xref: /openbmc/linux/lib/fortify_kunit.c (revision 7880dbf4)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * Runtime test cases for CONFIG_FORTIFY_SOURCE that aren't expected to
4  * Oops the kernel on success. (For those, see drivers/misc/lkdtm/fortify.c)
5  *
6  * For corner cases with UBSAN, try testing with:
7  *
8  * ./tools/testing/kunit/kunit.py run --arch=x86_64 \
9  *	--kconfig_add CONFIG_FORTIFY_SOURCE=y \
10  *	--kconfig_add CONFIG_UBSAN=y \
11  *	--kconfig_add CONFIG_UBSAN_TRAP=y \
12  *	--kconfig_add CONFIG_UBSAN_BOUNDS=y \
13  *	--kconfig_add CONFIG_UBSAN_LOCAL_BOUNDS=y \
14  *	--make_options LLVM=1 fortify
15  */
16 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
17 
18 #include <kunit/test.h>
19 #include <linux/device.h>
20 #include <linux/slab.h>
21 #include <linux/string.h>
22 #include <linux/vmalloc.h>
23 
24 static const char array_of_10[] = "this is 10";
25 static const char *ptr_of_11 = "this is 11!";
26 static char array_unknown[] = "compiler thinks I might change";
27 
known_sizes_test(struct kunit * test)28 static void known_sizes_test(struct kunit *test)
29 {
30 	KUNIT_EXPECT_EQ(test, __compiletime_strlen("88888888"), 8);
31 	KUNIT_EXPECT_EQ(test, __compiletime_strlen(array_of_10), 10);
32 	KUNIT_EXPECT_EQ(test, __compiletime_strlen(ptr_of_11), 11);
33 
34 	KUNIT_EXPECT_EQ(test, __compiletime_strlen(array_unknown), SIZE_MAX);
35 	/* Externally defined and dynamically sized string pointer: */
36 	KUNIT_EXPECT_EQ(test, __compiletime_strlen(test->name), SIZE_MAX);
37 }
38 
39 /* This is volatile so the optimizer can't perform DCE below. */
40 static volatile int pick;
41 
42 /* Not inline to keep optimizer from figuring out which string we want. */
want_minus_one(int pick)43 static noinline size_t want_minus_one(int pick)
44 {
45 	const char *str;
46 
47 	switch (pick) {
48 	case 1:
49 		str = "4444";
50 		break;
51 	case 2:
52 		str = "333";
53 		break;
54 	default:
55 		str = "1";
56 		break;
57 	}
58 	return __compiletime_strlen(str);
59 }
60 
control_flow_split_test(struct kunit * test)61 static void control_flow_split_test(struct kunit *test)
62 {
63 	KUNIT_EXPECT_EQ(test, want_minus_one(pick), SIZE_MAX);
64 }
65 
66 #define KUNIT_EXPECT_BOS(test, p, expected, name)			\
67 	KUNIT_EXPECT_EQ_MSG(test, __builtin_object_size(p, 1),		\
68 		expected,						\
69 		"__alloc_size() not working with __bos on " name "\n")
70 
71 #if !__has_builtin(__builtin_dynamic_object_size)
72 #define KUNIT_EXPECT_BDOS(test, p, expected, name)			\
73 	/* Silence "unused variable 'expected'" warning. */		\
74 	KUNIT_EXPECT_EQ(test, expected, expected)
75 #else
76 #define KUNIT_EXPECT_BDOS(test, p, expected, name)			\
77 	KUNIT_EXPECT_EQ_MSG(test, __builtin_dynamic_object_size(p, 1),	\
78 		expected,						\
79 		"__alloc_size() not working with __bdos on " name "\n")
80 #endif
81 
82 /* If the execpted size is a constant value, __bos can see it. */
83 #define check_const(_expected, alloc, free)		do {		\
84 	size_t expected = (_expected);					\
85 	void *p = alloc;						\
86 	KUNIT_EXPECT_TRUE_MSG(test, p != NULL, #alloc " failed?!\n");	\
87 	KUNIT_EXPECT_BOS(test, p, expected, #alloc);			\
