3 * Copyright (c) 2014 Samsung Electronics Co., Ltd.
4 * Author: Andrey Ryabinin <a.ryabinin@samsung.com>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
12 #define pr_fmt(fmt) "kasan test: %s " fmt, __func__
14 #include <linux/kernel.h>
15 #include <linux/mman.h>
17 #include <linux/printk.h>
18 #include <linux/slab.h>
19 #include <linux/string.h>
20 #include <linux/uaccess.h>
21 #include <linux/module.h>
22 #include <linux/kasan.h>
25 * Note: test functions are marked noinline so that their names appear in
29 static noinline void __init kmalloc_oob_right(void)
34 pr_info("out-of-bounds to right\n");
35 ptr = kmalloc(size, GFP_KERNEL);
37 pr_err("Allocation failed\n");
45 static noinline void __init kmalloc_oob_left(void)
50 pr_info("out-of-bounds to left\n");
51 ptr = kmalloc(size, GFP_KERNEL);
53 pr_err("Allocation failed\n");
61 static noinline void __init kmalloc_node_oob_right(void)
66 pr_info("kmalloc_node(): out-of-bounds to right\n");
67 ptr = kmalloc_node(size, GFP_KERNEL, 0);
69 pr_err("Allocation failed\n");
78 static noinline void __init kmalloc_pagealloc_oob_right(void)
81 size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
83 /* Allocate a chunk that does not fit into a SLUB cache to trigger
84 * the page allocator fallback.
86 pr_info("kmalloc pagealloc allocation: out-of-bounds to right\n");
87 ptr = kmalloc(size, GFP_KERNEL);
89 pr_err("Allocation failed\n");
98 static noinline void __init kmalloc_large_oob_right(void)
101 size_t size = KMALLOC_MAX_CACHE_SIZE - 256;
102 /* Allocate a chunk that is large enough, but still fits into a slab
103 * and does not trigger the page allocator fallback in SLUB.
105 pr_info("kmalloc large allocation: out-of-bounds to right\n");
106 ptr = kmalloc(size, GFP_KERNEL);
108 pr_err("Allocation failed\n");
116 static noinline void __init kmalloc_oob_krealloc_more(void)
122 pr_info("out-of-bounds after krealloc more\n");
123 ptr1 = kmalloc(size1, GFP_KERNEL);
124 ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
125 if (!ptr1 || !ptr2) {
126 pr_err("Allocation failed\n");
136 static noinline void __init kmalloc_oob_krealloc_less(void)
142 pr_info("out-of-bounds after krealloc less\n");
143 ptr1 = kmalloc(size1, GFP_KERNEL);
144 ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
145 if (!ptr1 || !ptr2) {
146 pr_err("Allocation failed\n");
154 static noinline void __init kmalloc_oob_16(void)
160 pr_info("kmalloc out-of-bounds for 16-bytes access\n");
161 ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL);
162 ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
163 if (!ptr1 || !ptr2) {
164 pr_err("Allocation failed\n");
174 static noinline void __init kmalloc_oob_memset_2(void)
179 pr_info("out-of-bounds in memset2\n");
180 ptr = kmalloc(size, GFP_KERNEL);
182 pr_err("Allocation failed\n");
190 static noinline void __init kmalloc_oob_memset_4(void)
195 pr_info("out-of-bounds in memset4\n");
196 ptr = kmalloc(size, GFP_KERNEL);
198 pr_err("Allocation failed\n");
207 static noinline void __init kmalloc_oob_memset_8(void)
212 pr_info("out-of-bounds in memset8\n");
213 ptr = kmalloc(size, GFP_KERNEL);
215 pr_err("Allocation failed\n");
223 static noinline void __init kmalloc_oob_memset_16(void)
228 pr_info("out-of-bounds in memset16\n");
229 ptr = kmalloc(size, GFP_KERNEL);
231 pr_err("Allocation failed\n");
235 memset(ptr+1, 0, 16);
239 static noinline void __init kmalloc_oob_in_memset(void)
244 pr_info("out-of-bounds in memset\n");
245 ptr = kmalloc(size, GFP_KERNEL);
247 pr_err("Allocation failed\n");
251 memset(ptr, 0, size+5);
255 static noinline void __init kmalloc_uaf(void)
260 pr_info("use-after-free\n");
261 ptr = kmalloc(size, GFP_KERNEL);
263 pr_err("Allocation failed\n");
271 static noinline void __init kmalloc_uaf_memset(void)
276 pr_info("use-after-free in memset\n");
277 ptr = kmalloc(size, GFP_KERNEL);
279 pr_err("Allocation failed\n");
284 memset(ptr, 0, size);
287 static noinline void __init kmalloc_uaf2(void)
292 pr_info("use-after-free after another kmalloc\n");
293 ptr1 = kmalloc(size, GFP_KERNEL);
295 pr_err("Allocation failed\n");
300 ptr2 = kmalloc(size, GFP_KERNEL);
302 pr_err("Allocation failed\n");
308 pr_err("Could not detect use-after-free: ptr1 == ptr2\n");
312 static noinline void __init kmem_cache_oob(void)
316 struct kmem_cache *cache = kmem_cache_create("test_cache",
320 pr_err("Cache allocation failed\n");
323 pr_info("out-of-bounds in kmem_cache_alloc\n");
324 p = kmem_cache_alloc(cache, GFP_KERNEL);
326 pr_err("Allocation failed\n");
327 kmem_cache_destroy(cache);
332 kmem_cache_free(cache, p);
333 kmem_cache_destroy(cache);
336 static char global_array[10];
338 static noinline void __init kasan_global_oob(void)
341 char *p = &global_array[ARRAY_SIZE(global_array) + i];
343 pr_info("out-of-bounds global variable\n");
347 static noinline void __init kasan_stack_oob(void)
349 char stack_array[10];
351 char *p = &stack_array[ARRAY_SIZE(stack_array) + i];
353 pr_info("out-of-bounds on stack\n");
357 static noinline void __init ksize_unpoisons_memory(void)
360 size_t size = 123, real_size = size;
362 pr_info("ksize() unpoisons the whole allocated chunk\n");
363 ptr = kmalloc(size, GFP_KERNEL);
365 pr_err("Allocation failed\n");
368 real_size = ksize(ptr);
369 /* This access doesn't trigger an error. */
372 ptr[real_size] = 'y';
376 static noinline void __init copy_user_test(void)
379 char __user *usermem;
383 kmem = kmalloc(size, GFP_KERNEL);
387 usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE,
388 PROT_READ | PROT_WRITE | PROT_EXEC,
389 MAP_ANONYMOUS | MAP_PRIVATE, 0);
390 if (IS_ERR(usermem)) {
391 pr_err("Failed to allocate user memory\n");
396 pr_info("out-of-bounds in copy_from_user()\n");
397 unused = copy_from_user(kmem, usermem, size + 1);
399 pr_info("out-of-bounds in copy_to_user()\n");
400 unused = copy_to_user(usermem, kmem, size + 1);
402 pr_info("out-of-bounds in __copy_from_user()\n");
403 unused = __copy_from_user(kmem, usermem, size + 1);
405 pr_info("out-of-bounds in __copy_to_user()\n");
406 unused = __copy_to_user(usermem, kmem, size + 1);
408 pr_info("out-of-bounds in __copy_from_user_inatomic()\n");
409 unused = __copy_from_user_inatomic(kmem, usermem, size + 1);
411 pr_info("out-of-bounds in __copy_to_user_inatomic()\n");
412 unused = __copy_to_user_inatomic(usermem, kmem, size + 1);
414 pr_info("out-of-bounds in strncpy_from_user()\n");
415 unused = strncpy_from_user(kmem, usermem, size + 1);
417 vm_munmap((unsigned long)usermem, PAGE_SIZE);
421 static noinline void __init use_after_scope_test(void)
423 volatile char *volatile p;
425 pr_info("use-after-scope on int\n");
434 pr_info("use-after-scope on array\n");
436 char local[1024] = {0};
444 static int __init kmalloc_tests_init(void)
447 * Temporarily enable multi-shot mode. Otherwise, we'd only get a
448 * report for the first case.
450 bool multishot = kasan_save_enable_multi_shot();
454 kmalloc_node_oob_right();
456 kmalloc_pagealloc_oob_right();
458 kmalloc_large_oob_right();
459 kmalloc_oob_krealloc_more();
460 kmalloc_oob_krealloc_less();
462 kmalloc_oob_in_memset();
463 kmalloc_oob_memset_2();
464 kmalloc_oob_memset_4();
465 kmalloc_oob_memset_8();
466 kmalloc_oob_memset_16();
468 kmalloc_uaf_memset();
473 ksize_unpoisons_memory();
475 use_after_scope_test();
477 kasan_restore_multi_shot(multishot);
482 module_init(kmalloc_tests_init);
483 MODULE_LICENSE("GPL");