From patchwork Wed Aug 18 17:48:52 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12444909 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.4 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A9ABCC19F34 for ; Wed, 18 Aug 2021 17:49:12 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 961E0610CF for ; Wed, 18 Aug 2021 17:49:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229475AbhHRRtq (ORCPT ); Wed, 18 Aug 2021 13:49:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40690 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231661AbhHRRtn (ORCPT ); Wed, 18 Aug 2021 13:49:43 -0400 Received: from mail-pj1-x102d.google.com (mail-pj1-x102d.google.com [IPv6:2607:f8b0:4864:20::102d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5655AC06129D for ; Wed, 18 Aug 2021 10:49:01 -0700 (PDT) Received: by mail-pj1-x102d.google.com with SMTP id fa24-20020a17090af0d8b0290178bfa69d97so2924535pjb.0 for ; Wed, 18 Aug 2021 10:49:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=mHmTsQdU7KuN/XtvGUVKPpwurNSYz6PXrWrKJdVLujA=; b=gdlOiNEvaBd8syF+UyAdQamEuZevfhSagivxujwAjkcgGWlQ4N9lmhdRyqNWEEvloN YZS7yVakWd5A8a4T2WIqfKA9Pz6k/G7szM/9Rb4cJMGhIYehK22YFTD705ddPe2UhmZh zLAwlblgTURmQYHXkYsa4tO+/lhGyNdOnWRKY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=mHmTsQdU7KuN/XtvGUVKPpwurNSYz6PXrWrKJdVLujA=; b=RgeRcpzTsbJJfQVxBy9/Sde+y0UUgtJQyfCL0bZTR+7HiN3DJnVDhH9w5gwoVLO2Fo jIanRBpbtRjjK66yXA3+Y2coOjLuk5rE4D3BIP1Ydjf05q8K01zSoGmhHt+LsxzmJ28M AtfH0VCjt39jtmBmQyZp4VKhLh0KhV3QDCRQM+qlTMTBIyJIwBUDa15gHIZ5AXqjOp46 MC9u++keIrYvHqY7gYXV7gOWHrTQRFKTf3ebY1wg+MYsDqn3cf6Xk71/7r4ZB4KO8cFU BiQLu/M+uliVhY1cCl3tYIfFuaLs2kZ6YRnWzzzQAOEoCfaopY6SxxyUDOYq81lE2OYL epsg== X-Gm-Message-State: AOAM533ZBQsj13d4tqV2QBW/K/OngDG2JL37drwBrCE67ENmJscqGNJo 6xyb6Dp69Av51SKiaGpEbIr5hQ== X-Google-Smtp-Source: ABdhPJz7hwDBbVejgmN2cAL4PuRkHPIZdKRXP+wNeblDTZXNmEaryjgNQimYWqo0SwYsSVe+cBSwIA== X-Received: by 2002:a17:903:2303:b0:12d:d5d8:7497 with SMTP id d3-20020a170903230300b0012dd5d87497mr7045802plh.60.1629308940843; Wed, 18 Aug 2021 10:49:00 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id i11sm419356pfo.29.2021.08.18.10.48.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 18 Aug 2021 10:48:58 -0700 (PDT) From: Kees Cook To: Greg Kroah-Hartman Cc: Kees Cook , kernelci@groups.io, Guillaume Tucker , Arnd Bergmann , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 1/4] lkdtm/bugs: Add ARRAY_BOUNDS to selftests Date: Wed, 18 Aug 2021 10:48:52 -0700 Message-Id: <20210818174855.2307828-2-keescook@chromium.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210818174855.2307828-1-keescook@chromium.org> References: <20210818174855.2307828-1-keescook@chromium.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1892; h=from:subject; bh=DOYOqZV2Q+UGJKZkToQtyhtlYGp8Wu9ehFVapQblCWI=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBhHUgFZCr5VVGQzdkNXiPZUJ8p/WI0XYxFqAyjv4Tz fR0Wg56JAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCYR1IBQAKCRCJcvTf3G3AJk/QD/ 46oKDZ6UwgsHHF4mJW+4mfPhBUiEhtaEfkQxAuFjD9Lrul+zHQgsm43l/BAamshKopp7z8FTdl8249 x4qZ5lhrVo3Z5+gzxk5vtUkwwO2U+2kJvZhNGDX8VsbhGZdwXk4szHuwzA3sQAOPnkz51PUMoF82sr iehEHwfEtEc8w3Ux+KuGiTZ4KanKOmvyhKnQDZO8cmW8sYVk+pxSXkz6go+7HWy+gK0YMnKidKs1fX VXcznGC/0YD0rmUPrU6iRBjst+DDXr+VzyzWJChZD+m0cxudDSJpdey0fABTOAkl8Xt5mqR0JUfv5I