drivers/misc/lkdtm_bugs.c

   1 /*
   2  * This is for all the tests related to logic bugs (e.g. bad dereferences,
   3  * bad alignment, bad loops, bad locking, bad scheduling, deep stacks, and
   4  * lockups) along with other things that don't fit well into existing LKDTM
   5  * test source files.
   6  */
   7 #include "lkdtm.h"
   8 #include <linux/list.h>
   9 #include <linux/refcount.h>
  10 #include <linux/sched.h>
  11
  12 struct lkdtm_list {
  13         struct list_head node;
  14 };
  15
  16 /*
  17  * Make sure our attempts to over run the kernel stack doesn't trigger
  18  * a compiler warning when CONFIG_FRAME_WARN is set. Then make sure we
  19  * recurse past the end of THREAD_SIZE by default.
  20  */
  21 #if defined(CONFIG_FRAME_WARN) && (CONFIG_FRAME_WARN > 0)
  22 #define REC_STACK_SIZE (CONFIG_FRAME_WARN / 2)
  23 #else
  24 #define REC_STACK_SIZE (THREAD_SIZE / 8)
  25 #endif
  26 #define REC_NUM_DEFAULT ((THREAD_SIZE / REC_STACK_SIZE) * 2)
  27
  28 static int recur_count = REC_NUM_DEFAULT;
  29
  30 static DEFINE_SPINLOCK(lock_me_up);
  31
  32 static int recursive_loop(int remaining)
  33 {
  34         char buf[REC_STACK_SIZE];
  35
  36         /* Make sure compiler does not optimize this away. */
  37         memset(buf, (remaining & 0xff) | 0x1, REC_STACK_SIZE);
  38         if (!remaining)
  39                 return 0;
  40         else
  41                 return recursive_loop(remaining - 1);
  42 }
  43
  44 /* If the depth is negative, use the default, otherwise keep parameter. */
  45 void __init lkdtm_bugs_init(int *recur_param)
  46 {
  47         if (*recur_param < 0)
  48                 *recur_param = recur_count;
  49         else
  50                 recur_count = *recur_param;
  51 }
  52
  53 void lkdtm_PANIC(void)
  54 {
  55         panic("dumptest");
  56 }
  57
  58 void lkdtm_BUG(void)
  59 {
  60         BUG();
  61 }
  62
  63 void lkdtm_WARNING(void)
  64 {
  65         WARN_ON(1);
  66 }
  67
  68 void lkdtm_EXCEPTION(void)
  69 {
  70         *((int *) 0) = 0;
  71 }
  72
  73 void lkdtm_LOOP(void)
  74 {
  75         for (;;)
  76                 ;
  77 }
  78
  79 void lkdtm_OVERFLOW(void)
  80 {
  81         (void) recursive_loop(recur_count);
  82 }
  83
  84 noinline void lkdtm_CORRUPT_STACK(void)
  85 {
  86         /* Use default char array length that triggers stack protection. */
  87         char data[8];
  88
  89         memset((void *)data, 'a', 64);
  90         pr_info("Corrupted stack with '%16s'...\n", data);
  91 }
  92
  93 void lkdtm_UNALIGNED_LOAD_STORE_WRITE(void)
  94 {
  95         static u8 data[5] __attribute__((aligned(4))) = {1, 2, 3, 4, 5};
  96         u32 *p;
  97         u32 val = 0x12345678;
  98
  99         p = (u32 *)(data + 1);
 100         if (*p == 0)
 101                 val = 0x87654321;
 102         *p = val;
 103 }
 104
 105 void lkdtm_SOFTLOCKUP(void)
 106 {
 107         preempt_disable();
 108         for (;;)
 109                 cpu_relax();
 110 }
 111
 112 void lkdtm_HARDLOCKUP(void)
 113 {
 114         local_irq_disable();
 115         for (;;)
 116                 cpu_relax();
 117 }
 118
 119 void lkdtm_SPINLOCKUP(void)
 120 {
 121         /* Must be called twice to trigger. */
 122         spin_lock(&lock_me_up);
 123         /* Let sparse know we intended to exit holding the lock. */
 124         __release(&lock_me_up);
 125 }
 126
 127 void lkdtm_HUNG_TASK(void)
 128 {
 129         set_current_state(TASK_UNINTERRUPTIBLE);
 130         schedule();
 131 }
 132
 133 void lkdtm_REFCOUNT_SATURATE_INC(void)
 134 {
 135         refcount_t over = REFCOUNT_INIT(UINT_MAX - 1);
 136
 137         pr_info("attempting good refcount decrement\n");
 138         refcount_dec(&over);
 139         refcount_inc(&over);
 140
 141         pr_info("attempting bad refcount inc overflow\n");
 142         refcount_inc(&over);
 143         refcount_inc(&over);
 144         if (refcount_read(&over) == UINT_MAX)
 145                 pr_err("Correctly stayed saturated, but no BUG?!\n");
 146         else
 147                 pr_err("Fail: refcount wrapped\n");
 148 }
 149
 150 void lkdtm_REFCOUNT_SATURATE_ADD(void)
 151 {
 152         refcount_t over = REFCOUNT_INIT(UINT_MAX - 1);
 153
 154         pr_info("attempting good refcount decrement\n");
 155         refcount_dec(&over);
