Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ffc514f3 authored by Kees Cook's avatar Kees Cook
Browse files

lkdtm: split heap corruption tests to separate file 



This splits the *_AFTER_FREE and related tests into the new lkdtm_heap.c
file to help separate things better for readability.

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent 0d9eb29b

drivers/misc/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -59,6 +59,7 @@ obj-$(CONFIG_CXL_BASE) += cxl/ 
obj-$(CONFIG_PANEL)             += panel.o



lkdtm-$(CONFIG_LKDTM)		+= lkdtm_core.o

lkdtm-$(CONFIG_LKDTM)		+= lkdtm_heap.o

lkdtm-$(CONFIG_LKDTM)		+= lkdtm_perms.o

lkdtm-$(CONFIG_LKDTM)		+= lkdtm_rodata_objcopy.o

lkdtm-$(CONFIG_LKDTM)		+= lkdtm_usercopy.o

drivers/misc/lkdtm.h

+7 −0
Original line number Diff line number Diff line 
#ifndef __LKDTM_H

#define __LKDTM_H



/* lkdtm_heap.c */

void lkdtm_OVERWRITE_ALLOCATION(void);

void lkdtm_WRITE_AFTER_FREE(void);

void lkdtm_READ_AFTER_FREE(void);

void lkdtm_WRITE_BUDDY_AFTER_FREE(void);

void lkdtm_READ_BUDDY_AFTER_FREE(void);



/* lkdtm_perms.c */

void __init lkdtm_perms_init(void);

void lkdtm_WRITE_RO(void);

drivers/misc/lkdtm_core.c

+10 −114
Original line number Diff line number Diff line
@@ -384,125 +384,21 @@ static void lkdtm_do_action(enum ctype which) 
		*p = val;

		 break;

	}

	case CT_OVERWRITE_ALLOCATION: {

		size_t len = 1020;

		u32 *data = kmalloc(len, GFP_KERNEL);



		data[1024 / sizeof(u32)] = 0x12345678;

		kfree(data);

	case CT_OVERWRITE_ALLOCATION:

		lkdtm_OVERWRITE_ALLOCATION();

		break;

	}

	case CT_WRITE_AFTER_FREE: {

		int *base, *again;

		size_t len = 1024;

		/*

		 * The slub allocator uses the first word to store the free

		 * pointer in some configurations. Use the middle of the

		 * allocation to avoid running into the freelist

		 */

		size_t offset = (len / sizeof(*base)) / 2;



		base = kmalloc(len, GFP_KERNEL);

		pr_info("Allocated memory %p-%p\n", base, &base[offset * 2]);

		pr_info("Attempting bad write to freed memory at %p\n",

			&base[offset]);

		kfree(base);

		base[offset] = 0x0abcdef0;

		/* Attempt to notice the overwrite. */

		again = kmalloc(len, GFP_KERNEL);

		kfree(again);

		if (again != base)

			pr_info("Hmm, didn't get the same memory range.\n");



	case CT_WRITE_AFTER_FREE:

		lkdtm_WRITE_AFTER_FREE();

		break;

	}

	case CT_READ_AFTER_FREE: {

		int *base, *val, saw;

		size_t len = 1024;

		/*

		 * The slub allocator uses the first word to store the free

		 * pointer in some configurations. Use the middle of the

		 * allocation to avoid running into the freelist

		 */

		size_t offset = (len / sizeof(*base)) / 2;



		base = kmalloc(len, GFP_KERNEL);

		if (!base)

	case CT_READ_AFTER_FREE:

		lkdtm_READ_AFTER_FREE();

		break;



		val = kmalloc(len, GFP_KERNEL);

		if (!val) {

			kfree(base);

	case CT_WRITE_BUDDY_AFTER_FREE:

		lkdtm_WRITE_BUDDY_AFTER_FREE();

		break;

		}



		*val = 0x12345678;

		base[offset] = *val;

		pr_info("Value in memory before free: %x\n", base[offset]);



		kfree(base);



		pr_info("Attempting bad read from freed memory\n");

		saw = base[offset];

		if (saw != *val) {

			/* Good! Poisoning happened, so declare a win. */

			pr_info("Memory correctly poisoned (%x)\n", saw);

			BUG();

		}

		pr_info("Memory was not poisoned\n");



		kfree(val);

	case CT_READ_BUDDY_AFTER_FREE:

		lkdtm_READ_BUDDY_AFTER_FREE();

		break;

	}

	case CT_WRITE_BUDDY_AFTER_FREE: {

		unsigned long p = __get_free_page(GFP_KERNEL);

		if (!p)

			break;

		pr_info("Writing to the buddy page before free\n");

		memset((void *)p, 0x3, PAGE_SIZE);

		free_page(p);

		schedule();

		pr_info("Attempting bad write to the buddy page after free\n");

		memset((void *)p, 0x78, PAGE_SIZE);

		/* Attempt to notice the overwrite. */

		p = __get_free_page(GFP_KERNEL);

		free_page(p);

		schedule();



		break;

