From patchwork Wed Jun 23 20:39:28 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12340485 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4CE0C49EAB for ; Wed, 23 Jun 2021 20:39:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8FC4B61241 for ; Wed, 23 Jun 2021 20:39:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229949AbhFWUmH (ORCPT ); Wed, 23 Jun 2021 16:42:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58490 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229922AbhFWUmF (ORCPT ); Wed, 23 Jun 2021 16:42:05 -0400 Received: from mail-pj1-x1031.google.com (mail-pj1-x1031.google.com [IPv6:2607:f8b0:4864:20::1031]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4DF77C061766 for ; Wed, 23 Jun 2021 13:39:47 -0700 (PDT) Received: by mail-pj1-x1031.google.com with SMTP id g4so2207671pjk.0 for ; Wed, 23 Jun 2021 13:39:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=a/NHLnzJB2ygZFZV6tY0zJmtOu+fbM3j2iEZapLwC/A=; b=I/banPaTpbTehL6OdlALe/IibBFT5OlgTdWS6XNKoIoXm+GiZtXArwzsPg+rtwRkgg NmrSVIMu+8EuZ9CYJ01zzWl4kbE+LLteCDRjIKB9SxVkzoI6SWm+GokpeXxJUhilXbxr V3BTbXTDX4uqb6Jl4nP19anmnYosCw2t8IZxM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=a/NHLnzJB2ygZFZV6tY0zJmtOu+fbM3j2iEZapLwC/A=; b=JGkvJlFX4rAmHMjegt0xGRwMorDVV1zQW1naZfx3H3aV3hWeLmonQbgQZw6dMkq3Qs W+WnX/ytXA8Y86Er3CgYkebMN4/VhtroOHJ/uwyANG0Fe7CqGGcJj7Ul1z7MOFsaRJiG KNgAFuccx/Fx88a4GWq8G02nFPOt3P6/IzA+JF7Cid39m5Qw9fy4Q9oflgGphy27tlmj bFGXp1QwdHDCk6mTn9w3QcIjSTIp0Dups5l3ic0Ydr6sxhux6yzoNEujXGR5vRJvMBQl l7pTNidMshZs3HsD2NQaU18vHHehGiL4DDy2vZ9jTrpyec0jtRKMMh7P1ZoEp2FImB6v 3S0g== X-Gm-Message-State: AOAM5321KkiCe1vEXZ9godYNCwj0IGgME+Dg4DZtEx68K/UOszyyyMDu 01/VNbJmcUUosw1vinLLsRmWvg== X-Google-Smtp-Source: ABdhPJyIVBrXhKOZzCBKXG3oK3wjH6BAd9s13vXvBJ+PpxlX5LInY9Q6iJqJZX6Jh5pq81lEvn0kug== X-Received: by 2002:a17:90a:5a08:: with SMTP id b8mr11356642pjd.228.1624480786915; Wed, 23 Jun 2021 13:39:46 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id u23sm9942pgk.38.2021.06.23.13.39.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 23 Jun 2021 13:39:45 -0700 (PDT) From: Kees Cook To: Greg Kroah-Hartman Cc: Kees Cook , Guillaume Tucker , David Laight , stable@vger.kernel.org, Arnd Bergmann , linux-kernel@vger.kernel.org, kernelci@groups.io, linux-kselftest@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 1/9] selftests/lkdtm: Avoid needing explicit sub-shell Date: Wed, 23 Jun 2021 13:39:28 -0700 Message-Id: <20210623203936.3151093-2-keescook@chromium.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210623203936.3151093-1-keescook@chromium.org> References: <20210623203936.3151093-1-keescook@chromium.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1841; h=from:subject; bh=AmOgu4HWdRZorYqBFRSjQNwNv37L2JYo/PWnXeJW7vY=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBg05wFY5oavND7smh3PFgLH+LKjB2fUh5OHY6bWTIk eYMshS6JAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCYNOcBQAKCRCJcvTf3G3AJvtJD/ 9G+j8CKarzbS3nY6L6aaVmdftLkiLrU13NYZGNHPstjHi6Lx9CpHpJ+QwK8wc78agXMWUB/r+L8qLk s5gPPethiYZV3QumjnWFZ+gj2T/Xoz+EbjLOWntVMv9mjstH5+5/e/VcX9vi3N56IBFqOT/OAyrw6V piyzsjxVP6elfNaUtfASxPcXo5H7zZVums4Lnz/S7qok5qi+zmFuE9cxdfPi1g5YHAdw8uxX76SDgD hoV+UheZw8Vf76IBrTdkW9Jp46PrE+jfJrWT6bx2II9gX/ukVqaMFNd4OMh/CyptWTqAdlnB165u2o dy3BZ1goom8Vqgcw5HC4Xyvj6RHMejdsHAwvZi1eykN7tOV2Ad3VciAb5zpVW0aw6N6KFim54cJhF+ 6ZEq4G2peIhgqpOiJQeN3nNjM19grUPTa4eG/YYfxZxPmhW9BgnimjjelWxx2V2bEUMsU5WvOOOhKl 3av97w61teJaEc5UTni4zXrsFfROtUVxxWtGT6W++WLxeHaIFjxiNKPOUNqIF8xNIDbfy5mnHt7dp6 qzq+WOtPvEmqbCZQ/qsVUVxIbAaVUSoNjmrIU5nCypQyLphJMqKBzn/qDVtewgDbXOT8Np07K7fFns ceDGvDFjboNdC3WG7S0yN+Pj+kveweqXC8AKB5TUR06NIKYA8nA74XD1efAg== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org Some environments do not set $SHELL when running tests. There's no need to use $SHELL here anyway, since "cat" can be used to receive any delivered signals from the kernel. Additionally avoid using bash-isms in the command, and record stderr for posterity. Suggested-by: Guillaume Tucker Suggested-by: David Laight Fixes: 46d1a0f03d66 ("selftests/lkdtm: Add tests for LKDTM targets") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook --- tools/testing/selftests/lkdtm/run.sh | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/tools/testing/selftests/lkdtm/run.sh b/tools/testing/selftests/lkdtm/run.sh index bb7a1775307b..e95e79bd3126 100755 --- a/tools/testing/selftests/lkdtm/run.sh +++ b/tools/testing/selftests/lkdtm/run.sh @@ -76,10 +76,14 @@ fi # Save existing dmesg so we can detect new content below dmesg > "$DMESG" -# Most shells yell about signals and we're expecting the "cat" process -# to usually be killed by the kernel. So we have to run it in a sub-shell -# and silence errors. -($SHELL -c 'cat <(echo '"$test"') >'"$TRIGGER" 2>/dev/null) || true +# Since the kernel is likely killing the process writing to the trigger +# file, it must not be the script's shell itself. i.e. we cannot do: +# echo "$test" >"$TRIGGER" +# Instead, use "cat" to take the signal. Since the shell will yell about +# the signal that killed the subprocess, we must ignore the failure and +# continue. However we don't silence stderr since there might be other +# useful details reported there in the case of other unexpected conditions. +echo "$test" | cat >"$TRIGGER" || true # Record and dump the results dmesg | comm --nocheck-order -13 "$DMESG" - > "$LOG" || true From patchwork Wed Jun 23 20:39:29 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12340487 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DD4B5C49EA5 for ; Wed, 23 Jun 2021 20:39:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C3E7F610C7 for ; Wed, 23 Jun 2021 20:39:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230004AbhFWUmK (ORCPT ); Wed, 23 Jun 2021 16:42:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58496 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229929AbhFWUmG (ORCPT ); Wed, 23 Jun 2021 16:42:06 -0400 Received: from mail-pj1-x1030.google.com (mail-pj1-x1030.google.com [IPv6:2607:f8b0:4864:20::1030]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B78F5C061787 for ; Wed, 23 Jun 2021 13:39:47 -0700 (PDT) Received: by mail-pj1-x1030.google.com with SMTP id x21-20020a17090aa395b029016e25313bfcso2112276pjp.2 for ; Wed, 23 Jun 2021 13:39:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=9GYkjjOQZ6Rz1pEOIf9K4RSl8mgGGEOKk2i3NOWLjLA=; b=oEmyBdL/O6vMQ+qVWEiW1NRHGzhz4sEKTZMQ6lOUKhPz+NU9pA0qtKyPEmtPkPcJ/T GFg4CLQSRyolenFblesTc/xamKo1azEcNE2e7G52IG9ckEWLkNoNPIZH+lwGdOv+zkLs E2Gz8zf4zFisvYsNtwUM+ePjJm2AW2kZbXzeM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=9GYkjjOQZ6Rz1pEOIf9K4RSl8mgGGEOKk2i3NOWLjLA=; b=t7g19454Iw0R7NODZEmB0ZO/AI7SDyuc9RXiDfrkvTJphixiQ87InhjpGp74AUe64f /EHVaHDdb2ehf5/5pRbXN/PoNh9PQ+cRuv9CDzy3BqrhLnTgkZ3z36yBrO4OU3kgsSIx bKVBzl6wm2B4/feHTf/8CwLtU6IV4PIU1YoiRdARrpJq0xFaCYZI8nP7B3xXzn/k6Bom TN0/P5CF7NYJJYFbosg/t56VPrQ+T2oLUaovz9XJAXmlZEIcZFVyw0RSVkXHTasbrm5H 21BRoS0lQY+zPT6i4s/cS85vxpPo551O5STH1dkbRJDnt+/GYYQm5Ehhx3nhbuB8zA0o dCqQ== X-Gm-Message-State: AOAM532R3ecYIyFaVzZpS1MCzpm6P8fPvrT3Bcnv4WQoZEq8NqlSIBmy AvoPja771h/MFvnVmQmp7nM6DA== X-Google-Smtp-Source: ABdhPJyiQ1Dq5u49OR3fXAfm+2eccv3ffMdE+z4V+DWcE7R4TT5inmbnDGnEzFjPHHMnRccPE95hkw== X-Received: by 2002:a17:90a:a107:: with SMTP id s7mr11289459pjp.1.1624480787198; Wed, 23 Jun 2021 13:39:47 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id y15sm408790pjy.38.2021.06.23.13.39.