Commit | Line | Data |
---|---|---|
d2912cb1 | 1 | // SPDX-License-Identifier: GPL-2.0-only |
3f15801c AR |
2 | /* |
3 | * | |
4 | * Copyright (c) 2014 Samsung Electronics Co., Ltd. | |
5 | * Author: Andrey Ryabinin <a.ryabinin@samsung.com> | |
3f15801c AR |
6 | */ |
7 | ||
7ce0ea19 AK |
8 | #define pr_fmt(fmt) "kasan_test: " fmt |
9 | ||
10 | #include <kunit/test.h> | |
19a33ca6 | 11 | #include <linux/bitops.h> |
0386bf38 | 12 | #include <linux/delay.h> |
7ce0ea19 | 13 | #include <linux/io.h> |
19a33ca6 | 14 | #include <linux/kasan.h> |
3f15801c | 15 | #include <linux/kernel.h> |
eae08dca | 16 | #include <linux/mm.h> |
19a33ca6 ME |
17 | #include <linux/mman.h> |
18 | #include <linux/module.h> | |
3f15801c | 19 | #include <linux/printk.h> |
573a4809 | 20 | #include <linux/random.h> |
7ce0ea19 | 21 | #include <linux/set_memory.h> |
3f15801c AR |
22 | #include <linux/slab.h> |
23 | #include <linux/string.h> | |
7ce0ea19 | 24 | #include <linux/tracepoint.h> |
eae08dca | 25 | #include <linux/uaccess.h> |
06513916 | 26 | #include <linux/vmalloc.h> |
7ce0ea19 | 27 | #include <trace/events/printk.h> |
b92a953c MR |
28 | |
29 | #include <asm/page.h> | |
3f15801c | 30 | |
f7e01ab8 | 31 | #include "kasan.h" |
f33a0149 | 32 | |
1f600626 | 33 | #define OOB_TAG_OFF (IS_ENABLED(CONFIG_KASAN_GENERIC) ? 0 : KASAN_GRANULE_SIZE) |
f33a0149 | 34 | |
7ce0ea19 AK |
35 | static bool multishot; |
36 | ||
37 | /* Fields set based on lines observed in the console. */ | |
38 | static struct { | |
39 | bool report_found; | |
40 | bool async_fault; | |
41 | } test_status; | |
42 | ||
adb72ae1 | 43 | /* |
0fd37925 AK |
44 | * Some tests use these global variables to store return values from function |
45 | * calls that could otherwise be eliminated by the compiler as dead code. | |
adb72ae1 | 46 | */ |
adb72ae1 | 47 | void *kasan_ptr_result; |
83c4e7a0 PA |
48 | int kasan_int_result; |
49 | ||
7ce0ea19 AK |
50 | /* Probe for console output: obtains test_status lines of interest. */ |
51 | static void probe_console(void *ignore, const char *buf, size_t len) | |
52 | { | |
53 | if (strnstr(buf, "BUG: KASAN: ", len)) | |
54 | WRITE_ONCE(test_status.report_found, true); | |
55 | else if (strnstr(buf, "Asynchronous fault: ", len)) | |
56 | WRITE_ONCE(test_status.async_fault, true); | |
57 | } | |
83c4e7a0 | 58 | |
7ce0ea19 | 59 | static int kasan_suite_init(struct kunit_suite *suite) |
83c4e7a0 | 60 | { |
d82dc3a4 | 61 | if (!kasan_enabled()) { |
7ce0ea19 | 62 | pr_err("Can't run KASAN tests with KASAN disabled"); |
d82dc3a4 AK |
63 | return -1; |
64 | } | |
65 | ||
c8c7016f AK |
66 | /* Stop failing KUnit tests on KASAN reports. */ |
67 | kasan_kunit_test_suite_start(); | |
68 | ||
7ce0ea19 AK |
69 | /* |
70 | * Temporarily enable multi-shot mode. Otherwise, KASAN would only | |
71 | * report the first detected bug and panic the kernel if panic_on_warn | |
72 | * is enabled. | |
73 | */ | |
83c4e7a0 | 74 | multishot = kasan_save_enable_multi_shot(); |
7ce0ea19 | 75 | |
1f6ab566 | 76 | register_trace_console(probe_console, NULL); |
83c4e7a0 PA |
77 | return 0; |
78 | } | |
79 | ||
7ce0ea19 | 80 | static void kasan_suite_exit(struct kunit_suite *suite) |
83c4e7a0 | 81 | { |
c8c7016f | 82 | kasan_kunit_test_suite_end(); |
83c4e7a0 | 83 | kasan_restore_multi_shot(multishot); |
1f6ab566 | 84 | unregister_trace_console(probe_console, NULL); |
7ce0ea19 AK |
85 | tracepoint_synchronize_unregister(); |
86 | } | |
87 | ||
88 | static void kasan_test_exit(struct kunit *test) | |
89 | { | |
90 | KUNIT_EXPECT_FALSE(test, READ_ONCE(test_status.report_found)); | |
83c4e7a0 PA |
91 | } |
92 | ||
93 | /** | |
0fd37925 AK |
94 | * KUNIT_EXPECT_KASAN_FAIL() - check that the executed expression produces a |
95 | * KASAN report; causes a test failure otherwise. This relies on a KUnit | |
ed6d7444 | 96 | * resource named "kasan_status". Do not use this name for KUnit resources |
0fd37925 | 97 | * outside of KASAN tests. |
f05842cf | 98 | * |
ed6d7444 | 99 | * For hardware tag-based KASAN, when a synchronous tag fault happens, tag |
e80a76aa AK |
100 | * checking is auto-disabled. When this happens, this test handler reenables |
101 | * tag checking. As tag checking can be only disabled or enabled per CPU, | |
102 | * this handler disables migration (preemption). | |
2e4bde6a | 103 | * |
ed6d7444 | 104 | * Since the compiler doesn't see that the expression can change the test_status |
2e4bde6a AK |
105 | * fields, it can reorder or optimize away the accesses to those fields. |
106 | * Use READ/WRITE_ONCE() for the accesses and compiler barriers around the | |
107 | * expression to prevent that. | |
99734b53 | 108 | * |
ed6d7444 AK |
109 | * In between KUNIT_EXPECT_KASAN_FAIL checks, test_status.report_found is kept |
110 | * as false. This allows detecting KASAN reports that happen outside of the | |
111 | * checks by asserting !test_status.report_found at the start of | |
112 | * KUNIT_EXPECT_KASAN_FAIL and in kasan_test_exit. | |
83c4e7a0 | 113 | */ |
99734b53 AK |
114 | #define KUNIT_EXPECT_KASAN_FAIL(test, expression) do { \ |
115 | if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) && \ | |
2d27e585 | 116 | kasan_sync_fault_possible()) \ |
99734b53 | 117 | migrate_disable(); \ |
ed6d7444 | 118 | KUNIT_EXPECT_FALSE(test, READ_ONCE(test_status.report_found)); \ |
99734b53 AK |
119 | barrier(); \ |
120 | expression; \ | |
121 | barrier(); \ | |
ed6d7444 AK |
122 | if (kasan_async_fault_possible()) \ |
123 | kasan_force_async_fault(); \ | |
124 | if (!READ_ONCE(test_status.report_found)) { \ | |
3ff16d30 DG |
125 | KUNIT_FAIL(test, KUNIT_SUBTEST_INDENT "KASAN failure " \ |
126 | "expected in \"" #expression \ | |
127 | "\", but none occurred"); \ | |
128 | } \ | |
ed6d7444 AK |
129 | if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) && \ |
130 | kasan_sync_fault_possible()) { \ | |
131 | if (READ_ONCE(test_status.report_found) && \ | |
7ce0ea19 | 132 | !READ_ONCE(test_status.async_fault)) \ |
0eafff1c | 133 | kasan_enable_hw_tags(); \ |
99734b53 AK |
134 | migrate_enable(); \ |
135 | } \ | |
ed6d7444 | 136 | WRITE_ONCE(test_status.report_found, false); \ |
7ce0ea19 | 137 | WRITE_ONCE(test_status.async_fault, false); \ |
83c4e7a0 PA |
138 | } while (0) |
139 | ||
da17e377 | 140 | #define KASAN_TEST_NEEDS_CONFIG_ON(test, config) do { \ |
40eb5cf4 ME |
141 | if (!IS_ENABLED(config)) \ |
142 | kunit_skip((test), "Test requires " #config "=y"); \ | |
da17e377 AK |
143 | } while (0) |
144 | ||
145 | #define KASAN_TEST_NEEDS_CONFIG_OFF(test, config) do { \ | |
40eb5cf4 ME |
146 | if (IS_ENABLED(config)) \ |
147 | kunit_skip((test), "Test requires " #config "=n"); \ | |
da17e377 AK |
148 | } while (0) |
149 | ||
85f195b1 ME |
150 | #define KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test) do { \ |
151 | if (IS_ENABLED(CONFIG_KASAN_HW_TAGS)) \ | |
152 | break; /* No compiler instrumentation. */ \ | |
153 | if (IS_ENABLED(CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX)) \ | |
154 | break; /* Should always be instrumented! */ \ | |
155 | if (IS_ENABLED(CONFIG_GENERIC_ENTRY)) \ | |
156 | kunit_skip((test), "Test requires checked mem*()"); \ | |
157 | } while (0) | |
158 | ||
73228c7e | 159 | static void kmalloc_oob_right(struct kunit *test) |
3f15801c AR |
160 | { |
161 | char *ptr; | |
ab512805 | 162 | size_t size = 128 - KASAN_GRANULE_SIZE - 5; |
3f15801c | 163 | |
3f15801c | 164 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 165 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
f33a0149 | 166 | |
aaf50b19 | 167 | OPTIMIZER_HIDE_VAR(ptr); |
ab512805 AK |
168 | /* |
169 | * An unaligned access past the requested kmalloc size. | |
170 | * Only generic KASAN can precisely detect these. | |
171 | */ | |
172 | if (IS_ENABLED(CONFIG_KASAN_GENERIC)) | |
173 | KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 'x'); | |
174 | ||
175 | /* | |
176 | * An aligned access into the first out-of-bounds granule that falls | |
177 | * within the aligned kmalloc object. | |
178 | */ | |
179 | KUNIT_EXPECT_KASAN_FAIL(test, ptr[size + 5] = 'y'); | |
