1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 *
4 * Copyright (c) 2014 Samsung Electronics Co., Ltd.
5 * Author: Andrey Ryabinin <a.ryabinin@samsung.com>
6 */
7
8 #include <linux/bitops.h>
9 #include <linux/delay.h>
10 #include <linux/kasan.h>
11 #include <linux/kernel.h>
12 #include <linux/mm.h>
13 #include <linux/mman.h>
14 #include <linux/module.h>
15 #include <linux/printk.h>
16 #include <linux/slab.h>
17 #include <linux/string.h>
18 #include <linux/uaccess.h>
19 #include <linux/io.h>
20 #include <linux/vmalloc.h>
21
22 #include <asm/page.h>
23
24 #include <kunit/test.h>
25
26 #include "../mm/kasan/kasan.h"
27
28 #define OOB_TAG_OFF (IS_ENABLED(CONFIG_KASAN_GENERIC) ? 0 : KASAN_SHADOW_SCALE_SIZE)
29
30 /*
31 * We assign some test results to these globals to make sure the tests
32 * are not eliminated as dead code.
33 */
34
35 void *kasan_ptr_result;
36 int kasan_int_result;
37
38 static struct kunit_resource resource;
39 static struct kunit_kasan_expectation fail_data;
40 static bool multishot;
41
kasan_test_init(struct kunit * test)42 static int kasan_test_init(struct kunit *test)
43 {
44 /*
45 * Temporarily enable multi-shot mode and set panic_on_warn=0.
46 * Otherwise, we'd only get a report for the first case.
47 */
48 multishot = kasan_save_enable_multi_shot();
49
50 return 0;
51 }
52
kasan_test_exit(struct kunit * test)53 static void kasan_test_exit(struct kunit *test)
54 {
55 kasan_restore_multi_shot(multishot);
56 }
57
58 /**
59 * KUNIT_EXPECT_KASAN_FAIL() - Causes a test failure when the expression does
60 * not cause a KASAN error. This uses a KUnit resource named "kasan_data." Do
61 * Do not use this name for a KUnit resource outside here.
62 *
63 */
64 #define KUNIT_EXPECT_KASAN_FAIL(test, condition) do { \
65 fail_data.report_expected = true; \
66 fail_data.report_found = false; \
67 kunit_add_named_resource(test, \
68 NULL, \
69 NULL, \
70 &resource, \
71 "kasan_data", &fail_data); \
72 condition; \
73 KUNIT_EXPECT_EQ(test, \
74 fail_data.report_expected, \
75 fail_data.report_found); \
76 } while (0)
77
kmalloc_oob_right(struct kunit * test)78 static void kmalloc_oob_right(struct kunit *test)
79 {
80 char *ptr;
81 size_t size = 123;
82
83 ptr = kmalloc(size, GFP_KERNEL);
84 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
85
86 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size + OOB_TAG_OFF] = 'x');
87 kfree(ptr);
88 }
89
kmalloc_oob_left(struct kunit * test)90 static void kmalloc_oob_left(struct kunit *test)
91 {
92 char *ptr;
93 size_t size = 15;
94
95 ptr = kmalloc(size, GFP_KERNEL);
96 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
97
98 KUNIT_EXPECT_KASAN_FAIL(test, *ptr = *(ptr - 1));
99 kfree(ptr);
100 }
101
kmalloc_node_oob_right(struct kunit * test)102 static void kmalloc_node_oob_right(struct kunit *test)
103 {
104 char *ptr;
105 size_t size = 4096;
106
107 ptr = kmalloc_node(size, GFP_KERNEL, 0);
108 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
109
110 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0);
111 kfree(ptr);
112 }
113
kmalloc_pagealloc_oob_right(struct kunit * test)114 static void kmalloc_pagealloc_oob_right(struct kunit *test)
115 {
116 char *ptr;
117 size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
118
119 if (!IS_ENABLED(CONFIG_SLUB)) {
120 kunit_info(test, "CONFIG_SLUB is not enabled.");
121 return;
122 }
123
124 /* Allocate a chunk that does not fit into a SLUB cache to trigger
125 * the page allocator fallback.
