]>
Commit | Line | Data |
---|---|---|
3f15801c AR |
1 | /* |
2 | * | |
3 | * Copyright (c) 2014 Samsung Electronics Co., Ltd. | |
4 | * Author: Andrey Ryabinin <a.ryabinin@samsung.com> | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or modify | |
7 | * it under the terms of the GNU General Public License version 2 as | |
8 | * published by the Free Software Foundation. | |
9 | * | |
10 | */ | |
11 | ||
12 | #define pr_fmt(fmt) "kasan test: %s " fmt, __func__ | |
13 | ||
0386bf38 | 14 | #include <linux/delay.h> |
3f15801c | 15 | #include <linux/kernel.h> |
eae08dca AR |
16 | #include <linux/mman.h> |
17 | #include <linux/mm.h> | |
3f15801c AR |
18 | #include <linux/printk.h> |
19 | #include <linux/slab.h> | |
20 | #include <linux/string.h> | |
eae08dca | 21 | #include <linux/uaccess.h> |
3f15801c | 22 | #include <linux/module.h> |
b0845ce5 | 23 | #include <linux/kasan.h> |
3f15801c | 24 | |
828347f8 DV |
25 | /* |
26 | * Note: test functions are marked noinline so that their names appear in | |
27 | * reports. | |
28 | */ | |
29 | ||
3f15801c AR |
30 | static noinline void __init kmalloc_oob_right(void) |
31 | { | |
32 | char *ptr; | |
33 | size_t size = 123; | |
34 | ||
35 | pr_info("out-of-bounds to right\n"); | |
36 | ptr = kmalloc(size, GFP_KERNEL); | |
37 | if (!ptr) { | |
38 | pr_err("Allocation failed\n"); | |
39 | return; | |
40 | } | |
41 | ||
42 | ptr[size] = 'x'; | |
43 | kfree(ptr); | |
44 | } | |
45 | ||
46 | static noinline void __init kmalloc_oob_left(void) | |
47 | { | |
48 | char *ptr; | |
49 | size_t size = 15; | |
50 | ||
51 | pr_info("out-of-bounds to left\n"); | |
52 | ptr = kmalloc(size, GFP_KERNEL); | |
53 | if (!ptr) { | |
54 | pr_err("Allocation failed\n"); | |
55 | return; | |
56 | } | |
57 | ||
58 | *ptr = *(ptr - 1); | |
59 | kfree(ptr); | |
60 | } | |
61 | ||
62 | static noinline void __init kmalloc_node_oob_right(void) | |
63 | { | |
64 | char *ptr; | |
65 | size_t size = 4096; | |
66 | ||
67 | pr_info("kmalloc_node(): out-of-bounds to right\n"); | |
68 | ptr = kmalloc_node(size, GFP_KERNEL, 0); | |
69 | if (!ptr) { | |
70 | pr_err("Allocation failed\n"); | |
71 | return; | |
72 | } | |
73 | ||
74 | ptr[size] = 0; | |
75 | kfree(ptr); | |
76 | } | |
77 | ||
e6e8379c AP |
78 | #ifdef CONFIG_SLUB |
79 | static noinline void __init kmalloc_pagealloc_oob_right(void) | |
3f15801c AR |
80 | { |
81 | char *ptr; | |
82 | size_t size = KMALLOC_MAX_CACHE_SIZE + 10; | |
83 | ||
e6e8379c AP |
84 | /* Allocate a chunk that does not fit into a SLUB cache to trigger |
85 | * the page allocator fallback. | |
86 | */ | |
87 | pr_info("kmalloc pagealloc allocation: out-of-bounds to right\n"); | |
88 | ptr = kmalloc(size, GFP_KERNEL); | |
89 | if (!ptr) { | |
90 | pr_err("Allocation failed\n"); | |
91 | return; | |
92 | } | |
93 | ||
94 | ptr[size] = 0; | |
95 | kfree(ptr); | |
96 | } | |
97 | #endif | |
98 | ||
99 | static noinline void __init kmalloc_large_oob_right(void) | |
100 | { | |
101 | char *ptr; | |
102 | size_t size = KMALLOC_MAX_CACHE_SIZE - 256; | |
