the-tree/lib/test_kasan_module.c

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  *
0004  * Copyright (c) 2014 Samsung Electronics Co., Ltd.
0005  * Author: Andrey Ryabinin <a.ryabinin@samsung.com>
0006  */
0007
0008 #define pr_fmt(fmt) "kasan test: %s " fmt, __func__
0009
0010 #include <linux/mman.h>
0011 #include <linux/module.h>
0012 #include <linux/printk.h>
0013 #include <linux/slab.h>
0014 #include <linux/uaccess.h>
0015
0016 #include "../mm/kasan/kasan.h"
0017
0018 static noinline void __init copy_user_test(void)
0019 {
0020     char *kmem;
0021     char __user *usermem;
0022     size_t size = 128 - KASAN_GRANULE_SIZE;
0023     int __maybe_unused unused;
0024
0025     kmem = kmalloc(size, GFP_KERNEL);
0026     if (!kmem)
0027         return;
0028
0029     usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE,
0030                 PROT_READ | PROT_WRITE | PROT_EXEC,
0031                 MAP_ANONYMOUS | MAP_PRIVATE, 0);
0032     if (IS_ERR(usermem)) {
0033         pr_err("Failed to allocate user memory\n");
0034         kfree(kmem);
0035         return;
0036     }
0037
0038     OPTIMIZER_HIDE_VAR(size);
0039
0040     pr_info("out-of-bounds in copy_from_user()\n");
0041     unused = copy_from_user(kmem, usermem, size + 1);
0042
0043     pr_info("out-of-bounds in copy_to_user()\n");
0044     unused = copy_to_user(usermem, kmem, size + 1);
0045
0046     pr_info("out-of-bounds in __copy_from_user()\n");
0047     unused = __copy_from_user(kmem, usermem, size + 1);
0048
0049     pr_info("out-of-bounds in __copy_to_user()\n");
0050     unused = __copy_to_user(usermem, kmem, size + 1);
0051
0052     pr_info("out-of-bounds in __copy_from_user_inatomic()\n");
0053     unused = __copy_from_user_inatomic(kmem, usermem, size + 1);
0054
0055     pr_info("out-of-bounds in __copy_to_user_inatomic()\n");
0056     unused = __copy_to_user_inatomic(usermem, kmem, size + 1);
0057
0058     pr_info("out-of-bounds in strncpy_from_user()\n");
0059     unused = strncpy_from_user(kmem, usermem, size + 1);
0060
0061     vm_munmap((unsigned long)usermem, PAGE_SIZE);
0062     kfree(kmem);
0063 }
0064
0065 static struct kasan_rcu_info {
0066     int i;
0067     struct rcu_head rcu;
0068 } *global_rcu_ptr;
0069
0070 static noinline void __init kasan_rcu_reclaim(struct rcu_head *rp)
0071 {
0072     struct kasan_rcu_info *fp = container_of(rp,
0073                         struct kasan_rcu_info, rcu);
0074
0075     kfree(fp);
0076     ((volatile struct kasan_rcu_info *)fp)->i;
0077 }
0078
0079 static noinline void __init kasan_rcu_uaf(void)
0080 {
0081     struct kasan_rcu_info *ptr;
0082
0083     pr_info("use-after-free in kasan_rcu_reclaim\n");
0084     ptr = kmalloc(sizeof(struct kasan_rcu_info), GFP_KERNEL);
0085     if (!ptr) {
0086         pr_err("Allocation failed\n");
0087         return;
0088     }
0089
0090     global_rcu_ptr = rcu_dereference_protected(ptr, NULL);
0091     call_rcu(&global_rcu_ptr->rcu, kasan_rcu_reclaim);
0092 }
0093
0094 static noinline void __init kasan_workqueue_work(struct work_struct *work)
0095 {
0096     kfree(work);
0097 }
0098
0099 static noinline void __init kasan_workqueue_uaf(void)
0100 {
0101     struct workqueue_struct *workqueue;
0102     struct work_struct *work;
0103
0104     workqueue = create_workqueue("kasan_wq_test");
0105     if (!workqueue) {
0106         pr_err("Allocation failed\n");
0107         return;
0108     }
0109     work = kmalloc(sizeof(struct work_struct), GFP_KERNEL);
0110     if (!work) {
0111         pr_err("Allocation failed\n");
0112         return;
0113     }
0114
0115     INIT_WORK(work, kasan_workqueue_work);
0116     queue_work(workqueue, work);
0117     destroy_workqueue(workqueue);
0118
0119     pr_info("use-after-free on workqueue\n");
0120     ((volatile struct work_struct *)work)->data;
0121 }
0122
0123 static int __init test_kasan_module_init(void)
0124 {
0125     /*
0126      * Temporarily enable multi-shot mode. Otherwise, KASAN would only
0127      * report the first detected bug and panic the kernel if panic_on_warn
0128      * is enabled.
0129      */
0130     bool multishot = kasan_save_enable_multi_shot();
0131
0132     copy_user_test();
0133     kasan_rcu_uaf();
0134     kasan_workqueue_uaf();
0135
0136     kasan_restore_multi_shot(multishot);
0137     return -EAGAIN;
0138 }
0139
0140 module_init(test_kasan_module_init);
0141 MODULE_LICENSE("GPL");