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 23 Jun 2021 13:39:45 -0700 (PDT) From: Kees Cook To: Greg Kroah-Hartman Cc: Kees Cook , stable@vger.kernel.org, Guillaume Tucker , David Laight , Arnd Bergmann , linux-kernel@vger.kernel.org, kernelci@groups.io, linux-kselftest@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 2/9] selftests/lkdtm: Fix expected text for CR4 pinning Date: Wed, 23 Jun 2021 13:39:29 -0700 Message-Id: <20210623203936.3151093-3-keescook@chromium.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210623203936.3151093-1-keescook@chromium.org> References: <20210623203936.3151093-1-keescook@chromium.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=856; h=from:subject; bh=BtO+LH6joKjiA1jPQ0OLj8i4wDaw/FKwTM5xGU6TBl4=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBg05wFD1/rNKnVPI48nDGJ/4Gf4RKsbn3ohaIJBJ1z W+hDT3uJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCYNOcBQAKCRCJcvTf3G3AJgPRD/ 9554BXu8baUchD9pqZuBakcbDtoPvR4mAfpwlKhZmDIAG1GjldVg2qs85A5/51LQ1mPCqv8HQUw/5y JucMju9+zN9hyC0j4+K+mz7kiWWsbTgpvRshpU9z89xohKpQO4RgwEhcJ80nVl+g6G7xtTBM9sZjDr ZsXxJE2vxcrsPc/Jk/ucVWI36iZw/JOrEwliKBaaoVEybyEbNPM9RoOGYTOaBJFPhencB0xSczI1YK ZoykQ09IfaXPfJG1cbYhdwyAU4Yo+oLY3VaWi47ELXLhwp9H4HbI0XpZBqNRlbK0Qd/YFnW614FjI/ f+piK+8e7mlAet+zuWdo9LrPQ84Q6toQSV2Y7YsksdVBY6ZVOfatpEDU3W4eKObM0234oE10xnAzJL nPeO610vI0wZ/OhmzHfwb/ybuomHS+e8L6MH0dYsOTU+5ON6bt8TgnX4clULypm89ihL9BrSEypG5c K+QqcbauDvH3EaLB0tP891W0aQ2f5He2M9QpqlvjIQiPWFHAHRmN5nHQTkWTxrY6sqW11nZll/OS1V +cHUbHbJWW5oiXsToLDOt9JBGoCUyqlqqde6vUoGyZZMU7kB1Cm98asIvoVCgcTFGXFaf3y48e4PrX MjdV0E8cknxC9Dr8pewPuwrhjptu/C8x3lPZeduzmOqHLbqxmVuUGORZ9rIA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org The error text for CR4 pinning changed. Update the test to match. Fixes: a13b9d0b9721 ("x86/cpu: Use pinning mask for CR4 bits needing to be 0") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook --- tools/testing/selftests/lkdtm/tests.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/lkdtm/tests.txt b/tools/testing/selftests/lkdtm/tests.txt index 11ef159be0fd..a5fce7fd4520 100644 --- a/tools/testing/selftests/lkdtm/tests.txt +++ b/tools/testing/selftests/lkdtm/tests.txt @@ -11,7 +11,7 @@ CORRUPT_LIST_ADD list_add corruption CORRUPT_LIST_DEL list_del corruption STACK_GUARD_PAGE_LEADING STACK_GUARD_PAGE_TRAILING -UNSET_SMEP CR4 bits went missing +UNSET_SMEP pinned CR4 bits changed: DOUBLE_FAULT CORRUPT_PAC UNALIGNED_LOAD_STORE_WRITE From patchwork Wed Jun 23 20:39:30 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12340483 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 35BEFC48BC2 for ; Wed, 23 Jun 2021 20:39:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1B9B8610C7 for ; Wed, 23 Jun 2021 20:39:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229881AbhFWUmF (ORCPT ); Wed, 23 Jun 2021 16:42:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58484 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229523AbhFWUmE (ORCPT ); Wed, 23 Jun 2021 16:42:04 -0400 Received: from mail-pg1-x535.google.com (mail-pg1-x535.google.com [IPv6:2607:f8b0:4864:20::535]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0CC7AC06175F for ; Wed, 23 Jun 2021 13:39:47 -0700 (PDT) Received: by mail-pg1-x535.google.com with SMTP id u190so2777884pgd.8 for ; Wed, 23 Jun 2021 13:39:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=h2E/emdsJT4/hSnBDyJfRLo21OxhdAolWugWFwmcmlQ=; b=W3ln4OJoSgh2tDYaZAkeBL1277kPHbjLgQzh5jp2lHmXWXDid6pL7ifbY/8JMhqBnS E7ljjEw7rDNL3pcvx7ES8rXIbycmwc5DlSBciCnxaHzzXxCJZJrIjzcmCdgTP3ZMG3h1 SvFAVic/oKTuJMlBmdCueWnPCoQBZ/kqG3otE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=h2E/emdsJT4/hSnBDyJfRLo21OxhdAolWugWFwmcmlQ=; b=Obzo3jRPyHw2GOi32QPKiYKv5QFK6L08DnrHGjd7JNs6CTAVPyKqUxC0bp8nGdAkQC vNYQY0uL9O9McbA66EfMZXWbcFHBe/vveHyhcHtN0Ne+oTfi0p04PN5rGxq5pgt/lceF ZlxuL8P1/eFkkQOBdCZl4H/V3vHx6SuieSWRYE9lMQxDrkMjll+8L0Yr9dlTTz3dJJLp OTnI2jWp6PgI8slmwnv0n+tfwc42SwBNgizY0fu3YTNHfe+dvalmhGU5e3g7dG/DoSA7 pLc4XTZ5J2AGMI+c+AtKCCE//nJGhMlz7Xb8nKbkCBMga63ptllIik7bsNipUuE+yysk xNzQ== X-Gm-Message-State: AOAM533PskxwgALm7Wj/YOgDTxspj5YQjT8DGtoUgxKfoyEoc8ivnXBq JAUnMUb2x0uCZ3dZ9ZNpBfBu2Q== X-Google-Smtp-Source: ABdhPJzu//ZPWLX4RFym3EWsld5xfBoKsgNiAcSmpIzhn3Zc80aAcR0fpGEdYQmR0b32cLTxprQFRw== X-Received: by 2002:a63:d003:: with SMTP id z3mr1232630pgf.210.1624480786581; Wed, 23 Jun 2021 13:39:46 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id c5sm5961432pjq.38.2021.06.23.13.39.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 23 Jun 2021 13:39:45 -0700 (PDT) From: Kees Cook To: Greg Kroah-Hartman Cc: Kees Cook , Guillaume Tucker , David Laight , Arnd Bergmann , linux-kernel@vger.kernel.org, kernelci@groups.io, linux-kselftest@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 3/9] selftests/lkdtm: Fix expected text for free poison Date: Wed, 23 Jun 2021 13:39:30 -0700 Message-Id: <20210623203936.3151093-4-keescook@chromium.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210623203936.3151093-1-keescook@chromium.org> References: <20210623203936.3151093-1-keescook@chromium.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=948; h=from:subject; bh=7Z6rDIdXc6OEiqueR+KR4HSl76Pq0nn3txazVEELU2Y=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBg05wG3Bu0QsJe7x2Dvq5gEv1AswiiPcQny5ntqUEu USMIUZuJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCYNOcBgAKCRCJcvTf3G3AJsYqEA C06Fjzuf/YFUDtqs9XGLBFg8ytEwa9LuoVTEzEvqPRHMjLXpPtx0U+WDGizzYfKlE9cFl1/pMdd05j Wqbj0N7UjHFWwa0qWFNGrMl0TnxkVFLZfK0ATu8aHMg6WAaZeSIBkijJHxpo5Oucnw5eDyiMn+eaGC Ht8s39AluGZ9uMqV0Ra2HIUaMimP7PnwM71FZXQ0OT+HxNtj4uL3gQuImuMfFRr5eaUsFDRVMHbsDL SOQXpMm34N/lycRcZvd8dRinj3+tA+TMBrv9pydRg6n3Qgm/FBD0Te8TnASKtt2RedQpsuj72Ho+Fe 4Lxv2yQ7inHYJbkrl9GAYOEDY1W7zQOj6yYUgutI6/919Zt3bs0Ml6CYaGCAtuu3evX9uhSdvR1ZPt NvglZf1dMNUGJZ3qeib24mKTek1QAcTJzvswlV+JxLBaCxAFtvMelCA7re6G/OO/84EEg4yKGtJxEp VmAjYgmqw3ZJbfB9PBCNgi89vQuhA85JuyGLqta9lTeu1U76SWF2IdUCctfcGnAAlcVtMBGLwiYPN5 Ajj52D8lA1Mcl9Wa0N98/YLkIynMA9A5evXOM/0x1WQ8C2gnVipNq6pk4+u1OvkX2Kf7XOzp4+lVqO Ap6O16W38xSAf6o1xen1nRrRpc1Um5d/6PNVEObh//+D2Moh51HKm+vbrBCg== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org Freed memory poisoning can be tested a few ways, so update the expected text to reflect the non-Oopsing alternative. Signed-off-by: Kees Cook --- tools/testing/selftests/lkdtm/tests.