180 | ||
181 | /* Out-of-bounds access past the aligned kmalloc object. */ | |
182 | KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = | |
183 | ptr[size + KASAN_GRANULE_SIZE + 5]); | |
184 | ||
3f15801c AR |
185 | kfree(ptr); |
186 | } | |
187 | ||
73228c7e | 188 | static void kmalloc_oob_left(struct kunit *test) |
3f15801c AR |
189 | { |
190 | char *ptr; | |
191 | size_t size = 15; | |
192 | ||
3f15801c | 193 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 194 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
3f15801c | 195 | |
aaf50b19 | 196 | OPTIMIZER_HIDE_VAR(ptr); |
73228c7e | 197 | KUNIT_EXPECT_KASAN_FAIL(test, *ptr = *(ptr - 1)); |
3f15801c AR |
198 | kfree(ptr); |
199 | } | |
200 | ||
73228c7e | 201 | static void kmalloc_node_oob_right(struct kunit *test) |
3f15801c AR |
202 | { |
203 | char *ptr; | |
204 | size_t size = 4096; | |
205 | ||
3f15801c | 206 | ptr = kmalloc_node(size, GFP_KERNEL, 0); |
73228c7e | 207 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
3f15801c | 208 | |
aaf50b19 | 209 | OPTIMIZER_HIDE_VAR(ptr); |
8fbad19b | 210 | KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = ptr[size]); |
3f15801c AR |
211 | kfree(ptr); |
212 | } | |
213 | ||
858bdeb0 AK |
214 | /* |
215 | * These kmalloc_pagealloc_* tests try allocating a memory chunk that doesn't | |
216 | * fit into a slab cache and therefore is allocated via the page allocator | |
217 | * fallback. Since this kind of fallback is only implemented for SLUB, these | |
218 | * tests are limited to that allocator. | |
219 | */ | |
73228c7e | 220 | static void kmalloc_pagealloc_oob_right(struct kunit *test) |
3f15801c AR |
221 | { |
222 | char *ptr; | |
223 | size_t size = KMALLOC_MAX_CACHE_SIZE + 10; | |
224 | ||
da17e377 | 225 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB); |
73228c7e | 226 | |
e6e8379c | 227 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 228 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
f33a0149 | 229 | |
aaf50b19 | 230 | OPTIMIZER_HIDE_VAR(ptr); |
73228c7e | 231 | KUNIT_EXPECT_KASAN_FAIL(test, ptr[size + OOB_TAG_OFF] = 0); |
858bdeb0 | 232 | |
e6e8379c AP |
233 | kfree(ptr); |
234 | } | |
47adccce | 235 | |
73228c7e | 236 | static void kmalloc_pagealloc_uaf(struct kunit *test) |
47adccce DV |
237 | { |
238 | char *ptr; | |
239 | size_t size = KMALLOC_MAX_CACHE_SIZE + 10; | |
240 | ||
da17e377 | 241 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB); |
47adccce | 242 | |
73228c7e PA |
243 | ptr = kmalloc(size, GFP_KERNEL); |
244 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
47adccce | 245 | kfree(ptr); |
858bdeb0 | 246 | |
8fbad19b | 247 | KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]); |
47adccce DV |
248 | } |
249 | ||
73228c7e | 250 | static void kmalloc_pagealloc_invalid_free(struct kunit *test) |
47adccce DV |
251 | { |
252 | char *ptr; | |
253 | size_t size = KMALLOC_MAX_CACHE_SIZE + 10; | |
254 | ||
da17e377 | 255 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB); |
47adccce | 256 | |
73228c7e PA |
257 | ptr = kmalloc(size, GFP_KERNEL); |
258 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
259 | ||
260 | KUNIT_EXPECT_KASAN_FAIL(test, kfree(ptr + 1)); | |
47adccce | 261 | } |
e6e8379c | 262 | |
858bdeb0 AK |
263 | static void pagealloc_oob_right(struct kunit *test) |
264 | { | |
265 | char *ptr; | |
266 | struct page *pages; | |
267 | size_t order = 4; | |
268 | size_t size = (1UL << (PAGE_SHIFT + order)); | |
269 | ||
270 | /* | |
271 | * With generic KASAN page allocations have no redzones, thus | |
272 | * out-of-bounds detection is not guaranteed. | |
273 | * See https://bugzilla.kernel.org/show_bug.cgi?id=210503. | |
274 | */ | |
275 | KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); | |
276 | ||
277 | pages = alloc_pages(GFP_KERNEL, order); | |
278 | ptr = page_address(pages); | |
279 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
280 | ||
8fbad19b | 281 | KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = ptr[size]); |
858bdeb0 AK |
282 | free_pages((unsigned long)ptr, order); |
283 | } | |
284 | ||
285 | static void pagealloc_uaf(struct kunit *test) | |
286 | { | |
287 | char *ptr; | |
288 | struct page *pages; | |
289 | size_t order = 4; | |
290 | ||
291 | pages = alloc_pages(GFP_KERNEL, order); | |
292 | ptr = page_address(pages); | |
293 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
294 | free_pages((unsigned long)ptr, order); | |
295 | ||
8fbad19b | 296 | KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]); |
858bdeb0 AK |
297 | } |
298 | ||
73228c7e | 299 | static void kmalloc_large_oob_right(struct kunit *test) |
e6e8379c AP |
300 | { |
301 | char *ptr; | |
302 | size_t size = KMALLOC_MAX_CACHE_SIZE - 256; | |
0fd37925 AK |
303 | |
304 | /* | |
305 | * Allocate a chunk that is large enough, but still fits into a slab | |
e6e8379c AP |
306 | * and does not trigger the page allocator fallback in SLUB. |
307 | */ | |
3f15801c | 308 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 309 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
3f15801c | 310 | |
aaf50b19 | 311 | OPTIMIZER_HIDE_VAR(ptr); |
73228c7e | 312 | KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0); |
3f15801c AR |
313 | kfree(ptr); |
314 | } | |
315 | ||
b87c28b9 AK |
316 | static void krealloc_more_oob_helper(struct kunit *test, |
317 | size_t size1, size_t size2) | |
3f15801c AR |
318 | { |
319 | char *ptr1, *ptr2; | |
b87c28b9 AK |
320 | size_t middle; |
321 | ||
322 | KUNIT_ASSERT_LT(test, size1, size2); | |
323 | middle = size1 + (size2 - size1) / 2; | |
3f15801c | 324 | |
3f15801c | 325 | ptr1 = kmalloc(size1, GFP_KERNEL); |
73228c7e | 326 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); |
3f15801c | 327 | |
73228c7e PA |
328 | ptr2 = krealloc(ptr1, size2, GFP_KERNEL); |
329 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); | |
f33a0149 | 330 | |
d6e5040b AK |
331 | /* Suppress -Warray-bounds warnings. */ |
332 | OPTIMIZER_HIDE_VAR(ptr2); | |
333 | ||
b87c28b9 AK |
334 | /* All offsets up to size2 must be accessible. */ |
335 | ptr2[size1 - 1] = 'x'; | |
336 | ptr2[size1] = 'x'; | |
337 | ptr2[middle] = 'x'; | |
338 | ptr2[size2 - 1] = 'x'; | |
339 | ||
340 | /* Generic mode is precise, so unaligned size2 must be inaccessible. */ | |
341 | if (IS_ENABLED(CONFIG_KASAN_GENERIC)) | |
342 | KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size2] = 'x'); | |
343 | ||
344 | /* For all modes first aligned offset after size2 must be inaccessible. */ | |
345 | KUNIT_EXPECT_KASAN_FAIL(test, | |
346 | ptr2[round_up(size2, KASAN_GRANULE_SIZE)] = 'x'); | |
347 | ||
3f15801c AR |
348 | kfree(ptr2); |
349 | } | |
350 | ||
b87c28b9 AK |
351 | static void krealloc_less_oob_helper(struct kunit *test, |
352 | size_t size1, size_t size2) | |
3f15801c AR |
353 | { |
354 | char *ptr1, *ptr2; | |
b87c28b9 AK |
355 | size_t middle; |
356 | ||
357 | KUNIT_ASSERT_LT(test, size2, size1); | |
358 | middle = size2 + (size1 - size2) / 2; | |
3f15801c | 359 | |
3f15801c | 360 | ptr1 = kmalloc(size1, GFP_KERNEL); |
73228c7e | 361 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); |
f33a0149 | 362 | |
73228c7e PA |
363 | ptr2 = krealloc(ptr1, size2, GFP_KERNEL); |
364 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); | |
f33a0149 | 365 | |
d6e5040b AK |
366 | /* Suppress -Warray-bounds warnings. */ |
367 | OPTIMIZER_HIDE_VAR(ptr2); | |
368 | ||
b87c28b9 AK |
369 | /* Must be accessible for all modes. */ |
370 | ptr2[size2 - 1] = 'x'; | |
371 | ||
372 | /* Generic mode is precise, so unaligned size2 must be inaccessible. */ | |
373 | if (IS_ENABLED(CONFIG_KASAN_GENERIC)) | |
374 | KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size2] = 'x'); | |
375 | ||
376 | /* For all modes first aligned offset after size2 must be inaccessible. */ | |
377 | KUNIT_EXPECT_KASAN_FAIL(test, | |
378 | ptr2[round_up(size2, KASAN_GRANULE_SIZE)] = 'x'); | |
379 | ||
380 | /* | |
381 | * For all modes all size2, middle, and size1 should land in separate | |
