| 1 | /* |
| 2 | * This is for all the tests related to copy_to_user() and copy_from_user() |
| 3 | * hardening. |
| 4 | */ |
| 5 | #include "lkdtm.h" |
| 6 | #include <linux/slab.h> |
| 7 | #include <linux/vmalloc.h> |
| 8 | #include <linux/mman.h> |
| 9 | #include <linux/uaccess.h> |
| 10 | #include <asm/cacheflush.h> |
| 11 | |
| 12 | static size_t cache_size = 1024; |
| 13 | static struct kmem_cache *bad_cache; |
| 14 | |
| 15 | static const unsigned char test_text[] = "This is a test.\n"; |
| 16 | |
| 17 | /* |
| 18 | * Instead of adding -Wno-return-local-addr, just pass the stack address |
| 19 | * through a function to obfuscate it from the compiler. |
| 20 | */ |
| 21 | static noinline unsigned char *trick_compiler(unsigned char *stack) |
| 22 | { |
| 23 | return stack + 0; |
| 24 | } |
| 25 | |
| 26 | static noinline unsigned char *do_usercopy_stack_callee(int value) |
| 27 | { |
| 28 | unsigned char buf[32]; |
| 29 | int i; |
| 30 | |
| 31 | /* Exercise stack to avoid everything living in registers. */ |
| 32 | for (i = 0; i < sizeof(buf); i++) { |
| 33 | buf[i] = value & 0xff; |
| 34 | } |
| 35 | |
| 36 | return trick_compiler(buf); |
| 37 | } |
| 38 | |
| 39 | static noinline void do_usercopy_stack(bool to_user, bool bad_frame) |
| 40 | { |
| 41 | unsigned long user_addr; |
| 42 | unsigned char good_stack[32]; |
| 43 | unsigned char *bad_stack; |
| 44 | int i; |
| 45 | |
| 46 | /* Exercise stack to avoid everything living in registers. */ |
| 47 | for (i = 0; i < sizeof(good_stack); i++) |
| 48 | good_stack[i] = test_text[i % sizeof(test_text)]; |
| 49 | |
| 50 | /* This is a pointer to outside our current stack frame. */ |
| 51 | if (bad_frame) { |
| 52 | bad_stack = do_usercopy_stack_callee((uintptr_t)bad_stack); |
| 53 | } else { |
| 54 | /* Put start address just inside stack. */ |
| 55 | bad_stack = task_stack_page(current) + THREAD_SIZE; |
| 56 | bad_stack -= sizeof(unsigned long); |
| 57 | } |
| 58 | |
| 59 | user_addr = vm_mmap(NULL, 0, PAGE_SIZE, |
| 60 | PROT_READ | PROT_WRITE | PROT_EXEC, |
| 61 | MAP_ANONYMOUS | MAP_PRIVATE, 0); |
| 62 | if (user_addr >= TASK_SIZE) { |
| 63 | pr_warn("Failed to allocate user memory\n"); |
| 64 | return; |
| 65 | } |
| 66 | |
| 67 | if (to_user) { |
| 68 | pr_info("attempting good copy_to_user of local stack\n"); |
| 69 | if (copy_to_user((void __user *)user_addr, good_stack, |
| 70 | sizeof(good_stack))) { |
| 71 | pr_warn("copy_to_user failed unexpectedly?!\n"); |
| 72 | goto free_user; |
| 73 | } |
| 74 | |
| 75 | pr_info("attempting bad copy_to_user of distant stack\n"); |
| 76 | if (copy_to_user((void __user *)user_addr, bad_stack, |
| 77 | sizeof(good_stack))) { |
| 78 | pr_warn("copy_to_user failed, but lacked Oops\n"); |
| 79 | goto free_user; |
| 80 | } |
| 81 | } else { |
| 82 | /* |
| 83 | * There isn't a safe way to not be protected by usercopy |
| 84 | * if we're going to write to another thread's stack. |
| 85 | */ |
| 86 | if (!bad_frame) |
| 87 | goto free_user; |
| 88 | |
| 89 | pr_info("attempting good copy_from_user of local stack\n"); |
| 90 | if (copy_from_user(good_stack, (void __user *)user_addr, |
| 91 | sizeof(good_stack))) { |
| 92 | pr_warn("copy_from_user failed unexpectedly?!\n"); |
| 93 | goto free_user; |
| 94 | } |
| 95 | |
| 96 | pr_info("attempting bad copy_from_user of distant stack\n"); |
| 97 | if (copy_from_user(bad_stack, (void __user *)user_addr, |
| 98 | sizeof(good_stack))) { |
| 99 | pr_warn("copy_from_user failed, but lacked Oops\n"); |