126 */
127 ptr = kmalloc(size, GFP_KERNEL);
128 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
129
130 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size + OOB_TAG_OFF] = 0);
131 kfree(ptr);
132 }
133
kmalloc_pagealloc_uaf(struct kunit * test)134 static void kmalloc_pagealloc_uaf(struct kunit *test)
135 {
136 char *ptr;
137 size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
138
139 if (!IS_ENABLED(CONFIG_SLUB)) {
140 kunit_info(test, "CONFIG_SLUB is not enabled.");
141 return;
142 }
143
144 ptr = kmalloc(size, GFP_KERNEL);
145 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
146
147 kfree(ptr);
148 KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = 0);
149 }
150
kmalloc_pagealloc_invalid_free(struct kunit * test)151 static void kmalloc_pagealloc_invalid_free(struct kunit *test)
152 {
153 char *ptr;
154 size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
155
156 if (!IS_ENABLED(CONFIG_SLUB)) {
157 kunit_info(test, "CONFIG_SLUB is not enabled.");
158 return;
159 }
160
161 ptr = kmalloc(size, GFP_KERNEL);
162 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
163
164 KUNIT_EXPECT_KASAN_FAIL(test, kfree(ptr + 1));
165 }
166
kmalloc_large_oob_right(struct kunit * test)167 static void kmalloc_large_oob_right(struct kunit *test)
168 {
169 char *ptr;
170 size_t size = KMALLOC_MAX_CACHE_SIZE - 256;
171 /* Allocate a chunk that is large enough, but still fits into a slab
172 * and does not trigger the page allocator fallback in SLUB.
173 */
174 ptr = kmalloc(size, GFP_KERNEL);
175 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
176
177 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0);
178 kfree(ptr);
179 }
180
kmalloc_oob_krealloc_more(struct kunit * test)181 static void kmalloc_oob_krealloc_more(struct kunit *test)
182 {
183 char *ptr1, *ptr2;
184 size_t size1 = 17;
185 size_t size2 = 19;
186
187 ptr1 = kmalloc(size1, GFP_KERNEL);
188 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
189
190 ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
191 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
192
193 KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size2 + OOB_TAG_OFF] = 'x');
194 kfree(ptr2);
195 }
196
kmalloc_oob_krealloc_less(struct kunit * test)197 static void kmalloc_oob_krealloc_less(struct kunit *test)
198 {
199 char *ptr1, *ptr2;
200 size_t size1 = 17;
201 size_t size2 = 15;
202
203 ptr1 = kmalloc(size1, GFP_KERNEL);
204 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
205
206 ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
207 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
208
209 KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size2 + OOB_TAG_OFF] = 'x');
210 kfree(ptr2);
211 }
212
kmalloc_oob_16(struct kunit * test)213 static void kmalloc_oob_16(struct kunit *test)
214 {
215 struct {
216 u64 words[2];
217 } *ptr1, *ptr2;
218
219 /* This test is specifically crafted for the generic mode. */
220 if (!IS_ENABLED(CONFIG_KASAN_GENERIC)) {
221 kunit_info(test, "CONFIG_KASAN_GENERIC required\n");
222 return;
223 }
224
225 ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL);
226 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
227
228 ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
229 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
230
231 KUNIT_EXPECT_KASAN_FAIL(test, *ptr1 = *ptr2);
232 kfree(ptr1);
233 kfree(ptr2);
234 }
235
kmalloc_uaf_16(struct kunit * test)236 static void kmalloc_uaf_16(struct kunit *test)
237 {
238 struct {
239 u64 words[2];
240 } *ptr1, *ptr2;
241
242 ptr1 = kmalloc(sizeof(*ptr1), GFP_KERNEL);
243 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
244
245 ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
246 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
247 kfree(ptr2);
248
249 KUNIT_EXPECT_KASAN_FAIL(test, *ptr1 = *ptr2);
250 kfree(ptr1);
251 }
252
kmalloc_oob_memset_2(struct kunit * test)253 static void kmalloc_oob_memset_2(struct kunit *test)
254 {
255 char *ptr;
256 size_t size = 8;
257
258 ptr = kmalloc(size, GFP_KERNEL);
259 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
260
261 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + 7 + OOB_TAG_OFF, 0, 2));
262 kfree(ptr);
263 }
264
kmalloc_oob_memset_4(struct kunit * test)265 static void kmalloc_oob_memset_4(struct kunit *test)
266 {
267 char *ptr;
268 size_t size = 8;
269
270 ptr = kmalloc(size, GFP_KERNEL);
271 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
272