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/lkdtm/tests.txt b/tools/testing/selftests/lkdtm/tests.txt index a5fce7fd4520..a94d4d8eeb5c 100644 --- a/tools/testing/selftests/lkdtm/tests.txt +++ b/tools/testing/selftests/lkdtm/tests.txt @@ -17,9 +17,9 @@ CORRUPT_PAC UNALIGNED_LOAD_STORE_WRITE #OVERWRITE_ALLOCATION Corrupts memory on failure #WRITE_AFTER_FREE Corrupts memory on failure -READ_AFTER_FREE +READ_AFTER_FREE call trace:|Memory correctly poisoned #WRITE_BUDDY_AFTER_FREE Corrupts memory on failure -READ_BUDDY_AFTER_FREE +READ_BUDDY_AFTER_FREE call trace:|Memory correctly poisoned SLAB_FREE_DOUBLE SLAB_FREE_CROSS SLAB_FREE_PAGE From patchwork Wed Jun 23 20:39:31 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12340491 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7EE7FC49EB9 for ; Wed, 23 Jun 2021 20:39:54 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6CB62610C7 for ; Wed, 23 Jun 2021 20:39:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230015AbhFWUmL (ORCPT ); Wed, 23 Jun 2021 16:42:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58508 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229945AbhFWUmG (ORCPT ); Wed, 23 Jun 2021 16:42:06 -0400 Received: from mail-pj1-x102c.google.com (mail-pj1-x102c.google.com [IPv6:2607:f8b0:4864:20::102c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EAB1EC0617A8 for ; Wed, 23 Jun 2021 13:39:48 -0700 (PDT) Received: by mail-pj1-x102c.google.com with SMTP id k5so2187588pjj.1 for ; Wed, 23 Jun 2021 13:39:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=weOFYHnAt9XHzyijtFN46zZa/bge4PQn7pFxvS+uscM=; b=PINKBfWpr3gvTyJ0eFnAv65n6MifZbR/apDoNhNeYQq+pb7Y+nHfI6/29jpyhKRsrA kSmtPGNKM36+xWmlgXqHNtUo2kVWovxkLqFL92N+B8M0nbpRfCD32Nat5OMJ3EJp3QwV KrPvrHdngyt40imWa1hgx+IPHVy1nFGR4oZAI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=weOFYHnAt9XHzyijtFN46zZa/bge4PQn7pFxvS+uscM=; b=FMDvhpVD3pJZk1sZqRnlZ8yXtXt+kyCqCyKJx7MbQP1GRv+CGHXeofR/sE+DRBIIbc IZcNhDIJhLxctxWT9nZWThcNNZIChs6uY/qWjtEzuIhzLfTwO3hgfObvkKvgFWYPgAF5 aHyBBgPdYKXJi5pXj5RqXec0+WD1onDnjbzlnbKSna2yawxnSGKpoT3E8wb/6DY8oCqh HpLEYiiXyOAFe3I2OMRcXdnhi1ZKZFGt8QZLelwU/C1/NHqx3lVskEeXG41xtnEbzxuE Nc0sU9sCu5sdWrPV/OAQ8YzyXXCZvoWmZWVyfyO6RnEt+WYwns5HzpWgp3mh2M2+HAVh CysA== X-Gm-Message-State: AOAM531N6cEfnPZCHNcU3g4/eq28MqWB7aExbYu+xYgeUw22FZVJafhr aV3uO260oPr9b+wWaFvUs+TimA== X-Google-Smtp-Source: ABdhPJx1ypcWLUnUHJBbnBIjhX9m3ZNAxwtdnMUAu2WOpDwAvnSgoGuRx7tr0mmBARqaMdXFPQlhRQ== X-Received: by 2002:a17:902:c789:b029:110:4933:71ce with SMTP id w9-20020a170902c789b0290110493371cemr1194211pla.56.1624480788561; Wed, 23 Jun 2021 13:39:48 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id f5sm640523pfe.79.2021.06.23.13.39.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 23 Jun 2021 13:39:45 -0700 (PDT) From: Kees Cook To: Greg Kroah-Hartman Cc: Kees Cook , stable@vger.kernel.org, Guillaume Tucker , David Laight , Arnd Bergmann , linux-kernel@vger.kernel.org, kernelci@groups.io, linux-kselftest@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 4/9] lkdtm/bugs: XFAIL UNALIGNED_LOAD_STORE_WRITE Date: Wed, 23 Jun 2021 13:39:31 -0700 Message-Id: <20210623203936.3151093-5-keescook@chromium.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210623203936.3151093-1-keescook@chromium.org> References: <20210623203936.3151093-1-keescook@chromium.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=821; h=from:subject; bh=Ug1zxBYqfqGVjk6HZPE+S2IQ++k8iErOOapO5olSeEg=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBg05wGnJvmDSLi1MPOx05nkNSD/27SmvDUPYKaSZ+b ABK1bYKJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCYNOcBgAKCRCJcvTf3G3AJhiJEA Ciux3+IGOay7Jw49WbIkgIv0TxSZgcO90q+vD3qxYri5Kve5Gl362F2aW0FCOlOtxfzOnGmC53o+vL mnCazUpoqn0dW/Y15W4dfOo+HoN5/Afr2nMEj2cwPYh7e2v3kQ2/JK4gaqP9mMDegUGCvWynQbQq54 md3YCttGo14SuaAMF9Wgo60xgxde5gIvQadm2WfvXU0BLyeZBBQb/iHJb8A06PBRzIBP06Nu+NmVVS 4gjNsMrbg6ltVcNDZ67UJ4sjzuFEP2hO+bd3d6/D/d7os59xJd11AHlpBYfk1gCBMC4wl/ZHgbOsaY ew49zKobbo1qt1K8F7Yct3U3IZZ9e2Ny/XCdM/rQMR0KlGYK/LXREO8mEubV2DBQzQidihoy2cFwBk 5gEjXn+w2QmsY5GXkuCXxsRXVw90q9IyT0Qt6kyJ44vqmTKpUFpcarqthBP1/2nXx243B73YaVCB12 6nd+koQb1m5NQNvzwZ8i/jObt5py/ucSDlpCVQ/PCl3NUt9sRB0S8MRNKXxgEJuNMGGs/BUSoYK5AE 51LAiLpudvJPuDuLgHUfzx1Ig+tAVem+P/7WoryLM/rDXtXqsXoyyHzBPcZGczV6nPm7xCwdkviySP adfzxjhgaQrqToXPyTkus9c6NYZDhVyUcK6oihTYUAjfRzEQc+F7f3grbaNA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org When built under CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS, this test is expected to fail (i.e. not trip an exception). Fixes: 46d1a0f03d66 ("selftests/lkdtm: Add tests for LKDTM targets") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook --- drivers/misc/lkdtm/bugs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/misc/lkdtm/bugs.c b/drivers/misc/lkdtm/bugs.c index 0e8254d0cf0b..9ff02bdf3153 100644 --- a/drivers/misc/lkdtm/bugs.c +++ b/drivers/misc/lkdtm/bugs.c @@ -161,6 +161,9 @@ void lkdtm_UNALIGNED_LOAD_STORE_WRITE(void) if (*p == 0) val = 0x87654321; *p = val; + + if (IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)) + pr_err("XFAIL: arch has CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS\n"); } void lkdtm_SOFTLOCKUP(void) From patchwork Wed Jun 23 20:39:32 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12340493 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DCEF1C49EBE for ; Wed, 23 Jun 2021 20:39:54 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C8A36611CB for ; Wed, 23 Jun 2021 20:39:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230018AbhFWUmL (ORCPT ); Wed, 23 Jun 2021 16:42:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58498 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229959AbhFWUmI (ORCPT ); Wed, 23 Jun 2021 16:42:08 -0400 Received: from mail-pl1-x62e.google.com (mail-pl1-x62e.google.com [IPv6:2607:f8b0:4864:20::62e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 029E3C061756 for ; Wed, 23 Jun 2021 13:39:50 -0700 (PDT) Received: by mail-pl1-x62e.google.com with SMTP id x22so1773717pll.11 for ; Wed, 23 Jun 2021 13:39:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=0p8CmnZcgKw/qBa8l8GhA+tejn8NuFe/v2fTm6mOatA=; b=Ld3dnJzwkASwHNh4UKy0njC4K70Un+Vi4APlJKV9Ef4wyL5/mXObvHYjnduK0s6Egv MU6ECnaLnS4pmrWXHHwgJToYaUO6tvRZ4YGFh/RxWzDuYdMnUJXGd9Nc0ojr+i1wBlzP JVnpzNrGp/VRIDPsXF/RozbZtmHDrih6eJM7c= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=0p8CmnZcgKw/qBa8l8GhA+tejn8NuFe/v2fTm6mOatA=; b=Nyp2W72JKEJhyqLHBaa1DjqKKEob6DYaisL/DpFVcERy+4L7wyKD0zKWcWxn3giXOE VPnRGRD1+2gNAfU65S5L95eY3WmimTlg/teFxeWpqHn6HH2DkPDiSFRlLIsPE3W2R45R xOAOWmTwujYxRfp/OJzgDz/xFwOyNpW3L1u3aKwzBiHjDETZg4yHh5S/E4tK1nR/yP7g w3kUZVGaxQR6svO7wS90uMV1YaU9+C3/5bXRVzPKws/O8U+YVSHLRgjM/Mg5QRDxA5Fr 4u+XBeaFJrT/RX+ArPUK4Fvy3VCE/6GoYBNBQxZT0FpaOVp8DjQgdux1R9s/JMlGjGHQ 2TLw== X-Gm-Message-State: AOAM5313n7Wv32wxS17RFJZJEeTrgE3M38udgNhjTHiOF5nYyRwkIOHy LRMGgJ4TcL3qARFFLxYzjNqCHg== X-Google-Smtp-Source: ABdhPJxcfSfVu4fr32AHcmeClwNpA5RxHuzicdKsJP3tTotu8VXHv7dVDw+LSPdUfX+/Zjmz54f+IQ== X-Received: by 2002:a17:902:7085:b029:114:557b:fb02 with SMTP id z5-20020a1709027085b0290114557bfb02mr1439590plk.14.1624480789570; Wed, 23 Jun 2021 13:39:49 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id i20sm645692pfo.130.2021.06.23.13.39.