382 | * granules and thus the latter two offsets should be inaccessible. | |
383 | */ | |
384 | KUNIT_EXPECT_LE(test, round_up(size2, KASAN_GRANULE_SIZE), | |
385 | round_down(middle, KASAN_GRANULE_SIZE)); | |
386 | KUNIT_EXPECT_LE(test, round_up(middle, KASAN_GRANULE_SIZE), | |
387 | round_down(size1, KASAN_GRANULE_SIZE)); | |
388 | KUNIT_EXPECT_KASAN_FAIL(test, ptr2[middle] = 'x'); | |
389 | KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size1 - 1] = 'x'); | |
390 | KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size1] = 'x'); | |
391 | ||
3f15801c AR |
392 | kfree(ptr2); |
393 | } | |
394 | ||
b87c28b9 AK |
395 | static void krealloc_more_oob(struct kunit *test) |
396 | { | |
397 | krealloc_more_oob_helper(test, 201, 235); | |
398 | } | |
399 | ||
400 | static void krealloc_less_oob(struct kunit *test) | |
401 | { | |
402 | krealloc_less_oob_helper(test, 235, 201); | |
403 | } | |
404 | ||
405 | static void krealloc_pagealloc_more_oob(struct kunit *test) | |
406 | { | |
407 | /* page_alloc fallback in only implemented for SLUB. */ | |
408 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB); | |
409 | ||
410 | krealloc_more_oob_helper(test, KMALLOC_MAX_CACHE_SIZE + 201, | |
411 | KMALLOC_MAX_CACHE_SIZE + 235); | |
412 | } | |
413 | ||
414 | static void krealloc_pagealloc_less_oob(struct kunit *test) | |
415 | { | |
416 | /* page_alloc fallback in only implemented for SLUB. */ | |
417 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB); | |
418 | ||
419 | krealloc_less_oob_helper(test, KMALLOC_MAX_CACHE_SIZE + 235, | |
420 | KMALLOC_MAX_CACHE_SIZE + 201); | |
421 | } | |
422 | ||
26a5ca7a AK |
423 | /* |
424 | * Check that krealloc() detects a use-after-free, returns NULL, | |
425 | * and doesn't unpoison the freed object. | |
426 | */ | |
427 | static void krealloc_uaf(struct kunit *test) | |
428 | { | |
429 | char *ptr1, *ptr2; | |
430 | int size1 = 201; | |
431 | int size2 = 235; | |
432 | ||
433 | ptr1 = kmalloc(size1, GFP_KERNEL); | |
434 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); | |
435 | kfree(ptr1); | |
436 | ||
437 | KUNIT_EXPECT_KASAN_FAIL(test, ptr2 = krealloc(ptr1, size2, GFP_KERNEL)); | |
ccad78f1 | 438 | KUNIT_ASSERT_NULL(test, ptr2); |
26a5ca7a AK |
439 | KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)ptr1); |
440 | } | |
441 | ||
73228c7e | 442 | static void kmalloc_oob_16(struct kunit *test) |
3f15801c AR |
443 | { |
444 | struct { | |
445 | u64 words[2]; | |
446 | } *ptr1, *ptr2; | |
447 | ||
85f195b1 ME |
448 | KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); |
449 | ||
58b999d7 | 450 | /* This test is specifically crafted for the generic mode. */ |
da17e377 | 451 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); |
58b999d7 | 452 | |
3f15801c | 453 | ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL); |
73228c7e PA |
454 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); |
455 | ||
3f15801c | 456 | ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL); |
73228c7e PA |
457 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); |
458 | ||
aaf50b19 KC |
459 | OPTIMIZER_HIDE_VAR(ptr1); |
460 | OPTIMIZER_HIDE_VAR(ptr2); | |
73228c7e | 461 | KUNIT_EXPECT_KASAN_FAIL(test, *ptr1 = *ptr2); |
3f15801c AR |
462 | kfree(ptr1); |
463 | kfree(ptr2); | |
464 | } | |
465 | ||
58b999d7 AK |
466 | static void kmalloc_uaf_16(struct kunit *test) |
467 | { | |
468 | struct { | |
469 | u64 words[2]; | |
470 | } *ptr1, *ptr2; | |
471 | ||
85f195b1 ME |
472 | KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); |
473 | ||
58b999d7 AK |
474 | ptr1 = kmalloc(sizeof(*ptr1), GFP_KERNEL); |
475 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); | |
476 | ||
477 | ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL); | |
478 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); | |
479 | kfree(ptr2); | |
480 | ||
481 | KUNIT_EXPECT_KASAN_FAIL(test, *ptr1 = *ptr2); | |
482 | kfree(ptr1); | |
483 | } | |
484 | ||
555999a0 AK |
485 | /* |
486 | * Note: in the memset tests below, the written range touches both valid and | |
487 | * invalid memory. This makes sure that the instrumentation does not only check | |
488 | * the starting address but the whole range. | |
489 | */ | |
490 | ||
73228c7e | 491 | static void kmalloc_oob_memset_2(struct kunit *test) |
f523e737 WL |
492 | { |
493 | char *ptr; | |
555999a0 | 494 | size_t size = 128 - KASAN_GRANULE_SIZE; |
f523e737 | 495 | |
85f195b1 ME |
496 | KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); |
497 | ||
f523e737 | 498 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 499 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
f33a0149 | 500 | |
d73dad4e | 501 | OPTIMIZER_HIDE_VAR(size); |
555999a0 | 502 | KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 1, 0, 2)); |
f523e737 WL |
503 | kfree(ptr); |
504 | } | |
505 | ||
73228c7e | 506 | static void kmalloc_oob_memset_4(struct kunit *test) |
f523e737 WL |
507 | { |
508 | char *ptr; | |
555999a0 | 509 | size_t size = 128 - KASAN_GRANULE_SIZE; |
f523e737 | 510 | |
85f195b1 ME |
511 | KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); |
512 | ||
f523e737 | 513 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 514 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
f33a0149 | 515 | |
d73dad4e | 516 | OPTIMIZER_HIDE_VAR(size); |
555999a0 | 517 | KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 3, 0, 4)); |
f523e737 WL |
518 | kfree(ptr); |
519 | } | |
520 | ||
73228c7e | 521 | static void kmalloc_oob_memset_8(struct kunit *test) |
f523e737 WL |
522 | { |
523 | char *ptr; | |
555999a0 | 524 | size_t size = 128 - KASAN_GRANULE_SIZE; |
f523e737 | 525 | |
85f195b1 ME |
526 | KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); |
527 | ||
f523e737 | 528 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 529 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
f33a0149 | 530 | |
d73dad4e | 531 | OPTIMIZER_HIDE_VAR(size); |
555999a0 | 532 | KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 7, 0, 8)); |
f523e737 WL |
533 | kfree(ptr); |
534 | } | |
535 | ||
73228c7e | 536 | static void kmalloc_oob_memset_16(struct kunit *test) |
f523e737 WL |
537 | { |
538 | char *ptr; | |
555999a0 | 539 | size_t size = 128 - KASAN_GRANULE_SIZE; |
f523e737 | 540 | |
85f195b1 ME |
541 | KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); |
542 | ||
f523e737 | 543 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 544 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
f33a0149 | 545 | |
d73dad4e | 546 | OPTIMIZER_HIDE_VAR(size); |
555999a0 | 547 | KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 15, 0, 16)); |
f523e737 WL |
548 | kfree(ptr); |
549 | } | |
550 | ||
73228c7e | 551 | static void kmalloc_oob_in_memset(struct kunit *test) |
3f15801c AR |
552 | { |
553 | char *ptr; | |
555999a0 | 554 | size_t size = 128 - KASAN_GRANULE_SIZE; |
3f15801c | 555 | |
85f195b1 ME |
556 | KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); |
557 | ||
3f15801c | 558 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 559 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
f33a0149 | 560 | |
09c6304e | 561 | OPTIMIZER_HIDE_VAR(ptr); |
d73dad4e | 562 | OPTIMIZER_HIDE_VAR(size); |
555999a0 AK |
563 | KUNIT_EXPECT_KASAN_FAIL(test, |
564 | memset(ptr, 0, size + KASAN_GRANULE_SIZE)); | |
3f15801c AR |
565 | kfree(ptr); |
566 | } | |
567 | ||
758cabae | 568 | static void kmalloc_memmove_negative_size(struct kunit *test) |
98f3b56f WW |
569 | { |
570 | char *ptr; | |
571 | size_t size = 64; | |
d73dad4e | 572 | size_t invalid_size = -2; |
98f3b56f | 573 | |
85f195b1 ME |
574 | KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); |
575 | ||
1b0668be AK |
576 | /* |
577 | * Hardware tag-based mode doesn't check memmove for negative size. | |
578 | * As a result, this test introduces a side-effect memory corruption, | |
579 | * which can result in a crash. | |
580 | */ | |
581 | KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_HW_TAGS); | |
582 | ||
98f3b56f | 583 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 584 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
