2 * This is for all the tests related to logic bugs (e.g. bad dereferences,
3 * bad alignment, bad loops, bad locking, bad scheduling, deep stacks, and
4 * lockups) along with other things that don't fit well into existing LKDTM
8 #include <linux/list.h>
9 #include <linux/refcount.h>
10 #include <linux/sched.h>
13 struct list_head node;
17 * Make sure our attempts to over run the kernel stack doesn't trigger
18 * a compiler warning when CONFIG_FRAME_WARN is set. Then make sure we
19 * recurse past the end of THREAD_SIZE by default.
21 #if defined(CONFIG_FRAME_WARN) && (CONFIG_FRAME_WARN > 0)
22 #define REC_STACK_SIZE (CONFIG_FRAME_WARN / 2)
24 #define REC_STACK_SIZE (THREAD_SIZE / 8)
26 #define REC_NUM_DEFAULT ((THREAD_SIZE / REC_STACK_SIZE) * 2)
28 static int recur_count = REC_NUM_DEFAULT;
30 static DEFINE_SPINLOCK(lock_me_up);
32 static int recursive_loop(int remaining)
34 char buf[REC_STACK_SIZE];
36 /* Make sure compiler does not optimize this away. */
37 memset(buf, (remaining & 0xff) | 0x1, REC_STACK_SIZE);
41 return recursive_loop(remaining - 1);
44 /* If the depth is negative, use the default, otherwise keep parameter. */
45 void __init lkdtm_bugs_init(int *recur_param)
48 *recur_param = recur_count;
50 recur_count = *recur_param;
53 void lkdtm_PANIC(void)
63 void lkdtm_WARNING(void)
68 void lkdtm_EXCEPTION(void)
79 void lkdtm_OVERFLOW(void)
81 (void) recursive_loop(recur_count);
84 noinline void lkdtm_CORRUPT_STACK(void)
86 /* Use default char array length that triggers stack protection. */
89 memset((void *)data, 'a', 64);
90 pr_info("Corrupted stack with '%16s'...\n", data);
93 void lkdtm_UNALIGNED_LOAD_STORE_WRITE(void)
95 static u8 data[5] __attribute__((aligned(4))) = {1, 2, 3, 4, 5};
99 p = (u32 *)(data + 1);
105 void lkdtm_SOFTLOCKUP(void)
112 void lkdtm_HARDLOCKUP(void)
119 void lkdtm_SPINLOCKUP(void)
121 /* Must be called twice to trigger. */
122 spin_lock(&lock_me_up);
123 /* Let sparse know we intended to exit holding the lock. */
124 __release(&lock_me_up);
127 void lkdtm_HUNG_TASK(void)
129 set_current_state(TASK_UNINTERRUPTIBLE);
133 void lkdtm_REFCOUNT_SATURATE_INC(void)
135 refcount_t over = REFCOUNT_INIT(UINT_MAX - 1);
137 pr_info("attempting good refcount decrement\n");
141 pr_info("attempting bad refcount inc overflow\n");
144 if (refcount_read(&over) == UINT_MAX)
145 pr_err("Correctly stayed saturated, but no BUG?!\n");
147 pr_err("Fail: refcount wrapped\n");
150 void lkdtm_REFCOUNT_SATURATE_ADD(void)
152 refcount_t over = REFCOUNT_INIT(UINT_MAX - 1);
154 pr_info("attempting good refcount decrement\n");
158 pr_info("attempting bad refcount add overflow\n");
159 refcount_add(2, &over);
160 if (refcount_read(&over) == UINT_MAX)
161 pr_err("Correctly stayed saturated, but no BUG?!\n");
163 pr_err("Fail: refcount wrapped\n");
166 void lkdtm_REFCOUNT_ZERO_DEC(void)
168 refcount_t zero = REFCOUNT_INIT(1);
170 pr_info("attempting bad refcount decrement to zero\n");
172 if (refcount_read(&zero) == 0)
173 pr_err("Stayed at zero, but no BUG?!\n");
175 pr_err("Fail: refcount went crazy\n");
178 void lkdtm_REFCOUNT_ZERO_SUB(void)
180 refcount_t zero = REFCOUNT_INIT(1);
182 pr_info("attempting bad refcount subtract past zero\n");
183 if (!refcount_sub_and_test(2, &zero))
184 pr_info("wrap attempt was noticed\n");
185 if (refcount_read(&zero) == 1)
186 pr_err("Correctly stayed above 0, but no BUG?!\n");
188 pr_err("Fail: refcount wrapped\n");
191 void lkdtm_REFCOUNT_ZERO_INC(void)
193 refcount_t zero = REFCOUNT_INIT(0);
195 pr_info("attempting bad refcount increment from zero\n");
197 if (refcount_read(&zero) == 0)
198 pr_err("Stayed at zero, but no BUG?!\n");
200 pr_err("Fail: refcount went past zero\n");
203 void lkdtm_REFCOUNT_ZERO_ADD(void)
205 refcount_t zero = REFCOUNT_INIT(0);
207 pr_info("attempting bad refcount addition from zero\n");
208 refcount_add(2, &zero);
209 if (refcount_read(&zero) == 0)
210 pr_err("Stayed at zero, but no BUG?!\n");
212 pr_err("Fail: refcount went past zero\n");
215 void lkdtm_CORRUPT_LIST_ADD(void)
218 * Initially, an empty list via LIST_HEAD:
219 * test_head.next = &test_head
220 * test_head.prev = &test_head
222 LIST_HEAD(test_head);
223 struct lkdtm_list good, bad;
224 void *target[2] = { };
225 void *redirection = ⌖
227 pr_info("attempting good list addition\n");
230 * Adding to the list performs these actions:
231 * test_head.next->prev = &good.node
232 * good.node.next = test_head.next
233 * good.node.prev = test_head
234 * test_head.next = good.node
236 list_add(&good.node, &test_head);
238 pr_info("attempting corrupted list addition\n");
240 * In simulating this "write what where" primitive, the "what" is
241 * the address of &bad.node, and the "where" is the address held
244 test_head.next = redirection;
245 list_add(&bad.node, &test_head);
247 if (target[0] == NULL && target[1] == NULL)
248 pr_err("Overwrite did not happen, but no BUG?!\n");
250 pr_err("list_add() corruption not detected!\n");
253 void lkdtm_CORRUPT_LIST_DEL(void)
255 LIST_HEAD(test_head);
256 struct lkdtm_list item;
257 void *target[2] = { };
258 void *redirection = ⌖
260 list_add(&item.node, &test_head);
262 pr_info("attempting good list removal\n");
263 list_del(&item.node);
265 pr_info("attempting corrupted list removal\n");
266 list_add(&item.node, &test_head);
268 /* As with the list_add() test above, this corrupts "next". */
269 item.node.next = redirection;
270 list_del(&item.node);
272 if (target[0] == NULL && target[1] == NULL)
273 pr_err("Overwrite did not happen, but no BUG?!\n");
275 pr_err("list_del() corruption not detected!\n");