Back to home page

LXR

 
 

    


0001 /*
0002  *
0003  * Copyright (c) 2014 Samsung Electronics Co., Ltd.
0004  * Author: Andrey Ryabinin <a.ryabinin@samsung.com>
0005  *
0006  * This program is free software; you can redistribute it and/or modify
0007  * it under the terms of the GNU General Public License version 2 as
0008  * published by the Free Software Foundation.
0009  *
0010  */
0011 
0012 #define pr_fmt(fmt) "kasan test: %s " fmt, __func__
0013 
0014 #include <linux/kernel.h>
0015 #include <linux/mman.h>
0016 #include <linux/mm.h>
0017 #include <linux/printk.h>
0018 #include <linux/slab.h>
0019 #include <linux/string.h>
0020 #include <linux/uaccess.h>
0021 #include <linux/module.h>
0022 
0023 /*
0024  * Note: test functions are marked noinline so that their names appear in
0025  * reports.
0026  */
0027 
0028 static noinline void __init kmalloc_oob_right(void)
0029 {
0030     char *ptr;
0031     size_t size = 123;
0032 
0033     pr_info("out-of-bounds to right\n");
0034     ptr = kmalloc(size, GFP_KERNEL);
0035     if (!ptr) {
0036         pr_err("Allocation failed\n");
0037         return;
0038     }
0039 
0040     ptr[size] = 'x';
0041     kfree(ptr);
0042 }
0043 
0044 static noinline void __init kmalloc_oob_left(void)
0045 {
0046     char *ptr;
0047     size_t size = 15;
0048 
0049     pr_info("out-of-bounds to left\n");
0050     ptr = kmalloc(size, GFP_KERNEL);
0051     if (!ptr) {
0052         pr_err("Allocation failed\n");
0053         return;
0054     }
0055 
0056     *ptr = *(ptr - 1);
0057     kfree(ptr);
0058 }
0059 
0060 static noinline void __init kmalloc_node_oob_right(void)
0061 {
0062     char *ptr;
0063     size_t size = 4096;
0064 
0065     pr_info("kmalloc_node(): out-of-bounds to right\n");
0066     ptr = kmalloc_node(size, GFP_KERNEL, 0);
0067     if (!ptr) {
0068         pr_err("Allocation failed\n");
0069         return;
0070     }
0071 
0072     ptr[size] = 0;
0073     kfree(ptr);
0074 }
0075 
0076 #ifdef CONFIG_SLUB
0077 static noinline void __init kmalloc_pagealloc_oob_right(void)
0078 {
0079     char *ptr;
0080     size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
0081 
0082     /* Allocate a chunk that does not fit into a SLUB cache to trigger
0083      * the page allocator fallback.
0084      */
0085     pr_info("kmalloc pagealloc allocation: out-of-bounds to right\n");
0086     ptr = kmalloc(size, GFP_KERNEL);
0087     if (!ptr) {
0088         pr_err("Allocation failed\n");
0089         return;
0090     }
0091 
0092     ptr[size] = 0;
0093     kfree(ptr);
0094 }
0095 #endif
0096 
0097 static noinline void __init kmalloc_large_oob_right(void)
0098 {
0099     char *ptr;
0100     size_t size = KMALLOC_MAX_CACHE_SIZE - 256;
0101     /* Allocate a chunk that is large enough, but still fits into a slab
0102      * and does not trigger the page allocator fallback in SLUB.