98f3b56f WW |
585 | |
586 | memset((char *)ptr, 0, 64); | |
09c6304e | 587 | OPTIMIZER_HIDE_VAR(ptr); |
d73dad4e | 588 | OPTIMIZER_HIDE_VAR(invalid_size); |
73228c7e PA |
589 | KUNIT_EXPECT_KASAN_FAIL(test, |
590 | memmove((char *)ptr, (char *)ptr + 4, invalid_size)); | |
98f3b56f WW |
591 | kfree(ptr); |
592 | } | |
593 | ||
758cabae PC |
594 | static void kmalloc_memmove_invalid_size(struct kunit *test) |
595 | { | |
596 | char *ptr; | |
597 | size_t size = 64; | |
d6e5040b | 598 | size_t invalid_size = size; |
758cabae | 599 | |
85f195b1 ME |
600 | KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); |
601 | ||
758cabae PC |
602 | ptr = kmalloc(size, GFP_KERNEL); |
603 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
604 | ||
98f3b56f | 605 | memset((char *)ptr, 0, 64); |
09c6304e | 606 | OPTIMIZER_HIDE_VAR(ptr); |
d6e5040b | 607 | OPTIMIZER_HIDE_VAR(invalid_size); |
73228c7e PA |
608 | KUNIT_EXPECT_KASAN_FAIL(test, |
609 | memmove((char *)ptr, (char *)ptr + 4, invalid_size)); | |
98f3b56f WW |
610 | kfree(ptr); |
611 | } | |
612 | ||
73228c7e | 613 | static void kmalloc_uaf(struct kunit *test) |
3f15801c AR |
614 | { |
615 | char *ptr; | |
616 | size_t size = 10; | |
617 | ||
3f15801c | 618 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 619 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
3f15801c AR |
620 | |
621 | kfree(ptr); | |
8fbad19b | 622 | KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[8]); |
3f15801c AR |
623 | } |
624 | ||
73228c7e | 625 | static void kmalloc_uaf_memset(struct kunit *test) |
3f15801c AR |
626 | { |
627 | char *ptr; | |
628 | size_t size = 33; | |
629 | ||
85f195b1 ME |
630 | KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); |
631 | ||
25b12a58 AK |
632 | /* |
633 | * Only generic KASAN uses quarantine, which is required to avoid a | |
634 | * kernel memory corruption this test causes. | |
635 | */ | |
636 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); | |
637 | ||
3f15801c | 638 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 639 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
3f15801c AR |
640 | |
641 | kfree(ptr); | |
73228c7e | 642 | KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr, 0, size)); |
3f15801c AR |
643 | } |
644 | ||
73228c7e | 645 | static void kmalloc_uaf2(struct kunit *test) |
3f15801c AR |
646 | { |
647 | char *ptr1, *ptr2; | |
648 | size_t size = 43; | |
1b1df4c4 | 649 | int counter = 0; |
3f15801c | 650 | |
1b1df4c4 | 651 | again: |
3f15801c | 652 | ptr1 = kmalloc(size, GFP_KERNEL); |
73228c7e | 653 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); |
3f15801c AR |
654 | |
655 | kfree(ptr1); | |
73228c7e | 656 | |
3f15801c | 657 | ptr2 = kmalloc(size, GFP_KERNEL); |
73228c7e PA |
658 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); |
659 | ||
1b1df4c4 AK |
660 | /* |
661 | * For tag-based KASAN ptr1 and ptr2 tags might happen to be the same. | |
662 | * Allow up to 16 attempts at generating different tags. | |
663 | */ | |
664 | if (!IS_ENABLED(CONFIG_KASAN_GENERIC) && ptr1 == ptr2 && counter++ < 16) { | |
665 | kfree(ptr2); | |
666 | goto again; | |
667 | } | |
668 | ||
8fbad19b | 669 | KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr1)[40]); |
73228c7e | 670 | KUNIT_EXPECT_PTR_NE(test, ptr1, ptr2); |
3f15801c | 671 | |
3f15801c AR |
672 | kfree(ptr2); |
673 | } | |
674 | ||
34b592ce AK |
675 | /* |
676 | * Check that KASAN detects use-after-free when another object was allocated in | |
677 | * the same slot. Relevant for the tag-based modes, which do not use quarantine. | |
678 | */ | |
679 | static void kmalloc_uaf3(struct kunit *test) | |
680 | { | |
681 | char *ptr1, *ptr2; | |
682 | size_t size = 100; | |
683 | ||
684 | /* This test is specifically crafted for tag-based modes. */ | |
685 | KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); | |
686 | ||
687 | ptr1 = kmalloc(size, GFP_KERNEL); | |
688 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); | |
689 | kfree(ptr1); | |
690 | ||
691 | ptr2 = kmalloc(size, GFP_KERNEL); | |
692 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); | |
693 | kfree(ptr2); | |
694 | ||
695 | KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr1)[8]); | |
696 | } | |
697 | ||
73228c7e | 698 | static void kfree_via_page(struct kunit *test) |
b92a953c MR |
699 | { |
700 | char *ptr; | |
701 | size_t size = 8; | |
702 | struct page *page; | |
703 | unsigned long offset; | |
704 | ||
b92a953c | 705 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 706 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
b92a953c MR |
707 | |
708 | page = virt_to_page(ptr); | |
709 | offset = offset_in_page(ptr); | |
710 | kfree(page_address(page) + offset); | |
711 | } | |
712 | ||
73228c7e | 713 | static void kfree_via_phys(struct kunit *test) |
b92a953c MR |
714 | { |
715 | char *ptr; | |
716 | size_t size = 8; | |
717 | phys_addr_t phys; | |
718 | ||
b92a953c | 719 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 720 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
b92a953c MR |
721 | |
722 | phys = virt_to_phys(ptr); | |
723 | kfree(phys_to_virt(phys)); | |
724 | } | |
725 | ||
73228c7e | 726 | static void kmem_cache_oob(struct kunit *test) |
3f15801c AR |
727 | { |
728 | char *p; | |
729 | size_t size = 200; | |
11516135 AK |
730 | struct kmem_cache *cache; |
731 | ||
732 | cache = kmem_cache_create("test_cache", size, 0, 0, NULL); | |
73228c7e | 733 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); |
11516135 | 734 | |
3f15801c AR |
735 | p = kmem_cache_alloc(cache, GFP_KERNEL); |
736 | if (!p) { | |
73228c7e | 737 | kunit_err(test, "Allocation failed: %s\n", __func__); |
3f15801c AR |
738 | kmem_cache_destroy(cache); |
739 | return; | |
740 | } | |
741 | ||
73228c7e | 742 | KUNIT_EXPECT_KASAN_FAIL(test, *p = p[size + OOB_TAG_OFF]); |
11516135 | 743 | |
3f15801c AR |
744 | kmem_cache_free(cache, p); |
745 | kmem_cache_destroy(cache); | |
746 | } | |
747 | ||
11516135 | 748 | static void kmem_cache_accounted(struct kunit *test) |
0386bf38 GT |
749 | { |
750 | int i; | |
751 | char *p; | |
752 | size_t size = 200; | |
753 | struct kmem_cache *cache; | |
754 | ||
755 | cache = kmem_cache_create("test_cache", size, 0, SLAB_ACCOUNT, NULL); | |
73228c7e | 756 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); |
0386bf38 | 757 | |
0386bf38 GT |
758 | /* |
759 | * Several allocations with a delay to allow for lazy per memcg kmem | |
760 | * cache creation. | |
761 | */ | |
762 | for (i = 0; i < 5; i++) { | |
763 | p = kmem_cache_alloc(cache, GFP_KERNEL); | |
dc2bf000 | 764 | if (!p) |
0386bf38 | 765 | goto free_cache; |
dc2bf000 | 766 | |
0386bf38 GT |
767 | kmem_cache_free(cache, p); |
768 | msleep(100); | |
769 | } | |
770 | ||
771 | free_cache: | |
772 | kmem_cache_destroy(cache); | |
773 | } | |
774 | ||
11516135 AK |
775 | static void kmem_cache_bulk(struct kunit *test) |
776 | { | |
777 | struct kmem_cache *cache; | |
778 | size_t size = 200; | |
779 | char *p[10]; | |
780 | bool ret; | |
781 | int i; | |
782 | ||
783 | cache = kmem_cache_create("test_cache", size, 0, 0, NULL); | |
784 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); | |
785 | ||
786 | ret = kmem_cache_alloc_bulk(cache, GFP_KERNEL, ARRAY_SIZE(p), (void **)&p); | |
787 | if (!ret) { | |
788 | kunit_err(test, "Allocation failed: %s\n", __func__); | |
789 | kmem_cache_destroy(cache); | |
790 | return; | |
791 | } | |
792 | ||
793 | for (i = 0; i < ARRAY_SIZE(p); i++) | |
794 | p[i][0] = p[i][size - 1] = 42; | |
795 | ||
796 | kmem_cache_free_bulk(cache, ARRAY_SIZE(p), (void **)&p); | |
797 | kmem_cache_destroy(cache); | |
798 | } | |
799 | ||
3f15801c AR |
800 | static char global_array[10]; |
801 | ||
e5f47287 | 802 | static void kasan_global_oob_right(struct kunit *test) |
3f15801c | 803 | { |
f649dc0e PC |
804 | /* |
805 | * Deliberate out-of-bounds access. To prevent CONFIG_UBSAN_LOCAL_BOUNDS | |
53b0fe36 | 806 | * from failing here and panicking the kernel, access the array via a |
f649dc0e PC |
807 | * volatile pointer, which will prevent the compiler from being able to |
808 | * determine the array bounds. | |
809 | * | |
810 | * This access uses a volatile pointer to char (char *volatile) rather | |
811 | * than the more conventional pointer to volatile char (volatile char *) | |
812 | * because we want to prevent the compiler from making inferences about | |
813 | * the pointer itself (i.e. its array bounds), not the data that it | |
814 | * refers to. | |
815 | */ | |
816 | char *volatile array = global_array; | |
817 | char *p = &array[ARRAY_SIZE(global_array) + 3]; | |
3f15801c | 818 | |
58b999d7 | 819 | /* Only generic mode instruments globals. */ |
da17e377 | 820 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); |
58b999d7 | 821 | |
73228c7e | 822 | KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); |
3f15801c AR |
823 | } |
824 | ||
e5f47287 ME |
825 | static void kasan_global_oob_left(struct kunit *test) |
826 | { | |
827 | char *volatile array = global_array; | |
828 | char *p = array - 3; | |
829 | ||
830 | /* | |
831 | * GCC is known to fail this test, skip it. | |
832 | * See https://bugzilla.kernel.org/show_bug.cgi?id=215051. | |
833 | */ | |
834 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_CC_IS_CLANG); | |
835 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); | |
836 | KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); | |
837 | } | |
838 | ||
38931d89 | 839 | /* Check that ksize() does NOT unpoison whole object. */ |
73228c7e | 840 | static void ksize_unpoisons_memory(struct kunit *test) |
96fe805f AP |
841 | { |
842 | char *ptr; | |
38931d89 KC |
843 | size_t size = 128 - KASAN_GRANULE_SIZE - 5; |
844 | size_t real_size; | |
96fe805f | 845 | |
96fe805f | 846 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 847 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
38931d89 | 848 | |
96fe805f | 849 | real_size = ksize(ptr); |
38931d89 | 850 | KUNIT_EXPECT_GT(test, real_size, size); |
0fd37925 | 851 | |
aaf50b19 KC |
852 | OPTIMIZER_HIDE_VAR(ptr); |
853 | ||
38931d89 KC |
854 | /* These accesses shouldn't trigger a KASAN report. */ |
855 | ptr[0] = 'x'; | |
856 | ptr[size - 1] = 'x'; | |
0fd37925 | 857 | |
38931d89 KC |
858 | /* These must trigger a KASAN report. */ |
859 | if (IS_ENABLED(CONFIG_KASAN_GENERIC)) | |
860 | KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size]); | |
861 | KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size + 5]); | |
862 | KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[real_size - 1]); | |
0fd37925 | 863 | |
96fe805f AP |
864 | kfree(ptr); |
865 | } | |
866 | ||
611806b4 AK |
867 | /* |
868 | * Check that a use-after-free is detected by ksize() and via normal accesses | |
869 | * after it. | |
870 | */ | |
871 | static void ksize_uaf(struct kunit *test) | |
872 | { | |
873 | char *ptr; | |
874 | int size = 128 - KASAN_GRANULE_SIZE; | |
875 | ||
876 | ptr = kmalloc(size, GFP_KERNEL); | |
877 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
878 | kfree(ptr); | |
879 | ||
aaf50b19 | 880 | OPTIMIZER_HIDE_VAR(ptr); |
611806b4 | 881 | KUNIT_EXPECT_KASAN_FAIL(test, ksize(ptr)); |
b38fcca3 AK |
882 | KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]); |
883 | KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size]); | |
611806b4 AK |
884 | } |
885 | ||
73228c7e | 886 | static void kasan_stack_oob(struct kunit *test) |
eae08dca | 887 | { |
73228c7e | 888 | char stack_array[10]; |
2dfd1bd9 | 889 | /* See comment in kasan_global_oob_right. */ |
f649dc0e PC |
890 | char *volatile array = stack_array; |
891 | char *p = &array[ARRAY_SIZE(stack_array) + OOB_TAG_OFF]; | |
eae08dca | 892 | |
da17e377 | 893 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_STACK); |
eae08dca | 894 | |
73228c7e | 895 | KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); |
eae08dca AR |
896 | } |
897 | ||
73228c7e | 898 | static void kasan_alloca_oob_left(struct kunit *test) |
00a14294 PL |
899 | { |
900 | volatile int i = 10; | |
901 | char alloca_array[i]; | |
2dfd1bd9 | 902 | /* See comment in kasan_global_oob_right. */ |
f649dc0e PC |
903 | char *volatile array = alloca_array; |
904 | char *p = array - 1; | |
00a14294 | 905 | |
58b999d7 | 906 | /* Only generic mode instruments dynamic allocas. */ |
da17e377 AK |
907 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); |
908 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_STACK); | |
73228c7e PA |
909 | |
910 | KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); | |
00a14294 PL |
911 | } |
912 | ||
73228c7e | 913 | static void kasan_alloca_oob_right(struct kunit *test) |
00a14294 PL |
914 | { |
915 | volatile int i = 10; | |
916 | char alloca_array[i]; | |
2dfd1bd9 | 917 | /* See comment in kasan_global_oob_right. */ |
f649dc0e PC |
918 | char *volatile array = alloca_array; |
919 | char *p = array + i; | |
00a14294 | 920 | |
58b999d7 | 921 | /* Only generic mode instruments dynamic allocas. */ |
da17e377 AK |
922 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); |
923 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_STACK); | |
73228c7e PA |
924 | |
925 | KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); | |
00a14294 PL |
926 | } |
927 | ||
73228c7e | 928 | static void kmem_cache_double_free(struct kunit *test) |
b1d57289 DV |
929 | { |
930 | char *p; | |
931 | size_t size = 200; | |
932 | struct kmem_cache *cache; | |
933 | ||
934 | cache = kmem_cache_create("test_cache", size, 0, 0, NULL); | |
73228c7e PA |
935 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); |
936 | ||
b1d57289 DV |
937 | p = kmem_cache_alloc(cache, GFP_KERNEL); |
938 | if (!p) { | |
73228c7e | 939 | kunit_err(test, "Allocation failed: %s\n", __func__); |
b1d57289 DV |
940 | kmem_cache_destroy(cache); |
941 | return; | |
942 | } | |
943 | ||
944 | kmem_cache_free(cache, p); | |
73228c7e | 945 | KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p)); |
b1d57289 DV |
946 | kmem_cache_destroy(cache); |
947 | } | |
948 | ||
73228c7e | 949 | static void kmem_cache_invalid_free(struct kunit *test) |
b1d57289 DV |
950 | { |
951 | char *p; | |
952 | size_t size = 200; | |
953 | struct kmem_cache *cache; | |
954 | ||
955 | cache = kmem_cache_create("test_cache", size, 0, SLAB_TYPESAFE_BY_RCU, | |
956 | NULL); | |
73228c7e PA |
957 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); |
958 | ||
b1d57289 DV |
959 | p = kmem_cache_alloc(cache, GFP_KERNEL); |
960 | if (!p) { | |
73228c7e | 961 | kunit_err(test, "Allocation failed: %s\n", __func__); |
b1d57289 DV |
962 | kmem_cache_destroy(cache); |
963 | return; | |
964 | } | |
965 | ||
0fd37925 | 966 | /* Trigger invalid free, the object doesn't get freed. */ |
73228c7e | 967 | KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p + 1)); |
91c93ed0 AK |
968 | |
969 | /* | |
970 | * Properly free the object to prevent the "Objects remaining in | |
971 | * test_cache on __kmem_cache_shutdown" BUG failure. | |
972 | */ | |
973 | kmem_cache_free(cache, p); | |
974 | ||
b1d57289 DV |
975 | kmem_cache_destroy(cache); |
976 | } | |
977 | ||
70effdc3 AK |
978 | static void empty_cache_ctor(void *object) { } |
979 | ||
f98f966c ME |
980 | static void kmem_cache_double_destroy(struct kunit *test) |
981 | { | |
982 | struct kmem_cache *cache; | |
983 | ||
70effdc3 AK |
984 | /* Provide a constructor to prevent cache merging. */ |
985 | cache = kmem_cache_create("test_cache", 200, 0, 0, empty_cache_ctor); | |
f98f966c ME |
986 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); |
987 | kmem_cache_destroy(cache); | |
988 | KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_destroy(cache)); | |
989 | } | |
990 | ||
73228c7e | 991 | static void kasan_memchr(struct kunit *test) |
0c96350a AR |
992 | { |
993 | char *ptr; | |
994 | size_t size = 24; | |
995 | ||
0fd37925 AK |
996 | /* |
997 | * str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT. | |
998 | * See https://bugzilla.kernel.org/show_bug.cgi?id=206337 for details. | |
999 | */ | |