273 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + 5 + OOB_TAG_OFF, 0, 4));
274 kfree(ptr);
275 }
276
277
kmalloc_oob_memset_8(struct kunit * test)278 static void kmalloc_oob_memset_8(struct kunit *test)
279 {
280 char *ptr;
281 size_t size = 8;
282
283 ptr = kmalloc(size, GFP_KERNEL);
284 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
285
286 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + 1 + OOB_TAG_OFF, 0, 8));
287 kfree(ptr);
288 }
289
kmalloc_oob_memset_16(struct kunit * test)290 static void kmalloc_oob_memset_16(struct kunit *test)
291 {
292 char *ptr;
293 size_t size = 16;
294
295 ptr = kmalloc(size, GFP_KERNEL);
296 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
297
298 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + 1 + OOB_TAG_OFF, 0, 16));
299 kfree(ptr);
300 }
301
kmalloc_oob_in_memset(struct kunit * test)302 static void kmalloc_oob_in_memset(struct kunit *test)
303 {
304 char *ptr;
305 size_t size = 666;
306
307 ptr = kmalloc(size, GFP_KERNEL);
308 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
309
310 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr, 0, size + 5 + OOB_TAG_OFF));
311 kfree(ptr);
312 }
313
kmalloc_memmove_invalid_size(struct kunit * test)314 static void kmalloc_memmove_invalid_size(struct kunit *test)
315 {
316 char *ptr;
317 size_t size = 64;
318 volatile size_t invalid_size = -2;
319
320 ptr = kmalloc(size, GFP_KERNEL);
321 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
322
323 memset((char *)ptr, 0, 64);
324
325 KUNIT_EXPECT_KASAN_FAIL(test,
326 memmove((char *)ptr, (char *)ptr + 4, invalid_size));
327 kfree(ptr);
328 }
329
kmalloc_uaf(struct kunit * test)330 static void kmalloc_uaf(struct kunit *test)
331 {
332 char *ptr;
333 size_t size = 10;
334
335 ptr = kmalloc(size, GFP_KERNEL);
336 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
337
338 kfree(ptr);
339 KUNIT_EXPECT_KASAN_FAIL(test, *(ptr + 8) = 'x');
340 }
341
kmalloc_uaf_memset(struct kunit * test)342 static void kmalloc_uaf_memset(struct kunit *test)
343 {
344 char *ptr;
345 size_t size = 33;
346
347 ptr = kmalloc(size, GFP_KERNEL);
348 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
349
350 kfree(ptr);
351 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr, 0, size));
352 }
353
kmalloc_uaf2(struct kunit * test)354 static void kmalloc_uaf2(struct kunit *test)
355 {
356 char *ptr1, *ptr2;
357 size_t size = 43;
358
359 ptr1 = kmalloc(size, GFP_KERNEL);
360 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
361
362 kfree(ptr1);
363
364 ptr2 = kmalloc(size, GFP_KERNEL);
365 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
366
367 KUNIT_EXPECT_KASAN_FAIL(test, ptr1[40] = 'x');
368 KUNIT_EXPECT_PTR_NE(test, ptr1, ptr2);
369
370 kfree(ptr2);
371 }
372
kfree_via_page(struct kunit * test)373 static void kfree_via_page(struct kunit *test)
374 {
375 char *ptr;
376 size_t size = 8;
377 struct page *page;
378 unsigned long offset;
379
380 ptr = kmalloc(size, GFP_KERNEL);
381 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
382
383 page = virt_to_page(ptr);
384 offset = offset_in_page(ptr);
385 kfree(page_address(page) + offset);
386 }
387
kfree_via_phys(struct kunit * test)388 static void kfree_via_phys(struct kunit *test)
389 {
390 char *ptr;
391 size_t size = 8;
392 phys_addr_t phys;
393
394 ptr = kmalloc(size, GFP_KERNEL);
395 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
396
397 phys = virt_to_phys(ptr);
398 kfree(phys_to_virt(phys));
399 }
400
kmem_cache_oob(struct kunit * test)401 static void kmem_cache_oob(struct kunit *test)
402 {
403 char *p;
404 size_t size = 200;
405 struct kmem_cache *cache = kmem_cache_create("test_cache",
406 size, 0,
407 0, NULL);
408 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
409 p = kmem_cache_alloc(cache, GFP_KERNEL);
410 if (!p) {
411 kunit_err(test, "Allocation failed: %s\n", __func__);
412 kmem_cache_destroy(cache);
413 return;
414 }
415
416 KUNIT_EXPECT_KASAN_FAIL(test, *p = p[size + OOB_TAG_OFF]);
417 kmem_cache_free(cache, p);
418 kmem_cache_destroy(cache);
419 }
420
memcg_accounted_kmem_cache(struct kunit * test)421 static void memcg_accounted_kmem_cache(struct kunit *test)
422 {
423 int i;
424 char *p;
425 size_t size = 200;
426 struct kmem_cache *cache;
427
428 cache = kmem_cache_create("test_cache", size, 0, SLAB_ACCOUNT, NULL);
429 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
430
431 /*
432 * Several allocations with a delay to allow for lazy per memcg kmem
433 * cache creation.
