Commit | Line | Data |
---|---|---|
9c92ab61 | 1 | // SPDX-License-Identifier: GPL-2.0-only |
3e2a4c18 KC |
2 | /* |
3 | * Kernel module for testing copy_to/from_user infrastructure. | |
4 | * | |
5 | * Copyright 2013 Google Inc. All Rights Reserved | |
6 | * | |
7 | * Authors: | |
8 | * Kees Cook <keescook@chromium.org> | |
3e2a4c18 KC |
9 | */ |
10 | ||
11 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt | |
12 | ||
13 | #include <linux/mman.h> | |
14 | #include <linux/module.h> | |
15 | #include <linux/sched.h> | |
16 | #include <linux/slab.h> | |
17 | #include <linux/uaccess.h> | |
18 | #include <linux/vmalloc.h> | |
19 | ||
4c5d7bc6 KC |
20 | /* |
21 | * Several 32-bit architectures support 64-bit {get,put}_user() calls. | |
22 | * As there doesn't appear to be anything that can safely determine | |
23 | * their capability at compile-time, we just have to opt-out certain archs. | |
24 | */ | |
4deaa6fd | 25 | #if BITS_PER_LONG == 64 || (!(defined(CONFIG_ARM) && !defined(MMU)) && \ |
4c5d7bc6 KC |
26 | !defined(CONFIG_M68K) && \ |
27 | !defined(CONFIG_MICROBLAZE) && \ | |
4c5d7bc6 KC |
28 | !defined(CONFIG_NIOS2) && \ |
29 | !defined(CONFIG_PPC32) && \ | |
30 | !defined(CONFIG_SUPERH)) | |
31 | # define TEST_U64 | |
32 | #endif | |
33 | ||
3e2a4c18 KC |
34 | #define test(condition, msg) \ |
35 | ({ \ | |
36 | int cond = (condition); \ | |
37 | if (cond) \ | |
38 | pr_warn("%s\n", msg); \ | |
39 | cond; \ | |
40 | }) | |
41 | ||
42 | static int __init test_user_copy_init(void) | |
43 | { | |
44 | int ret = 0; | |
45 | char *kmem; | |
46 | char __user *usermem; | |
47 | char *bad_usermem; | |
48 | unsigned long user_addr; | |
4c5d7bc6 KC |
49 | u8 val_u8; |
50 | u16 val_u16; | |
51 | u32 val_u32; | |
52 | #ifdef TEST_U64 | |
53 | u64 val_u64; | |
54 | #endif | |
3e2a4c18 KC |
55 | |
56 | kmem = kmalloc(PAGE_SIZE * 2, GFP_KERNEL); | |
57 | if (!kmem) | |
58 | return -ENOMEM; | |
59 | ||
60 | user_addr = vm_mmap(NULL, 0, PAGE_SIZE * 2, | |
61 | PROT_READ | PROT_WRITE | PROT_EXEC, | |
62 | MAP_ANONYMOUS | MAP_PRIVATE, 0); | |
63 | if (user_addr >= (unsigned long)(TASK_SIZE)) { | |
64 | pr_warn("Failed to allocate user memory\n"); | |
65 | kfree(kmem); | |
66 | return -ENOMEM; | |
67 | } | |
68 | ||
69 | usermem = (char __user *)user_addr; | |
70 | bad_usermem = (char *)user_addr; | |
71 | ||
f5f893c5 KC |
72 | /* |
73 | * Legitimate usage: none of these copies should fail. | |
74 | */ | |
4c5d7bc6 | 75 | memset(kmem, 0x3a, PAGE_SIZE * 2); |
3e2a4c18 KC |
76 | ret |= test(copy_to_user(usermem, kmem, PAGE_SIZE), |
77 | "legitimate copy_to_user failed"); | |
4c5d7bc6 KC |
78 | memset(kmem, 0x0, PAGE_SIZE); |
79 | ret |= test(copy_from_user(kmem, usermem, PAGE_SIZE), | |
80 | "legitimate copy_from_user failed"); | |
81 | ret |= test(memcmp(kmem, kmem + PAGE_SIZE, PAGE_SIZE), | |
82 | "legitimate usercopy failed to copy data"); | |
83 | ||
84 | #define test_legit(size, check) \ | |
85 | do { \ | |
86 | val_##size = check; \ | |
87 | ret |= test(put_user(val_##size, (size __user *)usermem), \ | |
88 | "legitimate put_user (" #size ") failed"); \ | |
89 | val_##size = 0; \ | |
90 | ret |= test(get_user(val_##size, (size __user *)usermem), \ | |
91 | "legitimate get_user (" #size ") failed"); \ | |
92 | ret |= test(val_##size != check, \ | |
93 | "legitimate get_user (" #size ") failed to do copy"); \ | |
94 | if (val_##size != check) { \ | |