qLqfhrYqk1HTxDDNT6qIwRMoyw0mnSsSBKni/3OsNw0SF3lz64N872mlXozKtun4HNp093p+lktIoe qThiyfdaySnIOhvQgWiFKdcokNhoFNP8puj/A76U9qnT815CIIb9Yw9LN4vsIvtGF0VI6EwblwpVu1 3BdbUFh8Hp9VU1Z65NxMIEf53bMvQWAKrCGQIKmjvqddpxPiB162q8RFtguTpOT2dLbqHil5oDXslV sGeoIyRFuiNuJg5GgjhWCxvb+V7zlJGzDb4OtQqXooP26JOb8sP4Vt9Wh0bFo4egqiOVf1KDHJaF/l 7rQdHpvn1ADOrDbpcAcIxnx6X5UlNWT7mn30/9q/kum3zwYN3oY3WL4DqLcg== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org Add CONFIG hints about why the ARRAY_BOUNDS test might fail, and similarly include the CONFIGs needed to pass the ARRAY_BOUNDS test via the selftests, and add to selftests. Cc: kernelci@groups.io Suggested-by: Guillaume Tucker Signed-off-by: Kees Cook --- drivers/misc/lkdtm/bugs.c | 1 + tools/testing/selftests/lkdtm/config | 2 ++ tools/testing/selftests/lkdtm/tests.txt | 1 + 3 files changed, 4 insertions(+) diff --git a/drivers/misc/lkdtm/bugs.c b/drivers/misc/lkdtm/bugs.c index 88c218a9f8b3..03171e412356 100644 --- a/drivers/misc/lkdtm/bugs.c +++ b/drivers/misc/lkdtm/bugs.c @@ -267,6 +267,7 @@ void lkdtm_ARRAY_BOUNDS(void) kfree(not_checked); kfree(checked); pr_err("FAIL: survived array bounds overflow!\n"); + pr_expected_config(CONFIG_UBSAN_BOUNDS); } void lkdtm_CORRUPT_LIST_ADD(void) diff --git a/tools/testing/selftests/lkdtm/config b/tools/testing/selftests/lkdtm/config index 013446e87f1f..38edea25631b 100644 --- a/tools/testing/selftests/lkdtm/config +++ b/tools/testing/selftests/lkdtm/config @@ -6,3 +6,5 @@ CONFIG_HARDENED_USERCOPY=y # CONFIG_HARDENED_USERCOPY_FALLBACK is not set CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y +CONFIG_UBSAN_BOUNDS=y +CONFIG_UBSAN_TRAP=y diff --git a/tools/testing/selftests/lkdtm/tests.txt b/tools/testing/selftests/lkdtm/tests.txt index 846cfd508d3c..6a33dbea8491 100644 --- a/tools/testing/selftests/lkdtm/tests.txt +++ b/tools/testing/selftests/lkdtm/tests.txt @@ -7,6 +7,7 @@ EXCEPTION #EXHAUST_STACK Corrupts memory on failure #CORRUPT_STACK Crashes entire system on success #CORRUPT_STACK_STRONG Crashes entire system on success +ARRAY_BOUNDS CORRUPT_LIST_ADD list_add corruption CORRUPT_LIST_DEL list_del corruption STACK_GUARD_PAGE_LEADING From patchwork Wed Aug 18 17:48:53 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12444905 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.4 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F11EDC41537 for ; Wed, 18 Aug 2021 17:49:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DFA856104F for ; Wed, 18 Aug 2021 17:49:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232152AbhHRRtp (ORCPT ); Wed, 18 Aug 2021 13:49:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40686 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231547AbhHRRtn (ORCPT ); Wed, 18 Aug 2021 13:49:43 -0400 Received: from mail-pf1-x429.google.com (mail-pf1-x429.google.com [IPv6:2607:f8b0:4864:20::429]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0C8F3C0613A4 for ; Wed, 18 Aug 2021 10:49:01 -0700 (PDT) Received: by mail-pf1-x429.google.com with SMTP id x16so2909518pfh.2 for ; Wed, 18 Aug 2021 10:49:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=RYJCfFwgTLyuPD5HR77kYnoCFym34pQ+lKwHk2HigNQ=; b=DRRazD/Lj0lQe7SKFOSNF+yyrxiPQmphxU1+ZbHAiEunTQgwzqDrE0lxBq37Ik2OaB EkLcCX6CmJWAcr10CNwJXfYWieOKu7hZcAwwx2JbkV9MAWh3S2hjNLpDVlHMA0iD8GER