[linux-2.6-block.git] / lib / test_kasan.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 *
 * Copyright (c) 2014 Samsung Electronics Co., Ltd.
 * Author: Andrey Ryabinin <a.ryabinin@samsung.com>
 */

#define pr_fmt(fmt) "kasan test: %s " fmt, __func__

#include <linux/bitops.h>
#include <linux/delay.h>
#include <linux/kasan.h>
#include <linux/kernel.h>
#include <linux/mm.h>
#include <linux/mman.h>
#include <linux/module.h>
#include <linux/printk.h>
#include <linux/slab.h>
#include <linux/string.h>
#include <linux/uaccess.h>

/*
 * Note: test functions are marked noinline so that their names appear in
 * reports.
 */

static noinline void __init kmalloc_oob_right(void)
{
	char *ptr;
	size_t size = 123;

	pr_info("out-of-bounds to right\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	ptr[size] = 'x';
	kfree(ptr);
}

static noinline void __init kmalloc_oob_left(void)
{
	char *ptr;
	size_t size = 15;

	pr_info("out-of-bounds to left\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	*ptr = *(ptr - 1);
	kfree(ptr);
}

static noinline void __init kmalloc_node_oob_right(void)
{
	char *ptr;
	size_t size = 4096;

	pr_info("kmalloc_node(): out-of-bounds to right\n");
	ptr = kmalloc_node(size, GFP_KERNEL, 0);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	ptr[size] = 0;
	kfree(ptr);
}

#ifdef CONFIG_SLUB
static noinline void __init kmalloc_pagealloc_oob_right(void)
{
	char *ptr;
	size_t size = KMALLOC_MAX_CACHE_SIZE + 10;

	/* Allocate a chunk that does not fit into a SLUB cache to trigger
	 * the page allocator fallback.
	 */
	pr_info("kmalloc pagealloc allocation: out-of-bounds to right\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	ptr[size] = 0;
	kfree(ptr);
}

static noinline void __init kmalloc_pagealloc_uaf(void)
{
	char *ptr;
	size_t size = KMALLOC_MAX_CACHE_SIZE + 10;

	pr_info("kmalloc pagealloc allocation: use-after-free\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	kfree(ptr);
	ptr[0] = 0;
}

static noinline void __init kmalloc_pagealloc_invalid_free(void)
{
	char *ptr;
	size_t size = KMALLOC_MAX_CACHE_SIZE + 10;

	pr_info("kmalloc pagealloc allocation: invalid-free\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	kfree(ptr + 1);
}
#endif

static noinline void __init kmalloc_large_oob_right(void)
{
	char *ptr;
	size_t size = KMALLOC_MAX_CACHE_SIZE - 256;
	/* Allocate a chunk that is large enough, but still fits into a slab
	 * and does not trigger the page allocator fallback in SLUB.
	 */
	pr_info("kmalloc large allocation: out-of-bounds to right\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	ptr[size] = 0;
	kfree(ptr);
}

static noinline void __init kmalloc_oob_krealloc_more(void)
{
	char *ptr1, *ptr2;
	size_t size1 = 17;
	size_t size2 = 19;

	pr_info("out-of-bounds after krealloc more\n");
	ptr1 = kmalloc(size1, GFP_KERNEL);
	ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
	if (!ptr1 || !ptr2) {
		pr_err("Allocation failed\n");
		kfree(ptr1);
		return;
	}

	ptr2[size2] = 'x';
	kfree(ptr2);
}

static noinline void __init kmalloc_oob_krealloc_less(void)
{
	char *ptr1, *ptr2;
	size_t size1 = 17;
	size_t size2 = 15;

	pr_info("out-of-bounds after krealloc less\n");
	ptr1 = kmalloc(size1, GFP_KERNEL);
	ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
	if (!ptr1 || !ptr2) {
		pr_err("Allocation failed\n");
		kfree(ptr1);
		return;
	}
	ptr2[size2] = 'x';
	kfree(ptr2);
}

static noinline void __init kmalloc_oob_16(void)
{
	struct {
		u64 words[2];
	} *ptr1, *ptr2;

	pr_info("kmalloc out-of-bounds for 16-bytes access\n");
	ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL);
	ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
	if (!ptr1 || !ptr2) {
		pr_err("Allocation failed\n");
		kfree(ptr1);
		kfree(ptr2);
		return;
	}
	*ptr1 = *ptr2;
	kfree(ptr1);
	kfree(ptr2);
}

static noinline void __init kmalloc_oob_memset_2(void)
{
	char *ptr;
	size_t size = 8;

	pr_info("out-of-bounds in memset2\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	memset(ptr+7, 0, 2);
	kfree(ptr);
}

static noinline void __init kmalloc_oob_memset_4(void)
{
	char *ptr;
	size_t size = 8;

	pr_info("out-of-bounds in memset4\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	memset(ptr+5, 0, 4);
	kfree(ptr);
}


static noinline void __init kmalloc_oob_memset_8(void)
{
	char *ptr;
	size_t size = 8;

	pr_info("out-of-bounds in memset8\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	memset(ptr+1, 0, 8);
	kfree(ptr);
}

static noinline void __init kmalloc_oob_memset_16(void)
{
	char *ptr;
	size_t size = 16;

	pr_info("out-of-bounds in memset16\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	memset(ptr+1, 0, 16);
	kfree(ptr);
}

static noinline void __init kmalloc_oob_in_memset(void)
{
	char *ptr;
	size_t size = 666;

	pr_info("out-of-bounds in memset\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	memset(ptr, 0, size+5);
	kfree(ptr);
}

static noinline void __init kmalloc_uaf(void)
{
	char *ptr;
	size_t size = 10;