103 | /* Allocate a chunk that is large enough, but still fits into a slab | |
104 | * and does not trigger the page allocator fallback in SLUB. | |
105 | */ | |
3f15801c AR |
106 | pr_info("kmalloc large allocation: out-of-bounds to right\n"); |
107 | ptr = kmalloc(size, GFP_KERNEL); | |
108 | if (!ptr) { | |
109 | pr_err("Allocation failed\n"); | |
110 | return; | |
111 | } | |
112 | ||
113 | ptr[size] = 0; | |
114 | kfree(ptr); | |
115 | } | |
116 | ||
117 | static noinline void __init kmalloc_oob_krealloc_more(void) | |
118 | { | |
119 | char *ptr1, *ptr2; | |
120 | size_t size1 = 17; | |
121 | size_t size2 = 19; | |
122 | ||
123 | pr_info("out-of-bounds after krealloc more\n"); | |
124 | ptr1 = kmalloc(size1, GFP_KERNEL); | |
125 | ptr2 = krealloc(ptr1, size2, GFP_KERNEL); | |
126 | if (!ptr1 || !ptr2) { | |
127 | pr_err("Allocation failed\n"); | |
128 | kfree(ptr1); | |
06495469 | 129 | kfree(ptr2); |
3f15801c AR |
130 | return; |
131 | } | |
132 | ||
133 | ptr2[size2] = 'x'; | |
134 | kfree(ptr2); | |
135 | } | |
136 | ||
137 | static noinline void __init kmalloc_oob_krealloc_less(void) | |
138 | { | |
139 | char *ptr1, *ptr2; | |
140 | size_t size1 = 17; | |
141 | size_t size2 = 15; | |
142 | ||
143 | pr_info("out-of-bounds after krealloc less\n"); | |
144 | ptr1 = kmalloc(size1, GFP_KERNEL); | |
145 | ptr2 = krealloc(ptr1, size2, GFP_KERNEL); | |
146 | if (!ptr1 || !ptr2) { | |
147 | pr_err("Allocation failed\n"); | |
148 | kfree(ptr1); | |
149 | return; | |
150 | } | |
6b4a35fc | 151 | ptr2[size2] = 'x'; |
3f15801c AR |
152 | kfree(ptr2); |
153 | } | |
154 | ||
155 | static noinline void __init kmalloc_oob_16(void) | |
156 | { | |
157 | struct { | |
158 | u64 words[2]; | |
159 | } *ptr1, *ptr2; | |
160 | ||
161 | pr_info("kmalloc out-of-bounds for 16-bytes access\n"); | |
162 | ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL); | |
163 | ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL); | |
164 | if (!ptr1 || !ptr2) { | |
165 | pr_err("Allocation failed\n"); | |
166 | kfree(ptr1); | |
167 | kfree(ptr2); | |
168 | return; | |
169 | } | |
170 | *ptr1 = *ptr2; | |
171 | kfree(ptr1); | |
172 | kfree(ptr2); | |
173 | } | |
174 | ||
f523e737 WL |
175 | static noinline void __init kmalloc_oob_memset_2(void) |
176 | { | |
177 | char *ptr; | |
178 | size_t size = 8; | |
179 | ||
180 | pr_info("out-of-bounds in memset2\n"); | |
181 | ptr = kmalloc(size, GFP_KERNEL); | |
182 | if (!ptr) { | |
183 | pr_err("Allocation failed\n"); | |
184 | return; | |
185 | } | |
186 | ||
187 | memset(ptr+7, 0, 2); | |
188 | kfree(ptr); | |
189 | } | |
190 | ||
191 | static noinline void __init kmalloc_oob_memset_4(void) | |
192 | { | |
193 | char *ptr; | |
194 | size_t size = 8; | |
195 | ||
196 | pr_info("out-of-bounds in memset4\n"); | |
197 | ptr = kmalloc(size, GFP_KERNEL); | |
198 | if (!ptr) { | |
199 | pr_err("Allocation failed\n"); | |
200 | return; | |
201 | } | |
202 | ||
203 | memset(ptr+5, 0, 4); | |
204 | kfree(ptr); | |
205 | } | |
206 | ||
207 | ||
208 | static noinline void __init kmalloc_oob_memset_8(void) | |