DIem9oEZAOsUDqlakoh4NGwiUI/fdFNDDLPBk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=RYJCfFwgTLyuPD5HR77kYnoCFym34pQ+lKwHk2HigNQ=; b=VtiByQk+NfdIVVGANy8D/3yoY+ylRQzgRE98M4DCElaZLbE6F3GqAD1+8P5pJaious x/1SSS8wuC+nTNqckh2Zhhm5VwUaksgE683pxZCS5RqzMZkOPMG0oUeO/UIYFMCiVDEs cX1bsFxfZ4pt59tXrAqEZMYeSBJiXeNWQNIim4iOQ22Q2nAo9r36YSPZRPaR2QcvyERt 3P1nzREoqkS4EncB1wy9mO1a+/eRohJUN9I/PbQ8xfBTb7tl6oKXweGSjvEt5dCk6asY eVdNdqk/N9iDJTrr+8msSM+/kLvD2Bu7O+00eFL+qw/MRJPr1Pysjuyf0YvkeNVfv9G9 abWA== X-Gm-Message-State: AOAM532fBJu7xhkx6DIflj9f5/CLw3+zwY7yB40hwokMpugaVn2sStfy PeX+tVC+zZCovCOgF/c5HZJW1k3UgJlYhg== X-Google-Smtp-Source: ABdhPJyVd0WLAE1TFxBtO8q9eyjM/fvvUT+s/DMV5lELpYUS0bwQ5590WkBuPRVTIjDlOyJH/jVUlQ== X-Received: by 2002:a63:f946:: with SMTP id q6mr9928796pgk.42.1629308940542; Wed, 18 Aug 2021 10:49:00 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id gd20sm400380pjb.42.2021.08.18.10.48.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 18 Aug 2021 10:48:58 -0700 (PDT) From: Kees Cook To: Greg Kroah-Hartman Cc: Kees Cook , Arnd Bergmann , Guillaume Tucker , linux-kernel@vger.kernel.org, kernelci@groups.io, linux-kselftest@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 2/4] lkdtm/fortify: Consolidate FORTIFY_SOURCE tests Date: Wed, 18 Aug 2021 10:48:53 -0700 Message-Id: <20210818174855.2307828-3-keescook@chromium.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210818174855.2307828-1-keescook@chromium.org> References: <20210818174855.2307828-1-keescook@chromium.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=6095; h=from:subject; bh=UmwnZxO/xqyq4TgyADzfcD0MdjONqujpVInQIwTkiPA=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBhHUgGN9h2kr69Q2znAyUZppgYv1pZU7wBWLrirpH1 BbYNZlGJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCYR1IBgAKCRCJcvTf3G3AJmLVEA CMDyWcAaZGvjBppMRE5YtyzLTZEl1BJVupmm4IuHd/R8ncLZP1SNTUV9xx+mSpJgo/z/CireZO3PB3 UpjxyJt7L+fx9bM9sFbeZwv4aFXyImq+/EXQAGHWSmgZwXfWDPC6ywRqtAxPj7YqSKKh69SchzGRMP Nx82lkoOASBdmM0zveU9zZfMzPeagyLXyjQp8y9Noed9Yx76iycpLsmCvqgMWogEi4MSut3KeDBUbm UIKnd8l+1kHQB8nOtaFG0WuLTIw1heXk1rw36qRSt216rAlrhZOg5JC8rBIzIC2oBNKEdFGtw8kZGx BSObXYHoQpCyURAdI/8cmtgNh3ftH0f7rTGuFM2eaCnGwPxIk9pgDCclcyqDMACev8CDsjZUk3zAHd p5aT5qKJwfPvZZ8RkDBM1yW7S4BqhECGHG5b2e3F46oiZnDfcWSk2328f765hRiorKx+RGJbXPWUTF qmGcK7PRy/M4lXbJirQU4c5z9qkuoVK7ePozHHmtHLMoItefHKNAs94oD/Nn7WkTzHyw9MEr79C4fM ePpvjMmdz+8wt+Gj3Wyo4/c3iTWuUa8ZqerPaDf3TD9FzSwxQ1Zy5h2YX7bRgryvVuq/CU0MuPS4HB NSU92eeCfWHuVPLWQLIeIlYXL/Qxfqji3LRyxg3MJRgytS065OLNGwsqDvJw== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org The FORTIFY_SOURCE tests were split between bugs.c and fortify.c. Move tests into fortify.c, standardize their naming, add CONFIG hints, and add them to the lkdtm selftests. Cc: Arnd Bergmann Signed-off-by: Kees Cook --- drivers/misc/lkdtm/bugs.c | 50 ----------------------- drivers/misc/lkdtm/core.c | 4 +- drivers/misc/lkdtm/fortify.c | 53 +++++++++++++++++++++++++ drivers/misc/lkdtm/lkdtm.h | 4 +- tools/testing/selftests/lkdtm/tests.txt | 2 + 5 files changed, 59 insertions(+), 54 deletions(-) diff --git a/drivers/misc/lkdtm/bugs.c b/drivers/misc/lkdtm/bugs.c index 03171e412356..4282b625200f 100644 --- a/drivers/misc/lkdtm/bugs.c +++ b/drivers/misc/lkdtm/bugs.c @@ -507,53 +507,3 @@ noinline void