Orange Pi5 kernel

^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   1) // SPDX-License-Identifier: GPL-2.0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   3)  * This is for all the tests related to logic bugs (e.g. bad dereferences,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   4)  * bad alignment, bad loops, bad locking, bad scheduling, deep stacks, and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   5)  * lockups) along with other things that don't fit well into existing LKDTM
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   6)  * test source files.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   7)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   8) #include "lkdtm.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   9) #include <linux/list.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  10) #include <linux/sched.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  11) #include <linux/sched/signal.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  12) #include <linux/sched/task_stack.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  13) #include <linux/uaccess.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  14) #include <linux/slab.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  15) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  16) #if IS_ENABLED(CONFIG_X86_32) && !IS_ENABLED(CONFIG_UML)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  17) #include <asm/desc.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  18) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  19) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  20) struct lkdtm_list {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  21) 	struct list_head node;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  22) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  23) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  24) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  25)  * Make sure our attempts to over run the kernel stack doesn't trigger
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  26)  * a compiler warning when CONFIG_FRAME_WARN is set. Then make sure we
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  27)  * recurse past the end of THREAD_SIZE by default.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  28)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  29) #if defined(CONFIG_FRAME_WARN) && (CONFIG_FRAME_WARN > 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  30) #define REC_STACK_SIZE (_AC(CONFIG_FRAME_WARN, UL) / 2)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  31) #else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  32) #define REC_STACK_SIZE (THREAD_SIZE / 8)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  33) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  34) #define REC_NUM_DEFAULT ((THREAD_SIZE / REC_STACK_SIZE) * 2)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  35) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  36) static int recur_count = REC_NUM_DEFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  37) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  38) static DEFINE_SPINLOCK(lock_me_up);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  39) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  40) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  41)  * Make sure compiler does not optimize this function or stack frame away:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  42)  * - function marked noinline
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  43)  * - stack variables are marked volatile
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  44)  * - stack variables are written (memset()) and read (pr_info())
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  45)  * - function has external effects (pr_info())
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  46)  * */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  47) static int noinline recursive_loop(int remaining)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  48) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  49) 	volatile char buf[REC_STACK_SIZE];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  50) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  51) 	memset((void *)buf, remaining & 0xFF, sizeof(buf));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  52) 	pr_info("loop %d/%d ...\n", (int)buf[remaining % sizeof(buf)],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  53) 		recur_count);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  54) 	if (!remaining)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  55) 		return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  56) 	else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  57) 		return recursive_loop(remaining - 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  58) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  59) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  60) /* If the depth is negative, use the default, otherwise keep parameter. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  61) void __init lkdtm_bugs_init(int *recur_param)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  62) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  63) 	if (*recur_param < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  64) 		*recur_param = recur_count;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  65) 	else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  66) 		recur_count = *recur_param;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  67) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  68) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  69) void lkdtm_PANIC(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  70) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  71) 	panic("dumptest");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  72) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  73) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  74) void lkdtm_BUG(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  75) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  76) 	BUG();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  77) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  78) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  79) static int warn_counter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  80) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  81) void lkdtm_WARNING(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  82) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  83) 	WARN_ON(++warn_counter);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  84) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  85) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  86) void lkdtm_WARNING_MESSAGE(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  87) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  88) 	WARN(1, "Warning message trigger count: %d\n", ++warn_counter);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  89) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  90) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  91) void lkdtm_EXCEPTION(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  92) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  93) 	*((volatile int *) 0) = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  94) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  95) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  96) void lkdtm_LOOP(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  97) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  98) 	for (;;)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  99) 		;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) void lkdtm_EXHAUST_STACK(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) 	pr_info("Calling function with %lu frame size to depth %d ...\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) 		REC_STACK_SIZE, recur_count);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) 	recursive_loop(recur_count);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) 	pr_info("FAIL: survived without exhausting stack?!\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) static noinline void __lkdtm_CORRUPT_STACK(void *stack)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) 	memset(stack, '\xff', 64);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) /* This should trip the stack canary, not corrupt the return address. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) noinline void lkdtm_CORRUPT_STACK(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) 	/* Use default char array length that triggers stack protection. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) 	char data[8] __aligned(sizeof(void *));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) 	pr_info("Corrupting stack containing char array ...\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) 	__lkdtm_CORRUPT_STACK((void *)&data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) /* Same as above but will only get a canary with -fstack-protector-strong */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) noinline void lkdtm_CORRUPT_STACK_STRONG(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) 	union {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) 		unsigned short shorts[4];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) 		unsigned long *ptr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) 	} data __aligned(sizeof(void *));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) 	pr_info("Corrupting stack containing union ...\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) 	__lkdtm_CORRUPT_STACK((void *)&data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) void lkdtm_UNALIGNED_LOAD_STORE_WRITE(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) 	static u8 data[5] __attribute__((aligned(4))) = {1, 2, 3, 4, 5};