	}

	case CT_READ_BUDDY_AFTER_FREE: {

		unsigned long p = __get_free_page(GFP_KERNEL);

		int saw, *val;

		int *base;



		if (!p)

			break;



		val = kmalloc(1024, GFP_KERNEL);

		if (!val) {

			free_page(p);

			break;

		}



		base = (int *)p;



		*val = 0x12345678;

		base[0] = *val;

		pr_info("Value in memory before free: %x\n", base[0]);

		free_page(p);

		pr_info("Attempting to read from freed memory\n");

		saw = base[0];

		if (saw != *val) {

			/* Good! Poisoning happened, so declare a win. */

			pr_info("Memory correctly poisoned (%x)\n", saw);

			BUG();

		}

		pr_info("Buddy page was not poisoned\n");



		kfree(val);

		break;

	}

	case CT_SOFTLOCKUP:

		preempt_disable();

		for (;;)

drivers/misc/lkdtm_heap.c

0 → 100644
+146 −0
Original line number Diff line number Diff line 
/*

 * This is for all the tests relating directly to heap memory, including

 * page allocation and slab allocations.

 */

#define pr_fmt(fmt) "lkdtm: " fmt



#include <linux/kernel.h>

#include <linux/slab.h>



#include "lkdtm.h"



/*

 * This tries to stay within the next largest power-of-2 kmalloc cache

 * to avoid actually overwriting anything important if it's not detected

 * correctly.

 */

void lkdtm_OVERWRITE_ALLOCATION(void)

{

	size_t len = 1020;

	u32 *data = kmalloc(len, GFP_KERNEL);



	data[1024 / sizeof(u32)] = 0x12345678;

	kfree(data);

}



void lkdtm_WRITE_AFTER_FREE(void)

{

	int *base, *again;

	size_t len = 1024;

	/*

	 * The slub allocator uses the first word to store the free

	 * pointer in some configurations. Use the middle of the

	 * allocation to avoid running into the freelist

	 */

	size_t offset = (len / sizeof(*base)) / 2;



	base = kmalloc(len, GFP_KERNEL);

	pr_info("Allocated memory %p-%p\n", base, &base[offset * 2]);

	pr_info("Attempting bad write to freed memory at %p\n",

		&base[offset]);

	kfree(base);

	base[offset] = 0x0abcdef0;

	/* Attempt to notice the overwrite. */

	again = kmalloc(len, GFP_KERNEL);

	kfree(again);

	if (again != base)

		pr_info("Hmm, didn't get the same memory range.\n");

}



void lkdtm_READ_AFTER_FREE(void)

{

	int *base, *val, saw;

	size_t len = 1024;

	/*

	 * The slub allocator uses the first word to store the free

	 * pointer in some configurations. Use the middle of the

	 * allocation to avoid running into the freelist

	 */

	size_t offset = (len / sizeof(*base)) / 2;



	base = kmalloc(len, GFP_KERNEL);

	if (!base) {

		pr_info("Unable to allocate base memory.\n");

		return;

	}



	val = kmalloc(len, GFP_KERNEL);

	if (!val) {

		pr_info("Unable to allocate val memory.\n");

		kfree(base);

		return;

	}



	*val = 0x12345678;

	base[offset] = *val;

	pr_info("Value in memory before free: %x\n", base[offset]);



	kfree(base);



	pr_info("Attempting bad read from freed memory\n");

	saw = base[offset];

	if (saw != *val) {

		/* Good! Poisoning happened, so declare a win. */

		pr_info("Memory correctly poisoned (%x)\n", saw);

		BUG();

	}

	pr_info("Memory was not poisoned\n");



	kfree(val);

}



void lkdtm_WRITE_BUDDY_AFTER_FREE(void)

{

	unsigned long p = __get_free_page(GFP_KERNEL);

	if (!p) {

		pr_info("Unable to allocate free page\n");

		return;

	}



	pr_info("Writing to the buddy page before free\n");

	memset((void *)p, 0x3, PAGE_SIZE);

	free_page(p);

	schedule();

	pr_info("Attempting bad write to the buddy page after free\n");

	memset((void *)p, 0x78, PAGE_SIZE);

	/* Attempt to notice the overwrite. */

	p = __get_free_page(GFP_KERNEL);

	free_page(p);

	schedule();

}



void lkdtm_READ_BUDDY_AFTER_FREE(void)

{

	unsigned long p = __get_free_page(GFP_KERNEL);

	int saw, *val;

	int *base;



	if (!p) {

		pr_info("Unable to allocate free page\n");

		return;

	}



	val = kmalloc(1024, GFP_KERNEL);

	if (!val) {

		pr_info("Unable to allocate val memory.\n");

		free_page(p);

		return;

	}



	base = (int *)p;



	*val = 0x12345678;

	base[0] = *val;

	pr_info("Value in memory before free: %x\n", base[0]);

	free_page(p);

	pr_info("Attempting to read from freed memory\n");

	saw = base[0];

	if (saw != *val) {

		/* Good! Poisoning happened, so declare a win. */

		pr_info("Memory correctly poisoned (%x)\n", saw);

		BUG();

	}

	pr_info("Buddy page was not poisoned\n");



	kfree(val);

}