	pr_info("use-after-free\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	kfree(ptr);
	*(ptr + 8) = 'x';
}

static noinline void __init kmalloc_uaf_memset(void)
{
	char *ptr;
	size_t size = 33;

	pr_info("use-after-free in memset\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	kfree(ptr);
	memset(ptr, 0, size);
}

static noinline void __init kmalloc_uaf2(void)
{
	char *ptr1, *ptr2;
	size_t size = 43;

	pr_info("use-after-free after another kmalloc\n");
	ptr1 = kmalloc(size, GFP_KERNEL);
	if (!ptr1) {
		pr_err("Allocation failed\n");
		return;
	}

	kfree(ptr1);
	ptr2 = kmalloc(size, GFP_KERNEL);
	if (!ptr2) {
		pr_err("Allocation failed\n");
		return;
	}

	ptr1[40] = 'x';
	if (ptr1 == ptr2)
		pr_err("Could not detect use-after-free: ptr1 == ptr2\n");
	kfree(ptr2);
}

static noinline void __init kmem_cache_oob(void)
{
	char *p;
	size_t size = 200;
	struct kmem_cache *cache = kmem_cache_create("test_cache",
						size, 0,
						0, NULL);
	if (!cache) {
		pr_err("Cache allocation failed\n");
		return;
	}
	pr_info("out-of-bounds in kmem_cache_alloc\n");
	p = kmem_cache_alloc(cache, GFP_KERNEL);
	if (!p) {
		pr_err("Allocation failed\n");
		kmem_cache_destroy(cache);
		return;
	}

	*p = p[size];
	kmem_cache_free(cache, p);
	kmem_cache_destroy(cache);
}

static noinline void __init memcg_accounted_kmem_cache(void)
{
	int i;
	char *p;
	size_t size = 200;
	struct kmem_cache *cache;

	cache = kmem_cache_create("test_cache", size, 0, SLAB_ACCOUNT, NULL);
	if (!cache) {
		pr_err("Cache allocation failed\n");
		return;
	}

	pr_info("allocate memcg accounted object\n");
	/*
	 * Several allocations with a delay to allow for lazy per memcg kmem
	 * cache creation.
	 */
	for (i = 0; i < 5; i++) {
		p = kmem_cache_alloc(cache, GFP_KERNEL);
		if (!p)
			goto free_cache;

		kmem_cache_free(cache, p);
		msleep(100);
	}

free_cache:
	kmem_cache_destroy(cache);
}

static char global_array[10];

static noinline void __init kasan_global_oob(void)
{
	volatile int i = 3;
	char *p = &global_array[ARRAY_SIZE(global_array) + i];

	pr_info("out-of-bounds global variable\n");
	*(volatile char *)p;
}

static noinline void __init kasan_stack_oob(void)
{
	char stack_array[10];
	volatile int i = 0;
	char *p = &stack_array[ARRAY_SIZE(stack_array) + i];

	pr_info("out-of-bounds on stack\n");
	*(volatile char *)p;
}

static noinline void __init ksize_unpoisons_memory(void)
{
	char *ptr;
	size_t size = 123, real_size;

	pr_info("ksize() unpoisons the whole allocated chunk\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}
	real_size = ksize(ptr);
	/* This access doesn't trigger an error. */
	ptr[size] = 'x';
	/* This one does. */
	ptr[real_size] = 'y';
	kfree(ptr);
}

static noinline void __init copy_user_test(void)
{
	char *kmem;
	char __user *usermem;
	size_t size = 10;
	int unused;

	kmem = kmalloc(size, GFP_KERNEL);
	if (!kmem)
		return;

	usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE,
			    PROT_READ | PROT_WRITE | PROT_EXEC,
			    MAP_ANONYMOUS | MAP_PRIVATE, 0);
	if (IS_ERR(usermem)) {
		pr_err("Failed to allocate user memory\n");
		kfree(kmem);
		return;
	}

	pr_info("out-of-bounds in copy_from_user()\n");
	unused = copy_from_user(kmem, usermem, size + 1);

	pr_info("out-of-bounds in copy_to_user()\n");
	unused = copy_to_user(usermem, kmem, size + 1);

	pr_info("out-of-bounds in __copy_from_user()\n");
	unused = __copy_from_user(kmem, usermem, size + 1);

	pr_info("out-of-bounds in __copy_to_user()\n");
	unused = __copy_to_user(usermem, kmem, size + 1);

	pr_info("out-of-bounds in __copy_from_user_inatomic()\n");
	unused = __copy_from_user_inatomic(kmem, usermem, size + 1);

	pr_info("out-of-bounds in __copy_to_user_inatomic()\n");
	unused = __copy_to_user_inatomic(usermem, kmem, size + 1);

	pr_info("out-of-bounds in strncpy_from_user()\n");
	unused = strncpy_from_user(kmem, usermem, size + 1);

	vm_munmap((unsigned long)usermem, PAGE_SIZE);
	kfree(kmem);
}

static noinline void __init kasan_alloca_oob_left(void)
{
	volatile int i = 10;
	char alloca_array[i];
	char *p = alloca_array - 1;

	pr_info("out-of-bounds to left on alloca\n");
	*(volatile char *)p;
}

static noinline void __init kasan_alloca_oob_right(void)
{
	volatile int i = 10;
	char alloca_array[i];
	char *p = alloca_array + i;

	pr_info("out-of-bounds to right on alloca\n");
	*(volatile char *)p;
}

static noinline void __init kmem_cache_double_free(void)
{
	char *p;
	size_t size = 200;
	struct kmem_cache *cache;