0103      */
0104     pr_info("kmalloc large allocation: out-of-bounds to right\n");
0105     ptr = kmalloc(size, GFP_KERNEL);
0106     if (!ptr) {
0107         pr_err("Allocation failed\n");
0108         return;
0109     }
0110 
0111     ptr[size] = 0;
0112     kfree(ptr);
0113 }
0114 
0115 static noinline void __init kmalloc_oob_krealloc_more(void)
0116 {
0117     char *ptr1, *ptr2;
0118     size_t size1 = 17;
0119     size_t size2 = 19;
0120 
0121     pr_info("out-of-bounds after krealloc more\n");
0122     ptr1 = kmalloc(size1, GFP_KERNEL);
0123     ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
0124     if (!ptr1 || !ptr2) {
0125         pr_err("Allocation failed\n");
0126         kfree(ptr1);
0127         return;
0128     }
0129 
0130     ptr2[size2] = 'x';
0131     kfree(ptr2);
0132 }
0133 
0134 static noinline void __init kmalloc_oob_krealloc_less(void)
0135 {
0136     char *ptr1, *ptr2;
0137     size_t size1 = 17;
0138     size_t size2 = 15;
0139 
0140     pr_info("out-of-bounds after krealloc less\n");
0141     ptr1 = kmalloc(size1, GFP_KERNEL);
0142     ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
0143     if (!ptr1 || !ptr2) {
0144         pr_err("Allocation failed\n");
0145         kfree(ptr1);
0146         return;
0147     }
0148     ptr2[size2] = 'x';
0149     kfree(ptr2);
0150 }
0151 
0152 static noinline void __init kmalloc_oob_16(void)
0153 {
0154     struct {
0155         u64 words[2];
0156     } *ptr1, *ptr2;
0157 
0158     pr_info("kmalloc out-of-bounds for 16-bytes access\n");
0159     ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL);
0160     ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
0161     if (!ptr1 || !ptr2) {
0162         pr_err("Allocation failed\n");
0163         kfree(ptr1);
0164         kfree(ptr2);
0165         return;
0166     }
0167     *ptr1 = *ptr2;
0168     kfree(ptr1);
0169     kfree(ptr2);
0170 }
0171 
0172 static noinline void __init kmalloc_oob_memset_2(void)
0173 {
0174     char *ptr;
0175     size_t size = 8;
0176 
0177     pr_info("out-of-bounds in memset2\n");
0178     ptr = kmalloc(size, GFP_KERNEL);
0179     if (!ptr) {
0180         pr_err("Allocation failed\n");
0181         return;
0182     }
0183 
0184     memset(ptr+7, 0, 2);
0185     kfree(ptr);
0186 }
0187 
0188 static noinline void __init kmalloc_oob_memset_4(void)
0189 {
0190     char *ptr;
0191     size_t size = 8;
0192 
0193     pr_info("out-of-bounds in memset4\n");
0194     ptr = kmalloc(size, GFP_KERNEL);
0195     if (!ptr) {
0196         pr_err("Allocation failed\n");
0197         return;
0198     }
0199 
0200     memset(ptr+5, 0, 4);
0201     kfree(ptr);
0202 }
0203 
0204 
0205 static noinline void __init kmalloc_oob_memset_8(void)
0206 {
0207     char *ptr;
0208     size_t size = 8;
0209 
0210     pr_info("out-of-bounds in memset8\n");
0211     ptr = kmalloc(size, GFP_KERNEL);
0212     if (!ptr) {
0213         pr_err("Allocation failed\n");
0214         return;
0215     }
0216 
0217     memset(ptr+1, 0, 8);
0218     kfree(ptr);
0219 }
0220 
0221 static noinline void __init kmalloc_oob_memset_16(void)
0222 {
0223     char *ptr;
0224     size_t size = 16;
0225 
0226     pr_info("out-of-bounds in memset16\n");
0227     ptr = kmalloc(size, GFP_KERNEL);
0228     if (!ptr) {
0229         pr_err("Allocation failed\n");
