1 /*
2 *
3 * Copyright (c) 2014 Samsung Electronics Co., Ltd.
4 * Author: Andrey Ryabinin <a.ryabinin@samsung.com>
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 *
10 */
11
12 #define pr_fmt(fmt) "kasan test: %s " fmt, __func__
13
14 #include <linux/kernel.h>
15 #include <linux/mman.h>
16 #include <linux/mm.h>
17 #include <linux/printk.h>
18 #include <linux/slab.h>
19 #include <linux/string.h>
20 #include <linux/uaccess.h>
21 #include <linux/module.h>
22 #include <linux/kasan.h>
23
24 /*
25 * Note: test functions are marked noinline so that their names appear in
26 * reports.
27 */
28
kmalloc_oob_right(void)29 static noinline void __init kmalloc_oob_right(void)
30 {
31 char *ptr;
32 size_t size = 123;
33
34 pr_info("out-of-bounds to right\n");
35 ptr = kmalloc(size, GFP_KERNEL);
36 if (!ptr) {
37 pr_err("Allocation failed\n");
38 return;
39 }
40
41 ptr[size] = 'x';
42 kfree(ptr);
43 }
44
kmalloc_oob_left(void)45 static noinline void __init kmalloc_oob_left(void)
46 {
47 char *ptr;
48 size_t size = 15;
49
50 pr_info("out-of-bounds to left\n");
51 ptr = kmalloc(size, GFP_KERNEL);
52 if (!ptr) {
53 pr_err("Allocation failed\n");
54 return;
55 }
56
57 *ptr = *(ptr - 1);
58 kfree(ptr);
59 }
60
kmalloc_node_oob_right(void)61 static noinline void __init kmalloc_node_oob_right(void)
62 {
63 char *ptr;
64 size_t size = 4096;
65
66 pr_info("kmalloc_node(): out-of-bounds to right\n");
67 ptr = kmalloc_node(size, GFP_KERNEL, 0);
68 if (!ptr) {
69 pr_err("Allocation failed\n");
70 return;
71 }
72
73 ptr[size] = 0;
74 kfree(ptr);
75 }
76
77 #ifdef CONFIG_SLUB
kmalloc_pagealloc_oob_right(void)78 static noinline void __init kmalloc_pagealloc_oob_right(void)
79 {
80 char *ptr;
81 size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
82
83 /* Allocate a chunk that does not fit into a SLUB cache to trigger
84 * the page allocator fallback.
85 */
86 pr_info("kmalloc pagealloc allocation: out-of-bounds to right\n");
87 ptr = kmalloc(size, GFP_KERNEL);
88 if (!ptr) {
89 pr_err("Allocation failed\n");
90 return;
91 }
92
93 ptr[size] = 0;
94 kfree(ptr);
95 }
96 #endif
97
kmalloc_large_oob_right(void)98 static noinline void __init kmalloc_large_oob_right(void)
99 {
100 char *ptr;
101 size_t size = KMALLOC_MAX_CACHE_SIZE - 256;
102 /* Allocate a chunk that is large enough, but still fits into a slab
103 * and does not trigger the page allocator fallback in SLUB.
104 */
105 pr_info("kmalloc large allocation: out-of-bounds to right\n");
106 ptr = kmalloc(size, GFP_KERNEL);
107 if (!ptr) {
108 pr_err("Allocation failed\n");
109 return;
110 }
111
112 ptr[size] = 0;
113 kfree(ptr);
114 }
115
kmalloc_oob_krealloc_more(void)116 static noinline void __init kmalloc_oob_krealloc_more(void)
117 {
118 char *ptr1, *ptr2;
119 size_t size1 = 17;
120 size_t size2 = 19;
121
122 pr_info("out-of-bounds after krealloc more\n");
123 ptr1 = kmalloc(size1, GFP_KERNEL);
124 ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
125 if (!ptr1 || !ptr2) {
126 pr_err("Allocation failed\n");
127 kfree(ptr1);
128 kfree(ptr2);
129 return;
130 }
131
132 ptr2[size2] = 'x';
133 kfree(ptr2);
134 }
135
kmalloc_oob_krealloc_less(void)136 static noinline void __init kmalloc_oob_krealloc_less(void)
137 {
138 char *ptr1, *ptr2;
139 size_t size1 = 17;
140 size_t size2 = 15;
141
142 pr_info("out-of-bounds after krealloc less\n");
143 ptr1 = kmalloc(size1, GFP_KERNEL);
144 ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
145 if (!ptr1 || !ptr2) {
146 pr_err("Allocation failed\n");
147 kfree(ptr1);
148 return;
149 }
150 ptr2[size2] = 'x';
151 kfree(ptr2);
152 }
153
kmalloc_oob_16(void)154 static noinline void __init kmalloc_oob_16(void)
155 {
156 struct {
157 u64 words[2];
158 } *ptr1, *ptr2;
159
160 pr_info("kmalloc out-of-bounds for 16-bytes access\n");