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 23 Jun 2021 13:39:48 -0700 (PDT) From: Kees Cook To: Greg Kroah-Hartman Cc: Kees Cook , Guillaume Tucker , David Laight , Arnd Bergmann , linux-kernel@vger.kernel.org, kernelci@groups.io, linux-kselftest@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 5/9] lkdtm/heap: Add vmalloc linear overflow test Date: Wed, 23 Jun 2021 13:39:32 -0700 Message-Id: <20210623203936.3151093-6-keescook@chromium.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210623203936.3151093-1-keescook@chromium.org> References: <20210623203936.3151093-1-keescook@chromium.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3649; h=from:subject; bh=Rd9dxqPVzEvJaUgYUyjZ9N+UCrmg2sAZSjOVx9WFfeg=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBg05wGLxAIiNFpzMFbSLa96E0IxGPiEeMhCRuhHLfE 7MTJscuJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCYNOcBgAKCRCJcvTf3G3AJpjzEA CQpQ8ui/SBVcA03P4O9zpsIH93GSrqIDygQ2ZdNF2uvopvd2m/960BakuUrGt9s+CgA8PzK/bVpjJj 8/N/aiRbNNJ8WtCiBGZtxlS6ggQvwQADzJQIboI54ao0vx3BDCPKvsqCITxQkQ9Nq+idc3wluV+JYm ryJfFCk9Du1pTdhaDnMW32qZ+c42HHMLnRd1idMuo7mRPUEq8pKXgR2buRdCxsTTTg0JCOzhrg2INj ShjU7AQGcPQVF7LdtTtazqsEZaiqp8vVnC3Pm8Btm9dKH41YepYpk2hZKb5FtSmoYlKPezQw2SE2cA WbtOH65Y7mIt/5jZhr8+OG5P78UkcyYbNHylLLw26KrJGwZTpLlRDJZzDHy/avAFRS4dZ2ijT9c8dz meYXxpYkspBvYmvl2VTdv3fTCVIqsGCJ7vQQp9Z4rVuSvKwyetLypmbq1W8OnK9yV+sEiwmO+jukQK gxeo5HtSBhonxtUq8CASocXmX6Ro9OOsrSkEpsvioNTvVACZ4E99nzZ530SNOgCZ+lhRTxzARiKrVn HaNttRn6OJA5A0iSDjbHM7SdwNJwC7ZBRJ3+B4BFkHO9XrlPc4H/D3KBbbvwFBq0wBwx0RzXMf4QzM FwamnUQkFiKFpjl9mGXnCs9tbCP02PisTRkWBAIU+LWSWCcpYq/s/gJ2F5aQ== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org Similar to the existing slab overflow and stack exhaustion tests, add VMALLOC_LINEAR_OVERFLOW (and rename the slab test SLAB_LINEAR_OVERFLOW). Additionally unmarks the test as destructive. (It should be safe in the face of misbehavior.) Signed-off-by: Kees Cook --- drivers/misc/lkdtm/core.c | 3 ++- drivers/misc/lkdtm/heap.c | 22 +++++++++++++++++++++- drivers/misc/lkdtm/lkdtm.h | 3 ++- tools/testing/selftests/lkdtm/tests.txt | 3 ++- 4 files changed, 27 insertions(+), 4 deletions(-) diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c index 8024b6a5cc7f..645b31e98c77 100644 --- a/drivers/misc/lkdtm/core.c +++ b/drivers/misc/lkdtm/core.c @@ -120,7 +120,8 @@ static const struct crashtype crashtypes[] = { CRASHTYPE(UNALIGNED_LOAD_STORE_WRITE), CRASHTYPE(FORTIFY_OBJECT), CRASHTYPE(FORTIFY_SUBOBJECT), - CRASHTYPE(OVERWRITE_ALLOCATION), + CRASHTYPE(SLAB_LINEAR_OVERFLOW), + CRASHTYPE(VMALLOC_LINEAR_OVERFLOW), CRASHTYPE(WRITE_AFTER_FREE), CRASHTYPE(READ_AFTER_FREE), CRASHTYPE(WRITE_BUDDY_AFTER_FREE), diff --git a/drivers/misc/lkdtm/heap.c b/drivers/misc/lkdtm/heap.c index 1323bc16f113..36be5e353cd0 100644 --- a/drivers/misc/lkdtm/heap.c +++ b/drivers/misc/lkdtm/heap.c @@ -5,24 +5,44 @@ */ #include "lkdtm.h" #include +#include #include static struct kmem_cache *double_free_cache; static struct kmem_cache *a_cache; static struct kmem_cache *b_cache; +/* + * If there aren't guard pages, it's likely that a consecutive allocation will + * let us overflow into the second allocation without overwriting something real. + */ +void lkdtm_VMALLOC_LINEAR_OVERFLOW(void) +{ + char *one, *two; + + one = vzalloc(PAGE_SIZE); + two = vzalloc(PAGE_SIZE); + + pr_info("Attempting vmalloc linear overflow ...\n"); + memset(one, 0xAA, PAGE_SIZE + 1); + + vfree(two); + vfree(one); +} + /* * This tries to stay within the next largest power-of-2 kmalloc cache * to avoid actually overwriting anything important if it's not detected * correctly. */ -void lkdtm_OVERWRITE_ALLOCATION(void) +void lkdtm_SLAB_LINEAR_OVERFLOW(void) { size_t len = 1020; u32 *data = kmalloc(len, GFP_KERNEL); if (!data) return; + pr_info("Attempting slab linear overflow ...\n"); data[1024 / sizeof(u32)] = 0x12345678; kfree(data); } diff --git a/drivers/misc/lkdtm/lkdtm.h b/drivers/misc/lkdtm/lkdtm.h index 99f90d3e5e9c..c6baf4f1e1db 100644 --- a/drivers/misc/lkdtm/lkdtm.h +++ b/drivers/misc/lkdtm/lkdtm.h @@ -39,7 +39,8 @@ void lkdtm_FORTIFY_SUBOBJECT(void); /* heap.c */ void __init lkdtm_heap_init(void); void __exit lkdtm_heap_exit(void); -void lkdtm_OVERWRITE_ALLOCATION(void); +void lkdtm_VMALLOC_LINEAR_OVERFLOW(void); +void lkdtm_SLAB_LINEAR_OVERFLOW(void); void lkdtm_WRITE_AFTER_FREE(void); void lkdtm_READ_AFTER_FREE(void); void lkdtm_WRITE_BUDDY_AFTER_FREE(void); diff --git a/tools/testing/selftests/lkdtm/tests.txt b/tools/testing/selftests/lkdtm/tests.txt index a94d4d8eeb5c..30080cc15623 100644 --- a/tools/testing/selftests/lkdtm/tests.txt +++ b/tools/testing/selftests/lkdtm/tests.txt @@ -15,7 +15,8 @@ UNSET_SMEP pinned CR4 bits changed: DOUBLE_FAULT CORRUPT_PAC UNALIGNED_LOAD_STORE_WRITE -#OVERWRITE_ALLOCATION Corrupts memory on failure +SLAB_LINEAR_OVERFLOW +VMALLOC_LINEAR_OVERFLOW #WRITE_AFTER_FREE Corrupts memory on failure READ_AFTER_FREE call trace:|Memory correctly poisoned #WRITE_BUDDY_AFTER_FREE Corrupts memory on failure From patchwork Wed Jun 23 20:39:33 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12340495 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E579EC48BC2 for ; Wed, 23 Jun 2021 20:39:55 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C92A4611AD for ; Wed, 23 Jun 2021 20:39:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229959AbhFWUmM (ORCPT ); Wed, 23 Jun 2021 16:42:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58492 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229994AbhFWUmJ (ORCPT ); Wed, 23 Jun 2021 16:42:09 -0400 Received: from mail-pl1-x630.google.com (mail-pl1-x630.google.com [IPv6:2607:f8b0:4864:20::630]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 943E3C0613A4 for ; Wed, 23 Jun 2021 13:39:50 -0700 (PDT) Received: by mail-pl1-x630.google.com with SMTP id d1so1144773plg.6 for ; Wed, 23 Jun 2021 13:39:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=u4Wq1GvZOIjkJl+9Sb3C5gljEm3KHr7dyOq9Nh1kENs=; b=XFDgiA11BlqOZ/s5qZFq8MJlNVnoxfK5CVNFc1wQ+SamMB7fnUnMUUgxxrmEowQujn tChT4z4jt7Dod0HMLYvUcQ5smxaJewfSB0bx0ip0qzErWVrXCz873TRrhXNwq1WgYPh2 J+XbSmnSUcAJVg4aI04DD6Q+X3GDjnShhd/c0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=u4Wq1GvZOIjkJl+9Sb3C5gljEm3KHr7dyOq9Nh1kENs=; b=NqAH2PnehEge+qgAxvdbSm4NfsALm/FOwNRBolBH2bDPyQfjRnGKsKGMugXOTX4UC3 F1qw8ioRLm+P37d++4QihBPIWH0qmYDZUhdJrsI1WP3STRIYDt53U5vxeLFg+n+ogQvL A03p9d3FQkhiSgxCkuZdEiHRDdEeAuRpo7qCy38NXJxoCNiA9EVXgTya1w8S6PW3J+Cd ns6qNz7+AKPjnBHaQdAvxvPzMDeZl34hmOzdtCmC4cqy7Y2e4dCt30rXvoDikqCWzX7B GUsk30XCwRuiOa52vQVuEGpKLLmb059phW1+0Fir56CevX5I7QbTwSJJicDRhYWtLFQJ NGDg== X-Gm-Message-State: AOAM532j8ubMa8iuvaGi2Z/4es87x5AvEBFkLpQof6U9IRTjzA6cT4vQ o2rww6i6zBhf6J1gEH2lrrrdnw== X-Google-Smtp-Source: ABdhPJwaRWpJV0oWeW72e7h8k40qI2L5xwkI1YI4az/SGTiOAfGJgoe0c1chphXJsHy1G3dgvqSphQ== X-Received: by 2002:a17:90b:33c6:: with SMTP id lk6mr11521139pjb.6.1624480790156; Wed, 23 Jun 2021 13:39:50 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id y39sm644828pfa.119.2021.06.23.13.39.