209 | { | |
210 | char *ptr; | |
211 | size_t size = 8; | |
212 | ||
213 | pr_info("out-of-bounds in memset8\n"); | |
214 | ptr = kmalloc(size, GFP_KERNEL); | |
215 | if (!ptr) { | |
216 | pr_err("Allocation failed\n"); | |
217 | return; | |
218 | } | |
219 | ||
220 | memset(ptr+1, 0, 8); | |
221 | kfree(ptr); | |
222 | } | |
223 | ||
224 | static noinline void __init kmalloc_oob_memset_16(void) | |
225 | { | |
226 | char *ptr; | |
227 | size_t size = 16; | |
228 | ||
229 | pr_info("out-of-bounds in memset16\n"); | |
230 | ptr = kmalloc(size, GFP_KERNEL); | |
231 | if (!ptr) { | |
232 | pr_err("Allocation failed\n"); | |
233 | return; | |
234 | } | |
235 | ||
236 | memset(ptr+1, 0, 16); | |
237 | kfree(ptr); | |
238 | } | |
239 | ||
3f15801c AR |
240 | static noinline void __init kmalloc_oob_in_memset(void) |
241 | { | |
242 | char *ptr; | |
243 | size_t size = 666; | |
244 | ||
245 | pr_info("out-of-bounds in memset\n"); | |
246 | ptr = kmalloc(size, GFP_KERNEL); | |
247 | if (!ptr) { | |
248 | pr_err("Allocation failed\n"); | |
249 | return; | |
250 | } | |
251 | ||
252 | memset(ptr, 0, size+5); | |
253 | kfree(ptr); | |
254 | } | |
255 | ||
256 | static noinline void __init kmalloc_uaf(void) | |
257 | { | |
258 | char *ptr; | |
259 | size_t size = 10; | |
260 | ||
261 | pr_info("use-after-free\n"); | |
262 | ptr = kmalloc(size, GFP_KERNEL); | |
263 | if (!ptr) { | |
264 | pr_err("Allocation failed\n"); | |
265 | return; | |
266 | } | |
267 | ||
268 | kfree(ptr); | |
269 | *(ptr + 8) = 'x'; | |
270 | } | |
271 | ||
272 | static noinline void __init kmalloc_uaf_memset(void) | |
273 | { | |
274 | char *ptr; | |
275 | size_t size = 33; | |
276 | ||
277 | pr_info("use-after-free in memset\n"); | |
278 | ptr = kmalloc(size, GFP_KERNEL); | |
279 | if (!ptr) { | |
280 | pr_err("Allocation failed\n"); | |
281 | return; | |
282 | } | |
283 | ||
284 | kfree(ptr); | |
285 | memset(ptr, 0, size); | |
286 | } | |
287 | ||
288 | static noinline void __init kmalloc_uaf2(void) | |
289 | { | |
290 | char *ptr1, *ptr2; | |
291 | size_t size = 43; | |
292 | ||
293 | pr_info("use-after-free after another kmalloc\n"); | |
294 | ptr1 = kmalloc(size, GFP_KERNEL); | |
295 | if (!ptr1) { | |
296 | pr_err("Allocation failed\n"); | |
297 | return; | |
298 | } | |
299 | ||
300 | kfree(ptr1); | |
301 | ptr2 = kmalloc(size, GFP_KERNEL); | |
302 | if (!ptr2) { | |
303 | pr_err("Allocation failed\n"); | |
304 | return; | |
305 | } | |
306 | ||
307 | ptr1[40] = 'x'; | |
9dcadd38 AP |
308 | if (ptr1 == ptr2) |
309 | pr_err("Could not detect use-after-free: ptr1 == ptr2\n"); | |
3f15801c AR |
310 | kfree(ptr2); |
311 | } | |
312 | ||
313 | static noinline void __init kmem_cache_oob(void) | |
314 | { | |
315 | char *p; | |
316 | size_t size = 200; | |
317 | struct kmem_cache *cache = kmem_cache_create("test_cache", | |
318 | size, 0, | |
319 | 0, NULL); | |
320 | if (!cache) { | |
321 | pr_err("Cache allocation failed\n"); | |
322 | return; | |
323 | } | |
324 | pr_info("out-of-bounds in kmem_cache_alloc\n"); | |