da17e377 | 1000 | KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_AMD_MEM_ENCRYPT); |
73228c7e | 1001 | |
58b999d7 AK |
1002 | if (OOB_TAG_OFF) |
1003 | size = round_up(size, OOB_TAG_OFF); | |
1004 | ||
73228c7e PA |
1005 | ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO); |
1006 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
1007 | ||
09c6304e | 1008 | OPTIMIZER_HIDE_VAR(ptr); |
cab71f74 | 1009 | OPTIMIZER_HIDE_VAR(size); |
73228c7e PA |
1010 | KUNIT_EXPECT_KASAN_FAIL(test, |
1011 | kasan_ptr_result = memchr(ptr, '1', size + 1)); | |
0c96350a | 1012 | |
0c96350a AR |
1013 | kfree(ptr); |
1014 | } | |
1015 | ||
73228c7e | 1016 | static void kasan_memcmp(struct kunit *test) |
0c96350a AR |
1017 | { |
1018 | char *ptr; | |
1019 | size_t size = 24; | |
1020 | int arr[9]; | |
1021 | ||
0fd37925 AK |
1022 | /* |
1023 | * str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT. | |
1024 | * See https://bugzilla.kernel.org/show_bug.cgi?id=206337 for details. | |
1025 | */ | |
da17e377 | 1026 | KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_AMD_MEM_ENCRYPT); |
0c96350a | 1027 | |
58b999d7 AK |
1028 | if (OOB_TAG_OFF) |
1029 | size = round_up(size, OOB_TAG_OFF); | |
1030 | ||
73228c7e PA |
1031 | ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO); |
1032 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
0c96350a | 1033 | memset(arr, 0, sizeof(arr)); |
73228c7e | 1034 | |
09c6304e | 1035 | OPTIMIZER_HIDE_VAR(ptr); |
cab71f74 | 1036 | OPTIMIZER_HIDE_VAR(size); |
73228c7e PA |
1037 | KUNIT_EXPECT_KASAN_FAIL(test, |
1038 | kasan_int_result = memcmp(ptr, arr, size+1)); | |
0c96350a AR |
1039 | kfree(ptr); |
1040 | } | |
1041 | ||
73228c7e | 1042 | static void kasan_strings(struct kunit *test) |
0c96350a AR |
1043 | { |
1044 | char *ptr; | |
1045 | size_t size = 24; | |
1046 | ||
0fd37925 AK |
1047 | /* |
1048 | * str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT. | |
1049 | * See https://bugzilla.kernel.org/show_bug.cgi?id=206337 for details. | |
1050 | */ | |
da17e377 | 1051 | KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_AMD_MEM_ENCRYPT); |
73228c7e PA |
1052 | |
1053 | ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO); | |
1054 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
0c96350a AR |
1055 | |
1056 | kfree(ptr); | |
1057 | ||
1058 | /* | |
1059 | * Try to cause only 1 invalid access (less spam in dmesg). | |
1060 | * For that we need ptr to point to zeroed byte. | |
1061 | * Skip metadata that could be stored in freed object so ptr | |
1062 | * will likely point to zeroed byte. | |
1063 | */ | |
1064 | ptr += 16; | |
73228c7e | 1065 | KUNIT_EXPECT_KASAN_FAIL(test, kasan_ptr_result = strchr(ptr, '1')); |
0c96350a | 1066 | |
73228c7e | 1067 | KUNIT_EXPECT_KASAN_FAIL(test, kasan_ptr_result = strrchr(ptr, '1')); |
0c96350a | 1068 | |
73228c7e | 1069 | KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strcmp(ptr, "2")); |
0c96350a | 1070 | |
73228c7e | 1071 | KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strncmp(ptr, "2", 1)); |
0c96350a | 1072 | |
73228c7e | 1073 | KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strlen(ptr)); |
0c96350a | 1074 | |
73228c7e | 1075 | KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strnlen(ptr, 1)); |
0c96350a AR |
1076 | } |
1077 | ||
58b999d7 AK |
1078 | static void kasan_bitops_modify(struct kunit *test, int nr, void *addr) |
1079 | { | |
1080 | KUNIT_EXPECT_KASAN_FAIL(test, set_bit(nr, addr)); | |
1081 | KUNIT_EXPECT_KASAN_FAIL(test, __set_bit(nr, addr)); | |
1082 | KUNIT_EXPECT_KASAN_FAIL(test, clear_bit(nr, addr)); | |
1083 | KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit(nr, addr)); | |
1084 | KUNIT_EXPECT_KASAN_FAIL(test, clear_bit_unlock(nr, addr)); | |
1085 | KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit_unlock(nr, addr)); | |
1086 | KUNIT_EXPECT_KASAN_FAIL(test, change_bit(nr, addr)); | |
1087 | KUNIT_EXPECT_KASAN_FAIL(test, __change_bit(nr, addr)); | |
1088 | } | |
1089 | ||
1090 | static void kasan_bitops_test_and_modify(struct kunit *test, int nr, void *addr) | |
1091 | { | |
1092 | KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit(nr, addr)); | |
1093 | KUNIT_EXPECT_KASAN_FAIL(test, __test_and_set_bit(nr, addr)); | |
1094 | KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit_lock(nr, addr)); | |
1095 | KUNIT_EXPECT_KASAN_FAIL(test, test_and_clear_bit(nr, addr)); | |
1096 | KUNIT_EXPECT_KASAN_FAIL(test, __test_and_clear_bit(nr, addr)); | |
1097 | KUNIT_EXPECT_KASAN_FAIL(test, test_and_change_bit(nr, addr)); | |
1098 | KUNIT_EXPECT_KASAN_FAIL(test, __test_and_change_bit(nr, addr)); | |
1099 | KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = test_bit(nr, addr)); | |
1100 | ||
1101 | #if defined(clear_bit_unlock_is_negative_byte) | |
1102 | KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = | |
1103 | clear_bit_unlock_is_negative_byte(nr, addr)); | |
1104 | #endif | |
1105 | } | |
1106 | ||
1107 | static void kasan_bitops_generic(struct kunit *test) | |
19a33ca6 | 1108 | { |
58b999d7 AK |
1109 | long *bits; |
1110 | ||
1111 | /* This test is specifically crafted for the generic mode. */ | |
da17e377 | 1112 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); |
58b999d7 | 1113 | |
19a33ca6 | 1114 | /* |
0fd37925 | 1115 | * Allocate 1 more byte, which causes kzalloc to round up to 16 bytes; |
19a33ca6 ME |
1116 | * this way we do not actually corrupt other memory. |
1117 | */ | |
58b999d7 | 1118 | bits = kzalloc(sizeof(*bits) + 1, GFP_KERNEL); |
73228c7e | 1119 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits); |
19a33ca6 ME |
1120 | |
1121 | /* | |
1122 | * Below calls try to access bit within allocated memory; however, the | |
1123 | * below accesses are still out-of-bounds, since bitops are defined to | |
1124 | * operate on the whole long the bit is in. | |
1125 | */ | |
58b999d7 | 1126 | kasan_bitops_modify(test, BITS_PER_LONG, bits); |
19a33ca6 ME |
1127 | |
1128 | /* | |
1129 | * Below calls try to access bit beyond allocated memory. | |
1130 | */ | |
58b999d7 | 1131 | kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, bits); |
19a33ca6 | 1132 | |
58b999d7 AK |
1133 | kfree(bits); |
1134 | } | |
19a33ca6 | 1135 | |
58b999d7 AK |
1136 | static void kasan_bitops_tags(struct kunit *test) |
1137 | { | |
1138 | long *bits; | |
19a33ca6 | 1139 | |
da17e377 AK |
1140 | /* This test is specifically crafted for tag-based modes. */ |
1141 | KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); | |
19a33ca6 | 1142 | |
e66e1799 AK |
1143 | /* kmalloc-64 cache will be used and the last 16 bytes will be the redzone. */ |
1144 | bits = kzalloc(48, GFP_KERNEL); | |
58b999d7 | 1145 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits); |
19a33ca6 | 1146 | |
e66e1799 AK |
1147 | /* Do the accesses past the 48 allocated bytes, but within the redone. */ |
1148 | kasan_bitops_modify(test, BITS_PER_LONG, (void *)bits + 48); | |
1149 | kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, (void *)bits + 48); | |
19a33ca6 | 1150 | |
19a33ca6 ME |
1151 | kfree(bits); |
1152 | } | |
1153 | ||
73228c7e | 1154 | static void kmalloc_double_kzfree(struct kunit *test) |
bb104ed7 ME |
1155 | { |
1156 | char *ptr; | |
1157 | size_t size = 16; | |
1158 | ||
bb104ed7 | 1159 | ptr = kmalloc(size, GFP_KERNEL); |
73228c7e | 1160 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); |
bb104ed7 | 1161 | |
453431a5 | 1162 | kfree_sensitive(ptr); |
73228c7e | 1163 | KUNIT_EXPECT_KASAN_FAIL(test, kfree_sensitive(ptr)); |
bb104ed7 ME |
1164 | } |
1165 | ||
b2c5bd4c AK |
1166 | /* |
1167 | * The two tests below check that Generic KASAN prints auxiliary stack traces | |
1168 | * for RCU callbacks and workqueues. The reports need to be inspected manually. | |
1169 | * | |
1170 | * These tests are still enabled for other KASAN modes to make sure that all | |
1171 | * modes report bad accesses in tested scenarios. | |
1172 | */ | |
1173 | ||
8516e837 AK |
1174 | static struct kasan_rcu_info { |
1175 | int i; | |
1176 | struct rcu_head rcu; | |
1177 | } *global_rcu_ptr; | |