0230         return;
0231     }
0232 
0233     memset(ptr+1, 0, 16);
0234     kfree(ptr);
0235 }
0236 
0237 static noinline void __init kmalloc_oob_in_memset(void)
0238 {
0239     char *ptr;
0240     size_t size = 666;
0241 
0242     pr_info("out-of-bounds in memset\n");
0243     ptr = kmalloc(size, GFP_KERNEL);
0244     if (!ptr) {
0245         pr_err("Allocation failed\n");
0246         return;
0247     }
0248 
0249     memset(ptr, 0, size+5);
0250     kfree(ptr);
0251 }
0252 
0253 static noinline void __init kmalloc_uaf(void)
0254 {
0255     char *ptr;
0256     size_t size = 10;
0257 
0258     pr_info("use-after-free\n");
0259     ptr = kmalloc(size, GFP_KERNEL);
0260     if (!ptr) {
0261         pr_err("Allocation failed\n");
0262         return;
0263     }
0264 
0265     kfree(ptr);
0266     *(ptr + 8) = 'x';
0267 }
0268 
0269 static noinline void __init kmalloc_uaf_memset(void)
0270 {
0271     char *ptr;
0272     size_t size = 33;
0273 
0274     pr_info("use-after-free in memset\n");
0275     ptr = kmalloc(size, GFP_KERNEL);
0276     if (!ptr) {
0277         pr_err("Allocation failed\n");
0278         return;
0279     }
0280 
0281     kfree(ptr);
0282     memset(ptr, 0, size);
0283 }
0284 
0285 static noinline void __init kmalloc_uaf2(void)
0286 {
0287     char *ptr1, *ptr2;
0288     size_t size = 43;
0289 
0290     pr_info("use-after-free after another kmalloc\n");
0291     ptr1 = kmalloc(size, GFP_KERNEL);
0292     if (!ptr1) {
0293         pr_err("Allocation failed\n");
0294         return;
0295     }
0296 
0297     kfree(ptr1);
0298     ptr2 = kmalloc(size, GFP_KERNEL);
0299     if (!ptr2) {
0300         pr_err("Allocation failed\n");
0301         return;
0302     }
0303 
0304     ptr1[40] = 'x';
0305     if (ptr1 == ptr2)
0306         pr_err("Could not detect use-after-free: ptr1 == ptr2\n");
0307     kfree(ptr2);
0308 }
0309 
0310 static noinline void __init kmem_cache_oob(void)
0311 {
0312     char *p;
0313     size_t size = 200;
0314     struct kmem_cache *cache = kmem_cache_create("test_cache",
0315                         size, 0,
0316                         0, NULL);
0317     if (!cache) {
0318         pr_err("Cache allocation failed\n");
0319         return;
0320     }
0321     pr_info("out-of-bounds in kmem_cache_alloc\n");
0322     p = kmem_cache_alloc(cache, GFP_KERNEL);
0323     if (!p) {
0324         pr_err("Allocation failed\n");
0325         kmem_cache_destroy(cache);
0326         return;
0327     }
0328 
0329     *p = p[size];
0330     kmem_cache_free(cache, p);
0331     kmem_cache_destroy(cache);
0332 }
0333 
0334 static char global_array[10];
0335 
0336 static noinline void __init kasan_global_oob(void)
0337 {
0338     volatile int i = 3;
0339     char *p = &global_array[ARRAY_SIZE(global_array) + i];
0340 
0341     pr_info("out-of-bounds global variable\n");
0342     *(volatile char *)p;
0343 }
0344 
0345 static noinline void __init kasan_stack_oob(void)
0346 {
0347     char stack_array[10];
0348     volatile int i = 0;
0349     char *p = &stack_array[ARRAY_SIZE(stack_array) + i];
0350 
0351     pr_info("out-of-bounds on stack\n");
0352     *(volatile char *)p;
0353 }
0354 
0355 static noinline void __init ksize_unpoisons_memory(void)
0356 {
0357     char *ptr;
0358     size_t size = 123, real_size = size;
0359 
0360     pr_info("ksize() unpoisons the whole allocated chunk\n");