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 23 Jun 2021 13:39:48 -0700 (PDT) From: Kees Cook To: Greg Kroah-Hartman Cc: Kees Cook , stable@vger.kernel.org, Guillaume Tucker , David Laight , Arnd Bergmann , linux-kernel@vger.kernel.org, kernelci@groups.io, linux-kselftest@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 6/9] lkdtm: Enable DOUBLE_FAULT on all architectures Date: Wed, 23 Jun 2021 13:39:33 -0700 Message-Id: <20210623203936.3151093-7-keescook@chromium.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210623203936.3151093-1-keescook@chromium.org> References: <20210623203936.3151093-1-keescook@chromium.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=910; h=from:subject; bh=QfRkdXxwpbuwCkU2UJjVNaH2YmtWo4KLL9a8FrnsAOg=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBg05wGyZpmYK4bGS71//ZU4B8K/PYzebIRU4wL+IO5 4o7WiviJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCYNOcBgAKCRCJcvTf3G3AJirXD/ 9ZdemyXHPgslPcJgT1bRYzqMUwNSL97PXErHRLjYgDkmORiRviHSACWq7BdCf9JHLl+jBeflXOPLZQ AbximpuX/FoB9FKsrHW7PAqWDi25hrM8UFNh/Qru8hNicn5W1byfOBVo36lG7+/+4QKrrpMorYPEsA om3e7YlG5GsVrovAHUHMNWJ5WMcPZAvZJb0D7ESVcVjxhzmYoqccFGJIJpbNQU+MnoaLTs9Iu3PRuV 3q3nzAZIENHOUMQTihH7jEog+oudsw6O4yKRlYsP1+dKYm8HI2+1PBjkUcEx4gmBuvcCOfyaYseu0j 1bdozFFNR+T/Ji8v5ry2S6p/fsoMQTItw57w7xCT/tqZHcpMgddcxy+/QcdE5VnE0oW4Zc3ySiZWZB xfyGeUzLdRHPzcKdIYqflNCMw1VQSUoQNoV/Z6ImPROiSRYk+w0173YAlUNgSjTsP2CV96lhqelPSi RtjbNSRaB0FmDCi5+P0jaXa3lKOxnR4XAOyunOMRds0qwSeGiPWU+a8MWj1dWlDzZWoAgiqHO32CQK 62fMew6TMBnOwvUSFXRq7J8zdEMNoiTO+jF+UhnChwpGrid6O+oLnFe/cjuzWYp5rICy/d03T4yBKD mSq+hoWr7vvnEQpgPh92VHycKploZOSBWMAcAaolOJlskbK4P3hc9IVdTRog== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org Where feasible, I prefer to have all tests visible on all architectures, but to have them wired to XFAIL. DOUBLE_FAIL was set up to XFAIL, but wasn't actually being added to the test list. Fixes: cea23efb4de2 ("lkdtm/bugs: Make double-fault test always available") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook --- drivers/misc/lkdtm/core.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c index 645b31e98c77..2c89fc18669f 100644 --- a/drivers/misc/lkdtm/core.c +++ b/drivers/misc/lkdtm/core.c @@ -178,9 +178,7 @@ static const struct crashtype crashtypes[] = { CRASHTYPE(STACKLEAK_ERASING), CRASHTYPE(CFI_FORWARD_PROTO), CRASHTYPE(FORTIFIED_STRSCPY), -#ifdef CONFIG_X86_32 CRASHTYPE(DOUBLE_FAULT), -#endif #ifdef CONFIG_PPC_BOOK3S_64 CRASHTYPE(PPC_SLB_MULTIHIT), #endif From patchwork Wed Jun 23 20:39:34 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12340501 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7CB1AC49ECB for ; Wed, 23 Jun 2021 20:39:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 64D1F611AD for ; Wed, 23 Jun 2021 20:39:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230046AbhFWUmO (ORCPT ); Wed, 23 Jun 2021 16:42:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58506 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229818AbhFWUmL (ORCPT ); Wed, 23 Jun 2021 16:42:11 -0400 Received: from mail-pg1-x531.google.com (mail-pg1-x531.google.com [IPv6:2607:f8b0:4864:20::531]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F37D2C06124A for ; Wed, 23 Jun 2021 13:39:51 -0700 (PDT) Received: by mail-pg1-x531.google.com with SMTP id a2so2776063pgi.6 for ; Wed, 23 Jun 2021 13:39:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=YB1QMw2s0p49cREGQrJQXXCv+ldkY+DRAMCGguZikW8=; b=QCgdBpKERk/oxmDtJWmPRe5iXuRywxoCtBOMMPl2fsOfN2lt0gypHfssBeJUjeIpAe r/6BlPJsRYWkp4Rp9nsmY2QWIgJKIczzkRvvZsOXjfTZtDNhPW5GlQJWTg/sb+ctk/2H C7QryRFfUdzV5I0Vk35+Hh3BDZdHAJi7oOUPw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=YB1QMw2s0p49cREGQrJQXXCv+ldkY+DRAMCGguZikW8=; b=dXXzxlkupzk2gV6QYTCKpifnziR59dR4FmqLLt83BBrEeQvsPL+uTC0n28VIZEBPAN XHYmgwoP9OMe14lKjlpum1JkJUYetq1uJNlmsCxvHGcqeqTng4l/WdHC1ekzEJC4F/cu 4VHlffxqQAff0vKhEXihc9DHoNU3GW5fISM3H+nPrZnFGyINbYOqcUr8syqCI9Me4upy pd86nNMFMLGwhFOuxU41lX7Caq8cAl9/HzPl4DS8U85UtGuXdLonL77qKV1ZFUKZP36z Ej5ylXk32kkRZ5KXtglS8o/PfRMiQ9TwM6joLLTKQqzQY3q3O5MBKxX/Cnixtkrpq9Iz UruA== X-Gm-Message-State: AOAM532PbuAy4stM5kpudl+m6yf/QdRWmiQZM2LpW8g/hBE1W9za/28S PV91gCr0oKGWvDonXUWJNHOQxA== X-Google-Smtp-Source: ABdhPJwQ5a7FgN9vtmDlBSFnMdebSU0VYgGX5dWwgCwReRBkdFbBsjqF5eY9+7pn3qqXus6bKdnW1g== X-Received: by 2002:a62:30c2:0:b029:289:116c:ec81 with SMTP id w185-20020a6230c20000b0290289116cec81mr1524946pfw.42.1624480791508; Wed, 23 Jun 2021 13:39:51 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id gg5sm5947796pjb.0.2021.06.23.13.39.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 23 Jun 2021 13:39:48 -0700 (PDT) From: Kees Cook To: Greg Kroah-Hartman Cc: Kees Cook , Guillaume Tucker , David Laight , Arnd Bergmann , linux-kernel@vger.kernel.org, kernelci@groups.io, linux-kselftest@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 7/9] lkdtm: Add CONFIG hints in errors where possible Date: Wed, 23 Jun 2021 13:39:34 -0700 Message-Id: <20210623203936.3151093-8-keescook@chromium.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210623203936.3151093-1-keescook@chromium.org> References: <20210623203936.3151093-1-keescook@chromium.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=9367; h=from:subject; bh=q2QNqMgAexEB6nQ3zg2sqZfAvavargjahO0eYPmdvCw=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBg05wG4oZYfg5oXBkAUiS7zKMgQP0ZzqhhfgjrSHrn bVv2xfaJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCYNOcBgAKCRCJcvTf3G3AJpkcD/ 9inpuVoFbo5B22k8y5L+UmtkzhAKDvVa0DgKjpKc0nxrjALIK/Zfddd/jsIMweIcrX/vni4XQZhOib 3siKclmnhR0VeUwQIXmV+zOo1xI4Rt5gm4lEcXBV1cqLV0cixKxyyFyPHN/n969TaJlIgPuPk90xXK RRVgRqEM5DKfZr/i98JuDXgB/eJdOk8oa257YETFU5d6eRA77E6xtOGXOtPJZTotf2Vc8wPjm0siMe taqX07HGuCJkUVh3nSLv+RQjbh9OC3bfFuYyrCACy69N/H1YIbfxfPbV48HTEWXRRbfw6e63gOtsn6 jqN6CjSwKk5fs86PcHAysomqkHVzUOumehxWv4aQB4/TSqMi5of5dVPG5NegjoFbCenekNRbfqyuhH 1J8M7wRS/RMadn9L9YliuFnMgncmKP6aiQGL5JdAw9dmCc51T9GNPCTc77FiBp77+xRwCjSdTxxIx0 sEvvAPVp+y+TRodhHSPqhK+/91guFdwrEAULZkR8TEqACapiUP/SlLU5tN9xboFET5xH9jJ1UCYYXc EqaJ3ZbYZWxMYDYR+TL0ka/ht80b54Lf+fZgnlk8yrRNE80VZHHOdibH9RuhP7n7yDnVZve9wxAkcO ASeXLns8bnbwIgqiIiRdqTOBAv2lF6Vw1P7saIHer9yuCp54SIFd55CSxuFQ== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org For various failure conditions, try to include some details about where to look for reasons about the failure. Signed-off-by: Kees Cook --- drivers/misc/lkdtm/bugs.c | 8 ++- drivers/misc/lkdtm/cfi.c | 3 +- drivers/misc/lkdtm/core.c | 51 +++++++++++++++++++ drivers/misc/lkdtm/fortify.c | 3 +- drivers/misc/lkdtm/heap.c | 10 ++-- drivers/misc/lkdtm/lkdtm.h | 41 +++++++++++++++ drivers/misc/lkdtm/stackleak.c | 4 +- drivers/misc/lkdtm/usercopy.c | 7 ++- .../testing/selftests/lkdtm/stack-entropy.sh | 1 + 9 files changed, 117 insertions(+), 11 deletions(-) diff --git a/drivers/misc/lkdtm/bugs.c b/drivers/misc/lkdtm/bugs.c index 9ff02bdf3153..7c7335506c45 100644 --- a/drivers/misc/lkdtm/bugs.c +++ b/drivers/misc/lkdtm/bugs.c @@ -303,8 +303,10 @@ void lkdtm_CORRUPT_LIST_ADD(void) if (target[0] == NULL && target[1] == NULL) pr_err("Overwrite did not happen, but no BUG?!