	cache = kmem_cache_create("test_cache", size, 0, 0, NULL);
	if (!cache) {
		pr_err("Cache allocation failed\n");
		return;
	}
	pr_info("double-free on heap object\n");
	p = kmem_cache_alloc(cache, GFP_KERNEL);
	if (!p) {
		pr_err("Allocation failed\n");
		kmem_cache_destroy(cache);
		return;
	}

	kmem_cache_free(cache, p);
	kmem_cache_free(cache, p);
	kmem_cache_destroy(cache);
}

static noinline void __init kmem_cache_invalid_free(void)
{
	char *p;
	size_t size = 200;
	struct kmem_cache *cache;

	cache = kmem_cache_create("test_cache", size, 0, SLAB_TYPESAFE_BY_RCU,
				  NULL);
	if (!cache) {
		pr_err("Cache allocation failed\n");
		return;
	}
	pr_info("invalid-free of heap object\n");
	p = kmem_cache_alloc(cache, GFP_KERNEL);
	if (!p) {
		pr_err("Allocation failed\n");
		kmem_cache_destroy(cache);
		return;
	}

	/* Trigger invalid free, the object doesn't get freed */
	kmem_cache_free(cache, p + 1);

	/*
	 * Properly free the object to prevent the "Objects remaining in
	 * test_cache on __kmem_cache_shutdown" BUG failure.
	 */
	kmem_cache_free(cache, p);

	kmem_cache_destroy(cache);
}

static noinline void __init kasan_memchr(void)
{
	char *ptr;
	size_t size = 24;

	pr_info("out-of-bounds in memchr\n");
	ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
	if (!ptr)
		return;

	memchr(ptr, '1', size + 1);
	kfree(ptr);
}

static noinline void __init kasan_memcmp(void)
{
	char *ptr;
	size_t size = 24;
	int arr[9];

	pr_info("out-of-bounds in memcmp\n");
	ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
	if (!ptr)
		return;

	memset(arr, 0, sizeof(arr));
	memcmp(ptr, arr, size+1);
	kfree(ptr);
}

static noinline void __init kasan_strings(void)
{
	char *ptr;
	size_t size = 24;

	pr_info("use-after-free in strchr\n");
	ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
	if (!ptr)
		return;

	kfree(ptr);

	/*
	 * Try to cause only 1 invalid access (less spam in dmesg).
	 * For that we need ptr to point to zeroed byte.
	 * Skip metadata that could be stored in freed object so ptr
	 * will likely point to zeroed byte.
	 */
	ptr += 16;
	strchr(ptr, '1');

	pr_info("use-after-free in strrchr\n");
	strrchr(ptr, '1');

	pr_info("use-after-free in strcmp\n");
	strcmp(ptr, "2");

	pr_info("use-after-free in strncmp\n");
	strncmp(ptr, "2", 1);

	pr_info("use-after-free in strlen\n");
	strlen(ptr);

	pr_info("use-after-free in strnlen\n");
	strnlen(ptr, 1);
}

static noinline void __init kasan_bitops(void)
{
	/*
	 * Allocate 1 more byte, which causes kzalloc to round up to 16-bytes;
	 * this way we do not actually corrupt other memory.
	 */
	long *bits = kzalloc(sizeof(*bits) + 1, GFP_KERNEL);
	if (!bits)
		return;

	/*
	 * Below calls try to access bit within allocated memory; however, the
	 * below accesses are still out-of-bounds, since bitops are defined to
	 * operate on the whole long the bit is in.
	 */
	pr_info("out-of-bounds in set_bit\n");
	set_bit(BITS_PER_LONG, bits);

	pr_info("out-of-bounds in __set_bit\n");
	__set_bit(BITS_PER_LONG, bits);

	pr_info("out-of-bounds in clear_bit\n");
	clear_bit(BITS_PER_LONG, bits);

	pr_info("out-of-bounds in __clear_bit\n");
	__clear_bit(BITS_PER_LONG, bits);

	pr_info("out-of-bounds in clear_bit_unlock\n");
	clear_bit_unlock(BITS_PER_LONG, bits);

	pr_info("out-of-bounds in __clear_bit_unlock\n");
	__clear_bit_unlock(BITS_PER_LONG, bits);

	pr_info("out-of-bounds in change_bit\n");
	change_bit(BITS_PER_LONG, bits);

	pr_info("out-of-bounds in __change_bit\n");
	__change_bit(BITS_PER_LONG, bits);

	/*
	 * Below calls try to access bit beyond allocated memory.
	 */
	pr_info("out-of-bounds in test_and_set_bit\n");
	test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);

	pr_info("out-of-bounds in __test_and_set_bit\n");
	__test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);

	pr_info("out-of-bounds in test_and_set_bit_lock\n");
	test_and_set_bit_lock(BITS_PER_LONG + BITS_PER_BYTE, bits);

	pr_info("out-of-bounds in test_and_clear_bit\n");
	test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);

	pr_info("out-of-bounds in __test_and_clear_bit\n");
	__test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);

	pr_info("out-of-bounds in test_and_change_bit\n");
	test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);

	pr_info("out-of-bounds in __test_and_change_bit\n");
	__test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);

	pr_info("out-of-bounds in test_bit\n");
	(void)test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);