 156         refcount_inc(&over);
 157
 158         pr_info("attempting bad refcount add overflow\n");
 159         refcount_add(2, &over);
 160         if (refcount_read(&over) == UINT_MAX)
 161                 pr_err("Correctly stayed saturated, but no BUG?!\n");
 162         else
 163                 pr_err("Fail: refcount wrapped\n");
 164 }
 165
 166 void lkdtm_REFCOUNT_ZERO_DEC(void)
 167 {
 168         refcount_t zero = REFCOUNT_INIT(1);
 169
 170         pr_info("attempting bad refcount decrement to zero\n");
 171         refcount_dec(&zero);
 172         if (refcount_read(&zero) == 0)
 173                 pr_err("Stayed at zero, but no BUG?!\n");
 174         else
 175                 pr_err("Fail: refcount went crazy\n");
 176 }
 177
 178 void lkdtm_REFCOUNT_ZERO_SUB(void)
 179 {
 180         refcount_t zero = REFCOUNT_INIT(1);
 181
 182         pr_info("attempting bad refcount subtract past zero\n");
 183         if (!refcount_sub_and_test(2, &zero))
 184                 pr_info("wrap attempt was noticed\n");
 185         if (refcount_read(&zero) == 1)
 186                 pr_err("Correctly stayed above 0, but no BUG?!\n");
 187         else
 188                 pr_err("Fail: refcount wrapped\n");
 189 }
 190
 191 void lkdtm_REFCOUNT_ZERO_INC(void)
 192 {
 193         refcount_t zero = REFCOUNT_INIT(0);
 194
 195         pr_info("attempting bad refcount increment from zero\n");
 196         refcount_inc(&zero);
 197         if (refcount_read(&zero) == 0)
 198                 pr_err("Stayed at zero, but no BUG?!\n");
 199         else
 200                 pr_err("Fail: refcount went past zero\n");
 201 }
 202
 203 void lkdtm_REFCOUNT_ZERO_ADD(void)
 204 {
 205         refcount_t zero = REFCOUNT_INIT(0);
 206
 207         pr_info("attempting bad refcount addition from zero\n");
 208         refcount_add(2, &zero);
 209         if (refcount_read(&zero) == 0)
 210                 pr_err("Stayed at zero, but no BUG?!\n");
 211         else
 212                 pr_err("Fail: refcount went past zero\n");
 213 }
 214
 215 void lkdtm_CORRUPT_LIST_ADD(void)
 216 {
 217         /*
 218          * Initially, an empty list via LIST_HEAD:
 219          *      test_head.next = &test_head
 220          *      test_head.prev = &test_head
 221          */
 222         LIST_HEAD(test_head);
 223         struct lkdtm_list good, bad;
 224         void *target[2] = { };
 225         void *redirection = &target;
 226
 227         pr_info("attempting good list addition\n");
 228
 229         /*
 230          * Adding to the list performs these actions:
 231          *      test_head.next->prev = &good.node
 232          *      good.node.next = test_head.next
 233          *      good.node.prev = test_head
 234          *      test_head.next = good.node
 235          */
 236         list_add(&good.node, &test_head);
 237
 238         pr_info("attempting corrupted list addition\n");
 239         /*
 240          * In simulating this "write what where" primitive, the "what" is
 241          * the address of &bad.node, and the "where" is the address held
 242          * by "redirection".
 243          */
 244         test_head.next = redirection;
 245         list_add(&bad.node, &test_head);
 246
 247         if (target[0] == NULL && target[1] == NULL)
 248                 pr_err("Overwrite did not happen, but no BUG?!\n");
 249         else
 250                 pr_err("list_add() corruption not detected!\n");
 251 }
 252
 253 void lkdtm_CORRUPT_LIST_DEL(void)
 254 {
 255         LIST_HEAD(test_head);
 256         struct lkdtm_list item;
 257         void *target[2] = { };
 258         void *redirection = &target;
 259
 260         list_add(&item.node, &test_head);
 261
 262         pr_info("attempting good list removal\n");
 263         list_del(&item.node);
 264
 265         pr_info("attempting corrupted list removal\n");
 266         list_add(&item.node, &test_head);
 267
 268         /* As with the list_add() test above, this corrupts "next". */
 269         item.node.next = redirection;
 270         list_del(&item.node);
 271
 272         if (target[0] == NULL && target[1] == NULL)
 273                 pr_err("Overwrite did not happen, but no BUG?!\n");
 274         else
 275                 pr_err("list_del() corruption not detected!\n");
 276 }