88 	KUNIT_EXPECT_BDOS(test, p, expected, #alloc);			\
89 	free;								\
90 } while (0)
91 
92 /* If the execpted size is NOT a constant value, __bos CANNOT see it. */
93 #define check_dynamic(_expected, alloc, free)		do {		\
94 	size_t expected = (_expected);					\
95 	void *p = alloc;						\
96 	KUNIT_EXPECT_TRUE_MSG(test, p != NULL, #alloc " failed?!\n");	\
97 	KUNIT_EXPECT_BOS(test, p, SIZE_MAX, #alloc);			\
98 	KUNIT_EXPECT_BDOS(test, p, expected, #alloc);			\
99 	free;								\
100 } while (0)
101 
102 /* Assortment of constant-value kinda-edge cases. */
103 #define CONST_TEST_BODY(TEST_alloc)	do {				\
104 	/* Special-case vmalloc()-family to skip 0-sized allocs. */	\
105 	if (strcmp(#TEST_alloc, "TEST_vmalloc") != 0)			\
106 		TEST_alloc(check_const, 0, 0);				\
107 	TEST_alloc(check_const, 1, 1);					\
108 	TEST_alloc(check_const, 128, 128);				\
109 	TEST_alloc(check_const, 1023, 1023);				\
110 	TEST_alloc(check_const, 1025, 1025);				\
111 	TEST_alloc(check_const, 4096, 4096);				\
112 	TEST_alloc(check_const, 4097, 4097);				\
113 } while (0)
114 
115 static volatile size_t zero_size;
116 static volatile size_t unknown_size = 50;
117 
118 #if !__has_builtin(__builtin_dynamic_object_size)
119 #define DYNAMIC_TEST_BODY(TEST_alloc)					\
120 	kunit_skip(test, "Compiler is missing __builtin_dynamic_object_size() support\n")
121 #else
122 #define DYNAMIC_TEST_BODY(TEST_alloc)	do {				\
123 	size_t size = unknown_size;					\
124 									\
125 	/*								\
126 	 * Expected size is "size" in each test, before it is then	\
127 	 * internally incremented in each test.	Requires we disable	\
128 	 * -Wunsequenced.						\
129 	 */								\
130 	TEST_alloc(check_dynamic, size, size++);			\
131 	/* Make sure incrementing actually happened. */			\
132 	KUNIT_EXPECT_NE(test, size, unknown_size);			\
133 } while (0)
134 #endif
135 
136 #define DEFINE_ALLOC_SIZE_TEST_PAIR(allocator)				\
137 static void alloc_size_##allocator##_const_test(struct kunit *test)	\
138 {									\
139 	CONST_TEST_BODY(TEST_##allocator);				\
140 }									\
141 static void alloc_size_##allocator##_dynamic_test(struct kunit *test)	\
142 {									\
143 	DYNAMIC_TEST_BODY(TEST_##allocator);				\
144 }
145 
146 #define TEST_kmalloc(checker, expected_size, alloc_size)	do {	\
147 	gfp_t gfp = GFP_KERNEL | __GFP_NOWARN;				\
148 	void *orig;							\
149 	size_t len;							\
150 									\
151 	checker(expected_size, kmalloc(alloc_size, gfp),		\
152 		kfree(p));						\
153 	checker(expected_size,						\
154 		kmalloc_node(alloc_size, gfp, NUMA_NO_NODE),		\
155 		kfree(p));						\
156 	checker(expected_size, kzalloc(alloc_size, gfp),		\
157 		kfree(p));						\
158 	checker(expected_size,						\
159 		kzalloc_node(alloc_size, gfp, NUMA_NO_NODE),		\
160 		kfree(p));						\
161 	checker(expected_size, kcalloc(1, alloc_size, gfp),		\
162 		kfree(p));						\
163 	checker(expected_size, kcalloc(alloc_size, 1, gfp),		\
164 		kfree(p));						\
165 	checker(expected_size,						\
166 		kcalloc_node(1, alloc_size, gfp, NUMA_NO_NODE),		\
167 		kfree(p));						\
168 	checker(expected_size,						\
169 		kcalloc_node(alloc_size, 1, gfp, NUMA_NO_NODE),		\
170 		kfree(p));						\
