Commit | Line | Data |
---|---|---|
3f15801c AR |
1 | /* |
2 | * | |
3 | * Copyright (c) 2014 Samsung Electronics Co., Ltd. | |
4 | * Author: Andrey Ryabinin <a.ryabinin@samsung.com> | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or modify | |
7 | * it under the terms of the GNU General Public License version 2 as | |
8 | * published by the Free Software Foundation. | |
9 | * | |
10 | */ | |
11 | ||
12 | #define pr_fmt(fmt) "kasan test: %s " fmt, __func__ | |
13 | ||
14 | #include <linux/kernel.h> | |
15 | #include <linux/printk.h> | |
16 | #include <linux/slab.h> | |
17 | #include <linux/string.h> | |
18 | #include <linux/module.h> | |
19 | ||
20 | static noinline void __init kmalloc_oob_right(void) | |
21 | { | |
22 | char *ptr; | |
23 | size_t size = 123; | |
24 | ||
25 | pr_info("out-of-bounds to right\n"); | |
26 | ptr = kmalloc(size, GFP_KERNEL); | |
27 | if (!ptr) { | |
28 | pr_err("Allocation failed\n"); | |
29 | return; | |
30 | } | |
31 | ||
32 | ptr[size] = 'x'; | |
33 | kfree(ptr); | |
34 | } | |
35 | ||
36 | static noinline void __init kmalloc_oob_left(void) | |
37 | { | |
38 | char *ptr; | |
39 | size_t size = 15; | |
40 | ||
41 | pr_info("out-of-bounds to left\n"); | |
42 | ptr = kmalloc(size, GFP_KERNEL); | |
43 | if (!ptr) { | |
44 | pr_err("Allocation failed\n"); | |
45 | return; | |
46 | } | |
47 | ||
48 | *ptr = *(ptr - 1); | |
49 | kfree(ptr); | |
50 | } | |
51 | ||
52 | static noinline void __init kmalloc_node_oob_right(void) | |
53 | { | |
54 | char *ptr; | |
55 | size_t size = 4096; | |
56 | ||
57 | pr_info("kmalloc_node(): out-of-bounds to right\n"); | |
58 | ptr = kmalloc_node(size, GFP_KERNEL, 0); | |
59 | if (!ptr) { | |
60 | pr_err("Allocation failed\n"); | |
61 | return; | |
62 | } | |
63 | ||
64 | ptr[size] = 0; | |
65 | kfree(ptr); | |
66 | } | |
67 | ||
e6e8379c AP |
68 | #ifdef CONFIG_SLUB |
69 | static noinline void __init kmalloc_pagealloc_oob_right(void) | |
3f15801c AR |
70 | { |
71 | char *ptr; | |
72 | size_t size = KMALLOC_MAX_CACHE_SIZE + 10; | |
73 | ||
e6e8379c AP |
74 | /* Allocate a chunk that does not fit into a SLUB cache to trigger |
75 | * the page allocator fallback. | |
76 | */ | |
77 | pr_info("kmalloc pagealloc allocation: out-of-bounds to right\n"); | |
78 | ptr = kmalloc(size, GFP_KERNEL); | |
79 | if (!ptr) { | |
80 | pr_err("Allocation failed\n"); | |
81 | return; | |
82 | } | |
83 | ||
84 | ptr[size] = 0; | |
85 | kfree(ptr); | |
86 | } | |
87 | #endif | |
88 | ||
89 | static noinline void __init kmalloc_large_oob_right(void) | |
90 | { | |
91 | char *ptr; | |
92 | size_t size = KMALLOC_MAX_CACHE_SIZE - 256; | |
93 | /* Allocate a chunk that is large enough, but still fits into a slab | |
94 | * and does not trigger the page allocator fallback in SLUB. | |
95 | */ | |
3f15801c AR |
96 | pr_info("kmalloc large allocation: out-of-bounds to right\n"); |
97 | ptr = kmalloc(size, GFP_KERNEL); | |
98 | if (!ptr) { | |
99 | pr_err("Allocation failed\n"); | |
100 | return; | |
101 | } | |
102 | ||
103 | ptr[size] = 0; | |
104 | kfree(ptr); | |
105 | } | |
106 | ||
107 | static noinline void __init kmalloc_oob_krealloc_more(void) | |
108 | { | |
109 | char *ptr1, *ptr2; | |
110 | size_t size1 = 17; | |
111 | size_t size2 = 19; | |
112 | ||
113 | pr_info("out-of-bounds after krealloc more\n"); | |
114 | ptr1 = kmalloc(size1, GFP_KERNEL); | |
115 | ptr2 = krealloc(ptr1, size2, GFP_KERNEL); | |
116 | if (!ptr1 || !ptr2) { | |
117 | pr_err("Allocation failed\n"); | |
118 | kfree(ptr1); | |