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) 	u32 *p;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) 	u32 val = 0x12345678;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) 	p = (u32 *)(data + 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) 	if (*p == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) 		val = 0x87654321;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) 	*p = val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) 	if (IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) 		pr_err("XFAIL: arch has CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) void lkdtm_SOFTLOCKUP(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) 	preempt_disable();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) 	for (;;)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) 		cpu_relax();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) void lkdtm_HARDLOCKUP(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) 	local_irq_disable();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) 	for (;;)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) 		cpu_relax();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) void lkdtm_SPINLOCKUP(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) 	/* Must be called twice to trigger. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) 	spin_lock(&lock_me_up);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) 	/* Let sparse know we intended to exit holding the lock. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) 	__release(&lock_me_up);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) void lkdtm_HUNG_TASK(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) 	set_current_state(TASK_UNINTERRUPTIBLE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) 	schedule();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) volatile unsigned int huge = INT_MAX - 2;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) volatile unsigned int ignored;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) void lkdtm_OVERFLOW_SIGNED(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) 	int value;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) 	value = huge;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) 	pr_info("Normal signed addition ...\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) 	value += 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) 	ignored = value;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) 	pr_info("Overflowing signed addition ...\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) 	value += 4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) 	ignored = value;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) void lkdtm_OVERFLOW_UNSIGNED(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) 	unsigned int value;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) 	value = huge;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) 	pr_info("Normal unsigned addition ...\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) 	value += 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) 	ignored = value;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) 	pr_info("Overflowing unsigned addition ...\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) 	value += 4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) 	ignored = value;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) /* Intentionally using old-style flex array definition of 1 byte. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) struct array_bounds_flex_array {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) 	int one;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) 	int two;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) 	char data[1];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) struct array_bounds {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) 	int one;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) 	int two;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) 	char data[8];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) 	int three;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226) void lkdtm_ARRAY_BOUNDS(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) 	struct array_bounds_flex_array *not_checked;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229) 	struct array_bounds *checked;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230) 	volatile int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232) 	not_checked = kmalloc(sizeof(*not_checked) * 2, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233) 	checked = kmalloc(sizeof(*checked) * 2, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) 	pr_info("Array access within bounds ...\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236) 	/* For both, touch all bytes in the actual member size. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237) 	for (i = 0; i < sizeof(checked->data); i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238) 		checked->data[i] = 'A';
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239) 	/*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) 	 * For the uninstrumented flex array member, also touch 1 byte
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) 	 * beyond to verify it is correctly uninstrumented.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) 	 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243) 	for (i = 0; i < sizeof(not_checked->data) + 1; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244) 		not_checked->data[i] = 'A';
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246) 	pr_info("Array access beyond bounds ...\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) 	for (i = 0; i < sizeof(checked->data) + 1; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) 		checked->data[i] = 'B';
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) 	kfree(not_checked);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251) 	kfree(checked);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252) 	pr_err("FAIL: survived array bounds overflow!\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255) void lkdtm_CORRUPT_LIST_ADD(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) 	/*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) 	 * Initially, an empty list via LIST_HEAD:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259) 	 *	test_head.next = &test_head
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) 	 *	test_head.prev = &test_head
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261) 	 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262) 	LIST_HEAD(test_head);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263) 	struct lkdtm_list good, bad;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) 	void *target[2] = { };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265) 	void *redirection = &target;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) 	pr_info("attempting good list addition\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269) 	/*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270) 	 * Adding to the list performs these actions:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) 	 *	test_head.next->prev = &good.node
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272) 	 *	good.node.next = test_head.next
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273) 	 *	good.node.prev = test_head
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274) 	 *	test_head.next = good.node
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275) 	 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276) 	list_add(&good.node, &test_head);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278) 	pr_info("attempting corrupted list addition\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279) 	/*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280) 	 * In simulating this "write what where" primitive, the "what" is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) 	 * the address of &bad.node, and the "where" is the address held
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282) 	 * by "redirection".
