B', size
);
133 pr_info("attempting good copy_to_user of correct size\n");
134 if (copy_to_user((void __user
*)user_addr
, one
, size
)) {
135 pr_warn("copy_to_user failed unexpectedly?!\n");
139 pr_info("attempting bad copy_to_user of too large size\n");
140 if (copy_to_user((void __user
*)user_addr
, one
, 2 * size
)) {
141 pr_warn("copy_to_user failed, but lacked Oops\n");
145 pr_info("attempting good copy_from_user of correct size\n");
146 if (copy_from_user(one
, (void __user
*)user_addr
, size
)) {
147 pr_warn("copy_from_user failed unexpectedly?!\n");
151 pr_info("attempting bad copy_from_user of too large size\n");
152 if (copy_from_user(one
, (void __user
*)user_addr
, 2 * size
)) {
153 pr_warn("copy_from_user failed, but lacked Oops\n");
159 vm_munmap(user_addr
, PAGE_SIZE
);
165 static void do_usercopy_heap_flag(bool to_user
)
167 unsigned long user_addr
;
168 unsigned char *good_buf
= NULL
;
169 unsigned char *bad_buf
= NULL
;
171 /* Make sure cache was prepared. */
173 pr_warn("Failed to allocate kernel cache\n");
178 * Allocate one buffer from each cache (kmalloc will have the
179 * SLAB_USERCOPY flag already, but "bad_cache" won't).
181 good_buf
= kmalloc(cache_size
, GFP_KERNEL
);
182 bad_buf
= kmem_cache_alloc(bad_cache
, GFP_KERNEL
);
183 if (!good_buf
|| !bad_buf
) {
184 pr_warn("Failed to allocate buffers from caches\n");
188 /* Allocate user memory we'll poke at. */
189 user_addr
= vm_mmap(NULL
, 0, PAGE_SIZE
,
190 PROT_READ
| PROT_WRITE
| PROT_EXEC
,
191 MAP_ANONYMOUS
| MAP_PRIVATE
, 0);
192 if (user_addr
>= TASK_SIZE
) {
193 pr_warn("Failed to allocate user memory\n");
197 memset(good_buf
, 'A', cache_size
);
198 memset(bad_buf
, 'B', cache_size
);
201 pr_info("attempting good copy_to_user with SLAB_USERCOPY\n");
202 if (copy_to_user((void __user
*)user_addr
, good_buf
,
204 pr_warn("copy_to_user failed unexpectedly?!\n");
208 pr_info("attempting bad copy_to_user w/o SLAB_USERCOPY\n");
209 if (copy_to_user((void __user
*)user_addr
, bad_buf
,
211 pr_warn("copy_to_user failed, but lacked Oops\n");
215 pr_info("attempting good copy_from_user with SLAB_USERCOPY\n");
216 if (copy_from_user(good_buf
, (void __user
*)user_addr
,
218 pr_warn("copy_from_user failed unexpectedly?!\n");
222 pr_info("attempting bad copy_from_user w/o SLAB_USERCOPY\n");
223 if (copy_from_user(bad_buf
, (void __user
*)user_addr
,
225 pr_warn("copy_from_user failed, but lacked Oops\n");
231 vm_munmap(user_addr
, PAGE_SIZE
);
234 kmem_cache_free(bad_cache
, bad_buf
);
238 /* Callable tests. */
239 void lkdtm_USERCOPY_HEAP_SIZE_TO(void)
241 do_usercopy_heap_size(true);
244 void lkdtm_USERCOPY_HEAP_SIZE_FROM(void)
246 do_usercopy_heap_size(false);
249 void lkdtm_USERCOPY_HEAP_FLAG_TO(void)
251 do_usercopy_heap_flag(true);
254 void lkdtm_USERCOPY_HEAP_FLAG_FROM(void)
256 do_usercopy_heap_flag(false);
259 void lkdtm_USERCOPY_STACK_FRAME_TO(void)
261 do_usercopy_stack(true, true);
264 void lkdtm_USERCOPY_STACK_FRAME_FROM(void)
266 do_usercopy_stack(false, true);
269 void lkdtm_USERCOPY_STACK_BEYOND(void)
271 do_usercopy_stack(true, false);
274 void lkdtm_USERCOPY_KERNEL(void)
276 unsigned long user_addr
;
278 user_addr
= vm_mmap(NULL
, 0, PAGE_SIZE
,
279 PROT_READ
| PROT_WRITE
| PROT_EXEC
,
280 MAP_ANONYMOUS
| MAP_PRIVATE
, 0);
281 if (user_addr
>= TASK_SIZE
) {
282 pr_warn("Failed to allocate user memory\n");
286 pr_info("attempting good copy_to_user from kernel rodata\n");
287 if (copy_to_user((void __user
*)user_addr
, test_text
,
288 sizeof(test_text
))) {
289 pr_warn("copy_to_user failed unexpectedly?!\n");
293 pr_info("attempting bad copy_to_user from kernel text\n");
294 if (copy_to_user((void __user
*)user_addr
, vm_mmap
, PAGE_SIZE
)) {
295 pr_warn("copy_to_user failed, but lacked Oops\n");
300 vm_munmap(user_addr
, PAGE_SIZE
);
303 void __init
lkdtm_usercopy_init(void)
305 /* Prepare cache that lacks SLAB_USERCOPY flag. */
306 bad_cache
= kmem_cache_create("lkdtm-no-usercopy", cache_size
, 0,
310 void __exit
lkdtm_usercopy_exit(void)
312 kmem_cache_destroy(bad_cache
);
This page took 0.041411 seconds and 6 git commands to generate.