\n"); - else + else { pr_err("list_add() corruption not detected!\n"); + pr_expected_config(CONFIG_DEBUG_LIST); + } } void lkdtm_CORRUPT_LIST_DEL(void) @@ -328,8 +330,10 @@ void lkdtm_CORRUPT_LIST_DEL(void) if (target[0] == NULL && target[1] == NULL) pr_err("Overwrite did not happen, but no BUG?!\n"); - else + else { pr_err("list_del() corruption not detected!\n"); + pr_expected_config(CONFIG_DEBUG_LIST); + } } /* Test that VMAP_STACK is actually allocating with a leading guard page */ diff --git a/drivers/misc/lkdtm/cfi.c b/drivers/misc/lkdtm/cfi.c index e73ebdbfa806..c9aeddef1044 100644 --- a/drivers/misc/lkdtm/cfi.c +++ b/drivers/misc/lkdtm/cfi.c @@ -38,5 +38,6 @@ void lkdtm_CFI_FORWARD_PROTO(void) func = (void *)lkdtm_increment_int; func(&called_count); - pr_info("Fail: survived mismatched prototype function call!\n"); + pr_err("FAIL: survived mismatched prototype function call!\n"); + pr_expected_config(CONFIG_CFI_CLANG); } diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c index 2c89fc18669f..c185ae4719c3 100644 --- a/drivers/misc/lkdtm/core.c +++ b/drivers/misc/lkdtm/core.c @@ -26,6 +26,7 @@ #include #include #include +#include #define DEFAULT_COUNT 10 @@ -398,6 +399,56 @@ static ssize_t direct_entry(struct file *f, const char __user *user_buf, return count; } +#ifndef MODULE +/* + * To avoid needing to export parse_args(), just don't use this code + * when LKDTM is built as a module. + */ +struct check_cmdline_args { + const char *param; + int value; +}; + +static int lkdtm_parse_one(char *param, char *val, + const char *unused, void *arg) +{ + struct check_cmdline_args *args = arg; + + /* short circuit if we already found a value. */ + if (args->value != -ESRCH) + return 0; + if (strncmp(param, args->param, strlen(args->param)) == 0) { + bool bool_result; + int ret; + + ret = kstrtobool(val, &bool_result); + if (ret == 0) + args->value = bool_result; + } + return 0; +} + +int lkdtm_check_bool_cmdline(const char *param) +{ + char *command_line; + struct check_cmdline_args args = { + .param = param, + .value = -ESRCH, + }; + + command_line = kstrdup(saved_command_line, GFP_KERNEL); + if (!command_line) + return -ENOMEM; + + parse_args("Setting sysctl args", command_line, + NULL, 0, -1, -1, &args, lkdtm_parse_one); + + kfree(command_line); + + return args.value; +} +#endif + static struct dentry *lkdtm_debugfs_root; static int __init lkdtm_module_init(void) diff --git a/drivers/misc/lkdtm/fortify.c b/drivers/misc/lkdtm/fortify.c index faf29cf04baa..0f51d31b57ca 100644 --- a/drivers/misc/lkdtm/fortify.c +++ b/drivers/misc/lkdtm/fortify.c @@ -76,7 +76,8 @@ void lkdtm_FORTIFIED_STRSCPY(void) */ strscpy(dst, src, strlen(src)); - pr_warn("FAIL: No overflow in above strscpy()\n"); + pr_err("FAIL: strscpy() overflow not detected!\n"); + pr_expected_config(CONFIG_FORTIFY_SOURCE); kfree(src); } diff --git a/drivers/misc/lkdtm/heap.c b/drivers/misc/lkdtm/heap.c index 36be5e353cd0..a3bb0577ed8b 100644 --- a/drivers/misc/lkdtm/heap.c +++ b/drivers/misc/lkdtm/heap.c @@ -109,9 +109,10 @@ void lkdtm_READ_AFTER_FREE(void) if (saw != *val) { /* Good! Poisoning happened, so declare a win. */ pr_info("Memory correctly poisoned (%x)\n", saw); - BUG(); + } else { + pr_err("FAIL: Memory was not poisoned!\n"); + pr_expected_config_param(CONFIG_INIT_ON_FREE_DEFAULT_ON, "init_on_free"); } - pr_info("Memory was not poisoned\n"); kfree(val); } @@ -165,9 +166,10 @@ void lkdtm_READ_BUDDY_AFTER_FREE(void) if (saw != *val) { /* Good! Poisoning happened, so declare a win. */ pr_info("Memory correctly poisoned (%x)\n", saw); - BUG(); + } else { + pr_err("FAIL: Buddy page was not poisoned!\n"); + pr_expected_config_param(CONFIG_INIT_ON_FREE_DEFAULT_ON, "init_on_free"); } - pr_info("Buddy page was not poisoned\n"); kfree(val); } diff --git a/drivers/misc/lkdtm/lkdtm.h b/drivers/misc/lkdtm/lkdtm.h index c6baf4f1e1db..e491bc571808 100644 --- a/drivers/misc/lkdtm/lkdtm.h +++ b/drivers/misc/lkdtm/lkdtm.h @@ -6,6 +6,47 @@ #include +#define pr_expected_config(kconfig) \ +{ \ + if (IS_ENABLED(kconfig)) \ + pr_err("Unexpected! This kernel was built with " #kconfig "=y\n"); \ + else \ + pr_warn("This is probably expected, since this kernel was built *without* " #kconfig "=y\n"); \ +} + +#ifndef MODULE +int lkdtm_check_bool_cmdline(const char *param); +#define pr_expected_config_param(kconfig, param) \ +{ \ + if (IS_ENABLED(kconfig)) { \ + switch (lkdtm_check_bool_cmdline(param)) { \ + case 0: \ + pr_warn("This is probably expected, since this kernel was built with " #kconfig "=y but booted with '" param "=N'\n"); \ + break; \ + case 1: \ + pr_err("Unexpected! This kernel was built with " #kconfig "=y and booted with '" param "=Y'\n"); \ + break; \ + default: \ + pr_err("Unexpected! This kernel was built with " #kconfig "=y (and booted without '" param "' specified)\n"); \ + } \ + } else { \ + switch (lkdtm_check_bool_cmdline(param)) { \ + case 0: \ + pr_warn("This is probably expected, as kernel was built *without* " #kconfig "=y and booted with '" param "=N'\n"); \ + break; \ + case 1: \ + pr_err("Unexpected! This kernel was built *without* " #kconfig "=y but booted with '" param "=Y'\n"); \ + break; \ + default: \ + pr_err("This is probably expected, since this kernel was built *without* " #kconfig "=y (and booted without '" param "' specified)\n"); \ + break; \ + } \ + } \ +} +#else +#define pr_expected_config_param(kconfig, param) pr_expected_config(kconfig) +#endif + /* bugs.c */ void __init lkdtm_bugs_init(int *recur_param); void lkdtm_PANIC(void); diff --git a/drivers/misc/lkdtm/stackleak.c b/drivers/misc/lkdtm/stackleak.c index d1a5c0705be3..00db21ff115e 100644 --- a/drivers/misc/lkdtm/stackleak.c +++ b/drivers/misc/lkdtm/stackleak.c @@ -74,8 +74,8 @@ void lkdtm_STACKLEAK_ERASING(void) end: if (test_failed) { - pr_err("FAIL: the thread stack is NOT properly erased\n"); - dump_stack(); + pr_err("FAIL: the thread stack is NOT properly erased!\n"); + pr_expected_config(CONFIG_GCC_PLUGIN_STACKLEAK); } else { pr_info("OK: the rest of the thread stack is properly erased\n"); } diff --git a/drivers/misc/lkdtm/usercopy.c b/drivers/misc/lkdtm/usercopy.c index 15d220ef35a5..9161ce7ed47a 100644 --- a/drivers/misc/lkdtm/usercopy.c +++ b/drivers/misc/lkdtm/usercopy.c @@ -173,6 +173,8 @@ static void do_usercopy_heap_size(bool to_user) goto free_user; } } + pr_err("FAIL: bad usercopy not detected!