lkdtm: split heap corruption tests to separate file (ffc514f3) · Commits · 戴 / test

drivers/misc/Makefile

+1 −0

Original line number	Diff line number	Diff line
		@@ -59,6 +59,7 @@ obj-$(CONFIG_CXL_BASE) += cxl/
		obj-$(CONFIG_PANEL) += panel.o

		lkdtm-$(CONFIG_LKDTM) += lkdtm_core.o
		lkdtm-$(CONFIG_LKDTM) += lkdtm_heap.o
		lkdtm-$(CONFIG_LKDTM) += lkdtm_perms.o
		lkdtm-$(CONFIG_LKDTM) += lkdtm_rodata_objcopy.o
		lkdtm-$(CONFIG_LKDTM) += lkdtm_usercopy.o

drivers/misc/lkdtm.h

+7 −0

Original line number	Diff line number	Diff line
		#ifndef __LKDTM_H
		#define __LKDTM_H

		/* lkdtm_heap.c */
		void lkdtm_OVERWRITE_ALLOCATION(void);
		void lkdtm_WRITE_AFTER_FREE(void);
		void lkdtm_READ_AFTER_FREE(void);
		void lkdtm_WRITE_BUDDY_AFTER_FREE(void);
		void lkdtm_READ_BUDDY_AFTER_FREE(void);

		/* lkdtm_perms.c */
		void __init lkdtm_perms_init(void);
		void lkdtm_WRITE_RO(void);

drivers/misc/lkdtm_core.c

+10 −114

Original line number	Diff line number	Diff line
		@@ -384,125 +384,21 @@ static void lkdtm_do_action(enum ctype which)
		*p = val;
		break;
		}
		case CT_OVERWRITE_ALLOCATION: {
		size_t len = 1020;
		u32 *data = kmalloc(len, GFP_KERNEL);

		data[1024 / sizeof(u32)] = 0x12345678;
		kfree(data);
		case CT_OVERWRITE_ALLOCATION:
		lkdtm_OVERWRITE_ALLOCATION();
		break;
		}
		case CT_WRITE_AFTER_FREE: {
		int base, again;
		size_t len = 1024;
		/*
		* The slub allocator uses the first word to store the free
		* pointer in some configurations. Use the middle of the
		* allocation to avoid running into the freelist
		*/
		size_t offset = (len / sizeof(*base)) / 2;

		base = kmalloc(len, GFP_KERNEL);
		pr_info("Allocated memory %p-%p\n", base, &base[offset * 2]);
		pr_info("Attempting bad write to freed memory at %p\n",
		&base[offset]);
		kfree(base);
		base[offset] = 0x0abcdef0;
		/* Attempt to notice the overwrite. */
		again = kmalloc(len, GFP_KERNEL);
		kfree(again);
		if (again != base)
		pr_info("Hmm, didn't get the same memory range.\n");

		case CT_WRITE_AFTER_FREE:
		lkdtm_WRITE_AFTER_FREE();
		break;
		}
		case CT_READ_AFTER_FREE: {
		int base, val, saw;
		size_t len = 1024;
		/*
		* The slub allocator uses the first word to store the free
		* pointer in some configurations. Use the middle of the
		* allocation to avoid running into the freelist
		*/
		size_t offset = (len / sizeof(*base)) / 2;

		base = kmalloc(len, GFP_KERNEL);
		if (!base)
		case CT_READ_AFTER_FREE:
		lkdtm_READ_AFTER_FREE();
		break;

		val = kmalloc(len, GFP_KERNEL);
		if (!val) {
		kfree(base);
		case CT_WRITE_BUDDY_AFTER_FREE:
		lkdtm_WRITE_BUDDY_AFTER_FREE();
		break;
		}

		*val = 0x12345678;
		base[offset] = *val;
		pr_info("Value in memory before free: %x\n", base[offset]);

		kfree(base);

		pr_info("Attempting bad read from freed memory\n");
		saw = base[offset];
		if (saw != *val) {
		/* Good! Poisoning happened, so declare a win. */
		pr_info("Memory correctly poisoned (%x)\n", saw);
		BUG();
		}
		pr_info("Memory was not poisoned\n");

		kfree(val);
		case CT_READ_BUDDY_AFTER_FREE:
		lkdtm_READ_BUDDY_AFTER_FREE();
		break;
		}
		case CT_WRITE_BUDDY_AFTER_FREE: {
		unsigned long p = __get_free_page(GFP_KERNEL);
		if (!p)
		break;
		pr_info("Writing to the buddy page before free\n");
		memset((void *)p, 0x3, PAGE_SIZE);
		free_page(p);
		schedule();
		pr_info("Attempting bad write to the buddy page after free\n");
		memset((void *)p, 0x78, PAGE_SIZE);
		/* Attempt to notice the overwrite. */
		p = __get_free_page(GFP_KERNEL);
		free_page(p);
		schedule();

		break;
		}
		case CT_READ_BUDDY_AFTER_FREE: {
		unsigned long p = __get_free_page(GFP_KERNEL);
		int saw, *val;
		int *base;

		if (!p)
		break;

		val = kmalloc(1024, GFP_KERNEL);
		if (!val) {
		free_page(p);
		break;
		}

		base = (int *)p;