#if defined(clear_bit_unlock_is_negative_byte)
	pr_info("out-of-bounds in clear_bit_unlock_is_negative_byte\n");
	clear_bit_unlock_is_negative_byte(BITS_PER_LONG + BITS_PER_BYTE, bits);
#endif
	kfree(bits);
}

static noinline void __init kmalloc_double_kzfree(void)
{
	char *ptr;
	size_t size = 16;

	pr_info("double-free (kzfree)\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	kzfree(ptr);
	kzfree(ptr);
}

static int __init kmalloc_tests_init(void)
{
	/*
	 * Temporarily enable multi-shot mode. Otherwise, we'd only get a
	 * report for the first case.
	 */
	bool multishot = kasan_save_enable_multi_shot();

	kmalloc_oob_right();
	kmalloc_oob_left();
	kmalloc_node_oob_right();
#ifdef CONFIG_SLUB
	kmalloc_pagealloc_oob_right();
	kmalloc_pagealloc_uaf();
	kmalloc_pagealloc_invalid_free();
#endif
	kmalloc_large_oob_right();
	kmalloc_oob_krealloc_more();
	kmalloc_oob_krealloc_less();
	kmalloc_oob_16();
	kmalloc_oob_in_memset();
	kmalloc_oob_memset_2();
	kmalloc_oob_memset_4();
	kmalloc_oob_memset_8();
	kmalloc_oob_memset_16();
	kmalloc_uaf();
	kmalloc_uaf_memset();
	kmalloc_uaf2();
	kmem_cache_oob();
	memcg_accounted_kmem_cache();
	kasan_stack_oob();
	kasan_global_oob();
	kasan_alloca_oob_left();
	kasan_alloca_oob_right();
	ksize_unpoisons_memory();
	copy_user_test();
	kmem_cache_double_free();
	kmem_cache_invalid_free();
	kasan_memchr();
	kasan_memcmp();
	kasan_strings();
	kasan_bitops();
	kmalloc_double_kzfree();

	kasan_restore_multi_shot(multishot);

	return -EAGAIN;
}

module_init(kmalloc_tests_init);
MODULE_LICENSE("GPL");
Commit	Line	Data
d2912cb1	1	// SPDX-License-Identifier: GPL-2.0-only
3f15801c AR	2	/*
	3	*
	4	* Copyright (c) 2014 Samsung Electronics Co., Ltd.
	5	* Author: Andrey Ryabinin <a.ryabinin@samsung.com>
3f15801c AR	6	*/
	7
	8	#define pr_fmt(fmt) "kasan test: %s " fmt, __func__
	9
19a33ca6	10	#include <linux/bitops.h>
0386bf38	11	#include <linux/delay.h>
19a33ca6	12	#include <linux/kasan.h>
3f15801c	13	#include <linux/kernel.h>
eae08dca	14	#include <linux/mm.h>
19a33ca6 ME	15	#include <linux/mman.h>
19a33ca6 ME	16	#include <linux/module.h>
3f15801c AR	17	#include <linux/printk.h>
	18	#include <linux/slab.h>
	19	#include <linux/string.h>
eae08dca	20	#include <linux/uaccess.h>
3f15801c	21
828347f8 DV	22	/*
	23	* Note: test functions are marked noinline so that their names appear in
	24	* reports.
	25	*/
	26
3f15801c AR	27	static noinline void __init kmalloc_oob_right(void)
	28	{
	29	char *ptr;
	30	size_t size = 123;
	31
	32	pr_info("out-of-bounds to right\n");
	33	ptr = kmalloc(size, GFP_KERNEL);
	34	if (!ptr) {
	35	pr_err("Allocation failed\n");
	36	return;
	37	}
	38
	39	ptr[size] = 'x';
	40	kfree(ptr);
	41	}
	42
	43	static noinline void __init kmalloc_oob_left(void)
	44	{
	45	char *ptr;
	46	size_t size = 15;
	47
	48	pr_info("out-of-bounds to left\n");
	49	ptr = kmalloc(size, GFP_KERNEL);
	50	if (!ptr) {
	51	pr_err("Allocation failed\n");
	52	return;
	53	}
	54
	55	ptr = (ptr - 1);
	56	kfree(ptr);
	57	}
	58
	59	static noinline void __init kmalloc_node_oob_right(void)
	60	{
	61	char *ptr;
	62	size_t size = 4096;
	63
	64	pr_info("kmalloc_node(): out-of-bounds to right\n");
	65	ptr = kmalloc_node(size, GFP_KERNEL, 0);
	66	if (!ptr) {
	67	pr_err("Allocation failed\n");
	68	return;
	69	}
	70
	71	ptr[size] = 0;
	72	kfree(ptr);
	73	}
	74
e6e8379c AP	75	#ifdef CONFIG_SLUB
e6e8379c AP	76	static noinline void __init kmalloc_pagealloc_oob_right(void)
3f15801c AR	77	{
	78	char *ptr;
	79	size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
	80
e6e8379c AP	81	/* Allocate a chunk that does not fit into a SLUB cache to trigger
	82	* the page allocator fallback.
	83	*/
	84	pr_info("kmalloc pagealloc allocation: out-of-bounds to right\n");
	85	ptr = kmalloc(size, GFP_KERNEL);
	86	if (!ptr) {
	87	pr_err("Allocation failed\n");
	88	return;
	89	}
	90
	91	ptr[size] = 0;
	92	kfree(ptr);
	93	}
47adccce DV	94
	95	static noinline void __init kmalloc_pagealloc_uaf(void)
	96	{
	97	char *ptr;
	98	size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
	99
	100	pr_info("kmalloc pagealloc allocation: use-after-free\n");
	101	ptr = kmalloc(size, GFP_KERNEL);
	102	if (!ptr) {
	103	pr_err("Allocation failed\n");
	104	return;
	105	}
	106
	107	kfree(ptr);
	108	ptr[0] = 0;
	109	}
	110
	111	static noinline void __init kmalloc_pagealloc_invalid_free(void)
	112	{
	113	char *ptr;
	114	size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
	115
	116	pr_info("kmalloc pagealloc allocation: invalid-free\n");
	117	ptr = kmalloc(size, GFP_KERNEL);
	118	if (!ptr) {
	119	pr_err("Allocation failed\n");
	120	return;
	121	}
	122
	123	kfree(ptr + 1);
	124	}
e6e8379c AP	125	#endif
	126
	127	static noinline void __init kmalloc_large_oob_right(void)
	128	{
	129	char *ptr;
	130	size_t size = KMALLOC_MAX_CACHE_SIZE - 256;
	131	/* Allocate a chunk that is large enough, but still fits into a slab
	132	* and does not trigger the page allocator fallback in SLUB.
	133	*/
3f15801c AR	134	pr_info("kmalloc large allocation: out-of-bounds to right\n");
	135	ptr = kmalloc(size, GFP_KERNEL);
	136	if (!ptr) {
	137	pr_err("Allocation failed\n");
	138	return;
	139	}
	140
	141	ptr[size] = 0;
	142	kfree(ptr);
	143	}
	144
	145	static noinline void __init kmalloc_oob_krealloc_more(void)
	146	{
	147	char ptr1, ptr2;
	148	size_t size1 = 17;
	149	size_t size2 = 19;
	150
	151	pr_info("out-of-bounds after krealloc more\n");
	152	ptr1 = kmalloc(size1, GFP_KERNEL);
	153	ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
	154	if (!ptr1 \|\| !ptr2) {
	155	pr_err("Allocation failed\n");
	156	kfree(ptr1);
	157	return;
	158	}
	159
	160	ptr2[size2] = 'x';
	161	kfree(ptr2);
	162	}
	163
	164	static noinline void __init kmalloc_oob_krealloc_less(void)
	165	{
	166	char ptr1, ptr2;
	167	size_t size1 = 17;
	168	size_t size2 = 15;
	169
	170	pr_info("out-of-bounds after krealloc less\n");
	171	ptr1 = kmalloc(size1, GFP_KERNEL);
	172	ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
	173	if (!ptr1 \|\| !ptr2) {
	174	pr_err("Allocation failed\n");
	175	kfree(ptr1);
	176	return;
	177	}
6b4a35fc	178	ptr2[size2] = 'x';
3f15801c AR	179	kfree(ptr2);
	180	}
	181
	182	static noinline void __init kmalloc_oob_16(void)
	183	{
	184	struct {
	185	u64 words[2];
	186	} ptr1, ptr2;
	187
	188	pr_info("kmalloc out-of-bounds for 16-bytes access\n");
	189	ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL);
	190	ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
	191	if (!ptr1 \|\| !ptr2) {
	192	pr_err("Allocation failed\n");
	193	kfree(ptr1);
	194	kfree(ptr2);
	195	return;
	196	}
	197	ptr1 = ptr2;
	198	kfree(ptr1);
	199	kfree(ptr2);
	200	}
	201
f523e737 WL	202	static noinline void __init kmalloc_oob_memset_2(void)
	203	{
	204	char *ptr;
	205	size_t size = 8;
	206
	207	pr_info("out-of-bounds in memset2\n");
	208	ptr = kmalloc(size, GFP_KERNEL);
	209	if (!ptr) {
	210	pr_err("Allocation failed\n");
	211	return;
	212	}
	213
	214	memset(ptr+7, 0, 2);
	215	kfree(ptr);
	216	}
	217
	218	static noinline void __init kmalloc_oob_memset_4(void)
	219	{
	220	char *ptr;
	221	size_t size = 8;
	222
	223	pr_info("out-of-bounds in memset4\n");
	224	ptr = kmalloc(size, GFP_KERNEL);
	225	if (!ptr) {
	226	pr_err("Allocation failed\n");
	227	return;
	228	}
	229
	230	memset(ptr+5, 0, 4);
	231	kfree(ptr);
	232	}
	233
	234
	235	static noinline void __init kmalloc_oob_memset_8(void)
	236	{
	237	char *ptr;
	238	size_t size = 8;
	239
	240	pr_info("out-of-bounds in memset8\n");
	241	ptr = kmalloc(size, GFP_KERNEL);
	242	if (!ptr) {
	243	pr_err("Allocation failed\n");
	244	return;
	245	}
	246
	247	memset(ptr+1, 0, 8);
	248	kfree(ptr);
	249	}
	250
	251	static noinline void __init kmalloc_oob_memset_16(void)
	252	{
	253	char *ptr;
	254	size_t size = 16;
	255
	256	pr_info("out-of-bounds in memset16\n");
	257	ptr = kmalloc(size, GFP_KERNEL);
	258	if (!ptr) {
	259	pr_err("Allocation failed\n");
	260	return;
	261	}
	262
	263	memset(ptr+1, 0, 16);
	264	kfree(ptr);
	265	}
266
3f15801c AR	267	static noinline void __init kmalloc_oob_in_memset(void)
	268	{
	269	char *ptr;
	270	size_t size = 666;
	271
	272	pr_info("out-of-bounds in memset\n");
	273	ptr = kmalloc(size, GFP_KERNEL);
	274	if (!ptr) {
	275	pr_err("Allocation failed\n");
	276	return;
	277	}
	278
	279	memset(ptr, 0, size+5);
	280	kfree(ptr);
	281	}
	282
	283	static noinline void __init kmalloc_uaf(void)
	284	{
	285	char *ptr;
	286	size_t size = 10;
	287
	288	pr_info("use-after-free\n");
	289	ptr = kmalloc(size, GFP_KERNEL);
	290	if (!ptr) {
	291	pr_err("Allocation failed\n");
	292	return;
	293	}
	294
	295	kfree(ptr);
	296	*(ptr + 8) = 'x';
	297	}
	298
	299	static noinline void __init kmalloc_uaf_memset(void)
	300	{
	301	char *ptr;
	302	size_t size = 33;
	303
	304	pr_info("use-after-free in memset\n");
	305	ptr = kmalloc(size, GFP_KERNEL);
	306	if (!ptr) {
	307	pr_err("Allocation failed\n");
	308	return;
	309	}
	310
	311	kfree(ptr);
	312	memset(ptr, 0, size);
	313	}
	314
	315	static noinline void __init kmalloc_uaf2(void)
	316	{
	317	char ptr1, ptr2;
	318	size_t size = 43;
	319
	320	pr_info("use-after-free after another kmalloc\n");
	321	ptr1 = kmalloc(size, GFP_KERNEL);
	322	if (!ptr1) {
	323	pr_err("Allocation failed\n");
	324	return;
	325	}
	326
	327	kfree(ptr1);
	328	ptr2 = kmalloc(size, GFP_KERNEL);
	329	if (!ptr2) {
	330	pr_err("Allocation failed\n");
331	return;
332	}
333
334	ptr1[40] = 'x';
9dcadd38 AP	335	if (ptr1 == ptr2)
9dcadd38 AP	336	pr_err("Could not detect use-after-free: ptr1 == ptr2\n");
3f15801c AR	337	kfree(ptr2);
	338	}
	339
	340	static noinline void __init kmem_cache_oob(void)
	341	{
	342	char *p;
	343	size_t size = 200;
	344	struct kmem_cache *cache = kmem_cache_create("test_cache",
	345	size, 0,
	346	0, NULL);
	347	if (!cache) {
	348	pr_err("Cache allocation failed\n");
	349	return;
	350	}
	351	pr_info("out-of-bounds in kmem_cache_alloc\n");
	352	p = kmem_cache_alloc(cache, GFP_KERNEL);
	353	if (!p) {
	354	pr_err("Allocation failed\n");
	355	kmem_cache_destroy(cache);
	356	return;
	357	}
	358
	359	*p = p[size];
	360	kmem_cache_free(cache, p);
	361	kmem_cache_destroy(cache);
	362	}
	363
0386bf38 GT	364	static noinline void __init memcg_accounted_kmem_cache(void)
	365	{
	366	int i;
	367	char *p;
	368	size_t size = 200;
	369	struct kmem_cache *cache;
	370
	371	cache = kmem_cache_create("test_cache", size, 0, SLAB_ACCOUNT, NULL);
	372	if (!cache) {
	373	pr_err("Cache allocation failed\n");
	374	return;
	375	}
	376
	377	pr_info("allocate memcg accounted object\n");
	378	/*
	379	* Several allocations with a delay to allow for lazy per memcg kmem
	380	* cache creation.
	381	*/
	382	for (i = 0; i < 5; i++) {
	383	p = kmem_cache_alloc(cache, GFP_KERNEL);
dc2bf000	384	if (!p)
0386bf38	385	goto free_cache;
dc2bf000	386
0386bf38 GT	387	kmem_cache_free(cache, p);
	388	msleep(100);
	389	}
	390
	391	free_cache:
	392	kmem_cache_destroy(cache);
	393	}
	394
3f15801c AR	395	static char global_array[10];
	396
	397	static noinline void __init kasan_global_oob(void)
	398	{
	399	volatile int i = 3;
	400	char *p = &global_array[ARRAY_SIZE(global_array) + i];
	401
	402	pr_info("out-of-bounds global variable\n");
	403	(volatile char )p;
	404	}
	405
	406	static noinline void __init kasan_stack_oob(void)
	407	{
	408	char stack_array[10];
	409	volatile int i = 0;
	410	char *p = &stack_array[ARRAY_SIZE(stack_array) + i];
	411
	412	pr_info("out-of-bounds on stack\n");
	413	(volatile char )p;
	414	}
	415
96fe805f AP	416	static noinline void __init ksize_unpoisons_memory(void)
	417	{
	418	char *ptr;
48c23239	419	size_t size = 123, real_size;
96fe805f AP	420
	421	pr_info("ksize() unpoisons the whole allocated chunk\n");
	422	ptr = kmalloc(size, GFP_KERNEL);
	423	if (!ptr) {
	424	pr_err("Allocation failed\n");
	425	return;
	426	}
	427	real_size = ksize(ptr);
	428	/* This access doesn't trigger an error. */
	429	ptr[size] = 'x';
	430	/* This one does. */
	431	ptr[real_size] = 'y';
	432	kfree(ptr);
	433	}
	434
eae08dca AR	435	static noinline void __init copy_user_test(void)
	436	{
	437	char *kmem;
	438	char __user *usermem;
	439	size_t size = 10;
	440	int unused;
	441
	442	kmem = kmalloc(size, GFP_KERNEL);
	443	if (!kmem)
	444	return;
	445
	446	usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE,
	447	PROT_READ \| PROT_WRITE \| PROT_EXEC,
	448	MAP_ANONYMOUS \| MAP_PRIVATE, 0);
	449	if (IS_ERR(usermem)) {
	450	pr_err("Failed to allocate user memory\n");
	451	kfree(kmem);
	452	return;
	453	}
	454
	455	pr_info("out-of-bounds in copy_from_user()\n");
	456	unused = copy_from_user(kmem, usermem, size + 1);
	457
	458	pr_info("out-of-bounds in copy_to_user()\n");
	459	unused = copy_to_user(usermem, kmem, size + 1);
	460
	461	pr_info("out-of-bounds in __copy_from_user()\n");
	462	unused = __copy_from_user(kmem, usermem, size + 1);
	463
	464	pr_info("out-of-bounds in __copy_to_user()\n");
	465	unused = __copy_to_user(usermem, kmem, size + 1);
	466
	467	pr_info("out-of-bounds in __copy_from_user_inatomic()\n");
	468	unused = __copy_from_user_inatomic(kmem, usermem, size + 1);
	469
	470	pr_info("out-of-bounds in __copy_to_user_inatomic()\n");
	471	unused = __copy_to_user_inatomic(usermem, kmem, size + 1);
	472
	473	pr_info("out-of-bounds in strncpy_from_user()\n");
	474	unused = strncpy_from_user(kmem, usermem, size + 1);
	475
	476	vm_munmap((unsigned long)usermem, PAGE_SIZE);
	477	kfree(kmem);
	478	}
	479
00a14294 PL	480	static noinline void __init kasan_alloca_oob_left(void)
	481	{
	482	volatile int i = 10;
	483	char alloca_array[i];
	484	char *p = alloca_array - 1;
	485
	486	pr_info("out-of-bounds to left on alloca\n");
	487	(volatile char )p;
	488	}
	489
	490	static noinline void __init kasan_alloca_oob_right(void)
	491	{
	492	volatile int i = 10;
	493	char alloca_array[i];
	494	char *p = alloca_array + i;
	495
	496	pr_info("out-of-bounds to right on alloca\n");
	497	(volatile char )p;
	498	}
	499
b1d57289 DV	500	static noinline void __init kmem_cache_double_free(void)
	501	{
	502	char *p;
	503	size_t size = 200;
	504	struct kmem_cache *cache;
	505
	506	cache = kmem_cache_create("test_cache", size, 0, 0, NULL);
	507	if (!cache) {
	508	pr_err("Cache allocation failed\n");
	509	return;
	510	}
	511	pr_info("double-free on heap object\n");
	512	p = kmem_cache_alloc(cache, GFP_KERNEL);
	513	if (!p) {
	514	pr_err("Allocation failed\n");
	515	kmem_cache_destroy(cache);
	516	return;
	517	}
	518
	519	kmem_cache_free(cache, p);
	520	kmem_cache_free(cache, p);
	521	kmem_cache_destroy(cache);
	522	}
	523
	524	static noinline void __init kmem_cache_invalid_free(void)
	525	{
	526	char *p;
	527	size_t size = 200;
	528	struct kmem_cache *cache;
	529
	530	cache = kmem_cache_create("test_cache", size, 0, SLAB_TYPESAFE_BY_RCU,
	531	NULL);
	532	if (!cache) {
	533	pr_err("Cache allocation failed\n");
	534	return;
	535	}
	536	pr_info("invalid-free of heap object\n");
	537	p = kmem_cache_alloc(cache, GFP_KERNEL);
	538	if (!p) {
	539	pr_err("Allocation failed\n");
	540	kmem_cache_destroy(cache);
	541	return;
	542	}
	543
91c93ed0	544	/* Trigger invalid free, the object doesn't get freed */
b1d57289	545	kmem_cache_free(cache, p + 1);
91c93ed0 AK	546
	547	/*
	548	* Properly free the object to prevent the "Objects remaining in
	549	* test_cache on __kmem_cache_shutdown" BUG failure.
	550	*/
	551	kmem_cache_free(cache, p);
	552
b1d57289 DV	553	kmem_cache_destroy(cache);
	554	}
	555
0c96350a AR	556	static noinline void __init kasan_memchr(void)
	557	{
	558	char *ptr;
	559	size_t size = 24;
	560
	561	pr_info("out-of-bounds in memchr\n");
	562	ptr = kmalloc(size, GFP_KERNEL \| __GFP_ZERO);
	563	if (!ptr)
	564	return;
	565
	566	memchr(ptr, '1', size + 1);
	567	kfree(ptr);
	568	}
	569
	570	static noinline void __init kasan_memcmp(void)
	571	{
	572	char *ptr;
	573	size_t size = 24;
	574	int arr[9];
	575
	576	pr_info("out-of-bounds in memcmp\n");
	577	ptr = kmalloc(size, GFP_KERNEL \| __GFP_ZERO);
	578	if (!ptr)
	579	return;
	580
	581	memset(arr, 0, sizeof(arr));
	582	memcmp(ptr, arr, size+1);
	583	kfree(ptr);
	584	}
	585
	586	static noinline void __init kasan_strings(void)
	587	{
	588	char *ptr;
	589	size_t size = 24;
	590
	591	pr_info("use-after-free in strchr\n");
	592	ptr = kmalloc(size, GFP_KERNEL \| __GFP_ZERO);
	593	if (!ptr)
	594	return;
	595
	596	kfree(ptr);
	597
	598	/*
	599	* Try to cause only 1 invalid access (less spam in dmesg).
	600	* For that we need ptr to point to zeroed byte.
	601	* Skip metadata that could be stored in freed object so ptr