lkdtm_CORRUPT_PAC(void) pr_err("XFAIL: this test is arm64-only\n"); #endif } - -void lkdtm_FORTIFY_OBJECT(void) -{ - struct target { - char a[10]; - } target[2] = {}; - int result; - - /* - * Using volatile prevents the compiler from determining the value of - * 'size' at compile time. Without that, we would get a compile error - * rather than a runtime error. - */ - volatile int size = 11; - - pr_info("trying to read past the end of a struct\n"); - - result = memcmp(&target[0], &target[1], size); - - /* Print result to prevent the code from being eliminated */ - pr_err("FAIL: fortify did not catch an object overread!\n" - "\"%d\" was the memcmp result.\n", result); -} - -void lkdtm_FORTIFY_SUBOBJECT(void) -{ - struct target { - char a[10]; - char b[10]; - } target; - char *src; - - src = kmalloc(20, GFP_KERNEL); - strscpy(src, "over ten bytes", 20); - - pr_info("trying to strcpy past the end of a member of a struct\n"); - - /* - * strncpy(target.a, src, 20); will hit a compile error because the - * compiler knows at build time that target.a < 20 bytes. Use strcpy() - * to force a runtime error. - */ - strcpy(target.a, src); - - /* Use target.a to prevent the code from being eliminated */ - pr_err("FAIL: fortify did not catch an sub-object overrun!\n" - "\"%s\" was copied.\n", target.a); - - kfree(src); -} diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c index 9dda87c6b54a..dbdb0af7f68a 100644 --- a/drivers/misc/lkdtm/core.c +++ b/drivers/misc/lkdtm/core.c @@ -119,8 +119,6 @@ static const struct crashtype crashtypes[] = { CRASHTYPE(UNSET_SMEP), CRASHTYPE(CORRUPT_PAC), CRASHTYPE(UNALIGNED_LOAD_STORE_WRITE), - CRASHTYPE(FORTIFY_OBJECT), - CRASHTYPE(FORTIFY_SUBOBJECT), CRASHTYPE(SLAB_LINEAR_OVERFLOW), CRASHTYPE(VMALLOC_LINEAR_OVERFLOW), CRASHTYPE(WRITE_AFTER_FREE), @@ -180,6 +178,8 @@ static const struct crashtype crashtypes[] = { CRASHTYPE(USERCOPY_KERNEL), CRASHTYPE(STACKLEAK_ERASING), CRASHTYPE(CFI_FORWARD_PROTO), + CRASHTYPE(FORTIFIED_OBJECT), + CRASHTYPE(FORTIFIED_SUBOBJECT), CRASHTYPE(FORTIFIED_STRSCPY), CRASHTYPE(DOUBLE_FAULT), #ifdef CONFIG_PPC_BOOK3S_64 diff --git a/drivers/misc/lkdtm/fortify.c b/drivers/misc/lkdtm/fortify.c index 0f51d31b57ca..d06458a4858e 100644 --- a/drivers/misc/lkdtm/fortify.c +++ b/drivers/misc/lkdtm/fortify.c @@ -8,6 +8,59 @@ #include #include +static volatile int fortify_scratch_space; + +void lkdtm_FORTIFIED_OBJECT(void) +{ + struct target { + char a[10]; + } target[2] = {}; + /* + * Using volatile prevents the compiler from determining the value of + * 'size' at compile time. Without that, we would get a compile error + * rather than a runtime error. + */ + volatile int size = 11; + + pr_info("trying to read past the end of a struct\n"); + + /* Store result to global to prevent the code from being eliminated */ + fortify_scratch_space = memcmp(&target[0], &target[1], size); + + pr_err("FAIL: fortify did not block an object overread!