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283) 	 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284) 	test_head.next = redirection;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285) 	list_add(&bad.node, &test_head);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287) 	if (target[0] == NULL && target[1] == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288) 		pr_err("Overwrite did not happen, but no BUG?!\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289) 	else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) 		pr_err("list_add() corruption not detected!\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293) void lkdtm_CORRUPT_LIST_DEL(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295) 	LIST_HEAD(test_head);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296) 	struct lkdtm_list item;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) 	void *target[2] = { };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298) 	void *redirection = &target;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300) 	list_add(&item.node, &test_head);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 302) 	pr_info("attempting good list removal\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 303) 	list_del(&item.node);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 304) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 305) 	pr_info("attempting corrupted list removal\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 306) 	list_add(&item.node, &test_head);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 307) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 308) 	/* As with the list_add() test above, this corrupts "next". */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 309) 	item.node.next = redirection;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 310) 	list_del(&item.node);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 311) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 312) 	if (target[0] == NULL && target[1] == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 313) 		pr_err("Overwrite did not happen, but no BUG?!\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 314) 	else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 315) 		pr_err("list_del() corruption not detected!\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 316) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 317) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 318) /* Test that VMAP_STACK is actually allocating with a leading guard page */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 319) void lkdtm_STACK_GUARD_PAGE_LEADING(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 320) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 321) 	const unsigned char *stack = task_stack_page(current);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 322) 	const unsigned char *ptr = stack - 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 323) 	volatile unsigned char byte;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 324) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 325) 	pr_info("attempting bad read from page below current stack\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 326) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 327) 	byte = *ptr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 328) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 329) 	pr_err("FAIL: accessed page before stack! (byte: %x)\n", byte);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 330) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 331) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 332) /* Test that VMAP_STACK is actually allocating with a trailing guard page */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 333) void lkdtm_STACK_GUARD_PAGE_TRAILING(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 334) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 335) 	const unsigned char *stack = task_stack_page(current);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 336) 	const unsigned char *ptr = stack + THREAD_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 337) 	volatile unsigned char byte;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 338) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 339) 	pr_info("attempting bad read from page above current stack\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 340) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 341) 	byte = *ptr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 342) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 343) 	pr_err("FAIL: accessed page after stack! (byte: %x)\n", byte);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 344) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 345) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 346) void lkdtm_UNSET_SMEP(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 347) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 348) #if IS_ENABLED(CONFIG_X86_64) && !IS_ENABLED(CONFIG_UML)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 349) #define MOV_CR4_DEPTH	64
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 350) 	void (*direct_write_cr4)(unsigned long val);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 351) 	unsigned char *insn;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 352) 	unsigned long cr4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 353) 	int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 354) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 355) 	cr4 = native_read_cr4();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 356) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 357) 	if ((cr4 & X86_CR4_SMEP) != X86_CR4_SMEP) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 358) 		pr_err("FAIL: SMEP not in use\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 359) 		return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 360) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 361) 	cr4 &= ~(X86_CR4_SMEP);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 362) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 363) 	pr_info("trying to clear SMEP normally\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 364) 	native_write_cr4(cr4);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 365) 	if (cr4 == native_read_cr4()) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 366) 		pr_err("FAIL: pinning SMEP failed!\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 367) 		cr4 |= X86_CR4_SMEP;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 368) 		pr_info("restoring SMEP\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 369) 		native_write_cr4(cr4);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 370) 		return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 371) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 372) 	pr_info("ok: SMEP did not get cleared\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 373) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 374) 	/*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 375) 	 * To test the post-write pinning verification we need to call