95 | pr_info("0x%llx != 0x%llx\n", \ | |
96 | (unsigned long long)val_##size, \ | |
97 | (unsigned long long)check); \ | |
98 | } \ | |
99 | } while (0) | |
100 | ||
101 | test_legit(u8, 0x5a); | |
102 | test_legit(u16, 0x5a5b); | |
103 | test_legit(u32, 0x5a5b5c5d); | |
104 | #ifdef TEST_U64 | |
105 | test_legit(u64, 0x5a5b5c5d6a6b6c6d); | |
106 | #endif | |
107 | #undef test_legit | |
3e2a4c18 | 108 | |
f5f893c5 KC |
109 | /* |
110 | * Invalid usage: none of these copies should succeed. | |
111 | */ | |
112 | ||
113 | /* Prepare kernel memory with check values. */ | |
4fbfeb8b HR |
114 | memset(kmem, 0x5a, PAGE_SIZE); |
115 | memset(kmem + PAGE_SIZE, 0, PAGE_SIZE); | |
f5f893c5 KC |
116 | |
117 | /* Reject kernel-to-kernel copies through copy_from_user(). */ | |
3e2a4c18 KC |
118 | ret |= test(!copy_from_user(kmem, (char __user *)(kmem + PAGE_SIZE), |
119 | PAGE_SIZE), | |
120 | "illegal all-kernel copy_from_user passed"); | |
f5f893c5 KC |
121 | |
122 | /* Destination half of buffer should have been zeroed. */ | |
4fbfeb8b HR |
123 | ret |= test(memcmp(kmem + PAGE_SIZE, kmem, PAGE_SIZE), |
124 | "zeroing failure for illegal all-kernel copy_from_user"); | |
f5f893c5 KC |
125 | |
126 | #if 0 | |
127 | /* | |
128 | * When running with SMAP/PAN/etc, this will Oops the kernel | |
129 | * due to the zeroing of userspace memory on failure. This needs | |
130 | * to be tested in LKDTM instead, since this test module does not | |
131 | * expect to explode. | |
132 | */ | |
3e2a4c18 KC |
133 | ret |= test(!copy_from_user(bad_usermem, (char __user *)kmem, |
134 | PAGE_SIZE), | |
135 | "illegal reversed copy_from_user passed"); | |
f5f893c5 | 136 | #endif |
3e2a4c18 KC |
137 | ret |= test(!copy_to_user((char __user *)kmem, kmem + PAGE_SIZE, |
138 | PAGE_SIZE), | |
139 | "illegal all-kernel copy_to_user passed"); | |
140 | ret |= test(!copy_to_user((char __user *)kmem, bad_usermem, | |
141 | PAGE_SIZE), | |
142 | "illegal reversed copy_to_user passed"); | |
f5f893c5 | 143 | |
4c5d7bc6 KC |
144 | #define test_illegal(size, check) \ |
145 | do { \ | |
146 | val_##size = (check); \ | |
147 | ret |= test(!get_user(val_##size, (size __user *)kmem), \ | |
148 | "illegal get_user (" #size ") passed"); \ | |
149 | ret |= test(val_##size != (size)0, \ | |
150 | "zeroing failure for illegal get_user (" #size ")"); \ | |
151 | if (val_##size != (size)0) { \ | |
152 | pr_info("0x%llx != 0\n", \ | |
153 | (unsigned long long)val_##size); \ | |
154 | } \ | |
155 | ret |= test(!put_user(val_##size, (size __user *)kmem), \ | |
156 | "illegal put_user (" #size ") passed"); \ | |
157 | } while (0) | |
158 | ||
159 | test_illegal(u8, 0x5a); | |
160 | test_illegal(u16, 0x5a5b); | |
161 | test_illegal(u32, 0x5a5b5c5d); | |
162 | #ifdef TEST_U64 | |
163 | test_illegal(u64, 0x5a5b5c5d6a6b6c6d); | |
164 | #endif | |
165 | #undef test_illegal | |
3e2a4c18 KC |
166 | |
167 | vm_munmap(user_addr, PAGE_SIZE * 2); | |
168 | kfree(kmem); | |
169 | ||
170 | if (ret == 0) { | |
171 | pr_info("tests passed.\n"); | |
172 | return 0; | |
173 | } | |
174 | ||
175 | return -EINVAL; | |
176 | } | |
177 | ||
178 | module_init(test_user_copy_init); | |
179 | ||
180 | static void __exit test_user_copy_exit(void) | |
181 | { | |
182 | pr_info("unloaded.\n"); | |
183 | } | |
184 | ||
185 | module_exit(test_user_copy_exit); | |
186 | ||
187 | MODULE_AUTHOR("Kees Cook <keescook@chromium.org>"); | |
188 | MODULE_LICENSE("GPL"); |