\n"); + pr_expected_config(CONFIG_FORTIFY_SOURCE); +} + +void lkdtm_FORTIFIED_SUBOBJECT(void) +{ + struct target { + char a[10]; + char b[10]; + } target; + volatile int size = 20; + char *src; + + src = kmalloc(size, GFP_KERNEL); + strscpy(src, "over ten bytes", size); + size = strlen(src) + 1; + + pr_info("trying to strcpy past the end of a member of a struct\n"); + + /* + * memcpy(target.a, src, 20); will hit a compile error because the + * compiler knows at build time that target.a < 20 bytes. Use a + * volatile to force a runtime error. + */ + memcpy(target.a, src, size); + + /* Store result to global to prevent the code from being eliminated */ + fortify_scratch_space = target.a[3]; + + pr_err("FAIL: fortify did not block an sub-object overrun!\n"); + pr_expected_config(CONFIG_FORTIFY_SOURCE); + + kfree(src); +} /* * Calls fortified strscpy to test that it returns the same result as vanilla diff --git a/drivers/misc/lkdtm/lkdtm.h b/drivers/misc/lkdtm/lkdtm.h index 6a30b60519f3..f2e61581c1ae 100644 --- a/drivers/misc/lkdtm/lkdtm.h +++ b/drivers/misc/lkdtm/lkdtm.h @@ -74,8 +74,6 @@ void lkdtm_STACK_GUARD_PAGE_TRAILING(void); void lkdtm_UNSET_SMEP(void); void lkdtm_DOUBLE_FAULT(void); void lkdtm_CORRUPT_PAC(void); -void lkdtm_FORTIFY_OBJECT(void); -void lkdtm_FORTIFY_SUBOBJECT(void); /* heap.c */ void __init lkdtm_heap_init(void); @@ -150,6 +148,8 @@ void lkdtm_STACKLEAK_ERASING(void); void lkdtm_CFI_FORWARD_PROTO(void); /* fortify.c */ +void lkdtm_FORTIFIED_OBJECT(void); +void lkdtm_FORTIFIED_SUBOBJECT(void); void lkdtm_FORTIFIED_STRSCPY(void); /* powerpc.c */ diff --git a/tools/testing/selftests/lkdtm/tests.txt b/tools/testing/selftests/lkdtm/tests.txt index 6a33dbea8491..09f7bfa383cc 100644 --- a/tools/testing/selftests/lkdtm/tests.txt +++ b/tools/testing/selftests/lkdtm/tests.txt @@ -73,4 +73,6 @@ USERCOPY_KERNEL STACKLEAK_ERASING OK: the rest of the thread stack is properly erased CFI_FORWARD_PROTO FORTIFIED_STRSCPY +FORTIFIED_OBJECT +FORTIFIED_SUBOBJECT PPC_SLB_MULTIHIT Recovered From patchwork Wed Aug 18 17:48:54 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12444907 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.4 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C3647C43214 for ; Wed, 18 Aug 2021 17:49:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id ABE5F610FE for ; Wed, 18 Aug 2021 17:49:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231422AbhHRRtp (ORCPT ); Wed, 18 Aug 2021 13:49:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40678 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230131AbhHRRtn (ORCPT ); Wed, 18 Aug 2021 13:49:43 -0400 Received: from mail-pg1-x52a.google.com (mail-pg1-x52a.google.com [IPv6:2607:f8b0:4864:20::52a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A865CC0617AD for ; Wed, 18 Aug 2021 10:48:59 -0700 (PDT) Received: by mail-pg1-x52a.google.com with SMTP id x4so3020199pgh.1 for ; Wed, 18 Aug 2021 10:48:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=1mY5RIBDNgWagktFsZEnudEN0wbyGTHt9HsdseVRFKY=; b=lkw1GFxei+c9lM+dD9uJpW8DM95igP4b7m/SJ7F/1vBejrYpTKSFtUAf3aWrxF9tWn v3DYj1UCk0uC+7Q+ySeP9w4Dqm+X0sdsz10+2CKJn1O3ZCId95GoWlD32iRwVx3YbYba OYFJhccVe20gKZQT0LbD8pl3H/rCi0S73uBvg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=1mY5RIBDNgWagktFsZEnudEN0wbyGTHt9HsdseVRFKY=; b=fXqVyZZ1r2jPI5oA0WKRV1aDRAXXwyinRIeWdnjkD/p+BIu9volpLHSlKYw6D0f34g DXO6aK3sWOEPhdIlxzLcQKVPBoLNWMpV1WTLr0hBBCUatdzh0VyoUjpQcRQIRAtmvTZw 8T2uvhu3VEbGBxjp4DptVdMClCY08ueFJjafWDx53fnJA/r/eX+oflHrjoXOEL/ay7Z+ TfDauQOtqyHTwJ4FCg6f+trkON4xtScs0sucMU2SQHvqaXu/dYOayo6Gshns3H7cCPaN 8/hQ3g1txhXwSUMDwuZz9PC3xtroAkuxLYjxPGNKOktjTPG7WUaSKbzBlzXZ54XiG+63 IRRw== X-Gm-Message-State: AOAM532YwLtHoC2D337yITSKguIS71sNUn0JcYWAaiNNacMGbTekKMKO VerR7wkYwCpXtT2v9k3kSb7i3g== X-Google-Smtp-Source: ABdhPJyFeBuwLVlU9TC3ZBx/6QU/4sy4LObAs/CpUDROrocaJs575Va38mcJ2sxKx6dEOTi/qL/Slg== X-Received: by 2002:a65:690c:: with SMTP id s12mr10069880pgq.401.1629308939206; Wed, 18 Aug 2021 10:48:59 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id q3sm455504pgf.18.2021.08.18.10.48.