| 100 | goto free_user; |
| 101 | } |
| 102 | } |
| 103 | |
| 104 | free_user: |
| 105 | vm_munmap(user_addr, PAGE_SIZE); |
| 106 | } |
| 107 | |
| 108 | static void do_usercopy_heap_size(bool to_user) |
| 109 | { |
| 110 | unsigned long user_addr; |
| 111 | unsigned char *one, *two; |
| 112 | const size_t size = 1024; |
| 113 | |
| 114 | one = kmalloc(size, GFP_KERNEL); |
| 115 | two = kmalloc(size, GFP_KERNEL); |
| 116 | if (!one || !two) { |
| 117 | pr_warn("Failed to allocate kernel memory\n"); |
| 118 | goto free_kernel; |
| 119 | } |
| 120 | |
| 121 | user_addr = vm_mmap(NULL, 0, PAGE_SIZE, |
| 122 | PROT_READ | PROT_WRITE | PROT_EXEC, |
| 123 | MAP_ANONYMOUS | MAP_PRIVATE, 0); |
| 124 | if (user_addr >= TASK_SIZE) { |
| 125 | pr_warn("Failed to allocate user memory\n"); |
| 126 | goto free_kernel; |
| 127 | } |
| 128 | |
| 129 | memset(one, 'A', size); |
| 130 | memset(two, 'B', size); |
| 131 | |
| 132 | if (to_user) { |
| 133 | pr_info("attempting good copy_to_user of correct size\n"); |
| 134 | if (copy_to_user((void __user *)user_addr, one, size)) { |
| 135 | pr_warn("copy_to_user failed unexpectedly?!\n"); |
| 136 | goto free_user; |
| 137 | } |
| 138 | |
| 139 | pr_info("attempting bad copy_to_user of too large size\n"); |
| 140 | if (copy_to_user((void __user *)user_addr, one, 2 * size)) { |
| 141 | pr_warn("copy_to_user failed, but lacked Oops\n"); |
| 142 | goto free_user; |
| 143 | } |
| 144 | } else { |
| 145 | pr_info("attempting good copy_from_user of correct size\n"); |
| 146 | if (copy_from_user(one, (void __user *)user_addr, size)) { |
| 147 | pr_warn("copy_from_user failed unexpectedly?!\n"); |
| 148 | goto free_user; |
| 149 | } |
| 150 | |
| 151 | pr_info("attempting bad copy_from_user of too large size\n"); |
| 152 | if (copy_from_user(one, (void __user *)user_addr, 2 * size)) { |
| 153 | pr_warn("copy_from_user failed, but lacked Oops\n"); |
| 154 | goto free_user; |
| 155 | } |
| 156 | } |
| 157 | |
| 158 | free_user: |
| 159 | vm_munmap(user_addr, PAGE_SIZE); |
| 160 | free_kernel: |
| 161 | kfree(one); |
| 162 | kfree(two); |
| 163 | } |
| 164 | |
| 165 | static void do_usercopy_heap_flag(bool to_user) |
| 166 | { |
| 167 | unsigned long user_addr; |
| 168 | unsigned char *good_buf = NULL; |
| 169 | unsigned char *bad_buf = NULL; |
| 170 | |
| 171 | /* Make sure cache was prepared. */ |
| 172 | if (!bad_cache) { |
| 173 | pr_warn("Failed to allocate kernel cache\n"); |
| 174 | return; |
| 175 | } |
| 176 | |
| 177 | /* |
| 178 | * Allocate one buffer from each cache (kmalloc will have the |
| 179 | * SLAB_USERCOPY flag already, but "bad_cache" won't). |
| 180 | */ |
| 181 | good_buf = kmalloc(cache_size, GFP_KERNEL); |
| 182 | bad_buf = kmem_cache_alloc(bad_cache, GFP_KERNEL); |
| 183 | if (!good_buf || !bad_buf) { |
| 184 | pr_warn("Failed to allocate buffers from caches\n"); |
| 185 | goto free_alloc; |
| 186 | } |
| 187 | |
| 188 | /* Allocate user memory we'll poke at. */ |
| 189 | user_addr = vm_mmap(NULL, 0, PAGE_SIZE, |
| 190 | PROT_READ | PROT_WRITE | PROT_EXEC, |
| 191 | MAP_ANONYMOUS | MAP_PRIVATE, 0); |
| 192 | if (user_addr >= TASK_SIZE) { |
| 193 | pr_warn("Failed to allocate user memory\n"); |
| 194 | goto free_alloc; |
| 195 | } |
| 196 | |
| 197 | memset(good_buf, 'A', cache_size); |
| 198 | memset(bad_buf, 'B', cache_size); |
| 199 | |
| 200 | if (to_user) { |
| 201 | pr_info("attempting good copy_to_user with SLAB_USERCOPY\n"); |