161 ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL);
162 ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
163 if (!ptr1 || !ptr2) {
164 pr_err("Allocation failed\n");
165 kfree(ptr1);
166 kfree(ptr2);
167 return;
168 }
169 *ptr1 = *ptr2;
170 kfree(ptr1);
171 kfree(ptr2);
172 }
173
kmalloc_oob_memset_2(void)174 static noinline void __init kmalloc_oob_memset_2(void)
175 {
176 char *ptr;
177 size_t size = 8;
178
179 pr_info("out-of-bounds in memset2\n");
180 ptr = kmalloc(size, GFP_KERNEL);
181 if (!ptr) {
182 pr_err("Allocation failed\n");
183 return;
184 }
185
186 memset(ptr+7, 0, 2);
187 kfree(ptr);
188 }
189
kmalloc_oob_memset_4(void)190 static noinline void __init kmalloc_oob_memset_4(void)
191 {
192 char *ptr;
193 size_t size = 8;
194
195 pr_info("out-of-bounds in memset4\n");
196 ptr = kmalloc(size, GFP_KERNEL);
197 if (!ptr) {
198 pr_err("Allocation failed\n");
199 return;
200 }
201
202 memset(ptr+5, 0, 4);
203 kfree(ptr);
204 }
205
206
kmalloc_oob_memset_8(void)207 static noinline void __init kmalloc_oob_memset_8(void)
208 {
209 char *ptr;
210 size_t size = 8;
211
212 pr_info("out-of-bounds in memset8\n");
213 ptr = kmalloc(size, GFP_KERNEL);
214 if (!ptr) {
215 pr_err("Allocation failed\n");
216 return;
217 }
218
219 memset(ptr+1, 0, 8);
220 kfree(ptr);
221 }
222
kmalloc_oob_memset_16(void)223 static noinline void __init kmalloc_oob_memset_16(void)
224 {
225 char *ptr;
226 size_t size = 16;
227
228 pr_info("out-of-bounds in memset16\n");
229 ptr = kmalloc(size, GFP_KERNEL);
230 if (!ptr) {
231 pr_err("Allocation failed\n");
232 return;
233 }
234
235 memset(ptr+1, 0, 16);
236 kfree(ptr);
237 }
238
kmalloc_oob_in_memset(void)239 static noinline void __init kmalloc_oob_in_memset(void)
240 {
241 char *ptr;
242 size_t size = 666;
243
244 pr_info("out-of-bounds in memset\n");
245 ptr = kmalloc(size, GFP_KERNEL);
246 if (!ptr) {
247 pr_err("Allocation failed\n");
248 return;
249 }
250
251 memset(ptr, 0, size+5);
252 kfree(ptr);
253 }
254
kmalloc_uaf(void)255 static noinline void __init kmalloc_uaf(void)
256 {
257 char *ptr;
258 size_t size = 10;
259
260 pr_info("use-after-free\n");
261 ptr = kmalloc(size, GFP_KERNEL);
262 if (!ptr) {
263 pr_err("Allocation failed\n");
264 return;
265 }
266
267 kfree(ptr);
268 *(ptr + 8) = 'x';
269 }
270
kmalloc_uaf_memset(void)271 static noinline void __init kmalloc_uaf_memset(void)
272 {
273 char *ptr;
274 size_t size = 33;
275
276 pr_info("use-after-free in memset\n");
277 ptr = kmalloc(size, GFP_KERNEL);
278 if (!ptr) {
279 pr_err("Allocation failed\n");
280 return;
281 }
282
283 kfree(ptr);
284 memset(ptr, 0, size);
285 }
286
kmalloc_uaf2(void)287 static noinline void __init kmalloc_uaf2(void)
288 {
289 char *ptr1, *ptr2;
290 size_t size = 43;
291
292 pr_info("use-after-free after another kmalloc\n");
293 ptr1 = kmalloc(size, GFP_KERNEL);
294 if (!ptr1) {
295 pr_err("Allocation failed\n");
296 return;
297 }
298
299 kfree(ptr1);
300 ptr2 = kmalloc(size, GFP_KERNEL);
301 if (!ptr2) {
302 pr_err("Allocation failed\n");
303 return;
304 }
305
306 ptr1[40] = 'x';
307 if (ptr1 == ptr2)
308 pr_err("Could not detect use-after-free: ptr1 == ptr2\n");
309 kfree(ptr2);
310 }
311
kmem_cache_oob(void)312 static noinline void __init kmem_cache_oob(void)
313 {
314 char *p;
315 size_t size = 200;
316 struct kmem_cache *cache = kmem_cache_create("test_cache",
317 size, 0,
318 0, NULL);
319 if (!cache) {
320 pr_err("Cache allocation failed\n");
321 return;
322 }
323 pr_info("out-of-bounds in kmem_cache_alloc\n");
324 p = kmem_cache_alloc(cache, GFP_KERNEL);
325 if (!p) {
326 pr_err("Allocation failed\n");
327 kmem_cache_destroy(cache);
328 return;
329 }
330
331 *p = p[size];
332 kmem_cache_free(cache, p);
333 kmem_cache_destroy(cache);
334 }
335
336 static char global_array[10];
337