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 18 Aug 2021 10:48:58 -0700 (PDT) From: Kees Cook To: Greg Kroah-Hartman Cc: Kees Cook , Arnd Bergmann , kernelci@groups.io, Guillaume Tucker , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 3/4] lkdtm: Add kernel version to failure hints Date: Wed, 18 Aug 2021 10:48:54 -0700 Message-Id: <20210818174855.2307828-4-keescook@chromium.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210818174855.2307828-1-keescook@chromium.org> References: <20210818174855.2307828-1-keescook@chromium.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3259; h=from:subject; bh=PtEIiImPUmgrshOeUImaqyYgtJBgocXjAnTdV62YVWE=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBhHUgGpLo07w7JG+djZ75yRYafgXtPwCynK3PTDlkt e7AJbVOJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCYR1IBgAKCRCJcvTf3G3AJo2GD/ 44EkwrK4hbubbr73YxDXfIpSvaWKhnl8gYOa0sDntMqcNRIYzJmGYpNhEHdFQfkZjk1RJ1SR7n2O4X JN1krgFSEuHeAYQaLTMI81W0lhwr3PnOG2qyVGSS7z9qW/1yxUixQiX9lnQDmHfV3aIdB6bYAnKyOR pcJsx8ZdvhfYBahlY8W5jKhVlBZfYoIJKSmdYG12t02WmGwmz3Kou0uHoq1PBRTwDI0QTdbuToTBmJ n7H+N/4owQAe/L5GbyL+UnU2xQYvhwRRMotH02KzigIHfWeGYlrJdAdQOca9igIJ2g7Inlv3AcTlqE Gq3PQikM0G91IIYlsUngDHXmEbCRgyxB4KnA0CbQ4UsNmGhwBZdfvy4WJXixFYcykknjenN4HikXd4 e1EyGxr0t637X4e47h8JP77RqCA3+WA8PGAGnAiRZZalJBUk7rM0BqagmQTpxkiHFIbA+oLY63qu1y IJ9OypOASHrlhwGXhMe4WNOFN2JIXnct8NgPVRDdUDm5lIP0DWOim/w09zhVdd4tDn0madmZKXHsbF cbHznNBjFl8ghq0XtkLQkBJJW5xkTAu2B5Qu74FoKqtd/polUqitIbEi/ijp+2bJ0F45jjO4Bi3KDH Xz7QoPaVowJvl6NaDr4lP0U3vp231xWWZYgeL8KPCjBTjHdG1JDBxPRyPxaA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org In an effort to keep as much information in once place as possible in CI logs, report the kernel version and architecture in the failure hints. Cc: Arnd Bergmann Cc: kernelci@groups.io Signed-off-by: Kees Cook --- drivers/misc/lkdtm/lkdtm.h | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/drivers/misc/lkdtm/lkdtm.h b/drivers/misc/lkdtm/lkdtm.h index f2e61581c1ae..d7d64d9765eb 100644 --- a/drivers/misc/lkdtm/lkdtm.h +++ b/drivers/misc/lkdtm/lkdtm.h @@ -5,13 +5,17 @@ #define pr_fmt(fmt) "lkdtm: " fmt #include +#include +#include + +#define LKDTM_KERNEL "kernel (" UTS_RELEASE " " UTS_MACHINE ")" #define pr_expected_config(kconfig) \ { \ if (IS_ENABLED(kconfig)) \ - pr_err("Unexpected! This kernel was built with " #kconfig "=y\n"); \ + pr_err("Unexpected! This " LKDTM_KERNEL " was built with " #kconfig "=y\n"); \ else \ - pr_warn("This is probably expected, since this kernel was built *without* " #kconfig "=y\n"); \ + pr_warn("This is probably expected, since this " LKDTM_KERNEL " was built *without* " #kconfig "=y\n"); \ } #ifndef MODULE @@ -21,24 +25,24 @@ int lkdtm_check_bool_cmdline(const char *param); if (IS_ENABLED(kconfig)) { \ switch (lkdtm_check_bool_cmdline(param)) { \ case 0: \ - pr_warn("This is probably expected, since this kernel was built with " #kconfig "=y