| 202 | if (copy_to_user((void __user *)user_addr, good_buf, |
| 203 | cache_size)) { |
| 204 | pr_warn("copy_to_user failed unexpectedly?!\n"); |
| 205 | goto free_user; |
| 206 | } |
| 207 | |
| 208 | pr_info("attempting bad copy_to_user w/o SLAB_USERCOPY\n"); |
| 209 | if (copy_to_user((void __user *)user_addr, bad_buf, |
| 210 | cache_size)) { |
| 211 | pr_warn("copy_to_user failed, but lacked Oops\n"); |
| 212 | goto free_user; |
| 213 | } |
| 214 | } else { |
| 215 | pr_info("attempting good copy_from_user with SLAB_USERCOPY\n"); |
| 216 | if (copy_from_user(good_buf, (void __user *)user_addr, |
| 217 | cache_size)) { |
| 218 | pr_warn("copy_from_user failed unexpectedly?!\n"); |
| 219 | goto free_user; |
| 220 | } |
| 221 | |
| 222 | pr_info("attempting bad copy_from_user w/o SLAB_USERCOPY\n"); |
| 223 | if (copy_from_user(bad_buf, (void __user *)user_addr, |
| 224 | cache_size)) { |
| 225 | pr_warn("copy_from_user failed, but lacked Oops\n"); |
| 226 | goto free_user; |
| 227 | } |
| 228 | } |
| 229 | |
| 230 | free_user: |
| 231 | vm_munmap(user_addr, PAGE_SIZE); |
| 232 | free_alloc: |
| 233 | if (bad_buf) |
| 234 | kmem_cache_free(bad_cache, bad_buf); |
| 235 | kfree(good_buf); |
| 236 | } |
| 237 | |
| 238 | /* Callable tests. */ |
| 239 | void lkdtm_USERCOPY_HEAP_SIZE_TO(void) |
| 240 | { |
| 241 | do_usercopy_heap_size(true); |
| 242 | } |
| 243 | |
| 244 | void lkdtm_USERCOPY_HEAP_SIZE_FROM(void) |
| 245 | { |
| 246 | do_usercopy_heap_size(false); |
| 247 | } |
| 248 | |
| 249 | void lkdtm_USERCOPY_HEAP_FLAG_TO(void) |
| 250 | { |
| 251 | do_usercopy_heap_flag(true); |
| 252 | } |
| 253 | |
| 254 | void lkdtm_USERCOPY_HEAP_FLAG_FROM(void) |
| 255 | { |
| 256 | do_usercopy_heap_flag(false); |
| 257 | } |
| 258 | |
| 259 | void lkdtm_USERCOPY_STACK_FRAME_TO(void) |
| 260 | { |
| 261 | do_usercopy_stack(true, true); |
| 262 | } |
| 263 | |
| 264 | void lkdtm_USERCOPY_STACK_FRAME_FROM(void) |
| 265 | { |
| 266 | do_usercopy_stack(false, true); |
| 267 | } |
| 268 | |
| 269 | void lkdtm_USERCOPY_STACK_BEYOND(void) |
| 270 | { |
| 271 | do_usercopy_stack(true, false); |
| 272 | } |
| 273 | |
| 274 | void lkdtm_USERCOPY_KERNEL(void) |
| 275 | { |
| 276 | unsigned long user_addr; |
| 277 | |
| 278 | user_addr = vm_mmap(NULL, 0, PAGE_SIZE, |
| 279 | PROT_READ | PROT_WRITE | PROT_EXEC, |
| 280 | MAP_ANONYMOUS | MAP_PRIVATE, 0); |
| 281 | if (user_addr >= TASK_SIZE) { |
| 282 | pr_warn("Failed to allocate user memory\n"); |
| 283 | return; |
| 284 | } |
| 285 | |
| 286 | pr_info("attempting good copy_to_user from kernel rodata\n"); |
| 287 | if (copy_to_user((void __user *)user_addr, test_text, |
| 288 | sizeof(test_text))) { |
| 289 | pr_warn("copy_to_user failed unexpectedly?!\n"); |
| 290 | goto free_user; |
| 291 | } |
| 292 | |
| 293 | pr_info("attempting bad copy_to_user from kernel text\n"); |
| 294 | if (copy_to_user((void __user *)user_addr, vm_mmap, PAGE_SIZE)) { |
| 295 | pr_warn("copy_to_user failed, but lacked Oops\n"); |
| 296 | goto free_user; |
| 297 | } |
| 298 | |
| 299 | free_user: |
| 300 | vm_munmap(user_addr, PAGE_SIZE); |
| 301 | } |
| 302 | |
| 303 | void __init lkdtm_usercopy_init(void) |
| 304 | { |
| 305 | /* Prepare cache that lacks SLAB_USERCOPY flag. */ |
| 306 | bad_cache = kmem_cache_create("lkdtm-no-usercopy", cache_size, 0, |
| 307 | 0, NULL); |
| 308 | } |
| 309 | |
| 310 | void __exit lkdtm_usercopy_exit(void) |
| 311 | { |
| 312 | kmem_cache_destroy(bad_cache); |
| 313 | } |