\n"); + pr_expected_config_param(CONFIG_HARDENED_USERCOPY, "hardened_usercopy"); free_user: vm_munmap(user_addr, PAGE_SIZE); @@ -248,6 +250,8 @@ static void do_usercopy_heap_whitelist(bool to_user) goto free_user; } } + pr_err("FAIL: bad usercopy not detected!\n"); + pr_expected_config_param(CONFIG_HARDENED_USERCOPY, "hardened_usercopy"); free_user: vm_munmap(user_alloc, PAGE_SIZE); @@ -319,7 +323,8 @@ void lkdtm_USERCOPY_KERNEL(void) pr_warn("copy_to_user failed, but lacked Oops\n"); goto free_user; } - pr_err("FAIL: survived bad copy_to_user()\n"); + pr_err("FAIL: bad copy_to_user() not detected!\n"); + pr_expected_config_param(CONFIG_HARDENED_USERCOPY, "hardened_usercopy"); free_user: vm_munmap(user_addr, PAGE_SIZE); diff --git a/tools/testing/selftests/lkdtm/stack-entropy.sh b/tools/testing/selftests/lkdtm/stack-entropy.sh index b1b8a5097cbb..1b4d95d575f8 100755 --- a/tools/testing/selftests/lkdtm/stack-entropy.sh +++ b/tools/testing/selftests/lkdtm/stack-entropy.sh @@ -30,6 +30,7 @@ rm -f "$log" # We would expect any functional stack randomization to be at least 5 bits. if [ "$bits" -lt 5 ]; then + echo "Stack entropy is low! Booted without 'randomize_kstack_offset=y'?" exit 1 else exit 0 From patchwork Wed Jun 23 20:39:35 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12340499 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 69A34C49EA6 for ; Wed, 23 Jun 2021 20:39:56 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 51FF16135C for ; Wed, 23 Jun 2021 20:39:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230001AbhFWUmN (ORCPT ); Wed, 23 Jun 2021 16:42:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58522 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229975AbhFWUmI (ORCPT ); Wed, 23 Jun 2021 16:42:08 -0400 Received: from mail-pj1-x102b.google.com (mail-pj1-x102b.google.com [IPv6:2607:f8b0:4864:20::102b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4DF8BC0617AE for ; Wed, 23 Jun 2021 13:39:50 -0700 (PDT) Received: by mail-pj1-x102b.google.com with SMTP id s17-20020a17090a8811b029016e89654f93so4547919pjn.1 for ; Wed, 23 Jun 2021 13:39:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=Pz31bWQ9kj3qQxfwbW4zNhCR6wU6ct/Uhdf374m05ZM=; b=bVah6ky5q1Oyu9Bp7zUuTiUXvq5aoO9izpLs3ix4WNWc7MmO6OWAc+KUoYmrjiaT8q Y45rQu0/kDD5K2LbPpN/5KIewbmXUkAd2EISHTAOFbWVbLTMpd4QC9MtGZcqXQMtn+Zt G9ATsaYiGlyYF4qtjGeUvi+nh3DWNzahK7ysY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Pz31bWQ9kj3qQxfwbW4zNhCR6wU6ct/Uhdf374m05ZM=; b=S4F6QrcIf4kavwrzew2efMlr2oZjnr7QVGBP/gcIoQUI06wSopexf0bq6b23ZAVaAT RXHVmkCLd2rPQosl3+VNYEHgM+bmtgOekzGMcfVfIKK0zAHJDYhUMIBRDkm4qps9QDwi dKmGC9DHbegkX0AB5Zvma9qFdDdnsAtQBcQF/GL/IYklyS54CVK9hDdJ+akMvdrNLoJM QF2TSWMeGTFAdEgZiF7WuQhYe5F8wB+9q5Dj+mikGwLTQ3SNCAmgUok1gF1u63vgR0pM NngrKR9iftnU645a9VPMZq86QX1z4cnTxIS78/GkmMlf7+7T8fo/+8ZaN+tRJimZiSOT 7VOQ== X-Gm-Message-State: AOAM532GfUebi6o8PjQiQd+pbeL+DgJ3mzIfgGn5zD2Y5PY+CoOyX26e xBBjWvf9VODZu5dRZdctuBVNSA== X-Google-Smtp-Source: ABdhPJyseZfK6ymKJ1p5VaH3usDgxd6X9v2WJaXwac+1vU0OCFOx4hrbbiaiMbNuXL3Niss8HQPHiA== X-Received: by 2002:a17:902:c409:b029:122:5537:95a6 with SMTP id k9-20020a170902c409b0290122553795a6mr1169407plk.11.1624480789847; Wed, 23 Jun 2021 13:39:49 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id k9sm11010pgq.27.2021.06.23.13.39.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 23 Jun 2021 13:39:48 -0700 (PDT) From: Kees Cook To: Greg Kroah-Hartman Cc: Kees Cook , kernelci@groups.io, Guillaume Tucker , David Laight , Arnd Bergmann , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 8/9] selftests/lkdtm: Enable various testable CONFIGs Date: Wed, 23 Jun 2021 13:39:35 -0700 Message-Id: <20210623203936.3151093-9-keescook@chromium.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210623203936.3151093-1-keescook@chromium.org> References: <20210623203936.3151093-1-keescook@chromium.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=938; h=from:subject; bh=mdLx0vJytUGz90du5cztVKVI/zg4LXTq/ivSPE9DL2U=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBg05wH6iQBLxV7pGZqSa7Oe0Zz9JY7N80557pAMpGH Y/TrfFmJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCYNOcBwAKCRCJcvTf3G3AJi9cD/ 4pY9gsJ0RUllyeaqn5C+w1B8pZc3dk6y9Dg4l5Uj+b4YJtlbDih3/wCb8cgUm0wo1sPAVse8PVeE+G J4Sepi+DP76OW+fuC4Ytf2zJST1Y47xdldZ2r3QAeduXBlCrGyLdziGma1HEeDRRcIUPq0G4lZvUJG g2aAhicvvMuGZsafw3WrOkiOkrMjYOM7eY/YHfv0UD34kHI9AnhzU+ZYbilOTxSdLbBzsJ3RtYnSiT HXLwCW+7YT8qQs8+fCMTtYTRfnGHG/FYYHosthcrUVjpE55x9l/l22JYd5tqpqGT0Iaz98Y4yKdZH0 ty/hAVob66L0hVjQHp624rqU0nXd0xr9Q+Y2fmc3DS3/HMrrhlMo7nhsVUOSf98/G2l5ldSjdxl/hm 9B9TTY2DyCxTsDOeSkAOVHA0RzE2g4Lhf7P41ConRrs0nI5RYrL6dR8vA/nfxf93yxGtGeUEWkeWL4 x4mbMwUUjJM7duARlmqNJZqYvVSviR2nFf+HpIfC2nNzgGJ0IbvQan66MFQSZIIrmPoJ+Q7JzPmwF5 QXVnAcFsH8h3ZGw4oEdrafr4BjLrvrVDrnTh+PUFvAKpoFWhXKuVsi0TIX45xjUIcHQcvScoXdCJQu +pDKxVhxnnFHoI+JA16YzjmHm6J7XzIApnpp4hoOhvym/RPNV771Bfqw1FXg== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org Add a handful of LKDTM-testable features that depend on certain CONFIGs so that they are visible in logs for CI systems that run the selftests. Others could be added, but may be seen as having too high a trade-off for general testing. Cc: kernelci@groups.io Suggested-by: Guillaume Tucker Signed-off-by: Kees Cook --- tools/testing/selftests/lkdtm/config | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tools/testing/selftests/lkdtm/config b/tools/testing/selftests/lkdtm/config index d874990e442b..849799bcfa95 100644 --- a/tools/testing/selftests/lkdtm/config +++ b/tools/testing/selftests/lkdtm/config @@ -1 +1,7 @@ CONFIG_LKDTM=y +CONFIG_DEBUG_LIST=y +CONFIG_SLAB_FREELIST_HARDENED=y +CONFIG_FORTIFY_SOURCE=y +CONFIG_HARDENED_USERCOPY=y +# CONFIG_HARDENED_USERCOPY_FALLBACK is not set +CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y From patchwork Wed Jun 23 20:39:36 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12340497 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1A33C49EC7 for ; Wed, 23 Jun 2021 20:39:56 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BDF88611C1 for ; Wed, 23 Jun 2021 20:39:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229975AbhFWUmN (ORCPT ); Wed, 23 Jun 2021 16:42:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58530 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229995AbhFWUmJ (ORCPT ); Wed, 23 Jun 2021 16:42:09 -0400 Received: from mail-pl1-x62f.google.com (mail-pl1-x62f.google.com [IPv6:2607:f8b0:4864:20::62f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 89B38C061787 for ; Wed, 23 Jun 2021 13:39:51 -0700 (PDT) Received: by mail-pl1-x62f.google.com with SMTP id v13so1780126ple.9 for ; Wed, 23 Jun 2021 13:39:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=9CbW/Yfm4YOVx5TLgcAG255DFJHXdYOCCgKp2CMgl9c=; b=dunBoi+rvP55ibjO4aMmp3PEcqi6plGzD3RKUIy2JY6icM4NLoCwMdjkH3bSpJGEZL rXBy87J/BsJRIb8BKC6N9nIa5pdSEtVsj9Jt2Eu2c7ibgdf7VysPOSGq2GGofBeJdmkV iHok836cmLjkdFjQnvhcnR9i+SLiV5yPdY7UI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=9CbW/Yfm4YOVx5TLgcAG255DFJHXdYOCCgKp2CMgl9c=; b=gLj3SvH/Sz/1sOafc0qdqv5FdBp1FxCxPQCtj9U6qyor4i32Q6+238QZjG91PEae+F le8x1fZIMaBEkuBvcpNZmNV/DveXnOXQY8iieUWSZjruevUWY/cpNNY0jlDSsmiRxA5Q bomunswmE/PQwNGwtAE50eITrRqeI2MyaRwywYw5ZAXXIfDIkcSMRMb1miqmM8zd5BDK Xe9XofrkSff547eCCX5h0nVdGHF1HfQGjR7kgpzQwtLzHb4mxbCWtl2QinFtT4Gjs0kp hO2JUNSJgk34FJ+4meFjGjDZiNp374CsU8/eJNpBwfFjtjbQujXXpIRX/4z3Nn16vSCi Ub1A== X-Gm-Message-State: AOAM530ddXuMOySH3kRMa3vVXFNB2dtEtTPaX3JBmKumb2prq70yzOcG gTmGWwKXnivLoB0aDdF0Sg0O4KruGlBlRA== X-Google-Smtp-Source: ABdhPJwt4bDW3fWxEAD6L43dOhtIQeD8GcbmXS575cFZ1n3sB6Aw0rEr0X01RYvfSmd5imUhk+B7Xw== X-Received: by 2002:a17:90a:4410:: with SMTP id s16mr1427889pjg.25.1624480791179; Wed, 23 Jun 2021 13:39:51 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id u1sm630574pfu.160.2021.06.23.13.39.