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 376) 	 * directly into the middle of native_write_cr4() where the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 377) 	 * cr4 write happens, skipping any pinning. This searches for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 378) 	 * the cr4 writing instruction.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 379) 	 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 380) 	insn = (unsigned char *)native_write_cr4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 381) 	for (i = 0; i < MOV_CR4_DEPTH; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 382) 		/* mov %rdi, %cr4 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 383) 		if (insn[i] == 0x0f && insn[i+1] == 0x22 && insn[i+2] == 0xe7)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 384) 			break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 385) 		/* mov %rdi,%rax; mov %rax, %cr4 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 386) 		if (insn[i]   == 0x48 && insn[i+1] == 0x89 &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 387) 		    insn[i+2] == 0xf8 && insn[i+3] == 0x0f &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 388) 		    insn[i+4] == 0x22 && insn[i+5] == 0xe0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 389) 			break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 390) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 391) 	if (i >= MOV_CR4_DEPTH) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 392) 		pr_info("ok: cannot locate cr4 writing call gadget\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 393) 		return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 394) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 395) 	direct_write_cr4 = (void *)(insn + i);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 396) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 397) 	pr_info("trying to clear SMEP with call gadget\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 398) 	direct_write_cr4(cr4);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 399) 	if (native_read_cr4() & X86_CR4_SMEP) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 400) 		pr_info("ok: SMEP removal was reverted\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 401) 	} else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 402) 		pr_err("FAIL: cleared SMEP not detected!\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 403) 		cr4 |= X86_CR4_SMEP;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 404) 		pr_info("restoring SMEP\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 405) 		native_write_cr4(cr4);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 406) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 407) #else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 408) 	pr_err("XFAIL: this test is x86_64-only\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 409) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 410) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 411) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 412) void lkdtm_DOUBLE_FAULT(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 413) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 414) #if IS_ENABLED(CONFIG_X86_32) && !IS_ENABLED(CONFIG_UML)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 415) 	/*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 416) 	 * Trigger #DF by setting the stack limit to zero.  This clobbers
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 417) 	 * a GDT TLS slot, which is okay because the current task will die
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 418) 	 * anyway due to the double fault.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 419) 	 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 420) 	struct desc_struct d = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 421) 		.type = 3,	/* expand-up, writable, accessed data */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 422) 		.p = 1,		/* present */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 423) 		.d = 1,		/* 32-bit */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 424) 		.g = 0,		/* limit in bytes */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 425) 		.s = 1,		/* not system */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 426) 	};
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 427) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 428) 	local_irq_disable();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 429) 	write_gdt_entry(get_cpu_gdt_rw(smp_processor_id()),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 430) 			GDT_ENTRY_TLS_MIN, &d, DESCTYPE_S);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 431) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 432) 	/*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 433) 	 * Put our zero-limit segment in SS and then trigger a fault.  The
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 434) 	 * 4-byte access to (%esp) will fault with #SS, and the attempt to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 435) 	 * deliver the fault will recursively cause #SS and result in #DF.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 436) 	 * This whole process happens while NMIs and MCEs are blocked by the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 437) 	 * MOV SS window.  This is nice because an NMI with an invalid SS
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 438) 	 * would also double-fault, resulting in the NMI or MCE being lost.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 439) 	 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 440) 	asm volatile ("movw %0, %%ss; addl $0, (%%esp)" ::
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 441) 		      "r" ((unsigned short)(GDT_ENTRY_TLS_MIN << 3)));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 442) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 443) 	pr_err("FAIL: tried to double fault but didn't die\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 444) #else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 445) 	pr_err("XFAIL: this test is ia32-only\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 446) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 447) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 448) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 449) #ifdef CONFIG_ARM64
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 450) static noinline void change_pac_parameters(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 451) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 452) 	if (IS_ENABLED(CONFIG_ARM64_PTR_AUTH)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 453) 		/* Reset the keys of current task */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 454) 		ptrauth_thread_init_kernel(current);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 455) 		ptrauth_thread_switch_kernel(current);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 456) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 457) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 458) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 459) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 460) noinline void lkdtm_CORRUPT_PAC(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 461) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 462) #ifdef CONFIG_ARM64
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 463) #define CORRUPT_PAC_ITERATE	10
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 464) 	int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 465) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 466) 	if (!IS_ENABLED(CONFIG_ARM64_PTR_AUTH))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 467) 		pr_err("FAIL: kernel not built with CONFIG_ARM64_PTR_AUTH\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 468) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 469) 	if (!system_supports_address_auth()) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 470) 		pr_err("FAIL: CPU lacks pointer authentication feature\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 471) 		return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 472) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 473) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 474) 	pr_info("changing PAC parameters to force function return failure...\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 475) 	/*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 476) 	 * PAC is a hash value computed from input keys, return address and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 477) 	 * stack pointer. As pac has fewer bits so there is a chance of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 478) 	 * collision, so iterate few times to reduce the collision probability.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 479) 	 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 480) 	for (i = 0; i < CORRUPT_PAC_ITERATE; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 481) 		change_pac_parameters();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 482) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 483) 	pr_err("FAIL: survived PAC changes! Kernel may be unstable from here\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 484) #else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 485) 	pr_err("XFAIL: this test is arm64-only\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 486) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 487) }