Kees Cook | 00f496c | 2016-06-26 22:17:25 -0700 | [diff] [blame^] | 1 | /* |
| 2 | * This is for all the tests related to logic bugs (e.g. bad dereferences, |
| 3 | * bad alignment, bad loops, bad locking, bad scheduling, deep stacks, and |
| 4 | * lockups) along with other things that don't fit well into existing LKDTM |
| 5 | * test source files. |
| 6 | */ |
| 7 | #define pr_fmt(fmt) "lkdtm: " fmt |
| 8 | |
| 9 | #include <linux/kernel.h> |
| 10 | #include <linux/sched.h> |
| 11 | |
| 12 | #include "lkdtm.h" |
| 13 | |
| 14 | /* |
| 15 | * Make sure our attempts to over run the kernel stack doesn't trigger |
| 16 | * a compiler warning when CONFIG_FRAME_WARN is set. Then make sure we |
| 17 | * recurse past the end of THREAD_SIZE by default. |
| 18 | */ |
| 19 | #if defined(CONFIG_FRAME_WARN) && (CONFIG_FRAME_WARN > 0) |
| 20 | #define REC_STACK_SIZE (CONFIG_FRAME_WARN / 2) |
| 21 | #else |
| 22 | #define REC_STACK_SIZE (THREAD_SIZE / 8) |
| 23 | #endif |
| 24 | #define REC_NUM_DEFAULT ((THREAD_SIZE / REC_STACK_SIZE) * 2) |
| 25 | |
| 26 | static int recur_count = REC_NUM_DEFAULT; |
| 27 | |
| 28 | static DEFINE_SPINLOCK(lock_me_up); |
| 29 | |
| 30 | static int recursive_loop(int remaining) |
| 31 | { |
| 32 | char buf[REC_STACK_SIZE]; |
| 33 | |
| 34 | /* Make sure compiler does not optimize this away. */ |
| 35 | memset(buf, (remaining & 0xff) | 0x1, REC_STACK_SIZE); |
| 36 | if (!remaining) |
| 37 | return 0; |
| 38 | else |
| 39 | return recursive_loop(remaining - 1); |
| 40 | } |
| 41 | |
| 42 | /* If the depth is negative, use the default, otherwise keep parameter. */ |
| 43 | void __init lkdtm_bugs_init(int *recur_param) |
| 44 | { |
| 45 | if (*recur_param < 0) |
| 46 | *recur_param = recur_count; |
| 47 | else |
| 48 | recur_count = *recur_param; |
| 49 | } |
| 50 | |
| 51 | void lkdtm_PANIC(void) |
| 52 | { |
| 53 | panic("dumptest"); |
| 54 | } |
| 55 | |
| 56 | void lkdtm_BUG(void) |
| 57 | { |
| 58 | BUG(); |
| 59 | } |
| 60 | |
| 61 | void lkdtm_WARNING(void) |
| 62 | { |
| 63 | WARN_ON(1); |
| 64 | } |
| 65 | |
| 66 | void lkdtm_EXCEPTION(void) |
| 67 | { |
| 68 | *((int *) 0) = 0; |
| 69 | } |
| 70 | |
| 71 | void lkdtm_LOOP(void) |
| 72 | { |
| 73 | for (;;) |
| 74 | ; |
| 75 | } |
| 76 | |
| 77 | void lkdtm_OVERFLOW(void) |
| 78 | { |
| 79 | (void) recursive_loop(recur_count); |
| 80 | } |
| 81 | |
| 82 | noinline void lkdtm_CORRUPT_STACK(void) |
| 83 | { |
| 84 | /* Use default char array length that triggers stack protection. */ |
| 85 | char data[8]; |
| 86 | |
| 87 | memset((void *)data, 0, 64); |
| 88 | } |
| 89 | |
| 90 | void lkdtm_UNALIGNED_LOAD_STORE_WRITE(void) |
| 91 | { |
| 92 | static u8 data[5] __attribute__((aligned(4))) = {1, 2, 3, 4, 5}; |
| 93 | u32 *p; |
| 94 | u32 val = 0x12345678; |
| 95 | |
| 96 | p = (u32 *)(data + 1); |
| 97 | if (*p == 0) |
| 98 | val = 0x87654321; |
| 99 | *p = val; |
| 100 | } |
| 101 | |
| 102 | void lkdtm_SOFTLOCKUP(void) |
| 103 | { |
| 104 | preempt_disable(); |
| 105 | for (;;) |
| 106 | cpu_relax(); |
| 107 | } |
| 108 | |
| 109 | void lkdtm_HARDLOCKUP(void) |
| 110 | { |
| 111 | local_irq_disable(); |
| 112 | for (;;) |
| 113 | cpu_relax(); |
| 114 | } |
| 115 | |
| 116 | void lkdtm_SPINLOCKUP(void) |
| 117 | { |
| 118 | /* Must be called twice to trigger. */ |
| 119 | spin_lock(&lock_me_up); |
| 120 | /* Let sparse know we intended to exit holding the lock. */ |
| 121 | __release(&lock_me_up); |
| 122 | } |
| 123 | |
| 124 | void lkdtm_HUNG_TASK(void) |
| 125 | { |
| 126 | set_current_state(TASK_UNINTERRUPTIBLE); |
| 127 | schedule(); |
| 128 | } |
| 129 | |
| 130 | void lkdtm_ATOMIC_UNDERFLOW(void) |
| 131 | { |
| 132 | atomic_t under = ATOMIC_INIT(INT_MIN); |
| 133 | |
| 134 | pr_info("attempting good atomic increment\n"); |
| 135 | atomic_inc(&under); |
| 136 | atomic_dec(&under); |
| 137 | |
| 138 | pr_info("attempting bad atomic underflow\n"); |
| 139 | atomic_dec(&under); |
| 140 | } |
| 141 | |
| 142 | void lkdtm_ATOMIC_OVERFLOW(void) |
| 143 | { |
| 144 | atomic_t over = ATOMIC_INIT(INT_MAX); |
| 145 | |
| 146 | pr_info("attempting good atomic decrement\n"); |
| 147 | atomic_dec(&over); |
| 148 | atomic_inc(&over); |
| 149 | |
| 150 | pr_info("attempting bad atomic overflow\n"); |
| 151 | atomic_inc(&over); |
| 152 | } |