119 | return; | |
120 | } | |
121 | ||
122 | ptr2[size2] = 'x'; | |
123 | kfree(ptr2); | |
124 | } | |
125 | ||
126 | static noinline void __init kmalloc_oob_krealloc_less(void) | |
127 | { | |
128 | char *ptr1, *ptr2; | |
129 | size_t size1 = 17; | |
130 | size_t size2 = 15; | |
131 | ||
132 | pr_info("out-of-bounds after krealloc less\n"); | |
133 | ptr1 = kmalloc(size1, GFP_KERNEL); | |
134 | ptr2 = krealloc(ptr1, size2, GFP_KERNEL); | |
135 | if (!ptr1 || !ptr2) { | |
136 | pr_err("Allocation failed\n"); | |
137 | kfree(ptr1); | |
138 | return; | |
139 | } | |
6b4a35fc | 140 | ptr2[size2] = 'x'; |
3f15801c AR |
141 | kfree(ptr2); |
142 | } | |
143 | ||
144 | static noinline void __init kmalloc_oob_16(void) | |
145 | { | |
146 | struct { | |
147 | u64 words[2]; | |
148 | } *ptr1, *ptr2; | |
149 | ||
150 | pr_info("kmalloc out-of-bounds for 16-bytes access\n"); | |
151 | ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL); | |
152 | ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL); | |
153 | if (!ptr1 || !ptr2) { | |
154 | pr_err("Allocation failed\n"); | |
155 | kfree(ptr1); | |
156 | kfree(ptr2); | |
157 | return; | |
158 | } | |
159 | *ptr1 = *ptr2; | |
160 | kfree(ptr1); | |
161 | kfree(ptr2); | |
162 | } | |
163 | ||
f523e737 WL |
164 | static noinline void __init kmalloc_oob_memset_2(void) |
165 | { | |
166 | char *ptr; | |
167 | size_t size = 8; | |
168 | ||
169 | pr_info("out-of-bounds in memset2\n"); | |
170 | ptr = kmalloc(size, GFP_KERNEL); | |
171 | if (!ptr) { | |
172 | pr_err("Allocation failed\n"); | |
173 | return; | |
174 | } | |
175 | ||
176 | memset(ptr+7, 0, 2); | |
177 | kfree(ptr); | |
178 | } | |
179 | ||
180 | static noinline void __init kmalloc_oob_memset_4(void) | |
181 | { | |
182 | char *ptr; | |
183 | size_t size = 8; | |
184 | ||
185 | pr_info("out-of-bounds in memset4\n"); | |
186 | ptr = kmalloc(size, GFP_KERNEL); | |
187 | if (!ptr) { | |
188 | pr_err("Allocation failed\n"); | |
189 | return; | |
190 | } | |
191 | ||
192 | memset(ptr+5, 0, 4); | |
193 | kfree(ptr); | |
194 | } | |
195 | ||
196 | ||
197 | static noinline void __init kmalloc_oob_memset_8(void) | |
198 | { | |
199 | char *ptr; | |
200 | size_t size = 8; | |
201 | ||
202 | pr_info("out-of-bounds in memset8\n"); | |
203 | ptr = kmalloc(size, GFP_KERNEL); | |
204 | if (!ptr) { | |
205 | pr_err("Allocation failed\n"); | |
206 | return; | |
207 | } | |
208 | ||
209 | memset(ptr+1, 0, 8); | |
210 | kfree(ptr); | |
211 | } | |
212 | ||
213 | static noinline void __init kmalloc_oob_memset_16(void) | |
214 | { | |
215 | char *ptr; | |
216 | size_t size = 16; | |
217 | ||
218 | pr_info("out-of-bounds in memset16\n"); | |
219 | ptr = kmalloc(size, GFP_KERNEL); | |
220 | if (!ptr) { | |
221 | pr_err("Allocation failed\n"); | |
222 | return; | |
223 | } | |
224 | ||
225 | memset(ptr+1, 0, 16); | |
226 | kfree(ptr); | |
227 | } | |
228 | ||
3f15801c AR |
229 | static noinline void __init kmalloc_oob_in_memset(void) |
230 | { | |
231 | char *ptr; | |
232 | size_t size = 666; | |
233 | ||
234 | pr_info("out-of-bounds in memset\n"); | |
235 | ptr = kmalloc(size, GFP_KERNEL); | |
236 | if (!ptr) { | |
237 | pr_err("Allocation failed\n"); | |
238 | return; | |
239 | } | |
240 | ||
241 | memset(ptr, 0, size+5); | |
242 | kfree(ptr); | |
243 | } | |
244 | ||
245 | static noinline void __init kmalloc_uaf(void) | |
246 | { | |
247 | char *ptr; | |
248 | size_t size = 10; | |
249 | ||
250 | pr_info("use-after-free\n"); | |
251 | ptr = kmalloc(size, GFP_KERNEL); | |