434 */
435 for (i = 0; i < 5; i++) {
436 p = kmem_cache_alloc(cache, GFP_KERNEL);
437 if (!p)
438 goto free_cache;
439
440 kmem_cache_free(cache, p);
441 msleep(100);
442 }
443
444 free_cache:
445 kmem_cache_destroy(cache);
446 }
447
448 static char global_array[10];
449
kasan_global_oob(struct kunit * test)450 static void kasan_global_oob(struct kunit *test)
451 {
452 /*
453 * Deliberate out-of-bounds access. To prevent CONFIG_UBSAN_LOCAL_BOUNDS
454 * from failing here and panicing the kernel, access the array via a
455 * volatile pointer, which will prevent the compiler from being able to
456 * determine the array bounds.
457 *
458 * This access uses a volatile pointer to char (char *volatile) rather
459 * than the more conventional pointer to volatile char (volatile char *)
460 * because we want to prevent the compiler from making inferences about
461 * the pointer itself (i.e. its array bounds), not the data that it
462 * refers to.
463 */
464 char *volatile array = global_array;
465 char *p = &array[ARRAY_SIZE(global_array) + 3];
466
467 /* Only generic mode instruments globals. */
468 if (!IS_ENABLED(CONFIG_KASAN_GENERIC)) {
469 kunit_info(test, "CONFIG_KASAN_GENERIC required");
470 return;
471 }
472
473 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
474 }
475
ksize_unpoisons_memory(struct kunit * test)476 static void ksize_unpoisons_memory(struct kunit *test)
477 {
478 char *ptr;
479 size_t size = 123, real_size;
480
481 ptr = kmalloc(size, GFP_KERNEL);
482 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
483 real_size = ksize(ptr);
484 /* This access doesn't trigger an error. */
485 ptr[size] = 'x';
486 /* This one does. */
487 KUNIT_EXPECT_KASAN_FAIL(test, ptr[real_size] = 'y');
488 kfree(ptr);
489 }
490
kasan_stack_oob(struct kunit * test)491 static void kasan_stack_oob(struct kunit *test)
492 {
493 char stack_array[10];
494 /* See comment in kasan_global_oob. */
495 char *volatile array = stack_array;
496 char *p = &array[ARRAY_SIZE(stack_array) + OOB_TAG_OFF];
497
498 if (!IS_ENABLED(CONFIG_KASAN_STACK)) {
499 kunit_info(test, "CONFIG_KASAN_STACK is not enabled");
500 return;
501 }
502
503 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
504 }
505
kasan_alloca_oob_left(struct kunit * test)506 static void kasan_alloca_oob_left(struct kunit *test)
507 {
508 volatile int i = 10;
509 char alloca_array[i];
510 /* See comment in kasan_global_oob. */
511 char *volatile array = alloca_array;
512 char *p = array - 1;
513
514 /* Only generic mode instruments dynamic allocas. */
515 if (!IS_ENABLED(CONFIG_KASAN_GENERIC)) {
516 kunit_info(test, "CONFIG_KASAN_GENERIC required");
517 return;
518 }
519
520 if (!IS_ENABLED(CONFIG_KASAN_STACK)) {
521 kunit_info(test, "CONFIG_KASAN_STACK is not enabled");
522 return;
523 }
524
525 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
526 }
527
kasan_alloca_oob_right(struct kunit * test)528 static void kasan_alloca_oob_right(struct kunit *test)
529 {
530 volatile int i = 10;
531 char alloca_array[i];
532 /* See comment in kasan_global_oob. */
533 char *volatile array = alloca_array;
534 char *p = array + i;
535
536 /* Only generic mode instruments dynamic allocas. */
537 if (!IS_ENABLED(CONFIG_KASAN_GENERIC)) {
538 kunit_info(test, "CONFIG_KASAN_GENERIC required");
539 return;
540 }
541
542 if (!IS_ENABLED(CONFIG_KASAN_STACK)) {
543 kunit_info(test, "CONFIG_KASAN_STACK is not enabled");
544 return;
545 }
546
