blob: 4621db801b233009c096452cbcd137d00574ad77 [file] [log] [blame]
Kees Cook3e2a4c12014-01-23 15:54:38 -08001/*
2 * Kernel module for testing copy_to/from_user infrastructure.
3 *
4 * Copyright 2013 Google Inc. All Rights Reserved
5 *
6 * Authors:
7 * Kees Cook <keescook@chromium.org>
8 *
9 * This software is licensed under the terms of the GNU General Public
10 * License version 2, as published by the Free Software Foundation, and
11 * may be copied, distributed, and modified under those terms.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 */
18
19#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
20
21#include <linux/mman.h>
22#include <linux/module.h>
23#include <linux/sched.h>
24#include <linux/slab.h>
25#include <linux/uaccess.h>
26#include <linux/vmalloc.h>
27
Kees Cook4c5d7bc2017-02-14 12:38:07 -080028/*
29 * Several 32-bit architectures support 64-bit {get,put}_user() calls.
30 * As there doesn't appear to be anything that can safely determine
31 * their capability at compile-time, we just have to opt-out certain archs.
32 */
Arnd Bergmann4deaa6f2017-02-22 11:21:22 -080033#if BITS_PER_LONG == 64 || (!(defined(CONFIG_ARM) && !defined(MMU)) && \
Kees Cook4c5d7bc2017-02-14 12:38:07 -080034 !defined(CONFIG_BLACKFIN) && \
35 !defined(CONFIG_M32R) && \
36 !defined(CONFIG_M68K) && \
37 !defined(CONFIG_MICROBLAZE) && \
38 !defined(CONFIG_MN10300) && \
39 !defined(CONFIG_NIOS2) && \
40 !defined(CONFIG_PPC32) && \
41 !defined(CONFIG_SUPERH))
42# define TEST_U64
43#endif
44
Kees Cook3e2a4c12014-01-23 15:54:38 -080045#define test(condition, msg) \
46({ \
47 int cond = (condition); \
48 if (cond) \
49 pr_warn("%s\n", msg); \
50 cond; \
51})
52
53static int __init test_user_copy_init(void)
54{
55 int ret = 0;
56 char *kmem;
57 char __user *usermem;
58 char *bad_usermem;
59 unsigned long user_addr;
Kees Cook4c5d7bc2017-02-14 12:38:07 -080060 u8 val_u8;
61 u16 val_u16;
62 u32 val_u32;
63#ifdef TEST_U64
64 u64 val_u64;
65#endif
Kees Cook3e2a4c12014-01-23 15:54:38 -080066
67 kmem = kmalloc(PAGE_SIZE * 2, GFP_KERNEL);
68 if (!kmem)
69 return -ENOMEM;
70
71 user_addr = vm_mmap(NULL, 0, PAGE_SIZE * 2,
72 PROT_READ | PROT_WRITE | PROT_EXEC,
73 MAP_ANONYMOUS | MAP_PRIVATE, 0);
74 if (user_addr >= (unsigned long)(TASK_SIZE)) {
75 pr_warn("Failed to allocate user memory\n");
76 kfree(kmem);
77 return -ENOMEM;
78 }
79
80 usermem = (char __user *)user_addr;
81 bad_usermem = (char *)user_addr;
82
Kees Cookf5f893c2017-02-13 11:25:26 -080083 /*
84 * Legitimate usage: none of these copies should fail.
85 */
Kees Cook4c5d7bc2017-02-14 12:38:07 -080086 memset(kmem, 0x3a, PAGE_SIZE * 2);
Kees Cook3e2a4c12014-01-23 15:54:38 -080087 ret |= test(copy_to_user(usermem, kmem, PAGE_SIZE),
88 "legitimate copy_to_user failed");
Kees Cook4c5d7bc2017-02-14 12:38:07 -080089 memset(kmem, 0x0, PAGE_SIZE);
90 ret |= test(copy_from_user(kmem, usermem, PAGE_SIZE),
91 "legitimate copy_from_user failed");
92 ret |= test(memcmp(kmem, kmem + PAGE_SIZE, PAGE_SIZE),
93 "legitimate usercopy failed to copy data");
94
95#define test_legit(size, check) \
96 do { \
97 val_##size = check; \
98 ret |= test(put_user(val_##size, (size __user *)usermem), \
99 "legitimate put_user (" #size ") failed"); \
100 val_##size = 0; \
101 ret |= test(get_user(val_##size, (size __user *)usermem), \
102 "legitimate get_user (" #size ") failed"); \
103 ret |= test(val_##size != check, \
104 "legitimate get_user (" #size ") failed to do copy"); \
105 if (val_##size != check) { \
106 pr_info("0x%llx != 0x%llx\n", \
107 (unsigned long long)val_##size, \
108 (unsigned long long)check); \
109 } \
110 } while (0)
111
112 test_legit(u8, 0x5a);
113 test_legit(u16, 0x5a5b);
114 test_legit(u32, 0x5a5b5c5d);
115#ifdef TEST_U64
116 test_legit(u64, 0x5a5b5c5d6a6b6c6d);
117#endif
118#undef test_legit
Kees Cook3e2a4c12014-01-23 15:54:38 -0800119
Kees Cookf5f893c2017-02-13 11:25:26 -0800120 /*
121 * Invalid usage: none of these copies should succeed.