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 23 Jun 2021 13:39:48 -0700 (PDT) From: Kees Cook To: Greg Kroah-Hartman Cc: Kees Cook , Guillaume Tucker , David Laight , Arnd Bergmann , linux-kernel@vger.kernel.org, kernelci@groups.io, linux-kselftest@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 9/9] lkdtm/heap: Add init_on_alloc tests Date: Wed, 23 Jun 2021 13:39:36 -0700 Message-Id: <20210623203936.3151093-10-keescook@chromium.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210623203936.3151093-1-keescook@chromium.org> References: <20210623203936.3151093-1-keescook@chromium.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4448; h=from:subject; bh=kzB2kajsXBcnoqdrRcymGnm8fdce7wFUEweva8HvKLM=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBg05wH5VR4lDW7Qn91KFyY0Hf6dSvabN6SXZM7fu6f PsdQeJCJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCYNOcBwAKCRCJcvTf3G3AJrtiEA CoREcu/vUQ2ed0GVO1Y3dypJDMih0UI4I5eduqeIitcrzItlcyUt0VyMnXcja+eI5KhvKJre/DEV6N JAmsX7/8fMHcIlJvDAVMxb5mzgFTyAQcwIOMVW9W+3r+UUHZS6kGdX0In5GjM0oGTDphSkDw7LVQbY wxTSCuoFvaX6JGRwtwTKCmf0yOxkYuSUmjJHP3vbzw8rycqrSTvpffy2vHVdG5lfncP2QvUbJhkroR YqXt+Y08bdkpdIS99ztaIPadsdcCWvdRG1KoGTSmnFHwfm11MhRoZPD2AzUKCn99c2adU25UgJoQQu IfWiqZ/0JUuO4YJACqa63gUv3lttKXM6Y0RLOyzPSZrdfG6fMJRbyK2BDNNBneDaeJOogvG+FWcLkT yX9ISCyG4xyhfgsPYQ37Dzftv2T9rWsCzn6IQbFefHbwjFbUTlG27if6rc8uiaQbPCh7g50faN26Kq OSqEkA5KwA251CpX+KiNd2JlxtXfTFtnSQKbVawsGGExVvDlLeuE+uZU9gps0EYtL4Rx8vGAiCMyOM 7kaI1WNW2RzpRc+2bK5fHt8rVn0HI3LFcHoX2pTX1ee//VbjPmF4EWsZsI7fVrgoTto7tM+Z+mOTU4 aF8WROfsOAjSNjtvkwi9P3oHmKdtILwXEN+5HFG/zWLAj0/J+i31bg6ZSiig== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org Add SLAB and page allocator tests for init_on_alloc. Testing for init_on_free was already happening via the poisoning tests. Signed-off-by: Kees Cook --- drivers/misc/lkdtm/core.c | 2 + drivers/misc/lkdtm/heap.c | 65 +++++++++++++++++++++++++ drivers/misc/lkdtm/lkdtm.h | 2 + tools/testing/selftests/lkdtm/config | 1 + tools/testing/selftests/lkdtm/tests.txt | 2 + 5 files changed, 72 insertions(+) diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c index c185ae4719c3..9dda87c6b54a 100644 --- a/drivers/misc/lkdtm/core.c +++ b/drivers/misc/lkdtm/core.c @@ -127,6 +127,8 @@ static const struct crashtype crashtypes[] = { CRASHTYPE(READ_AFTER_FREE), CRASHTYPE(WRITE_BUDDY_AFTER_FREE), CRASHTYPE(READ_BUDDY_AFTER_FREE), + CRASHTYPE(SLAB_INIT_ON_ALLOC), + CRASHTYPE(BUDDY_INIT_ON_ALLOC), CRASHTYPE(SLAB_FREE_DOUBLE), CRASHTYPE(SLAB_FREE_CROSS), CRASHTYPE(SLAB_FREE_PAGE), diff --git a/drivers/misc/lkdtm/heap.c b/drivers/misc/lkdtm/heap.c index a3bb0577ed8b..3d9aae5821a0 100644 --- a/drivers/misc/lkdtm/heap.c +++ b/drivers/misc/lkdtm/heap.c @@ -174,6 +174,71 @@ void lkdtm_READ_BUDDY_AFTER_FREE(void) kfree(val); } +void lkdtm_SLAB_INIT_ON_ALLOC(void) +{ + u8 *first; + u8 *val; + + first = kmalloc(512, GFP_KERNEL); + if (!first) { + pr_info("Unable to allocate 512 bytes the first time.\n"); + return; + } + + memset(first, 0xAB, 512); + kfree(first); + + val = kmalloc(512, GFP_KERNEL); + if (!val) { + pr_info("Unable to allocate 512 bytes the second time.\n"); + return; + } + if (val != first) { + pr_warn("Reallocation missed clobbered memory.\n"); + } + + if (memchr(val, 0xAB, 512) == NULL) { + pr_info("Memory appears initialized (%x, no earlier values)\n", *val); + } else { + pr_err("FAIL: Slab was not initialized\n"); + pr_expected_config_param(CONFIG_INIT_ON_ALLOC_DEFAULT_ON, "init_on_alloc"); + } + kfree(val); +} + +void lkdtm_BUDDY_INIT_ON_ALLOC(void) +{ + u8 *first; + u8 *val; + + first = (u8 *)__get_free_page(GFP_KERNEL); + if (!first) { + pr_info("Unable to allocate first free page\n"); + return; + } + + memset(first, 0xAB, PAGE_SIZE); + free_page((unsigned long)first); + + val = (u8 *)__get_free_page(GFP_KERNEL); + if (!val) { + pr_info("Unable to allocate second free page\n"); + return; + } + + if (val != first) { + pr_warn("Reallocation missed clobbered memory.\n"); + } + + if (memchr(val, 0xAB, PAGE_SIZE) == NULL) { + pr_info("Memory appears initialized (%x, no earlier values)\n", *val); + } else { + pr_err("FAIL: Slab was not initialized\n"); + pr_expected_config_param(CONFIG_INIT_ON_ALLOC_DEFAULT_ON, "init_on_alloc"); + } + free_page((unsigned long)val); +} + void lkdtm_SLAB_FREE_DOUBLE(void) { int *val; diff --git a/drivers/misc/lkdtm/lkdtm.h b/drivers/misc/lkdtm/lkdtm.h index e491bc571808..6a30b60519f3 100644 --- a/drivers/misc/lkdtm/lkdtm.h +++ b/drivers/misc/lkdtm/lkdtm.h @@ -86,6 +86,8 @@ void lkdtm_WRITE_AFTER_FREE(void); void lkdtm_READ_AFTER_FREE(void); void lkdtm_WRITE_BUDDY_AFTER_FREE(void); void lkdtm_READ_BUDDY_AFTER_FREE(void); +void lkdtm_SLAB_INIT_ON_ALLOC(void); +void lkdtm_BUDDY_INIT_ON_ALLOC(void); void lkdtm_SLAB_FREE_DOUBLE(void); void lkdtm_SLAB_FREE_CROSS(void); void lkdtm_SLAB_FREE_PAGE(void); diff --git a/tools/testing/selftests/lkdtm/config b/tools/testing/selftests/lkdtm/config index 849799bcfa95..013446e87f1f 100644 --- a/tools/testing/selftests/lkdtm/config +++ b/tools/testing/selftests/lkdtm/config @@ -5,3 +5,4 @@ CONFIG_FORTIFY_SOURCE=y CONFIG_HARDENED_USERCOPY=y # CONFIG_HARDENED_USERCOPY_FALLBACK is not set CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y +CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y diff --git a/tools/testing/selftests/lkdtm/tests.txt b/tools/testing/selftests/lkdtm/tests.txt index 30080cc15623..846cfd508d3c 100644 --- a/tools/testing/selftests/lkdtm/tests.txt +++ b/tools/testing/selftests/lkdtm/tests.txt @@ -21,6 +21,8 @@ VMALLOC_LINEAR_OVERFLOW READ_AFTER_FREE call trace:|Memory correctly poisoned #WRITE_BUDDY_AFTER_FREE Corrupts memory on failure READ_BUDDY_AFTER_FREE call trace:|Memory correctly poisoned +SLAB_INIT_ON_ALLOC Memory appears initialized +BUDDY_INIT_ON_ALLOC Memory appears initialized SLAB_FREE_DOUBLE SLAB_FREE_CROSS SLAB_FREE_PAGE