325 | p = kmem_cache_alloc(cache, GFP_KERNEL); | |
326 | if (!p) { | |
327 | pr_err("Allocation failed\n"); | |
328 | kmem_cache_destroy(cache); | |
329 | return; | |
330 | } | |
331 | ||
332 | *p = p[size]; | |
333 | kmem_cache_free(cache, p); | |
334 | kmem_cache_destroy(cache); | |
335 | } | |
336 | ||
0386bf38 GT |
337 | static noinline void __init memcg_accounted_kmem_cache(void) |
338 | { | |
339 | int i; | |
340 | char *p; | |
341 | size_t size = 200; | |
342 | struct kmem_cache *cache; | |
343 | ||
344 | cache = kmem_cache_create("test_cache", size, 0, SLAB_ACCOUNT, NULL); | |
345 | if (!cache) { | |
346 | pr_err("Cache allocation failed\n"); | |
347 | return; | |
348 | } | |
349 | ||
350 | pr_info("allocate memcg accounted object\n"); | |
351 | /* | |
352 | * Several allocations with a delay to allow for lazy per memcg kmem | |
353 | * cache creation. | |
354 | */ | |
355 | for (i = 0; i < 5; i++) { | |
356 | p = kmem_cache_alloc(cache, GFP_KERNEL); | |
357 | if (!p) { | |
358 | pr_err("Allocation failed\n"); | |
359 | goto free_cache; | |
360 | } | |
361 | kmem_cache_free(cache, p); | |
362 | msleep(100); | |
363 | } | |
364 | ||
365 | free_cache: | |
366 | kmem_cache_destroy(cache); | |
367 | } | |
368 | ||
3f15801c AR |
369 | static char global_array[10]; |
370 | ||
371 | static noinline void __init kasan_global_oob(void) | |
372 | { | |
373 | volatile int i = 3; | |
374 | char *p = &global_array[ARRAY_SIZE(global_array) + i]; | |
375 | ||
376 | pr_info("out-of-bounds global variable\n"); | |
377 | *(volatile char *)p; | |
378 | } | |
379 | ||
380 | static noinline void __init kasan_stack_oob(void) | |
381 | { | |
382 | char stack_array[10]; | |
383 | volatile int i = 0; | |
384 | char *p = &stack_array[ARRAY_SIZE(stack_array) + i]; | |
385 | ||
386 | pr_info("out-of-bounds on stack\n"); | |
387 | *(volatile char *)p; | |
388 | } | |
389 | ||
96fe805f AP |
390 | static noinline void __init ksize_unpoisons_memory(void) |
391 | { | |
392 | char *ptr; | |
13a1d1ad | 393 | size_t size = 123, real_size; |
96fe805f AP |
394 | |
395 | pr_info("ksize() unpoisons the whole allocated chunk\n"); | |
396 | ptr = kmalloc(size, GFP_KERNEL); | |
397 | if (!ptr) { | |
398 | pr_err("Allocation failed\n"); | |
399 | return; | |
400 | } | |
401 | real_size = ksize(ptr); | |
402 | /* This access doesn't trigger an error. */ | |
403 | ptr[size] = 'x'; | |
404 | /* This one does. */ | |
405 | ptr[real_size] = 'y'; | |
406 | kfree(ptr); | |
407 | } | |
408 | ||
eae08dca AR |
409 | static noinline void __init copy_user_test(void) |
410 | { | |
411 | char *kmem; | |
412 | char __user *usermem; | |
413 | size_t size = 10; | |
414 | int unused; | |
415 | ||
416 | kmem = kmalloc(size, GFP_KERNEL); | |
417 | if (!kmem) | |
418 | return; | |
419 | ||
420 | usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE, | |
421 | PROT_READ | PROT_WRITE | PROT_EXEC, | |
422 | MAP_ANONYMOUS | MAP_PRIVATE, 0); | |
423 | if (IS_ERR(usermem)) { | |
424 | pr_err("Failed to allocate user memory\n"); | |