122 */
123
124 /* Prepare kernel memory with check values. */
Hoeun Ryu4fbfeb82017-02-12 15:13:33 +0900125 memset(kmem, 0x5a, PAGE_SIZE);
126 memset(kmem + PAGE_SIZE, 0, PAGE_SIZE);
Kees Cookf5f893c2017-02-13 11:25:26 -0800127
128 /* Reject kernel-to-kernel copies through copy_from_user(). */
Kees Cook3e2a4c12014-01-23 15:54:38 -0800129 ret |= test(!copy_from_user(kmem, (char __user *)(kmem + PAGE_SIZE),
130 PAGE_SIZE),
131 "illegal all-kernel copy_from_user passed");
Kees Cookf5f893c2017-02-13 11:25:26 -0800132
133 /* Destination half of buffer should have been zeroed. */
Hoeun Ryu4fbfeb82017-02-12 15:13:33 +0900134 ret |= test(memcmp(kmem + PAGE_SIZE, kmem, PAGE_SIZE),
135 "zeroing failure for illegal all-kernel copy_from_user");
Kees Cookf5f893c2017-02-13 11:25:26 -0800136
137#if 0
138 /*
139 * When running with SMAP/PAN/etc, this will Oops the kernel
140 * due to the zeroing of userspace memory on failure. This needs
141 * to be tested in LKDTM instead, since this test module does not
142 * expect to explode.
143 */
Kees Cook3e2a4c12014-01-23 15:54:38 -0800144 ret |= test(!copy_from_user(bad_usermem, (char __user *)kmem,
145 PAGE_SIZE),
146 "illegal reversed copy_from_user passed");
Kees Cookf5f893c2017-02-13 11:25:26 -0800147#endif
Kees Cook3e2a4c12014-01-23 15:54:38 -0800148 ret |= test(!copy_to_user((char __user *)kmem, kmem + PAGE_SIZE,
149 PAGE_SIZE),
150 "illegal all-kernel copy_to_user passed");
151 ret |= test(!copy_to_user((char __user *)kmem, bad_usermem,
152 PAGE_SIZE),
153 "illegal reversed copy_to_user passed");
Kees Cookf5f893c2017-02-13 11:25:26 -0800154
Kees Cook4c5d7bc2017-02-14 12:38:07 -0800155#define test_illegal(size, check) \
156 do { \
157 val_##size = (check); \
158 ret |= test(!get_user(val_##size, (size __user *)kmem), \
159 "illegal get_user (" #size ") passed"); \
160 ret |= test(val_##size != (size)0, \
161 "zeroing failure for illegal get_user (" #size ")"); \
162 if (val_##size != (size)0) { \
163 pr_info("0x%llx != 0\n", \
164 (unsigned long long)val_##size); \
165 } \
166 ret |= test(!put_user(val_##size, (size __user *)kmem), \
167 "illegal put_user (" #size ") passed"); \
168 } while (0)
169
170 test_illegal(u8, 0x5a);
171 test_illegal(u16, 0x5a5b);
172 test_illegal(u32, 0x5a5b5c5d);
173#ifdef TEST_U64
174 test_illegal(u64, 0x5a5b5c5d6a6b6c6d);
175#endif
176#undef test_illegal
Kees Cook3e2a4c12014-01-23 15:54:38 -0800177
178 vm_munmap(user_addr, PAGE_SIZE * 2);
179 kfree(kmem);
180
181 if (ret == 0) {
182 pr_info("tests passed.\n");
183 return 0;
184 }
185
186 return -EINVAL;
187}
188
189module_init(test_user_copy_init);
190
191static void __exit test_user_copy_exit(void)
192{
193 pr_info("unloaded.\n");
194}
195
196module_exit(test_user_copy_exit);
197
198MODULE_AUTHOR("Kees Cook <keescook@chromium.org>");
199MODULE_LICENSE("GPL");