252 | if (!ptr) { | |
253 | pr_err("Allocation failed\n"); | |
254 | return; | |
255 | } | |
256 | ||
257 | kfree(ptr); | |
258 | *(ptr + 8) = 'x'; | |
259 | } | |
260 | ||
261 | static noinline void __init kmalloc_uaf_memset(void) | |
262 | { | |
263 | char *ptr; | |
264 | size_t size = 33; | |
265 | ||
266 | pr_info("use-after-free in memset\n"); | |
267 | ptr = kmalloc(size, GFP_KERNEL); | |
268 | if (!ptr) { | |
269 | pr_err("Allocation failed\n"); | |
270 | return; | |
271 | } | |
272 | ||
273 | kfree(ptr); | |
274 | memset(ptr, 0, size); | |
275 | } | |
276 | ||
277 | static noinline void __init kmalloc_uaf2(void) | |
278 | { | |
279 | char *ptr1, *ptr2; | |
280 | size_t size = 43; | |
281 | ||
282 | pr_info("use-after-free after another kmalloc\n"); | |
283 | ptr1 = kmalloc(size, GFP_KERNEL); | |
284 | if (!ptr1) { | |
285 | pr_err("Allocation failed\n"); | |
286 | return; | |
287 | } | |
288 | ||
289 | kfree(ptr1); | |
290 | ptr2 = kmalloc(size, GFP_KERNEL); | |
291 | if (!ptr2) { | |
292 | pr_err("Allocation failed\n"); | |
293 | return; | |
294 | } | |
295 | ||
296 | ptr1[40] = 'x'; | |
9dcadd38 AP |
297 | if (ptr1 == ptr2) |
298 | pr_err("Could not detect use-after-free: ptr1 == ptr2\n"); | |
3f15801c AR |
299 | kfree(ptr2); |
300 | } | |
301 | ||
302 | static noinline void __init kmem_cache_oob(void) | |
303 | { | |
304 | char *p; | |
305 | size_t size = 200; | |
306 | struct kmem_cache *cache = kmem_cache_create("test_cache", | |
307 | size, 0, | |
308 | 0, NULL); | |
309 | if (!cache) { | |
310 | pr_err("Cache allocation failed\n"); | |
311 | return; | |
312 | } | |
313 | pr_info("out-of-bounds in kmem_cache_alloc\n"); | |
314 | p = kmem_cache_alloc(cache, GFP_KERNEL); | |
315 | if (!p) { | |
316 | pr_err("Allocation failed\n"); | |
317 | kmem_cache_destroy(cache); | |
318 | return; | |
319 | } | |
320 | ||
321 | *p = p[size]; | |
322 | kmem_cache_free(cache, p); | |
323 | kmem_cache_destroy(cache); | |
324 | } | |
325 | ||
326 | static char global_array[10]; | |
327 | ||
328 | static noinline void __init kasan_global_oob(void) | |
329 | { | |
330 | volatile int i = 3; | |
331 | char *p = &global_array[ARRAY_SIZE(global_array) + i]; | |
332 | ||
333 | pr_info("out-of-bounds global variable\n"); | |
334 | *(volatile char *)p; | |
335 | } | |
336 | ||
337 | static noinline void __init kasan_stack_oob(void) | |
338 | { | |
339 | char stack_array[10]; | |
340 | volatile int i = 0; | |
341 | char *p = &stack_array[ARRAY_SIZE(stack_array) + i]; | |
342 | ||
343 | pr_info("out-of-bounds on stack\n"); | |
344 | *(volatile char *)p; | |
345 | } | |
346 | ||
347 | static int __init kmalloc_tests_init(void) | |
348 | { | |
349 | kmalloc_oob_right(); | |
350 | kmalloc_oob_left(); | |
351 | kmalloc_node_oob_right(); | |
e6e8379c AP |
352 | #ifdef CONFIG_SLUB |
353 | kmalloc_pagealloc_oob_right(); | |
354 | #endif | |
9789d8e0 | 355 | kmalloc_large_oob_right(); |
3f15801c AR |
356 | kmalloc_oob_krealloc_more(); |
357 | kmalloc_oob_krealloc_less(); | |
358 | kmalloc_oob_16(); | |
359 | kmalloc_oob_in_memset(); | |
f523e737 WL |
360 | kmalloc_oob_memset_2(); |
361 | kmalloc_oob_memset_4(); | |
362 | kmalloc_oob_memset_8(); | |
363 | kmalloc_oob_memset_16(); | |
3f15801c AR |
364 | kmalloc_uaf(); |
365 | kmalloc_uaf_memset(); | |
366 | kmalloc_uaf2(); | |
367 | kmem_cache_oob(); | |
368 | kasan_stack_oob(); | |
369 | kasan_global_oob(); | |
370 | return -EAGAIN; | |
371 | } | |
372 | ||
373 | module_init(kmalloc_tests_init); | |
374 | MODULE_LICENSE("GPL"); |