73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 1) // SPDX-License-Identifier: GPL-2.0-only
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 2) /*
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 3) *
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 4) * Copyright (c) 2014 Samsung Electronics Co., Ltd.
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 5) * Author: Andrey Ryabinin <a.ryabinin@samsung.com>
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 6) */
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 7)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 8) #define pr_fmt(fmt) "kasan test: %s " fmt, __func__
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 9)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 10) #include <linux/mman.h>
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 11) #include <linux/module.h>
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 12) #include <linux/printk.h>
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 13) #include <linux/slab.h>
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 14) #include <linux/uaccess.h>
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 15)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 16) #include "../mm/kasan/kasan.h"
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 17)
1f600626b3a9b (Andrey Konovalov 2020-12-22 12:00:24 -0800 18) #define OOB_TAG_OFF (IS_ENABLED(CONFIG_KASAN_GENERIC) ? 0 : KASAN_GRANULE_SIZE)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 19)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 20) static noinline void __init copy_user_test(void)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 21) {
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 22) char *kmem;
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 23) char __user *usermem;
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 24) size_t size = 10;
e156656717b81 (Andrew Morton 2021-04-09 13:27:41 -0700 25) int __maybe_unused unused;
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 26)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 27) kmem = kmalloc(size, GFP_KERNEL);
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 28) if (!kmem)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 29) return;
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 30)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 31) usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE,
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 32) PROT_READ | PROT_WRITE | PROT_EXEC,
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 33) MAP_ANONYMOUS | MAP_PRIVATE, 0);
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 34) if (IS_ERR(usermem)) {
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 35) pr_err("Failed to allocate user memory\n");
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 36) kfree(kmem);
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 37) return;
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 38) }
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 39)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 40) pr_info("out-of-bounds in copy_from_user()\n");
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 41) unused = copy_from_user(kmem, usermem, size + 1 + OOB_TAG_OFF);
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 42)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 43) pr_info("out-of-bounds in copy_to_user()\n");
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 44) unused = copy_to_user(usermem, kmem, size + 1 + OOB_TAG_OFF);
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 45)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 46) pr_info("out-of-bounds in __copy_from_user()\n");
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 47) unused = __copy_from_user(kmem, usermem, size + 1 + OOB_TAG_OFF);
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 48)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 49) pr_info("out-of-bounds in __copy_to_user()\n");
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 50) unused = __copy_to_user(usermem, kmem, size + 1 + OOB_TAG_OFF);
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 51)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 52) pr_info("out-of-bounds in __copy_from_user_inatomic()\n");
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 53) unused = __copy_from_user_inatomic(kmem, usermem, size + 1 + OOB_TAG_OFF);
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 54)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 55) pr_info("out-of-bounds in __copy_to_user_inatomic()\n");
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 56) unused = __copy_to_user_inatomic(usermem, kmem, size + 1 + OOB_TAG_OFF);
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 57)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 58) pr_info("out-of-bounds in strncpy_from_user()\n");
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 59) unused = strncpy_from_user(kmem, usermem, size + 1 + OOB_TAG_OFF);
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 60)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 61) vm_munmap((unsigned long)usermem, PAGE_SIZE);
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 62) kfree(kmem);
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 63) }
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 64)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 65) static struct kasan_rcu_info {
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 66) int i;
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 67) struct rcu_head rcu;
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 68) } *global_rcu_ptr;
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 69)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 70) static noinline void __init kasan_rcu_reclaim(struct rcu_head *rp)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 71) {
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 72) struct kasan_rcu_info *fp = container_of(rp,
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 73) struct kasan_rcu_info, rcu);
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 74)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 75) kfree(fp);
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 76) fp->i = 1;
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 77) }
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 78)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 79) static noinline void __init kasan_rcu_uaf(void)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 80) {
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 81) struct kasan_rcu_info *ptr;
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 82)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 83) pr_info("use-after-free in kasan_rcu_reclaim\n");
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 84) ptr = kmalloc(sizeof(struct kasan_rcu_info), GFP_KERNEL);
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 85) if (!ptr) {
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 86) pr_err("Allocation failed\n");
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 87) return;
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 88) }
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 89)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 90) global_rcu_ptr = rcu_dereference_protected(ptr, NULL);
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 91) call_rcu(&global_rcu_ptr->rcu, kasan_rcu_reclaim);
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 92) }
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 93)
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 94) static noinline void __init kasan_workqueue_work(struct work_struct *work)
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 95) {
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 96) kfree(work);
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 97) }
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 98)
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 99) static noinline void __init kasan_workqueue_uaf(void)
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 100) {
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 101) struct workqueue_struct *workqueue;
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 102) struct work_struct *work;
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 103)
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 104) workqueue = create_workqueue("kasan_wq_test");
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 105) if (!workqueue) {
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 106) pr_err("Allocation failed\n");
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 107) return;
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 108) }
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 109) work = kmalloc(sizeof(struct work_struct), GFP_KERNEL);
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 110) if (!work) {
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 111) pr_err("Allocation failed\n");
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 112) return;
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 113) }
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 114)
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 115) INIT_WORK(work, kasan_workqueue_work);
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 116) queue_work(workqueue, work);
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 117) destroy_workqueue(workqueue);
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 118)
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 119) pr_info("use-after-free on workqueue\n");
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 120) ((volatile struct work_struct *)work)->data;
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 121) }
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 122)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 123) static int __init test_kasan_module_init(void)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 124) {
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 125) /*
0fd379253691e (Andrey Konovalov 2021-02-24 12:05:13 -0800 126) * Temporarily enable multi-shot mode. Otherwise, KASAN would only
0fd379253691e (Andrey Konovalov 2021-02-24 12:05:13 -0800 127) * report the first detected bug and panic the kernel if panic_on_warn
0fd379253691e (Andrey Konovalov 2021-02-24 12:05:13 -0800 128) * is enabled.
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 129) */
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 130) bool multishot = kasan_save_enable_multi_shot();
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 131)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 132) copy_user_test();
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 133) kasan_rcu_uaf();
214c783d593bd (Walter Wu 2020-12-14 19:09:17 -0800 134) kasan_workqueue_uaf();
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 135)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 136) kasan_restore_multi_shot(multishot);
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 137) return -EAGAIN;
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 138) }
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 139)
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 140) module_init(test_kasan_module_init);
73228c7ecc5e4 (Patricia Alfonso 2020-10-13 16:55:06 -0700 141) MODULE_LICENSE("GPL");
VisionFive2 Linux kernel
StarFive Tech Linux Kernel for VisionFive (JH7110) boards (mirror)
More than 9999 Commits
32 Branches
54 Tags