547 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
548 }
549
kmem_cache_double_free(struct kunit * test)550 static void kmem_cache_double_free(struct kunit *test)
551 {
552 char *p;
553 size_t size = 200;
554 struct kmem_cache *cache;
555
556 cache = kmem_cache_create("test_cache", size, 0, 0, NULL);
557 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
558
559 p = kmem_cache_alloc(cache, GFP_KERNEL);
560 if (!p) {
561 kunit_err(test, "Allocation failed: %s\n", __func__);
562 kmem_cache_destroy(cache);
563 return;
564 }
565
566 kmem_cache_free(cache, p);
567 KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p));
568 kmem_cache_destroy(cache);
569 }
570
kmem_cache_invalid_free(struct kunit * test)571 static void kmem_cache_invalid_free(struct kunit *test)
572 {
573 char *p;
574 size_t size = 200;
575 struct kmem_cache *cache;
576
577 cache = kmem_cache_create("test_cache", size, 0, SLAB_TYPESAFE_BY_RCU,
578 NULL);
579 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
580
581 p = kmem_cache_alloc(cache, GFP_KERNEL);
582 if (!p) {
583 kunit_err(test, "Allocation failed: %s\n", __func__);
584 kmem_cache_destroy(cache);
585 return;
586 }
587
588 /* Trigger invalid free, the object doesn't get freed */
589 KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p + 1));
590
591 /*
592 * Properly free the object to prevent the "Objects remaining in
593 * test_cache on __kmem_cache_shutdown" BUG failure.
594 */
595 kmem_cache_free(cache, p);
596
597 kmem_cache_destroy(cache);
598 }
599
kasan_memchr(struct kunit * test)600 static void kasan_memchr(struct kunit *test)
601 {
602 char *ptr;
603 size_t size = 24;
604
605 /* See https://bugzilla.kernel.org/show_bug.cgi?id=206337 */
606 if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
607 kunit_info(test,
608 "str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT");
609 return;
610 }
611
612 if (OOB_TAG_OFF)
613 size = round_up(size, OOB_TAG_OFF);
614
615 ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
616 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
617
618 KUNIT_EXPECT_KASAN_FAIL(test,
619 kasan_ptr_result = memchr(ptr, '1', size + 1));
620
621 kfree(ptr);
622 }
623
kasan_memcmp(struct kunit * test)624 static void kasan_memcmp(struct kunit *test)
625 {
626 char *ptr;
627 size_t size = 24;
628 int arr[9];
629
630 /* See https://bugzilla.kernel.org/show_bug.cgi?id=206337 */
631 if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
632 kunit_info(test,
633 "str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT");
634 return;
635 }
636
637 if (OOB_TAG_OFF)
638 size = round_up(size, OOB_TAG_OFF);
639
640 ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
641 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
642 memset(arr, 0, sizeof(arr));
643
644 KUNIT_EXPECT_KASAN_FAIL(test,
645 kasan_int_result = memcmp(ptr, arr, size+1));
646 kfree(ptr);
647 }
648
kasan_strings(struct kunit * test)649 static void kasan_strings(struct kunit *test)
650 {
651 char *ptr;
652 size_t size = 24;
653
654 /* See https://bugzilla.kernel.org/show_bug.cgi?id=206337 */
655 if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
656 kunit_info(test,
657 "str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT");
658 return;
659 }
660
661 ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
662 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
663
664 kfree(ptr);
665
666 /*
667 * Try to cause only 1 invalid access (less spam in dmesg).
