Commit b09511c2 authored by Andy Lutomirski's avatar Andy Lutomirski Committed by Ingo Molnar
Browse files

lkdtm: Add a DOUBLE_FAULT crash type on x86 



The DOUBLE_FAULT crash does INT $8, which is a decent approximation
of a double fault.  This is useful for testing the double fault
handling.  Use it like:

Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
parent 3300c4f3

drivers/misc/lkdtm/bugs.c

+39 −0
Original line number Diff line number Diff line
@@ -12,6 +12,10 @@ 
#include <linux/sched/task_stack.h>

#include <linux/uaccess.h>



#ifdef CONFIG_X86_32

#include <asm/desc.h>

#endif



struct lkdtm_list {

	struct list_head node;

};
@@ -337,3 +341,38 @@ void lkdtm_UNSET_SMEP(void) 
	pr_err("FAIL: this test is x86_64-only\n");

#endif

}



#ifdef CONFIG_X86_32

void lkdtm_DOUBLE_FAULT(void)

{

	/*

	 * Trigger #DF by setting the stack limit to zero.  This clobbers

	 * a GDT TLS slot, which is okay because the current task will die

	 * anyway due to the double fault.

	 */

	struct desc_struct d = {

		.type = 3,	/* expand-up, writable, accessed data */

		.p = 1,		/* present */

		.d = 1,		/* 32-bit */

		.g = 0,		/* limit in bytes */

		.s = 1,		/* not system */

	};



	local_irq_disable();

	write_gdt_entry(get_cpu_gdt_rw(smp_processor_id()),

			GDT_ENTRY_TLS_MIN, &d, DESCTYPE_S);



	/*

	 * Put our zero-limit segment in SS and then trigger a fault.  The

	 * 4-byte access to (%esp) will fault with #SS, and the attempt to

	 * deliver the fault will recursively cause #SS and result in #DF.

	 * This whole process happens while NMIs and MCEs are blocked by the

	 * MOV SS window.  This is nice because an NMI with an invalid SS

	 * would also double-fault, resulting in the NMI or MCE being lost.

	 */

	asm volatile ("movw %0, %%ss; addl $0, (%%esp)" ::

		      "r" ((unsigned short)(GDT_ENTRY_TLS_MIN << 3)));



	panic("tried to double fault but didn't die\n");

}

#endif

drivers/misc/lkdtm/core.c

+3 −0
Original line number Diff line number Diff line
@@ -171,6 +171,9 @@ static const struct crashtype crashtypes[] = { 
	CRASHTYPE(USERCOPY_KERNEL_DS),

	CRASHTYPE(STACKLEAK_ERASING),

	CRASHTYPE(CFI_FORWARD_PROTO),

#ifdef CONFIG_X86_32

	CRASHTYPE(DOUBLE_FAULT),

#endif

};

drivers/misc/lkdtm/lkdtm.h

+3 −0
Original line number Diff line number Diff line
@@ -28,6 +28,9 @@ void lkdtm_CORRUPT_USER_DS(void); 
void lkdtm_STACK_GUARD_PAGE_LEADING(void);

void lkdtm_STACK_GUARD_PAGE_TRAILING(void);

void lkdtm_UNSET_SMEP(void);

#ifdef CONFIG_X86_32

void lkdtm_DOUBLE_FAULT(void);

#endif



/* lkdtm_heap.c */

void __init lkdtm_heap_init(void);

CRA Git | Maintained and supported by SUSTech CRA and CCSE