kasan_global_oob(void)338 static noinline void __init kasan_global_oob(void)
339 {
340 volatile int i = 3;
341 char *p = &global_array[ARRAY_SIZE(global_array) + i];
342
343 pr_info("out-of-bounds global variable\n");
344 *(volatile char *)p;
345 }
346
kasan_stack_oob(void)347 static noinline void __init kasan_stack_oob(void)
348 {
349 char stack_array[10];
350 volatile int i = 0;
351 char *p = &stack_array[ARRAY_SIZE(stack_array) + i];
352
353 pr_info("out-of-bounds on stack\n");
354 *(volatile char *)p;
355 }
356
ksize_unpoisons_memory(void)357 static noinline void __init ksize_unpoisons_memory(void)
358 {
359 char *ptr;
360 size_t size = 123, real_size = size;
361
362 pr_info("ksize() unpoisons the whole allocated chunk\n");
363 ptr = kmalloc(size, GFP_KERNEL);
364 if (!ptr) {
365 pr_err("Allocation failed\n");
366 return;
367 }
368 real_size = ksize(ptr);
369 /* This access doesn't trigger an error. */
370 ptr[size] = 'x';
371 /* This one does. */
372 ptr[real_size] = 'y';
373 kfree(ptr);
374 }
375
copy_user_test(void)376 static noinline void __init copy_user_test(void)
377 {
378 char *kmem;
379 char __user *usermem;
380 size_t size = 10;
381 int unused;
382
383 kmem = kmalloc(size, GFP_KERNEL);
384 if (!kmem)
385 return;
386
387 usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE,
388 PROT_READ | PROT_WRITE | PROT_EXEC,
389 MAP_ANONYMOUS | MAP_PRIVATE, 0);
390 if (IS_ERR(usermem)) {
391 pr_err("Failed to allocate user memory\n");
392 kfree(kmem);
393 return;
394 }
395
396 pr_info("out-of-bounds in copy_from_user()\n");
397 unused = copy_from_user(kmem, usermem, size + 1);
398
399 pr_info("out-of-bounds in copy_to_user()\n");
400 unused = copy_to_user(usermem, kmem, size + 1);
401
402 pr_info("out-of-bounds in __copy_from_user()\n");
403 unused = __copy_from_user(kmem, usermem, size + 1);
404
405 pr_info("out-of-bounds in __copy_to_user()\n");
406 unused = __copy_to_user(usermem, kmem, size + 1);
407
408 pr_info("out-of-bounds in __copy_from_user_inatomic()\n");
409 unused = __copy_from_user_inatomic(kmem, usermem, size + 1);
410
411 pr_info("out-of-bounds in __copy_to_user_inatomic()\n");
412 unused = __copy_to_user_inatomic(usermem, kmem, size + 1);
413
414 pr_info("out-of-bounds in strncpy_from_user()\n");
415 unused = strncpy_from_user(kmem, usermem, size + 1);
416
417 vm_munmap((unsigned long)usermem, PAGE_SIZE);
418 kfree(kmem);
419 }
420
use_after_scope_test(void)421 static noinline void __init use_after_scope_test(void)
422 {
423 volatile char *volatile p;
424
425 pr_info("use-after-scope on int\n");
426 {
427 int local = 0;
428
429 p = (char *)&local;
430 }
431 p[0] = 1;
432 p[3] = 1;
433
434 pr_info("use-after-scope on array\n");
435 {
436 char local[1024] = {0};
437
438 p = local;
439 }
440 p[0] = 1;
441 p[1023] = 1;
442 }
443
kmalloc_tests_init(void)444 static int __init kmalloc_tests_init(void)
445 {
446 /*
447 * Temporarily enable multi-shot mode. Otherwise, we'd only get a
448 * report for the first case.
449 */
450 bool multishot = kasan_save_enable_multi_shot();
451
452 kmalloc_oob_right();
453 kmalloc_oob_left();
454 kmalloc_node_oob_right();
455 #ifdef CONFIG_SLUB
456 kmalloc_pagealloc_oob_right();
457 #endif
458 kmalloc_large_oob_right();
459 kmalloc_oob_krealloc_more();
460 kmalloc_oob_krealloc_less();
461 kmalloc_oob_16();
462 kmalloc_oob_in_memset();
463 kmalloc_oob_memset_2();
464 kmalloc_oob_memset_4();
465 kmalloc_oob_memset_8();
466 kmalloc_oob_memset_16();
467 kmalloc_uaf();
468 kmalloc_uaf_memset();
469 kmalloc_uaf2();
470 kmem_cache_oob();
471 kasan_stack_oob();
472 kasan_global_oob();
473 ksize_unpoisons_memory();
474 copy_user_test();
475 use_after_scope_test();
476
477 kasan_restore_multi_shot(multishot);
478
479 return -EAGAIN;
480 }
481
482 module_init(kmalloc_tests_init);
483 MODULE_LICENSE("GPL");
484