171 	checker(expected_size, kmalloc_array(1, alloc_size, gfp),	\
172 		kfree(p));						\
173 	checker(expected_size, kmalloc_array(alloc_size, 1, gfp),	\
174 		kfree(p));						\
175 	checker(expected_size,						\
176 		kmalloc_array_node(1, alloc_size, gfp, NUMA_NO_NODE),	\
177 		kfree(p));						\
178 	checker(expected_size,						\
179 		kmalloc_array_node(alloc_size, 1, gfp, NUMA_NO_NODE),	\
180 		kfree(p));						\
181 	checker(expected_size, __kmalloc(alloc_size, gfp),		\
182 		kfree(p));						\
183 	checker(expected_size,						\
184 		__kmalloc_node(alloc_size, gfp, NUMA_NO_NODE),		\
185 		kfree(p));						\
186 									\
187 	orig = kmalloc(alloc_size, gfp);				\
188 	KUNIT_EXPECT_TRUE(test, orig != NULL);				\
189 	checker((expected_size) * 2,					\
190 		krealloc(orig, (alloc_size) * 2, gfp),			\
191 		kfree(p));						\
192 	orig = kmalloc(alloc_size, gfp);				\
193 	KUNIT_EXPECT_TRUE(test, orig != NULL);				\
194 	checker((expected_size) * 2,					\
195 		krealloc_array(orig, 1, (alloc_size) * 2, gfp),		\
196 		kfree(p));						\
197 	orig = kmalloc(alloc_size, gfp);				\
198 	KUNIT_EXPECT_TRUE(test, orig != NULL);				\
199 	checker((expected_size) * 2,					\
200 		krealloc_array(orig, (alloc_size) * 2, 1, gfp),		\
201 		kfree(p));						\
202 									\
203 	len = 11;							\
204 	/* Using memdup() with fixed size, so force unknown length. */	\
205 	if (!__builtin_constant_p(expected_size))			\
206 		len += zero_size;					\
207 	checker(len, kmemdup("hello there", len, gfp), kfree(p));	\
208 } while (0)
209 DEFINE_ALLOC_SIZE_TEST_PAIR(kmalloc)
210 
211 /* Sizes are in pages, not bytes. */
212 #define TEST_vmalloc(checker, expected_pages, alloc_pages)	do {	\
213 	gfp_t gfp = GFP_KERNEL | __GFP_NOWARN;				\
214 	checker((expected_pages) * PAGE_SIZE,				\
215 		vmalloc((alloc_pages) * PAGE_SIZE),	   vfree(p));	\
216 	checker((expected_pages) * PAGE_SIZE,				\
217 		vzalloc((alloc_pages) * PAGE_SIZE),	   vfree(p));	\
218 	checker((expected_pages) * PAGE_SIZE,				\
219 		__vmalloc((alloc_pages) * PAGE_SIZE, gfp), vfree(p));	\
220 } while (0)
221 DEFINE_ALLOC_SIZE_TEST_PAIR(vmalloc)
222 
223 /* Sizes are in pages (and open-coded for side-effects), not bytes. */
224 #define TEST_kvmalloc(checker, expected_pages, alloc_pages)	do {	\
225 	gfp_t gfp = GFP_KERNEL | __GFP_NOWARN;				\
226 	size_t prev_size;						\
227 	void *orig;							\
228 									\
229 	checker((expected_pages) * PAGE_SIZE,				\
230 		kvmalloc((alloc_pages) * PAGE_SIZE, gfp),		\
231 		kvfree(p));						\
232 	checker((expected_pages) * PAGE_SIZE,				\
233 		kvmalloc_node((alloc_pages) * PAGE_SIZE, gfp, NUMA_NO_NODE), \
234 		kvfree(p));						\
235 	checker((expected_pages) * PAGE_SIZE,				\
236 		kvzalloc((alloc_pages) * PAGE_SIZE, gfp),		\
237 		kvfree(p));						\
238 	checker((expected_pages) * PAGE_SIZE,				\
239 		kvzalloc_node((alloc_pages) * PAGE_SIZE, gfp, NUMA_NO_NODE), \
240 		kvfree(p));						\
241 	checker((expected_pages) * PAGE_SIZE,				\
242 		kvcalloc(1, (alloc_pages) * PAGE_SIZE, gfp),		\
243 		kvfree(p));						\
244 	checker((expected_pages) * PAGE_SIZE,				\
245 		kvcalloc((alloc_pages) * PAGE_SIZE, 1, gfp),		\
246 		kvfree(p));						\
247 	checker((expected_pages) * PAGE_SIZE,				\
