Commit 02bd610e authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge tag 'lkdtm-next' of... 

Merge tag 'lkdtm-next' of https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux into char-misc-linus

Kees writes:

lkdtm: various fixes

- Move KERNEL_DS test to non-canonical range
- Make stack exhaustion test more robust

* tag 'lkdtm-next' of https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  lkdtm/bugs: Adjust recursion test to avoid elision
  lkdtm/usercopy: Moves the KERNEL_DS test to non-canonical
parents 6660a04f 24cccab4

drivers/misc/lkdtm/bugs.c

+17 −6
Original line number Diff line number Diff line
@@ -32,12 +32,20 @@ static int recur_count = REC_NUM_DEFAULT; 


static DEFINE_SPINLOCK(lock_me_up);



static int recursive_loop(int remaining)

/*

 * Make sure compiler does not optimize this function or stack frame away:

 * - function marked noinline

 * - stack variables are marked volatile

 * - stack variables are written (memset()) and read (pr_info())

 * - function has external effects (pr_info())

 * */

static int noinline recursive_loop(int remaining)

{

	char buf[REC_STACK_SIZE];

	volatile char buf[REC_STACK_SIZE];



	/* Make sure compiler does not optimize this away. */

	memset(buf, (remaining & 0xff) | 0x1, REC_STACK_SIZE);

	memset((void *)buf, remaining & 0xFF, sizeof(buf));

	pr_info("loop %d/%d ...\n", (int)buf[remaining % sizeof(buf)],

		recur_count);

	if (!remaining)

		return 0;

	else
@@ -81,9 +89,12 @@ void lkdtm_LOOP(void) 
		;

}



void lkdtm_OVERFLOW(void)

void lkdtm_EXHAUST_STACK(void)

{

	(void) recursive_loop(recur_count);

	pr_info("Calling function with %d frame size to depth %d ...\n",

		REC_STACK_SIZE, recur_count);

	recursive_loop(recur_count);

	pr_info("FAIL: survived without exhausting stack?!\n");

}



static noinline void __lkdtm_CORRUPT_STACK(void *stack)

drivers/misc/lkdtm/core.c

+3 −3
Original line number Diff line number Diff line
@@ -119,12 +119,12 @@ static const struct crashtype crashtypes[] = { 
	CRASHTYPE(WARNING),

	CRASHTYPE(EXCEPTION),

	CRASHTYPE(LOOP),

	CRASHTYPE(OVERFLOW),

	CRASHTYPE(EXHAUST_STACK),

	CRASHTYPE(CORRUPT_STACK),

	CRASHTYPE(CORRUPT_STACK_STRONG),

	CRASHTYPE(CORRUPT_LIST_ADD),

	CRASHTYPE(CORRUPT_LIST_DEL),

	CRASHTYPE(CORRUPT_USER_DS),

	CRASHTYPE(CORRUPT_STACK),

	CRASHTYPE(CORRUPT_STACK_STRONG),

	CRASHTYPE(STACK_GUARD_PAGE_LEADING),

	CRASHTYPE(STACK_GUARD_PAGE_TRAILING),

	CRASHTYPE(UNALIGNED_LOAD_STORE_WRITE),

drivers/misc/lkdtm/lkdtm.h

+1 −1
Original line number Diff line number Diff line
@@ -13,7 +13,7 @@ void lkdtm_BUG(void); 
void lkdtm_WARNING(void);

void lkdtm_EXCEPTION(void);

void lkdtm_LOOP(void);

void lkdtm_OVERFLOW(void);

void lkdtm_EXHAUST_STACK(void);

void lkdtm_CORRUPT_STACK(void);

void lkdtm_CORRUPT_STACK_STRONG(void);

void lkdtm_UNALIGNED_LOAD_STORE_WRITE(void);

drivers/misc/lkdtm/usercopy.c

+6 −4
Original line number Diff line number Diff line
@@ -324,14 +324,16 @@ free_user: 


void lkdtm_USERCOPY_KERNEL_DS(void)

{

	char __user *user_ptr = (char __user *)ERR_PTR(-EINVAL);

	char __user *user_ptr =

		(char __user *)(0xFUL << (sizeof(unsigned long) * 8 - 4));

	mm_segment_t old_fs = get_fs();

	char buf[10] = {0};



	pr_info("attempting copy_to_user on unmapped kernel address\n");

	pr_info("attempting copy_to_user() to noncanonical address: %px\n",

		user_ptr);

	set_fs(KERNEL_DS);

	if (copy_to_user(user_ptr, buf, sizeof(buf)))

		pr_info("copy_to_user un unmapped kernel address failed\n");

	if (copy_to_user(user_ptr, buf, sizeof(buf)) == 0)

		pr_err("copy_to_user() to noncanonical address succeeded!?\n");

	set_fs(old_fs);

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE