^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * This is for all the tests relating directly to heap memory, including
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) * page allocation and slab allocations.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) #include "lkdtm.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) #include <linux/slab.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) #include <linux/sched.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) static struct kmem_cache *double_free_cache;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) static struct kmem_cache *a_cache;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) static struct kmem_cache *b_cache;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) * This tries to stay within the next largest power-of-2 kmalloc cache
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) * to avoid actually overwriting anything important if it's not detected
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) * correctly.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) void lkdtm_OVERWRITE_ALLOCATION(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) size_t len = 1020;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) u32 *data = kmalloc(len, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) if (!data)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) data[1024 / sizeof(u32)] = 0x12345678;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) kfree(data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) void lkdtm_WRITE_AFTER_FREE(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) int *base, *again;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) size_t len = 1024;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) * The slub allocator uses the first word to store the free
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) * pointer in some configurations. Use the middle of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) * allocation to avoid running into the freelist
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) size_t offset = (len / sizeof(*base)) / 2;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) base = kmalloc(len, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) if (!base)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) pr_info("Allocated memory %p-%p\n", base, &base[offset * 2]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) pr_info("Attempting bad write to freed memory at %p\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) &base[offset]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) kfree(base);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) base[offset] = 0x0abcdef0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) /* Attempt to notice the overwrite. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) again = kmalloc(len, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) kfree(again);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) if (again != base)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) pr_info("Hmm, didn't get the same memory range.\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) void lkdtm_READ_AFTER_FREE(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) int *base, *val, saw;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) size_t len = 1024;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) * The slub allocator will use the either the first word or
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) * the middle of the allocation to store the free pointer,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) * depending on configurations. Store in the second word to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) * avoid running into the freelist.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) size_t offset = sizeof(*base);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) base = kmalloc(len, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) if (!base) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) pr_info("Unable to allocate base memory.\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) val = kmalloc(len, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) if (!val) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) pr_info("Unable to allocate val memory.\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) kfree(base);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) *val = 0x12345678;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) base[offset] = *val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) pr_info("Value in memory before free: %x\n", base[offset]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) kfree(base);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) pr_info("Attempting bad read from freed memory\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) saw = base[offset];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) if (saw != *val) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) /* Good! Poisoning happened, so declare a win. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) pr_info("Memory correctly poisoned (%x)\n", saw);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) BUG();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) pr_info("Memory was not poisoned\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) kfree(val);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) void lkdtm_WRITE_BUDDY_AFTER_FREE(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) unsigned long p = __get_free_page(GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) if (!p) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) pr_info("Unable to allocate free page\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) pr_info("Writing to the buddy page before free\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) memset((void *)p, 0x3, PAGE_SIZE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) free_page(p);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) schedule();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) pr_info("Attempting bad write to the buddy page after free\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) memset((void *)p, 0x78, PAGE_SIZE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) /* Attempt to notice the overwrite. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) p = __get_free_page(GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) free_page(p);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) schedule();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) void lkdtm_READ_BUDDY_AFTER_FREE(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) unsigned long p = __get_free_page(GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) int saw, *val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) int *base;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) if (!p) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) pr_info("Unable to allocate free page\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) val = kmalloc(1024, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) if (!val) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) pr_info("Unable to allocate val memory.\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) free_page(p);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) base = (int *)p;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) *val = 0x12345678;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) base[0] = *val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) pr_info("Value in memory before free: %x\n", base[0]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) free_page(p);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) pr_info("Attempting to read from freed memory\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) saw = base[0];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) if (saw != *val) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) /* Good! Poisoning happened, so declare a win. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) pr_info("Memory correctly poisoned (%x)\n", saw);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) BUG();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) pr_info("Buddy page was not poisoned\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) kfree(val);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) void lkdtm_SLAB_FREE_DOUBLE(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) int *val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) val = kmem_cache_alloc(double_free_cache, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) if (!val) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) pr_info("Unable to allocate double_free_cache memory.\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) /* Just make sure we got real memory. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) *val = 0x12345678;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) pr_info("Attempting double slab free ...\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) kmem_cache_free(double_free_cache, val);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) kmem_cache_free(double_free_cache, val);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) void lkdtm_SLAB_FREE_CROSS(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) int *val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) val = kmem_cache_alloc(a_cache, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) if (!val) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) pr_info("Unable to allocate a_cache memory.\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) /* Just make sure we got real memory. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) *val = 0x12345679;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) pr_info("Attempting cross-cache slab free ...\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) kmem_cache_free(b_cache, val);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) void lkdtm_SLAB_FREE_PAGE(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) unsigned long p = __get_free_page(GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) pr_info("Attempting non-Slab slab free ...\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) kmem_cache_free(NULL, (void *)p);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) free_page(p);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) * We have constructors to keep the caches distinctly separated without
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) * needing to boot with "slab_nomerge".
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) static void ctor_double_free(void *region)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) { }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) static void ctor_a(void *region)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) { }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) static void ctor_b(void *region)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) { }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) void __init lkdtm_heap_init(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) double_free_cache = kmem_cache_create("lkdtm-heap-double_free",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) 64, 0, 0, ctor_double_free);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) a_cache = kmem_cache_create("lkdtm-heap-a", 64, 0, 0, ctor_a);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) b_cache = kmem_cache_create("lkdtm-heap-b", 64, 0, 0, ctor_b);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) void __exit lkdtm_heap_exit(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) kmem_cache_destroy(double_free_cache);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) kmem_cache_destroy(a_cache);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) kmem_cache_destroy(b_cache);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) }
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags