Commit | Line | Data |
---|---|---|
3e2a4c18 KC |
1 | /* |
2 | * Kernel module for testing copy_to/from_user infrastructure. | |
3 | * | |
4 | * Copyright 2013 Google Inc. All Rights Reserved | |
5 | * | |
6 | * Authors: | |
7 | * Kees Cook <keescook@chromium.org> | |
8 | * | |
9 | * This software is licensed under the terms of the GNU General Public | |
10 | * License version 2, as published by the Free Software Foundation, and | |
11 | * may be copied, distributed, and modified under those terms. | |
12 | * | |
13 | * This program is distributed in the hope that it will be useful, | |
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
16 | * GNU General Public License for more details. | |
17 | */ | |
18 | ||
19 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt | |
20 | ||
21 | #include <linux/mman.h> | |
22 | #include <linux/module.h> | |
23 | #include <linux/sched.h> | |
24 | #include <linux/slab.h> | |
25 | #include <linux/uaccess.h> | |
26 | #include <linux/vmalloc.h> | |
27 | ||
4c5d7bc6 KC |
28 | /* |
29 | * Several 32-bit architectures support 64-bit {get,put}_user() calls. | |
30 | * As there doesn't appear to be anything that can safely determine | |
31 | * their capability at compile-time, we just have to opt-out certain archs. | |
32 | */ | |
4deaa6fd | 33 | #if BITS_PER_LONG == 64 || (!(defined(CONFIG_ARM) && !defined(MMU)) && \ |
4c5d7bc6 KC |
34 | !defined(CONFIG_BLACKFIN) && \ |
35 | !defined(CONFIG_M32R) && \ | |
36 | !defined(CONFIG_M68K) && \ | |
37 | !defined(CONFIG_MICROBLAZE) && \ | |
38 | !defined(CONFIG_MN10300) && \ | |
39 | !defined(CONFIG_NIOS2) && \ | |
40 | !defined(CONFIG_PPC32) && \ | |
41 | !defined(CONFIG_SUPERH)) | |
42 | # define TEST_U64 | |
43 | #endif | |
44 | ||
3e2a4c18 KC |
45 | #define test(condition, msg) \ |
46 | ({ \ | |
47 | int cond = (condition); \ | |
48 | if (cond) \ | |
49 | pr_warn("%s\n", msg); \ | |
50 | cond; \ | |
51 | }) | |
52 | ||
53 | static int __init test_user_copy_init(void) | |
54 | { | |
55 | int ret = 0; | |
56 | char *kmem; | |
57 | char __user *usermem; | |
58 | char *bad_usermem; | |
59 | unsigned long user_addr; | |
4c5d7bc6 KC |
60 | u8 val_u8; |
61 | u16 val_u16; | |
62 | u32 val_u32; | |
63 | #ifdef TEST_U64 | |
64 | u64 val_u64; | |
65 | #endif | |
3e2a4c18 KC |
66 | |
67 | kmem = kmalloc(PAGE_SIZE * 2, GFP_KERNEL); | |
68 | if (!kmem) | |
69 | return -ENOMEM; | |
70 | ||
71 | user_addr = vm_mmap(NULL, 0, PAGE_SIZE * 2, | |
72 | PROT_READ | PROT_WRITE | PROT_EXEC, | |
73 | MAP_ANONYMOUS | MAP_PRIVATE, 0); | |
74 | if (user_addr >= (unsigned long)(TASK_SIZE)) { | |
75 | pr_warn("Failed to allocate user memory\n"); | |
76 | kfree(kmem); | |
77 | return -ENOMEM; | |
78 | } | |
79 | ||
80 | usermem = (char __user *)user_addr; | |
81 | bad_usermem = (char *)user_addr; | |
82 | ||
f5f893c5 KC |
83 | /* |
84 | * Legitimate usage: none of these copies should fail. | |
85 | */ | |
4c5d7bc6 | 86 | memset(kmem, 0x3a, PAGE_SIZE * 2); |
3e2a4c18 KC |
87 | ret |= test(copy_to_user(usermem, kmem, PAGE_SIZE), |
88 | "legitimate copy_to_user failed"); | |
4c5d7bc6 KC |
89 | memset(kmem, 0x0, PAGE_SIZE); |
90 | ret |= test(copy_from_user(kmem, usermem, PAGE_SIZE), | |
91 | "legitimate copy_from_user failed"); | |
92 | ret |= test(memcmp(kmem, kmem + PAGE_SIZE, PAGE_SIZE), | |
93 | "legitimate usercopy failed to copy data"); | |
94 | ||
95 | #define test_legit(size, check) \ | |
96 | do { \ | |
97 | val_##size = check; \ | |
98 | ret |= test(put_user(val_##size, (size __user *)usermem), \ | |
99 | "legitimate put_user (" #size ") failed"); \ | |
100 | val_##size = 0; \ | |
101 | ret |= test(get_user(val_##size, (size __user *)usermem), \ | |