		*val = 0x12345678;
		base[0] = *val;
		pr_info("Value in memory before free: %x\n", base[0]);
		free_page(p);
		pr_info("Attempting to read from freed memory\n");
		saw = base[0];
		if (saw != *val) {
		/* Good! Poisoning happened, so declare a win. */
		pr_info("Memory correctly poisoned (%x)\n", saw);
		BUG();
		}
		pr_info("Buddy page was not poisoned\n");

		kfree(val);
		break;
		}
		case CT_SOFTLOCKUP:
		preempt_disable();
		for (;;)

drivers/misc/lkdtm_heap.c

0 → 100644

+146 −0

Original line number	Diff line number	Diff line
		/*
		* This is for all the tests relating directly to heap memory, including
		* page allocation and slab allocations.
		*/
		#define pr_fmt(fmt) "lkdtm: " fmt

		#include <linux/kernel.h>
		#include <linux/slab.h>

		#include "lkdtm.h"

		/*
		* This tries to stay within the next largest power-of-2 kmalloc cache
		* to avoid actually overwriting anything important if it's not detected
		* correctly.
		*/
		void lkdtm_OVERWRITE_ALLOCATION(void)
		{
		size_t len = 1020;
		u32 *data = kmalloc(len, GFP_KERNEL);

		data[1024 / sizeof(u32)] = 0x12345678;
		kfree(data);
		}

		void lkdtm_WRITE_AFTER_FREE(void)
		{
		int base, again;
		size_t len = 1024;
		/*
		* The slub allocator uses the first word to store the free
		* pointer in some configurations. Use the middle of the
		* allocation to avoid running into the freelist
		*/
		size_t offset = (len / sizeof(*base)) / 2;

		base = kmalloc(len, GFP_KERNEL);
		pr_info("Allocated memory %p-%p\n", base, &base[offset * 2]);
		pr_info("Attempting bad write to freed memory at %p\n",
		&base[offset]);
		kfree(base);
		base[offset] = 0x0abcdef0;
		/* Attempt to notice the overwrite. */
		again = kmalloc(len, GFP_KERNEL);
		kfree(again);
		if (again != base)
		pr_info("Hmm, didn't get the same memory range.\n");
		}

		void lkdtm_READ_AFTER_FREE(void)
		{
		int base, val, saw;
		size_t len = 1024;
		/*
		* The slub allocator uses the first word to store the free
		* pointer in some configurations. Use the middle of the
		* allocation to avoid running into the freelist
		*/
		size_t offset = (len / sizeof(*base)) / 2;

		base = kmalloc(len, GFP_KERNEL);
		if (!base) {
		pr_info("Unable to allocate base memory.\n");
		return;
		}

		val = kmalloc(len, GFP_KERNEL);
		if (!val) {
		pr_info("Unable to allocate val memory.\n");
		kfree(base);
		return;
		}

		*val = 0x12345678;
		base[offset] = *val;
		pr_info("Value in memory before free: %x\n", base[offset]);

		kfree(base);

		pr_info("Attempting bad read from freed memory\n");
		saw = base[offset];
		if (saw != *val) {
		/* Good! Poisoning happened, so declare a win. */
		pr_info("Memory correctly poisoned (%x)\n", saw);
		BUG();
		}
		pr_info("Memory was not poisoned\n");

		kfree(val);
		}

		void lkdtm_WRITE_BUDDY_AFTER_FREE(void)
		{
		unsigned long p = __get_free_page(GFP_KERNEL);
		if (!p) {
		pr_info("Unable to allocate free page\n");
		return;
		}

		pr_info("Writing to the buddy page before free\n");
		memset((void *)p, 0x3, PAGE_SIZE);
		free_page(p);
		schedule();
		pr_info("Attempting bad write to the buddy page after free\n");
		memset((void *)p, 0x78, PAGE_SIZE);
		/* Attempt to notice the overwrite. */
		p = __get_free_page(GFP_KERNEL);
		free_page(p);
		schedule();
		}

		void lkdtm_READ_BUDDY_AFTER_FREE(void)
		{
		unsigned long p = __get_free_page(GFP_KERNEL);
		int saw, *val;
		int *base;

		if (!p) {
		pr_info("Unable to allocate free page\n");
		return;
		}

		val = kmalloc(1024, GFP_KERNEL);
		if (!val) {
		pr_info("Unable to allocate val memory.\n");
		free_page(p);
		return;
		}

		base = (int *)p;

		*val = 0x12345678;
		base[0] = *val;
		pr_info("Value in memory before free: %x\n", base[0]);
		free_page(p);
		pr_info("Attempting to read from freed memory\n");
		saw = base[0];
		if (saw != *val) {
		/* Good! Poisoning happened, so declare a win. */
		pr_info("Memory correctly poisoned (%x)\n", saw);
		BUG();
		}
		pr_info("Buddy page was not poisoned\n");

		kfree(val);
		}

Admin message