668 * For that we need ptr to point to zeroed byte.
669 * Skip metadata that could be stored in freed object so ptr
670 * will likely point to zeroed byte.
671 */
672 ptr += 16;
673 KUNIT_EXPECT_KASAN_FAIL(test, kasan_ptr_result = strchr(ptr, '1'));
674
675 KUNIT_EXPECT_KASAN_FAIL(test, kasan_ptr_result = strrchr(ptr, '1'));
676
677 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strcmp(ptr, "2"));
678
679 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strncmp(ptr, "2", 1));
680
681 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strlen(ptr));
682
683 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strnlen(ptr, 1));
684 }
685
kasan_bitops_modify(struct kunit * test,int nr,void * addr)686 static void kasan_bitops_modify(struct kunit *test, int nr, void *addr)
687 {
688 KUNIT_EXPECT_KASAN_FAIL(test, set_bit(nr, addr));
689 KUNIT_EXPECT_KASAN_FAIL(test, __set_bit(nr, addr));
690 KUNIT_EXPECT_KASAN_FAIL(test, clear_bit(nr, addr));
691 KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit(nr, addr));
692 KUNIT_EXPECT_KASAN_FAIL(test, clear_bit_unlock(nr, addr));
693 KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit_unlock(nr, addr));
694 KUNIT_EXPECT_KASAN_FAIL(test, change_bit(nr, addr));
695 KUNIT_EXPECT_KASAN_FAIL(test, __change_bit(nr, addr));
696 }
697
kasan_bitops_test_and_modify(struct kunit * test,int nr,void * addr)698 static void kasan_bitops_test_and_modify(struct kunit *test, int nr, void *addr)
699 {
700 KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit(nr, addr));
701 KUNIT_EXPECT_KASAN_FAIL(test, __test_and_set_bit(nr, addr));
702 KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit_lock(nr, addr));
703 KUNIT_EXPECT_KASAN_FAIL(test, test_and_clear_bit(nr, addr));
704 KUNIT_EXPECT_KASAN_FAIL(test, __test_and_clear_bit(nr, addr));
705 KUNIT_EXPECT_KASAN_FAIL(test, test_and_change_bit(nr, addr));
706 KUNIT_EXPECT_KASAN_FAIL(test, __test_and_change_bit(nr, addr));
707 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = test_bit(nr, addr));
708
709 #if defined(clear_bit_unlock_is_negative_byte)
710 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result =
711 clear_bit_unlock_is_negative_byte(nr, addr));
712 #endif
713 }
714
kasan_bitops_generic(struct kunit * test)715 static void kasan_bitops_generic(struct kunit *test)
716 {
717 long *bits;
718
719 /* This test is specifically crafted for the generic mode. */
720 if (!IS_ENABLED(CONFIG_KASAN_GENERIC)) {
721 kunit_info(test, "CONFIG_KASAN_GENERIC required\n");
722 return;
723 }
724
725 /*
726 * Allocate 1 more byte, which causes kzalloc to round up to 16-bytes;
727 * this way we do not actually corrupt other memory.
728 */
729 bits = kzalloc(sizeof(*bits) + 1, GFP_KERNEL);
730 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits);
731
732 /*
733 * Below calls try to access bit within allocated memory; however, the
734 * below accesses are still out-of-bounds, since bitops are defined to
735 * operate on the whole long the bit is in.
736 */
737 kasan_bitops_modify(test, BITS_PER_LONG, bits);
738
739 /*
740 * Below calls try to access bit beyond allocated memory.