but booted with '" param "=N'\n"); \ + pr_warn("This is probably expected, since this " LKDTM_KERNEL " was built with " #kconfig "=y but booted with '" param "=N'\n"); \ break; \ case 1: \ - pr_err("Unexpected! This kernel was built with " #kconfig "=y and booted with '" param "=Y'\n"); \ + pr_err("Unexpected! This " LKDTM_KERNEL " was built with " #kconfig "=y and booted with '" param "=Y'\n"); \ break; \ default: \ - pr_err("Unexpected! This kernel was built with " #kconfig "=y (and booted without '" param "' specified)\n"); \ + pr_err("Unexpected! This " LKDTM_KERNEL " was built with " #kconfig "=y (and booted without '" param "' specified)\n"); \ } \ } else { \ switch (lkdtm_check_bool_cmdline(param)) { \ case 0: \ - pr_warn("This is probably expected, as kernel was built *without* " #kconfig "=y and booted with '" param "=N'\n"); \ + pr_warn("This is probably expected, as this " LKDTM_KERNEL " was built *without* " #kconfig "=y and booted with '" param "=N'\n"); \ break; \ case 1: \ - pr_err("Unexpected! This kernel was built *without* " #kconfig "=y but booted with '" param "=Y'\n"); \ + pr_err("Unexpected! This " LKDTM_KERNEL " was built *without* " #kconfig "=y but booted with '" param "=Y'\n"); \ break; \ default: \ - pr_err("This is probably expected, since this kernel was built *without* " #kconfig "=y (and booted without '" param "' specified)\n"); \ + pr_err("This is probably expected, since this " LKDTM_KERNEL " was built *without* " #kconfig "=y (and booted without '" param "' specified)\n"); \ break; \ } \ } \ From patchwork Wed Aug 18 17:48:55 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12444903 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.4 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C7A4C432BE for ; Wed, 18 Aug 2021 17:49:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4BD8B610CF for ; Wed, 18 Aug 2021 17:49:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231402AbhHRRto (ORCPT ); Wed, 18 Aug 2021 13:49:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40654 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231422AbhHRRtj (ORCPT ); Wed, 18 Aug 2021 13:49:39 -0400 Received: from mail-pf1-x42d.google.com (mail-pf1-x42d.google.com [IPv6:2607:f8b0:4864:20::42d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 68B80C06179A for ; Wed, 18 Aug 2021 10:48:59 -0700 (PDT) Received: by mail-pf1-x42d.google.com with SMTP id j187so2900537pfg.4 for ; Wed, 18 Aug 2021 10:48:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=9VAhCQA3MkM6rsCTMJO3M3k3MNEZtb/Tb2JXEPR3wc8=; b=SNCXq/5oc+O/tePHpiIlGQK1Jx7CqAUD8e5IdHI683aauQpDfGujbae9TjWFhkU046 rLBkgjvQvx/rHbQXy9+zJe3cKrHceKrSA2AvGMxpnpE5p7VwcgX7ak86HeWswH40YbTw G64ACPxE1o2scPWySFI7B8j/z0C8bzgR+gr6w= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=9VAhCQA3MkM6rsCTMJO3M3k3MNEZtb/Tb2JXEPR3wc8=; b=ehaQksgw8X0NkyhE1aTGCFx1aUNOum+KD/RWNdbQlYtcCSAa7ovTZua8Bhsnj83PBy JukoK9l1xlG62l5CElOcnkA6Xi2iuN+a2m9ytdYpDYcQxiELoFbV2HjjBhIg6jpEkaeA GzF3gHu5IEn19r+z5vYyxJh+tJr+eNnXdEW0u3LadlZ9aWoKRkmOeB5NYpuYOKu5jbe/ P/N25Zj8pWnuSm1Eh2oHVdrIwZB40K1mfvSwIbPL2n08Xolmfd1JEjwI15x6FXshUlkG dPi27J4EWJL5ntD+c3cggUgBcMMmYLkuTAOr0z86P2wsyRIOK8G3owqrOWM5oKR+kZ4v UzdQ== X-Gm-Message-State: AOAM533hEHXw3Ovhy7z69NpUhT/kI9FXCf2tv0mseiC5kt3NFBBvYLwx mQVY6GSABUayovM+eIQwhJtpJA== X-Google-Smtp-Source: ABdhPJzWo9rtC4QhANM5t54ZDvpGyVJ01qR9Trm8ucGnt71I36aBkBxsezedVbtcTSSr5oPNubf9dQ== X-Received: by 2002:a63:ed50:: with SMTP id m16mr9989573pgk.231.1629308938931; Wed, 18 Aug 2021 10:48:58 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id q13sm5784525pjq.10.2021.08.18.10.48.