1178 | ||
1179 | static void rcu_uaf_reclaim(struct rcu_head *rp) | |
1180 | { | |
1181 | struct kasan_rcu_info *fp = | |
1182 | container_of(rp, struct kasan_rcu_info, rcu); | |
1183 | ||
1184 | kfree(fp); | |
1185 | ((volatile struct kasan_rcu_info *)fp)->i; | |
1186 | } | |
1187 | ||
8516e837 AK |
1188 | static void rcu_uaf(struct kunit *test) |
1189 | { | |
1190 | struct kasan_rcu_info *ptr; | |
1191 | ||
1192 | ptr = kmalloc(sizeof(struct kasan_rcu_info), GFP_KERNEL); | |
1193 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
1194 | ||
1195 | global_rcu_ptr = rcu_dereference_protected( | |
1196 | (struct kasan_rcu_info __rcu *)ptr, NULL); | |
1197 | ||
1198 | KUNIT_EXPECT_KASAN_FAIL(test, | |
1199 | call_rcu(&global_rcu_ptr->rcu, rcu_uaf_reclaim); | |
1200 | rcu_barrier()); | |
1201 | } | |
1202 | ||
b2c5bd4c AK |
1203 | static void workqueue_uaf_work(struct work_struct *work) |
1204 | { | |
1205 | kfree(work); | |
1206 | } | |
1207 | ||
1208 | static void workqueue_uaf(struct kunit *test) | |
1209 | { | |
1210 | struct workqueue_struct *workqueue; | |
1211 | struct work_struct *work; | |
1212 | ||
1213 | workqueue = create_workqueue("kasan_workqueue_test"); | |
1214 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, workqueue); | |
1215 | ||
1216 | work = kmalloc(sizeof(struct work_struct), GFP_KERNEL); | |
1217 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, work); | |
1218 | ||
1219 | INIT_WORK(work, workqueue_uaf_work); | |
1220 | queue_work(workqueue, work); | |
1221 | destroy_workqueue(workqueue); | |
1222 | ||
1223 | KUNIT_EXPECT_KASAN_FAIL(test, | |
1224 | ((volatile struct work_struct *)work)->data); | |
1225 | } | |
1226 | ||
1a2473f0 AK |
1227 | static void vmalloc_helpers_tags(struct kunit *test) |
1228 | { | |
1229 | void *ptr; | |
1230 | ||
1231 | /* This test is intended for tag-based modes. */ | |
1232 | KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); | |
1233 | ||
1234 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_VMALLOC); | |
1235 | ||
1236 | ptr = vmalloc(PAGE_SIZE); | |
1237 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
1238 | ||
1239 | /* Check that the returned pointer is tagged. */ | |
1240 | KUNIT_EXPECT_GE(test, (u8)get_tag(ptr), (u8)KASAN_TAG_MIN); | |
1241 | KUNIT_EXPECT_LT(test, (u8)get_tag(ptr), (u8)KASAN_TAG_KERNEL); | |
1242 | ||
1243 | /* Make sure exported vmalloc helpers handle tagged pointers. */ | |
1244 | KUNIT_ASSERT_TRUE(test, is_vmalloc_addr(ptr)); | |
1245 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, vmalloc_to_page(ptr)); | |
1246 | ||
1247 | #if !IS_MODULE(CONFIG_KASAN_KUNIT_TEST) | |
1248 | { | |
1249 | int rv; | |
1250 | ||
1251 | /* Make sure vmalloc'ed memory permissions can be changed. */ | |
1252 | rv = set_memory_ro((unsigned long)ptr, 1); | |
1253 | KUNIT_ASSERT_GE(test, rv, 0); | |
1254 | rv = set_memory_rw((unsigned long)ptr, 1); | |
1255 | KUNIT_ASSERT_GE(test, rv, 0); | |
1256 | } | |
1257 | #endif | |
1258 | ||
1259 | vfree(ptr); | |
1260 | } | |
1261 | ||
73228c7e | 1262 | static void vmalloc_oob(struct kunit *test) |
06513916 | 1263 | { |
1a2473f0 AK |
1264 | char *v_ptr, *p_ptr; |
1265 | struct page *page; | |
1266 | size_t size = PAGE_SIZE / 2 - KASAN_GRANULE_SIZE - 5; | |
06513916 | 1267 | |
da17e377 | 1268 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_VMALLOC); |
06513916 | 1269 | |
1a2473f0 AK |
1270 | v_ptr = vmalloc(size); |
1271 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, v_ptr); | |
1272 | ||
1273 | OPTIMIZER_HIDE_VAR(v_ptr); | |
1274 | ||
06513916 | 1275 | /* |
1a2473f0 | 1276 | * We have to be careful not to hit the guard page in vmalloc tests. |
06513916 DA |
1277 | * The MMU will catch that and crash us. |
1278 | */ | |
06513916 | 1279 | |
1a2473f0 AK |
1280 | /* Make sure in-bounds accesses are valid. */ |
1281 | v_ptr[0] = 0; | |
1282 | v_ptr[size - 1] = 0; | |
1283 | ||
1284 | /* | |
1285 | * An unaligned access past the requested vmalloc size. | |
1286 | * Only generic KASAN can precisely detect these. | |
1287 | */ | |
1288 | if (IS_ENABLED(CONFIG_KASAN_GENERIC)) | |
1289 | KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)v_ptr)[size]); | |
1290 | ||
1291 | /* An aligned access into the first out-of-bounds granule. */ | |
1292 | KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)v_ptr)[size + 5]); | |
1293 | ||
1294 | /* Check that in-bounds accesses to the physical page are valid. */ | |
1295 | page = vmalloc_to_page(v_ptr); | |
1296 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, page); | |
1297 | p_ptr = page_address(page); | |
1298 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, p_ptr); | |
1299 | p_ptr[0] = 0; | |
1300 | ||
1301 | vfree(v_ptr); | |
1302 | ||
1303 | /* | |
1304 | * We can't check for use-after-unmap bugs in this nor in the following | |
1305 | * vmalloc tests, as the page might be fully unmapped and accessing it | |
1306 | * will crash the kernel. | |
1307 | */ | |
1308 | } | |
1309 | ||
1310 | static void vmap_tags(struct kunit *test) | |
1311 | { | |
1312 | char *p_ptr, *v_ptr; | |
1313 | struct page *p_page, *v_page; | |
1314 | ||
1315 | /* | |
1316 | * This test is specifically crafted for the software tag-based mode, | |
1317 | * the only tag-based mode that poisons vmap mappings. | |
1318 | */ | |
1319 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_SW_TAGS); | |
1320 | ||
1321 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_VMALLOC); | |
1322 | ||
1323 | p_page = alloc_pages(GFP_KERNEL, 1); | |
1324 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, p_page); | |
1325 | p_ptr = page_address(p_page); | |
1326 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, p_ptr); | |
1327 | ||
1328 | v_ptr = vmap(&p_page, 1, VM_MAP, PAGE_KERNEL); | |
1329 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, v_ptr); | |
1330 | ||
1331 | /* | |
1332 | * We can't check for out-of-bounds bugs in this nor in the following | |
1333 | * vmalloc tests, as allocations have page granularity and accessing | |
1334 | * the guard page will crash the kernel. | |
1335 | */ | |
1336 | ||
1337 | KUNIT_EXPECT_GE(test, (u8)get_tag(v_ptr), (u8)KASAN_TAG_MIN); | |
1338 | KUNIT_EXPECT_LT(test, (u8)get_tag(v_ptr), (u8)KASAN_TAG_KERNEL); | |
1339 | ||
1340 | /* Make sure that in-bounds accesses through both pointers work. */ | |
1341 | *p_ptr = 0; | |
1342 | *v_ptr = 0; | |
1343 | ||
1344 | /* Make sure vmalloc_to_page() correctly recovers the page pointer. */ | |
1345 | v_page = vmalloc_to_page(v_ptr); | |
1346 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, v_page); | |
1347 | KUNIT_EXPECT_PTR_EQ(test, p_page, v_page); | |
1348 | ||
1349 | vunmap(v_ptr); | |
1350 | free_pages((unsigned long)p_ptr, 1); | |
1351 | } | |
1352 | ||
1353 | static void vm_map_ram_tags(struct kunit *test) | |
1354 | { | |
1355 | char *p_ptr, *v_ptr; | |
1356 | struct page *page; | |
1357 | ||
1358 | /* | |
1359 | * This test is specifically crafted for the software tag-based mode, | |
1360 | * the only tag-based mode that poisons vm_map_ram mappings. | |
1361 | */ | |
1362 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_SW_TAGS); | |
1363 | ||
1364 | page = alloc_pages(GFP_KERNEL, 1); | |
1365 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, page); | |
1366 | p_ptr = page_address(page); | |
1367 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, p_ptr); | |
1368 | ||
1369 | v_ptr = vm_map_ram(&page, 1, -1); | |
1370 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, v_ptr); | |
1371 | ||
1372 | KUNIT_EXPECT_GE(test, (u8)get_tag(v_ptr), (u8)KASAN_TAG_MIN); | |
1373 | KUNIT_EXPECT_LT(test, (u8)get_tag(v_ptr), (u8)KASAN_TAG_KERNEL); | |
1374 | ||
1375 | /* Make sure that in-bounds accesses through both pointers work. */ | |
1376 | *p_ptr = 0; | |
1377 | *v_ptr = 0; | |
1378 | ||
1379 | vm_unmap_ram(v_ptr, 1); | |
1380 | free_pages((unsigned long)p_ptr, 1); | |
1381 | } | |
1382 | ||
1383 | static void vmalloc_percpu(struct kunit *test) | |
1384 | { | |
1385 | char __percpu *ptr; | |
1386 | int cpu; | |
1387 | ||
