Commit 5fd9e480 authored Dec 17, 2015 by David Windsor Committed by Kees Cook Mar 01, 2016

lkdtm: add test for atomic_t underflow/overflow



dmesg output of running this LKDTM test with PaX:

[187095.475573] lkdtm: No crash points registered, enable through debugfs
[187118.020257] lkdtm: Performing direct entry WRAP_ATOMIC
[187118.030045] lkdtm: attempting atomic underflow
[187118.030929] PAX: refcount overflow detected in: bash:1790, uid/euid: 0/0
[187118.071667] PAX: refcount overflow occured at: lkdtm_do_action+0x19e/0x400 [lkdtm]
[187118.081423] CPU: 3 PID: 1790 Comm: bash Not tainted 4.2.6-pax-refcount-split+ #2
[187118.083403] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[187118.102596] task: ffff8800da8de040 ti: ffff8800da8e4000 task.ti: ffff8800da8e4000
[187118.111321] RIP: 0010:[<ffffffffc00fc2fe>]  [<ffffffffc00fc2fe>] lkdtm_do_action+0x19e/0x400 [lkdtm]
...
[187118.128074] lkdtm: attempting atomic overflow
[187118.128080] PAX: refcount overflow detected in: bash:1790, uid/euid: 0/0
[187118.128082] PAX: refcount overflow occured at: lkdtm_do_action+0x1b6/0x400 [lkdtm]
[187118.128085] CPU: 3 PID: 1790 Comm: bash Not tainted 4.2.6-pax-refcount-split+ #2
[187118.128086] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[187118.128088] task: ffff8800da8de040 ti: ffff8800da8e4000 task.ti: ffff8800da8e4000
[187118.128092] RIP: 0010:[<ffffffffc00fc316>]  [<ffffffffc00fc316>] lkdtm_do_action+0x1b6/0x400 [lkdtm]

Signed-off-by: David Windsor <dave@progbits.org>
[cleaned up whitespacing, keescook]
Signed-off-by: Kees Cook <keescook@chromium.org>

parent 920d451f

drivers/misc/lkdtm.c

+13 −0

Original line number	Diff line number	Diff line
		@@ -107,6 +107,7 @@ enum ctype {
		CT_ACCESS_USERSPACE,
		CT_WRITE_RO,
		CT_WRITE_KERN,
		CT_WRAP_ATOMIC
		};

		static char* cp_name[] = {
		@@ -147,6 +148,7 @@ static char* cp_type[] = {
		"ACCESS_USERSPACE",
		"WRITE_RO",
		"WRITE_KERN",
		"WRAP_ATOMIC"
		};

		static struct jprobe lkdtm;
		@@ -620,6 +622,17 @@ static void lkdtm_do_action(enum ctype which)
		do_overwritten();
		break;
		}
		case CT_WRAP_ATOMIC: {
		atomic_t under = ATOMIC_INIT(INT_MIN);
		atomic_t over = ATOMIC_INIT(INT_MAX);

		pr_info("attempting atomic underflow\n");
		atomic_dec(&under);
		pr_info("attempting atomic overflow\n");
		atomic_inc(&over);

		return;
		}
		case CT_NONE:
		default:
		break;