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 18 Aug 2021 10:48:58 -0700 (PDT) From: Kees Cook To: Greg Kroah-Hartman Cc: Kees Cook , Arnd Bergmann , Guillaume Tucker , linux-kernel@vger.kernel.org, kernelci@groups.io, linux-kselftest@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 4/4] lkdtm/heap: Avoid __alloc_size hint warning for VMALLOC_LINEAR_OVERFLOW Date: Wed, 18 Aug 2021 10:48:55 -0700 Message-Id: <20210818174855.2307828-5-keescook@chromium.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210818174855.2307828-1-keescook@chromium.org> References: <20210818174855.2307828-1-keescook@chromium.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1433; h=from:subject; bh=hEHwsjZSD/SYU1VoaQ5mTXOJ9xQG9V/0cWsn/qe6UfM=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBhHUgGBUS/d6eL8MtIKgEouR7CqPpSrnry2WnQbOoB MJRkKMuJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCYR1IBgAKCRCJcvTf3G3AJq2QEA CYtjA8ExIWPk7JvqRI/61/kE99RMnZcDBn7KzqjP0m7JW5yqwlWBUMIz+ye1hV21EL2F5arOPH8BvR 3V9TjF+7swg9wtnWeIWdkurG6SE0wnSv9XECt+FpJzNKxsa9TsUw9OzP94iXOX0lhLJtiS5hbbDzvm 1xWlOJh9WnUVQVNHoQ0SWthtBbKyUGXh/xmr3ASedX9L6Ue100evlIwHgSaY4HK18yKW2oxesg9vRq 2nfod7QFT4T2wsrMrNBcPKnaillIzxm4xYIHVZ64iXPKFsSoxJAppeZ25QJS8u431AEsh7QC1vzUHN mYYvmqS5lBlfI4JWTTS2kh/l+646Yw6u2XmBhYm/auAnyQo6Y7uDXi4YZ0qxInN+fMocEm6/SG2Ts0 q+eQTj7eahrc7dPrq34ZqReM3Anssp+dl3jbBZ4qlHzyoL8i4QUkwHKBalsUDUu0AXanwZvIuUpVRE Xspwci5AKkP3cZFW92NW3seSikRnhZFP+SnAUf9FouV5pMfGgDfGEtAe+KcNGwOiaWjjArhEqeIHzt fiQFAZHI6CJUhJ+OdyXbeFfQfR/d0PG0GUn67vyUiVMF6oqs24HnZ7vRHm5paxs7yDRBfvhx+RD1sk 77kNe3nsroN6hhYbzbAgtAbYjR89fEwFvL1eLnnR4NI6p2wq7155My+YT1IA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-kselftest@vger.kernel.org Once __alloc_size hints have been added, the compiler will (correctly!) see this as an overflow. We are, however, trying to test for this condition at run-time (not compile-time), so work around it with a volatile int offset. Cc: Arnd Bergmann Signed-off-by: Kees Cook --- drivers/misc/lkdtm/heap.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/misc/lkdtm/heap.c b/drivers/misc/lkdtm/heap.c index 3d9aae5821a0..8a92f5a800fa 100644 --- a/drivers/misc/lkdtm/heap.c +++ b/drivers/misc/lkdtm/heap.c @@ -12,6 +12,13 @@ static struct kmem_cache *double_free_cache; static struct kmem_cache *a_cache; static struct kmem_cache *b_cache; +/* + * Using volatile here means the compiler cannot ever make assumptions + * about this value. This means compile-time length checks involving + * this variable cannot be performed; only run-time checks. + */ +static volatile int __offset = 1; + /* * If there aren't guard pages, it's likely that a consecutive allocation will * let us overflow into the second allocation without overwriting something real. @@ -24,7 +31,7 @@ void lkdtm_VMALLOC_LINEAR_OVERFLOW(void) two = vzalloc(PAGE_SIZE); pr_info("Attempting vmalloc linear overflow ...\n"); - memset(one, 0xAA, PAGE_SIZE + 1); + memset(one, 0xAA, PAGE_SIZE + __offset); vfree(two); vfree(one);