425 | kfree(kmem); | |
426 | return; | |
427 | } | |
428 | ||
429 | pr_info("out-of-bounds in copy_from_user()\n"); | |
430 | unused = copy_from_user(kmem, usermem, size + 1); | |
431 | ||
432 | pr_info("out-of-bounds in copy_to_user()\n"); | |
433 | unused = copy_to_user(usermem, kmem, size + 1); | |
434 | ||
435 | pr_info("out-of-bounds in __copy_from_user()\n"); | |
436 | unused = __copy_from_user(kmem, usermem, size + 1); | |
437 | ||
438 | pr_info("out-of-bounds in __copy_to_user()\n"); | |
439 | unused = __copy_to_user(usermem, kmem, size + 1); | |
440 | ||
441 | pr_info("out-of-bounds in __copy_from_user_inatomic()\n"); | |
442 | unused = __copy_from_user_inatomic(kmem, usermem, size + 1); | |
443 | ||
444 | pr_info("out-of-bounds in __copy_to_user_inatomic()\n"); | |
445 | unused = __copy_to_user_inatomic(usermem, kmem, size + 1); | |
446 | ||
447 | pr_info("out-of-bounds in strncpy_from_user()\n"); | |
448 | unused = strncpy_from_user(kmem, usermem, size + 1); | |
449 | ||
450 | vm_munmap((unsigned long)usermem, PAGE_SIZE); | |
451 | kfree(kmem); | |
452 | } | |
453 | ||
828347f8 DV |
454 | static noinline void __init use_after_scope_test(void) |
455 | { | |
456 | volatile char *volatile p; | |
457 | ||
458 | pr_info("use-after-scope on int\n"); | |
459 | { | |
460 | int local = 0; | |
461 | ||
462 | p = (char *)&local; | |
463 | } | |
464 | p[0] = 1; | |
465 | p[3] = 1; | |
466 | ||
467 | pr_info("use-after-scope on array\n"); | |
468 | { | |
469 | char local[1024] = {0}; | |
470 | ||
471 | p = local; | |
472 | } | |
473 | p[0] = 1; | |
474 | p[1023] = 1; | |
475 | } | |
476 | ||
3f15801c AR |
477 | static int __init kmalloc_tests_init(void) |
478 | { | |
b0845ce5 MR |
479 | /* |
480 | * Temporarily enable multi-shot mode. Otherwise, we'd only get a | |
481 | * report for the first case. | |
482 | */ | |
483 | bool multishot = kasan_save_enable_multi_shot(); | |
484 | ||
3f15801c AR |
485 | kmalloc_oob_right(); |
486 | kmalloc_oob_left(); | |
487 | kmalloc_node_oob_right(); | |
e6e8379c AP |
488 | #ifdef CONFIG_SLUB |
489 | kmalloc_pagealloc_oob_right(); | |
490 | #endif | |
9789d8e0 | 491 | kmalloc_large_oob_right(); |
3f15801c AR |
492 | kmalloc_oob_krealloc_more(); |
493 | kmalloc_oob_krealloc_less(); | |
494 | kmalloc_oob_16(); | |
495 | kmalloc_oob_in_memset(); | |
f523e737 WL |
496 | kmalloc_oob_memset_2(); |
497 | kmalloc_oob_memset_4(); | |
498 | kmalloc_oob_memset_8(); | |
499 | kmalloc_oob_memset_16(); | |
3f15801c AR |
500 | kmalloc_uaf(); |
501 | kmalloc_uaf_memset(); | |
502 | kmalloc_uaf2(); | |
503 | kmem_cache_oob(); | |
0386bf38 | 504 | memcg_accounted_kmem_cache(); |
3f15801c AR |
505 | kasan_stack_oob(); |
506 | kasan_global_oob(); | |
96fe805f | 507 | ksize_unpoisons_memory(); |
eae08dca | 508 | copy_user_test(); |
828347f8 | 509 | use_after_scope_test(); |
b0845ce5 MR |
510 | |
511 | kasan_restore_multi_shot(multishot); | |
512 | ||
3f15801c AR |
513 | return -EAGAIN; |
514 | } | |
515 | ||
516 | module_init(kmalloc_tests_init); | |
517 | MODULE_LICENSE("GPL"); |