741 */
742 kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, bits);
743
744 kfree(bits);
745 }
746
kasan_bitops_tags(struct kunit * test)747 static void kasan_bitops_tags(struct kunit *test)
748 {
749 long *bits;
750
751 /* This test is specifically crafted for the tag-based mode. */
752 if (IS_ENABLED(CONFIG_KASAN_GENERIC)) {
753 kunit_info(test, "CONFIG_KASAN_SW_TAGS required\n");
754 return;
755 }
756
757 /* kmalloc-64 cache will be used and the last 16 bytes will be the redzone. */
758 bits = kzalloc(48, GFP_KERNEL);
759 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits);
760
761 /* Do the accesses past the 48 allocated bytes, but within the redone. */
762 kasan_bitops_modify(test, BITS_PER_LONG, (void *)bits + 48);
763 kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, (void *)bits + 48);
764
765 kfree(bits);
766 }
767
kmalloc_double_kzfree(struct kunit * test)768 static void kmalloc_double_kzfree(struct kunit *test)
769 {
770 char *ptr;
771 size_t size = 16;
772
773 ptr = kmalloc(size, GFP_KERNEL);
774 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
775
776 kfree_sensitive(ptr);
777 KUNIT_EXPECT_KASAN_FAIL(test, kfree_sensitive(ptr));
778 }
779
vmalloc_oob(struct kunit * test)780 static void vmalloc_oob(struct kunit *test)
781 {
782 void *area;
783
784 if (!IS_ENABLED(CONFIG_KASAN_VMALLOC)) {
785 kunit_info(test, "CONFIG_KASAN_VMALLOC is not enabled.");
786 return;
787 }
788
789 /*
790 * We have to be careful not to hit the guard page.
791 * The MMU will catch that and crash us.
792 */
793 area = vmalloc(3000);
794 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, area);
795
796 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)area)[3100]);
797 vfree(area);
798 }
799
800 static struct kunit_case kasan_kunit_test_cases[] = {
801 KUNIT_CASE(kmalloc_oob_right),
802 KUNIT_CASE(kmalloc_oob_left),
803 KUNIT_CASE(kmalloc_node_oob_right),
804 KUNIT_CASE(kmalloc_pagealloc_oob_right),
805 KUNIT_CASE(kmalloc_pagealloc_uaf),
806 KUNIT_CASE(kmalloc_pagealloc_invalid_free),
807 KUNIT_CASE(kmalloc_large_oob_right),
808 KUNIT_CASE(kmalloc_oob_krealloc_more),
809 KUNIT_CASE(kmalloc_oob_krealloc_less),
810 KUNIT_CASE(kmalloc_oob_16),
811 KUNIT_CASE(kmalloc_uaf_16),
812 KUNIT_CASE(kmalloc_oob_in_memset),
813 KUNIT_CASE(kmalloc_oob_memset_2),
814 KUNIT_CASE(kmalloc_oob_memset_4),
815 KUNIT_CASE(kmalloc_oob_memset_8),
816 KUNIT_CASE(kmalloc_oob_memset_16),
817 KUNIT_CASE(kmalloc_memmove_invalid_size),
818 KUNIT_CASE(kmalloc_uaf),
819 KUNIT_CASE(kmalloc_uaf_memset),
820 KUNIT_CASE(kmalloc_uaf2),
821 KUNIT_CASE(kfree_via_page),
822 KUNIT_CASE(kfree_via_phys),
823 KUNIT_CASE(kmem_cache_oob),
824 KUNIT_CASE(memcg_accounted_kmem_cache),
825 KUNIT_CASE(kasan_global_oob),
826 KUNIT_CASE(kasan_stack_oob),
827 KUNIT_CASE(kasan_alloca_oob_left),
828 KUNIT_CASE(kasan_alloca_oob_right),
829 KUNIT_CASE(ksize_unpoisons_memory),
830 KUNIT_CASE(kmem_cache_double_free),
831 KUNIT_CASE(kmem_cache_invalid_free),
832 KUNIT_CASE(kasan_memchr),
833 KUNIT_CASE(kasan_memcmp),
834 KUNIT_CASE(kasan_strings),
835 KUNIT_CASE(kasan_bitops_generic),
836 KUNIT_CASE(kasan_bitops_tags),
837 KUNIT_CASE(kmalloc_double_kzfree),
838 KUNIT_CASE(vmalloc_oob),
839 {}
840 };
841
842 static struct kunit_suite kasan_kunit_test_suite = {
843 .name = "kasan",
844 .init = kasan_test_init,
845 .test_cases = kasan_kunit_test_cases,
846 .exit = kasan_test_exit,
847 };
848
849 kunit_test_suite(kasan_kunit_test_suite);
850
851 MODULE_LICENSE("GPL");
852