Merge tag 'lkdtm-next-part2' of... (5f972797) · Commits · 戴 / test

drivers/misc/lkdtm.h

+3 −0

Original line number	Diff line number	Diff line
		@@ -14,6 +14,7 @@ void lkdtm_EXCEPTION(void);
		void lkdtm_LOOP(void);
		void lkdtm_OVERFLOW(void);
		void lkdtm_CORRUPT_STACK(void);
		void lkdtm_CORRUPT_STACK_STRONG(void);
		void lkdtm_UNALIGNED_LOAD_STORE_WRITE(void);
		void lkdtm_SOFTLOCKUP(void);
		void lkdtm_HARDLOCKUP(void);
		@@ -22,6 +23,8 @@ void lkdtm_HUNG_TASK(void);
		void lkdtm_CORRUPT_LIST_ADD(void);
		void lkdtm_CORRUPT_LIST_DEL(void);
		void lkdtm_CORRUPT_USER_DS(void);
		void lkdtm_STACK_GUARD_PAGE_LEADING(void);
		void lkdtm_STACK_GUARD_PAGE_TRAILING(void);

		/* lkdtm_heap.c */
		void lkdtm_OVERWRITE_ALLOCATION(void);

drivers/misc/lkdtm_bugs.c

+48 −3

Original line number	Diff line number	Diff line
		@@ -8,6 +8,7 @@
		#include <linux/list.h>
		#include <linux/sched.h>
		#include <linux/sched/signal.h>
		#include <linux/sched/task_stack.h>
		#include <linux/uaccess.h>

		struct lkdtm_list {
		@@ -84,16 +85,31 @@ void lkdtm_OVERFLOW(void)

		static noinline void __lkdtm_CORRUPT_STACK(void *stack)
		{
		memset(stack, 'a', 64);
		memset(stack, '\xff', 64);
		}

		/* This should trip the stack canary, not corrupt the return address. */
		noinline void lkdtm_CORRUPT_STACK(void)
		{
		/* Use default char array length that triggers stack protection. */
		char data[8];
		char data[8] __aligned(sizeof(void *));

		__lkdtm_CORRUPT_STACK(&data);

		pr_info("Corrupted stack containing char array ...\n");
		}

		/* Same as above but will only get a canary with -fstack-protector-strong */
		noinline void lkdtm_CORRUPT_STACK_STRONG(void)
		{
		union {
		unsigned short shorts[4];
		unsigned long *ptr;
		} data __aligned(sizeof(void *));

		__lkdtm_CORRUPT_STACK(&data);

		pr_info("Corrupted stack with '%16s'...\n", data);
		pr_info("Corrupted stack containing union ...\n");
		}

		void lkdtm_UNALIGNED_LOAD_STORE_WRITE(void)
		@@ -199,6 +215,7 @@ void lkdtm_CORRUPT_LIST_DEL(void)
		pr_err("list_del() corruption not detected!\n");
		}

		/* Test if unbalanced set_fs(KERNEL_DS)/set_fs(USER_DS) check exists. */
		void lkdtm_CORRUPT_USER_DS(void)
		{
		pr_info("setting bad task size limit\n");
		@@ -207,3 +224,31 @@ void lkdtm_CORRUPT_USER_DS(void)
		/* Make sure we do not keep running with a KERNEL_DS! */
		force_sig(SIGKILL, current);
		}

		/* Test that VMAP_STACK is actually allocating with a leading guard page */
		void lkdtm_STACK_GUARD_PAGE_LEADING(void)
		{
		const unsigned char *stack = task_stack_page(current);
		const unsigned char *ptr = stack - 1;
		volatile unsigned char byte;

		pr_info("attempting bad read from page below current stack\n");

		byte = *ptr;

		pr_err("FAIL: accessed page before stack!\n");
		}

		/* Test that VMAP_STACK is actually allocating with a trailing guard page */
		void lkdtm_STACK_GUARD_PAGE_TRAILING(void)
		{
		const unsigned char *stack = task_stack_page(current);
		const unsigned char *ptr = stack + THREAD_SIZE;
		volatile unsigned char byte;

		pr_info("attempting bad read from page above current stack\n");

		byte = *ptr;

		pr_err("FAIL: accessed page after stack!\n");
		}

drivers/misc/lkdtm_core.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -201,6 +201,9 @@ struct crashtype crashtypes[] = {
		CRASHTYPE(CORRUPT_LIST_DEL),
		CRASHTYPE(CORRUPT_USER_DS),
		CRASHTYPE(CORRUPT_STACK),
		CRASHTYPE(CORRUPT_STACK_STRONG),
		CRASHTYPE(STACK_GUARD_PAGE_LEADING),
		CRASHTYPE(STACK_GUARD_PAGE_TRAILING),
		CRASHTYPE(UNALIGNED_LOAD_STORE_WRITE),
		CRASHTYPE(OVERWRITE_ALLOCATION),
		CRASHTYPE(WRITE_AFTER_FREE),

Admin message