	602	* will likely point to zeroed byte.
	603	*/
	604	ptr += 16;
	605	strchr(ptr, '1');
	606
	607	pr_info("use-after-free in strrchr\n");
	608	strrchr(ptr, '1');
	609
	610	pr_info("use-after-free in strcmp\n");
	611	strcmp(ptr, "2");
	612
	613	pr_info("use-after-free in strncmp\n");
	614	strncmp(ptr, "2", 1);
	615
	616	pr_info("use-after-free in strlen\n");
	617	strlen(ptr);
	618
	619	pr_info("use-after-free in strnlen\n");
620	strnlen(ptr, 1);
621	}
622
19a33ca6 ME	623	static noinline void __init kasan_bitops(void)
	624	{
	625	/*
	626	* Allocate 1 more byte, which causes kzalloc to round up to 16-bytes;
	627	* this way we do not actually corrupt other memory.
	628	*/
	629	long bits = kzalloc(sizeof(bits) + 1, GFP_KERNEL);
	630	if (!bits)
	631	return;
	632
	633	/*
	634	* Below calls try to access bit within allocated memory; however, the
	635	* below accesses are still out-of-bounds, since bitops are defined to
	636	* operate on the whole long the bit is in.
	637	*/
	638	pr_info("out-of-bounds in set_bit\n");
	639	set_bit(BITS_PER_LONG, bits);
	640
	641	pr_info("out-of-bounds in __set_bit\n");
	642	__set_bit(BITS_PER_LONG, bits);
	643
	644	pr_info("out-of-bounds in clear_bit\n");
	645	clear_bit(BITS_PER_LONG, bits);
	646
	647	pr_info("out-of-bounds in __clear_bit\n");
	648	__clear_bit(BITS_PER_LONG, bits);
	649
	650	pr_info("out-of-bounds in clear_bit_unlock\n");
	651	clear_bit_unlock(BITS_PER_LONG, bits);
	652
	653	pr_info("out-of-bounds in __clear_bit_unlock\n");
	654	__clear_bit_unlock(BITS_PER_LONG, bits);
	655
	656	pr_info("out-of-bounds in change_bit\n");
	657	change_bit(BITS_PER_LONG, bits);
	658
	659	pr_info("out-of-bounds in __change_bit\n");
	660	__change_bit(BITS_PER_LONG, bits);
	661
	662	/*
	663	* Below calls try to access bit beyond allocated memory.
	664	*/
	665	pr_info("out-of-bounds in test_and_set_bit\n");
	666	test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
	667
	668	pr_info("out-of-bounds in __test_and_set_bit\n");
	669	__test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
	670
	671	pr_info("out-of-bounds in test_and_set_bit_lock\n");
	672	test_and_set_bit_lock(BITS_PER_LONG + BITS_PER_BYTE, bits);
	673
	674	pr_info("out-of-bounds in test_and_clear_bit\n");
	675	test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
	676
	677	pr_info("out-of-bounds in __test_and_clear_bit\n");
	678	__test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
	679
	680	pr_info("out-of-bounds in test_and_change_bit\n");
	681	test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
	682
	683	pr_info("out-of-bounds in __test_and_change_bit\n");
	684	__test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
	685
	686	pr_info("out-of-bounds in test_bit\n");
687	(void)test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
688
689	#if defined(clear_bit_unlock_is_negative_byte)
690	pr_info("out-of-bounds in clear_bit_unlock_is_negative_byte\n");
691	clear_bit_unlock_is_negative_byte(BITS_PER_LONG + BITS_PER_BYTE, bits);
692	#endif
693	kfree(bits);
694	}
695
bb104ed7 ME	696	static noinline void __init kmalloc_double_kzfree(void)
	697	{
	698	char *ptr;
	699	size_t size = 16;
	700
	701	pr_info("double-free (kzfree)\n");
	702	ptr = kmalloc(size, GFP_KERNEL);
	703	if (!ptr) {
	704	pr_err("Allocation failed\n");
	705	return;
	706	}
	707
	708	kzfree(ptr);
	709	kzfree(ptr);
	710	}
	711
3f15801c AR	712	static int __init kmalloc_tests_init(void)
3f15801c AR	713	{
b0845ce5 MR	714	/*
	715	* Temporarily enable multi-shot mode. Otherwise, we'd only get a
	716	* report for the first case.
	717	*/
	718	bool multishot = kasan_save_enable_multi_shot();
	719
3f15801c AR	720	kmalloc_oob_right();
	721	kmalloc_oob_left();
	722	kmalloc_node_oob_right();
e6e8379c AP	723	#ifdef CONFIG_SLUB
e6e8379c AP	724	kmalloc_pagealloc_oob_right();
47adccce DV	725	kmalloc_pagealloc_uaf();
47adccce DV	726	kmalloc_pagealloc_invalid_free();
e6e8379c	727	#endif
9789d8e0	728	kmalloc_large_oob_right();
3f15801c AR	729	kmalloc_oob_krealloc_more();
	730	kmalloc_oob_krealloc_less();
	731	kmalloc_oob_16();
	732	kmalloc_oob_in_memset();
f523e737 WL	733	kmalloc_oob_memset_2();
	734	kmalloc_oob_memset_4();
	735	kmalloc_oob_memset_8();
	736	kmalloc_oob_memset_16();
3f15801c AR	737	kmalloc_uaf();
	738	kmalloc_uaf_memset();
	739	kmalloc_uaf2();
	740	kmem_cache_oob();
0386bf38	741	memcg_accounted_kmem_cache();
3f15801c AR	742	kasan_stack_oob();
3f15801c AR	743	kasan_global_oob();
00a14294 PL	744	kasan_alloca_oob_left();
00a14294 PL	745	kasan_alloca_oob_right();
96fe805f	746	ksize_unpoisons_memory();
eae08dca	747	copy_user_test();
b1d57289 DV	748	kmem_cache_double_free();
b1d57289 DV	749	kmem_cache_invalid_free();
0c96350a AR	750	kasan_memchr();
	751	kasan_memcmp();
	752	kasan_strings();
19a33ca6	753	kasan_bitops();
bb104ed7	754	kmalloc_double_kzfree();
b0845ce5 MR	755
	756	kasan_restore_multi_shot(multishot);
	757
3f15801c AR	758	return -EAGAIN;
	759	}
	760
	761	module_init(kmalloc_tests_init);
	762	MODULE_LICENSE("GPL");