1388 | /* | |
1389 | * This test is specifically crafted for the software tag-based mode, | |
1390 | * the only tag-based mode that poisons percpu mappings. | |
1391 | */ | |
1392 | KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_SW_TAGS); | |
1393 | ||
1394 | ptr = __alloc_percpu(PAGE_SIZE, PAGE_SIZE); | |
1395 | ||
1396 | for_each_possible_cpu(cpu) { | |
1397 | char *c_ptr = per_cpu_ptr(ptr, cpu); | |
1398 | ||
1399 | KUNIT_EXPECT_GE(test, (u8)get_tag(c_ptr), (u8)KASAN_TAG_MIN); | |
1400 | KUNIT_EXPECT_LT(test, (u8)get_tag(c_ptr), (u8)KASAN_TAG_KERNEL); | |
1401 | ||
1402 | /* Make sure that in-bounds accesses don't crash the kernel. */ | |
1403 | *c_ptr = 0; | |
1404 | } | |
1405 | ||
1406 | free_percpu(ptr); | |
06513916 | 1407 | } |
387d6e46 | 1408 | |
573a4809 AK |
1409 | /* |
1410 | * Check that the assigned pointer tag falls within the [KASAN_TAG_MIN, | |
1411 | * KASAN_TAG_KERNEL) range (note: excluding the match-all tag) for tag-based | |
1412 | * modes. | |
1413 | */ | |
1414 | static void match_all_not_assigned(struct kunit *test) | |
1415 | { | |
1416 | char *ptr; | |
1417 | struct page *pages; | |
1418 | int i, size, order; | |
1419 | ||
1420 | KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); | |
1421 | ||
1422 | for (i = 0; i < 256; i++) { | |
e8a533cb | 1423 | size = get_random_u32_inclusive(1, 1024); |
573a4809 AK |
1424 | ptr = kmalloc(size, GFP_KERNEL); |
1425 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
1426 | KUNIT_EXPECT_GE(test, (u8)get_tag(ptr), (u8)KASAN_TAG_MIN); | |
1427 | KUNIT_EXPECT_LT(test, (u8)get_tag(ptr), (u8)KASAN_TAG_KERNEL); | |
1428 | kfree(ptr); | |
1429 | } | |
1430 | ||
1431 | for (i = 0; i < 256; i++) { | |
e8a533cb | 1432 | order = get_random_u32_inclusive(1, 4); |
573a4809 AK |
1433 | pages = alloc_pages(GFP_KERNEL, order); |
1434 | ptr = page_address(pages); | |
1435 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
1436 | KUNIT_EXPECT_GE(test, (u8)get_tag(ptr), (u8)KASAN_TAG_MIN); | |
1437 | KUNIT_EXPECT_LT(test, (u8)get_tag(ptr), (u8)KASAN_TAG_KERNEL); | |
1438 | free_pages((unsigned long)ptr, order); | |
1439 | } | |
1a2473f0 AK |
1440 | |
1441 | if (!IS_ENABLED(CONFIG_KASAN_VMALLOC)) | |
1442 | return; | |
1443 | ||
1444 | for (i = 0; i < 256; i++) { | |
e8a533cb | 1445 | size = get_random_u32_inclusive(1, 1024); |
1a2473f0 AK |
1446 | ptr = vmalloc(size); |
1447 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
1448 | KUNIT_EXPECT_GE(test, (u8)get_tag(ptr), (u8)KASAN_TAG_MIN); | |
1449 | KUNIT_EXPECT_LT(test, (u8)get_tag(ptr), (u8)KASAN_TAG_KERNEL); | |
1450 | vfree(ptr); | |
1451 | } | |
573a4809 AK |
1452 | } |
1453 | ||
1454 | /* Check that 0xff works as a match-all pointer tag for tag-based modes. */ | |
1455 | static void match_all_ptr_tag(struct kunit *test) | |
1456 | { | |
1457 | char *ptr; | |
1458 | u8 tag; | |
1459 | ||
1460 | KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); | |
1461 | ||
1462 | ptr = kmalloc(128, GFP_KERNEL); | |
1463 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
1464 | ||
1465 | /* Backup the assigned tag. */ | |
1466 | tag = get_tag(ptr); | |
1467 | KUNIT_EXPECT_NE(test, tag, (u8)KASAN_TAG_KERNEL); | |
1468 | ||
1469 | /* Reset the tag to 0xff.*/ | |
1470 | ptr = set_tag(ptr, KASAN_TAG_KERNEL); | |
1471 | ||
1472 | /* This access shouldn't trigger a KASAN report. */ | |
1473 | *ptr = 0; | |
1474 | ||
1475 | /* Recover the pointer tag and free. */ | |
1476 | ptr = set_tag(ptr, tag); | |
1477 | kfree(ptr); | |
1478 | } | |
1479 | ||
1480 | /* Check that there are no match-all memory tags for tag-based modes. */ | |
1481 | static void match_all_mem_tag(struct kunit *test) | |
1482 | { | |
1483 | char *ptr; | |
1484 | int tag; | |
1485 | ||
1486 | KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); | |
1487 | ||
1488 | ptr = kmalloc(128, GFP_KERNEL); | |
1489 | KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); | |
1490 | KUNIT_EXPECT_NE(test, (u8)get_tag(ptr), (u8)KASAN_TAG_KERNEL); | |
1491 | ||
1492 | /* For each possible tag value not matching the pointer tag. */ | |
1493 | for (tag = KASAN_TAG_MIN; tag <= KASAN_TAG_KERNEL; tag++) { | |
1494 | if (tag == get_tag(ptr)) | |
1495 | continue; | |
1496 | ||
1497 | /* Mark the first memory granule with the chosen memory tag. */ | |
aa5c219c | 1498 | kasan_poison(ptr, KASAN_GRANULE_SIZE, (u8)tag, false); |
573a4809 AK |
1499 | |
1500 | /* This access must cause a KASAN report. */ | |
1501 | KUNIT_EXPECT_KASAN_FAIL(test, *ptr = 0); | |
1502 | } | |
1503 | ||
1504 | /* Recover the memory tag and free. */ | |
aa5c219c | 1505 | kasan_poison(ptr, KASAN_GRANULE_SIZE, get_tag(ptr), false); |
573a4809 AK |
1506 | kfree(ptr); |
1507 | } | |
1508 | ||
73228c7e PA |
1509 | static struct kunit_case kasan_kunit_test_cases[] = { |
1510 | KUNIT_CASE(kmalloc_oob_right), | |
1511 | KUNIT_CASE(kmalloc_oob_left), | |
1512 | KUNIT_CASE(kmalloc_node_oob_right), | |
1513 | KUNIT_CASE(kmalloc_pagealloc_oob_right), | |
1514 | KUNIT_CASE(kmalloc_pagealloc_uaf), | |
1515 | KUNIT_CASE(kmalloc_pagealloc_invalid_free), | |
858bdeb0 AK |
1516 | KUNIT_CASE(pagealloc_oob_right), |
1517 | KUNIT_CASE(pagealloc_uaf), | |
73228c7e | 1518 | KUNIT_CASE(kmalloc_large_oob_right), |
b87c28b9 AK |
1519 | KUNIT_CASE(krealloc_more_oob), |
1520 | KUNIT_CASE(krealloc_less_oob), | |
1521 | KUNIT_CASE(krealloc_pagealloc_more_oob), | |
1522 | KUNIT_CASE(krealloc_pagealloc_less_oob), | |
26a5ca7a | 1523 | KUNIT_CASE(krealloc_uaf), |
73228c7e | 1524 | KUNIT_CASE(kmalloc_oob_16), |
58b999d7 | 1525 | KUNIT_CASE(kmalloc_uaf_16), |
73228c7e PA |
1526 | KUNIT_CASE(kmalloc_oob_in_memset), |
1527 | KUNIT_CASE(kmalloc_oob_memset_2), | |
1528 | KUNIT_CASE(kmalloc_oob_memset_4), | |
1529 | KUNIT_CASE(kmalloc_oob_memset_8), | |
1530 | KUNIT_CASE(kmalloc_oob_memset_16), | |
758cabae | 1531 | KUNIT_CASE(kmalloc_memmove_negative_size), |
73228c7e PA |
1532 | KUNIT_CASE(kmalloc_memmove_invalid_size), |
1533 | KUNIT_CASE(kmalloc_uaf), | |
1534 | KUNIT_CASE(kmalloc_uaf_memset), | |
1535 | KUNIT_CASE(kmalloc_uaf2), | |
34b592ce | 1536 | KUNIT_CASE(kmalloc_uaf3), |
73228c7e PA |
1537 | KUNIT_CASE(kfree_via_page), |
1538 | KUNIT_CASE(kfree_via_phys), | |
1539 | KUNIT_CASE(kmem_cache_oob), | |
11516135 AK |
1540 | KUNIT_CASE(kmem_cache_accounted), |
1541 | KUNIT_CASE(kmem_cache_bulk), | |
e5f47287 ME |
1542 | KUNIT_CASE(kasan_global_oob_right), |
1543 | KUNIT_CASE(kasan_global_oob_left), | |
73228c7e PA |
1544 | KUNIT_CASE(kasan_stack_oob), |
1545 | KUNIT_CASE(kasan_alloca_oob_left), | |
1546 | KUNIT_CASE(kasan_alloca_oob_right), | |
1547 | KUNIT_CASE(ksize_unpoisons_memory), | |
611806b4 | 1548 | KUNIT_CASE(ksize_uaf), |
73228c7e PA |
1549 | KUNIT_CASE(kmem_cache_double_free), |
1550 | KUNIT_CASE(kmem_cache_invalid_free), | |
f98f966c | 1551 | KUNIT_CASE(kmem_cache_double_destroy), |
73228c7e PA |
1552 | KUNIT_CASE(kasan_memchr), |
1553 | KUNIT_CASE(kasan_memcmp), | |
1554 | KUNIT_CASE(kasan_strings), | |
58b999d7 AK |
1555 | KUNIT_CASE(kasan_bitops_generic), |
1556 | KUNIT_CASE(kasan_bitops_tags), | |
73228c7e | 1557 | KUNIT_CASE(kmalloc_double_kzfree), |
8516e837 | 1558 | KUNIT_CASE(rcu_uaf), |
b2c5bd4c | 1559 | KUNIT_CASE(workqueue_uaf), |
1a2473f0 | 1560 | KUNIT_CASE(vmalloc_helpers_tags), |
73228c7e | 1561 | KUNIT_CASE(vmalloc_oob), |
1a2473f0 AK |
1562 | KUNIT_CASE(vmap_tags), |
1563 | KUNIT_CASE(vm_map_ram_tags), | |
1564 | KUNIT_CASE(vmalloc_percpu), | |
573a4809 AK |
1565 | KUNIT_CASE(match_all_not_assigned), |
1566 | KUNIT_CASE(match_all_ptr_tag), | |
1567 | KUNIT_CASE(match_all_mem_tag), | |
73228c7e PA |
1568 | {} |
1569 | }; | |
1570 | ||
1571 | static struct kunit_suite kasan_kunit_test_suite = { | |
1572 | .name = "kasan", | |
73228c7e PA |
1573 | .test_cases = kasan_kunit_test_cases, |
1574 | .exit = kasan_test_exit, | |
7ce0ea19 AK |
1575 | .suite_init = kasan_suite_init, |
1576 | .suite_exit = kasan_suite_exit, | |
73228c7e PA |
1577 | }; |
1578 | ||
1579 | kunit_test_suite(kasan_kunit_test_suite); | |
3f15801c | 1580 | |
3f15801c | 1581 | MODULE_LICENSE("GPL"); |