248 		kvmalloc_array(1, (alloc_pages) * PAGE_SIZE, gfp),	\
249 		kvfree(p));						\
250 	checker((expected_pages) * PAGE_SIZE,				\
251 		kvmalloc_array((alloc_pages) * PAGE_SIZE, 1, gfp),	\
252 		kvfree(p));						\
253 									\
254 	prev_size = (expected_pages) * PAGE_SIZE;			\
255 	orig = kvmalloc(prev_size, gfp);				\
256 	KUNIT_EXPECT_TRUE(test, orig != NULL);				\
257 	checker(((expected_pages) * PAGE_SIZE) * 2,			\
258 		kvrealloc(orig, prev_size,				\
259 			  ((alloc_pages) * PAGE_SIZE) * 2, gfp),	\
260 		kvfree(p));						\
261 } while (0)
262 DEFINE_ALLOC_SIZE_TEST_PAIR(kvmalloc)
263 
264 #define TEST_devm_kmalloc(checker, expected_size, alloc_size)	do {	\
265 	gfp_t gfp = GFP_KERNEL | __GFP_NOWARN;				\
266 	const char dev_name[] = "fortify-test";				\
267 	struct device *dev;						\
268 	void *orig;							\
269 	size_t len;							\
270 									\
271 	/* Create dummy device for devm_kmalloc()-family tests. */	\
272 	dev = root_device_register(dev_name);				\
273 	KUNIT_ASSERT_FALSE_MSG(test, IS_ERR(dev),			\
274 			       "Cannot register test device\n");	\
275 									\
276 	checker(expected_size, devm_kmalloc(dev, alloc_size, gfp),	\
277 		devm_kfree(dev, p));					\
278 	checker(expected_size, devm_kzalloc(dev, alloc_size, gfp),	\
279 		devm_kfree(dev, p));					\
280 	checker(expected_size,						\
281 		devm_kmalloc_array(dev, 1, alloc_size, gfp),		\
282 		devm_kfree(dev, p));					\
283 	checker(expected_size,						\
284 		devm_kmalloc_array(dev, alloc_size, 1, gfp),		\
285 		devm_kfree(dev, p));					\
286 	checker(expected_size,						\
287 		devm_kcalloc(dev, 1, alloc_size, gfp),			\
288 		devm_kfree(dev, p));					\
289 	checker(expected_size,						\
290 		devm_kcalloc(dev, alloc_size, 1, gfp),			\
291 		devm_kfree(dev, p));					\
292 									\
293 	orig = devm_kmalloc(dev, alloc_size, gfp);			\
294 	KUNIT_EXPECT_TRUE(test, orig != NULL);				\
295 	checker((expected_size) * 2,					\
296 		devm_krealloc(dev, orig, (alloc_size) * 2, gfp),	\
297 		devm_kfree(dev, p));					\
298 									\
299 	len = 4;							\
300 	/* Using memdup() with fixed size, so force unknown length. */	\
301 	if (!__builtin_constant_p(expected_size))			\
302 		len += zero_size;					\
303 	checker(len, devm_kmemdup(dev, "Ohai", len, gfp),		\
304 		devm_kfree(dev, p));					\
305 									\
306 	device_unregister(dev);						\
307 } while (0)
308 DEFINE_ALLOC_SIZE_TEST_PAIR(devm_kmalloc)
309 
310 static struct kunit_case fortify_test_cases[] = {
311 	KUNIT_CASE(known_sizes_test),
312 	KUNIT_CASE(control_flow_split_test),
313 	KUNIT_CASE(alloc_size_kmalloc_const_test),
314 	KUNIT_CASE(alloc_size_kmalloc_dynamic_test),
315 	KUNIT_CASE(alloc_size_vmalloc_const_test),
316 	KUNIT_CASE(alloc_size_vmalloc_dynamic_test),
317 	KUNIT_CASE(alloc_size_kvmalloc_const_test),
318 	KUNIT_CASE(alloc_size_kvmalloc_dynamic_test),
319 	KUNIT_CASE(alloc_size_devm_kmalloc_const_test),
320 	KUNIT_CASE(alloc_size_devm_kmalloc_dynamic_test),
321 	{}
322 };
323 
324 static struct kunit_suite fortify_test_suite = {
325 	.name = "fortify",
326 	.test_cases = fortify_test_cases,
327 };
328 
329 kunit_test_suite(fortify_test_suite);
330 
331 MODULE_LICENSE("GPL");
332