0361     ptr = kmalloc(size, GFP_KERNEL);
0362     if (!ptr) {
0363         pr_err("Allocation failed\n");
0364         return;
0365     }
0366     real_size = ksize(ptr);
0367     /* This access doesn't trigger an error. */
0368     ptr[size] = 'x';
0369     /* This one does. */
0370     ptr[real_size] = 'y';
0371     kfree(ptr);
0372 }
0373 
0374 static noinline void __init copy_user_test(void)
0375 {
0376     char *kmem;
0377     char __user *usermem;
0378     size_t size = 10;
0379     int unused;
0380 
0381     kmem = kmalloc(size, GFP_KERNEL);
0382     if (!kmem)
0383         return;
0384 
0385     usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE,
0386                 PROT_READ | PROT_WRITE | PROT_EXEC,
0387                 MAP_ANONYMOUS | MAP_PRIVATE, 0);
0388     if (IS_ERR(usermem)) {
0389         pr_err("Failed to allocate user memory\n");
0390         kfree(kmem);
0391         return;
0392     }
0393 
0394     pr_info("out-of-bounds in copy_from_user()\n");
0395     unused = copy_from_user(kmem, usermem, size + 1);
0396 
0397     pr_info("out-of-bounds in copy_to_user()\n");
0398     unused = copy_to_user(usermem, kmem, size + 1);
0399 
0400     pr_info("out-of-bounds in __copy_from_user()\n");
0401     unused = __copy_from_user(kmem, usermem, size + 1);
0402 
0403     pr_info("out-of-bounds in __copy_to_user()\n");
0404     unused = __copy_to_user(usermem, kmem, size + 1);
0405 
0406     pr_info("out-of-bounds in __copy_from_user_inatomic()\n");
0407     unused = __copy_from_user_inatomic(kmem, usermem, size + 1);
0408 
0409     pr_info("out-of-bounds in __copy_to_user_inatomic()\n");
0410     unused = __copy_to_user_inatomic(usermem, kmem, size + 1);
0411 
0412     pr_info("out-of-bounds in strncpy_from_user()\n");
0413     unused = strncpy_from_user(kmem, usermem, size + 1);
0414 
0415     vm_munmap((unsigned long)usermem, PAGE_SIZE);
0416     kfree(kmem);
0417 }
0418 
0419 static noinline void __init use_after_scope_test(void)
0420 {
0421     volatile char *volatile p;
0422 
0423     pr_info("use-after-scope on int\n");
0424     {
0425         int local = 0;
0426 
0427         p = (char *)&local;
0428     }
0429     p[0] = 1;
0430     p[3] = 1;
0431 
0432     pr_info("use-after-scope on array\n");
0433     {
0434         char local[1024] = {0};
0435 
0436         p = local;
0437     }
0438     p[0] = 1;
0439     p[1023] = 1;
0440 }
0441 
0442 static int __init kmalloc_tests_init(void)
0443 {
0444     kmalloc_oob_right();
0445     kmalloc_oob_left();
0446     kmalloc_node_oob_right();
0447 #ifdef CONFIG_SLUB
0448     kmalloc_pagealloc_oob_right();
0449 #endif
0450     kmalloc_large_oob_right();
0451     kmalloc_oob_krealloc_more();
0452     kmalloc_oob_krealloc_less();
0453     kmalloc_oob_16();
0454     kmalloc_oob_in_memset();
0455     kmalloc_oob_memset_2();
0456     kmalloc_oob_memset_4();
0457     kmalloc_oob_memset_8();
0458     kmalloc_oob_memset_16();
0459     kmalloc_uaf();
0460     kmalloc_uaf_memset();
0461     kmalloc_uaf2();
0462     kmem_cache_oob();
0463     kasan_stack_oob();
0464     kasan_global_oob();
0465     ksize_unpoisons_memory();
0466     copy_user_test();
0467     use_after_scope_test();
0468     return -EAGAIN;
0469 }
0470 
0471 module_init(kmalloc_tests_init);
0472 MODULE_LICENSE("GPL");