102 | "legitimate get_user (" #size ") failed"); \ | |
103 | ret |= test(val_##size != check, \ | |
104 | "legitimate get_user (" #size ") failed to do copy"); \ | |
105 | if (val_##size != check) { \ | |
106 | pr_info("0x%llx != 0x%llx\n", \ | |
107 | (unsigned long long)val_##size, \ | |
108 | (unsigned long long)check); \ | |
109 | } \ | |
110 | } while (0) | |
111 | ||
112 | test_legit(u8, 0x5a); | |
113 | test_legit(u16, 0x5a5b); | |
114 | test_legit(u32, 0x5a5b5c5d); | |
115 | #ifdef TEST_U64 | |
116 | test_legit(u64, 0x5a5b5c5d6a6b6c6d); | |
117 | #endif | |
118 | #undef test_legit | |
3e2a4c18 | 119 | |
f5f893c5 KC |
120 | /* |
121 | * Invalid usage: none of these copies should succeed. | |
122 | */ | |
123 | ||
124 | /* Prepare kernel memory with check values. */ | |
4fbfeb8b HR |
125 | memset(kmem, 0x5a, PAGE_SIZE); |
126 | memset(kmem + PAGE_SIZE, 0, PAGE_SIZE); | |
f5f893c5 KC |
127 | |
128 | /* Reject kernel-to-kernel copies through copy_from_user(). */ | |
3e2a4c18 KC |
129 | ret |= test(!copy_from_user(kmem, (char __user *)(kmem + PAGE_SIZE), |
130 | PAGE_SIZE), | |
131 | "illegal all-kernel copy_from_user passed"); | |
f5f893c5 KC |
132 | |
133 | /* Destination half of buffer should have been zeroed. */ | |
4fbfeb8b HR |
134 | ret |= test(memcmp(kmem + PAGE_SIZE, kmem, PAGE_SIZE), |
135 | "zeroing failure for illegal all-kernel copy_from_user"); | |
f5f893c5 KC |
136 | |
137 | #if 0 | |
138 | /* | |
139 | * When running with SMAP/PAN/etc, this will Oops the kernel | |
140 | * due to the zeroing of userspace memory on failure. This needs | |
141 | * to be tested in LKDTM instead, since this test module does not | |
142 | * expect to explode. | |
143 | */ | |
3e2a4c18 KC |
144 | ret |= test(!copy_from_user(bad_usermem, (char __user *)kmem, |
145 | PAGE_SIZE), | |
146 | "illegal reversed copy_from_user passed"); | |
f5f893c5 | 147 | #endif |
3e2a4c18 KC |
148 | ret |= test(!copy_to_user((char __user *)kmem, kmem + PAGE_SIZE, |
149 | PAGE_SIZE), | |
150 | "illegal all-kernel copy_to_user passed"); | |
151 | ret |= test(!copy_to_user((char __user *)kmem, bad_usermem, | |
152 | PAGE_SIZE), | |
153 | "illegal reversed copy_to_user passed"); | |
f5f893c5 | 154 | |
4c5d7bc6 KC |
155 | #define test_illegal(size, check) \ |
156 | do { \ | |
157 | val_##size = (check); \ | |
158 | ret |= test(!get_user(val_##size, (size __user *)kmem), \ | |
159 | "illegal get_user (" #size ") passed"); \ | |
160 | ret |= test(val_##size != (size)0, \ | |
161 | "zeroing failure for illegal get_user (" #size ")"); \ | |
162 | if (val_##size != (size)0) { \ | |
163 | pr_info("0x%llx != 0\n", \ | |
164 | (unsigned long long)val_##size); \ | |
165 | } \ | |
166 | ret |= test(!put_user(val_##size, (size __user *)kmem), \ | |
167 | "illegal put_user (" #size ") passed"); \ | |
168 | } while (0) | |
169 | ||
170 | test_illegal(u8, 0x5a); | |
171 | test_illegal(u16, 0x5a5b); | |
172 | test_illegal(u32, 0x5a5b5c5d); | |
173 | #ifdef TEST_U64 | |
174 | test_illegal(u64, 0x5a5b5c5d6a6b6c6d); | |
175 | #endif | |
176 | #undef test_illegal | |
3e2a4c18 KC |
177 | |
178 | vm_munmap(user_addr, PAGE_SIZE * 2); | |
179 | kfree(kmem); | |
180 | ||
181 | if (ret == 0) { | |
182 | pr_info("tests passed.\n"); | |
183 | return 0; | |
184 | } | |
185 | ||
186 | return -EINVAL; | |
187 | } | |
188 | ||
189 | module_init(test_user_copy_init); | |
190 | ||
191 | static void __exit test_user_copy_exit(void) | |
192 | { | |
193 | pr_info("unloaded.\n"); | |
194 | } | |
195 | ||
196 | module_exit(test_user_copy_exit); | |
197 | ||
198 | MODULE_AUTHOR("Kees Cook <keescook@chromium.org>"); | |
199 | MODULE_LICENSE("GPL"); |