1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Test cases for compiler-based stack variable zeroing via 4 * -ftrivial-auto-var-init={zero,pattern} or CONFIG_GCC_PLUGIN_STRUCTLEAK*. 5 * For example, see: 6 * "Running tests with kunit_tool" at Documentation/dev-tools/kunit/start.rst 7 * ./tools/testing/kunit/kunit.py run stackinit [--raw_output] \ 8 * --make_option LLVM=1 \ 9 * --kconfig_add CONFIG_INIT_STACK_ALL_ZERO=y 10 * 11 */ 12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 13 14 #include <kunit/test.h> 15 #include <linux/init.h> 16 #include <linux/kernel.h> 17 #include <linux/module.h> 18 #include <linux/string.h> 19 20 /* Exfiltration buffer. */ 21 #define MAX_VAR_SIZE 128 22 static u8 check_buf[MAX_VAR_SIZE]; 23 24 /* Character array to trigger stack protector in all functions. */ 25 #define VAR_BUFFER 32 26 27 /* Volatile mask to convince compiler to copy memory with 0xff. */ 28 static volatile u8 forced_mask = 0xff; 29 30 /* Location and size tracking to validate fill and test are colocated. */ 31 static void *fill_start, *target_start; 32 static size_t fill_size, target_size; 33 stackinit_range_contains(char * haystack_start,size_t haystack_size,char * needle_start,size_t needle_size)34 static bool stackinit_range_contains(char *haystack_start, size_t haystack_size, 35 char *needle_start, size_t needle_size) 36 { 37 if (needle_start >= haystack_start && 38 needle_start + needle_size <= haystack_start + haystack_size) 39 return true; 40 return false; 41 } 42 43 /* Whether the test is expected to fail. */ 44 #define WANT_SUCCESS 0 45 #define XFAIL 1 46 47 #define DO_NOTHING_TYPE_SCALAR(var_type) var_type 48 #define DO_NOTHING_TYPE_STRING(var_type) void 49 #define DO_NOTHING_TYPE_STRUCT(var_type) void 50 51 #define DO_NOTHING_RETURN_SCALAR(ptr) *(ptr) 52 #define DO_NOTHING_RETURN_STRING(ptr) /**/ 53 #define DO_NOTHING_RETURN_STRUCT(ptr) /**/ 54 55 #define DO_NOTHING_CALL_SCALAR(var, name) \ 56 (var) = do_nothing_ ## name(&(var)) 57 #define DO_NOTHING_CALL_STRING(var, name) \ 58 do_nothing_ ## name(var) 59 #define DO_NOTHING_CALL_STRUCT(var, name) \ 60 do_nothing_ ## name(&(var)) 61 62 #define FETCH_ARG_SCALAR(var) &var 63 #define FETCH_ARG_STRING(var) var 64 #define FETCH_ARG_STRUCT(var) &var 65 66 #define FILL_SIZE_STRING 16 67 68 #define INIT_CLONE_SCALAR /**/ 69 #define INIT_CLONE_STRING [FILL_SIZE_STRING] 70 #define INIT_CLONE_STRUCT /**/ 71 72 #define ZERO_CLONE_SCALAR(zero) memset(&(zero), 0x00, sizeof(zero)) 73 #define ZERO_CLONE_STRING(zero) memset(&(zero), 0x00, sizeof(zero)) 74 /* 75 * For the struct, intentionally poison padding to see if it gets 76 * copied out in direct assignments. 77 * */ 78 #define ZERO_CLONE_STRUCT(zero) \ 79 do { \ 80 memset(&(zero), 0xFF, sizeof(zero)); \ 81 zero.one = 0; \ 82 zero.two = 0; \ 83 zero.three = 0; \ 84 zero.four = 0; \ 85 } while (0) 86 87 #define INIT_SCALAR_none(var_type) /**/ 88 #define INIT_SCALAR_zero(var_type) = 0 89 90 #define INIT_STRING_none(var_type) [FILL_SIZE_STRING] /**/ 91 #define INIT_STRING_zero(var_type) [FILL_SIZE_STRING] = { } 92 93 #define INIT_STRUCT_none(var_type) /**/ 94 #define INIT_STRUCT_zero(var_type) = { } 95 96 97 #define __static_partial { .two = 0, } 98 #define __static_all { .one = 0, \ 99 .two = 0, \ 100 .three = 0, \ 101 .four = 0, \ 102 } 103 #define __dynamic_partial { .two = arg->two, } 104 #define __dynamic_all { .one = arg->one, \ 105 .two = arg->two, \ 106 .three = arg->three, \ 107 .four = arg->four, \ 108 } 109 #define __runtime_partial var.two = 0 110 #define __runtime_all var.one = 0; \ 111 var.two = 0; \ 112 var.three = 0; \ 113 var.four = 0 114 115 #define INIT_STRUCT_static_partial(var_type) \ 116 = __static_partial 117 #define INIT_STRUCT_static_all(var_type) \ 118 = __static_all 119 #define INIT_STRUCT_dynamic_partial(var_type) \ 120 = __dynamic_partial 121 #define INIT_STRUCT_dynamic_all(var_type) \ 122 = __dynamic_all 123 #define INIT_STRUCT_runtime_partial(var_type) \ 124 ; __runtime_partial 125 #define INIT_STRUCT_runtime_all(var_type) \ 126 ; __runtime_all 127 128 #define INIT_STRUCT_assigned_static_partial(var_type) \ 129 ; var = (var_type)__static_partial 130 #define INIT_STRUCT_assigned_static_all(var_type) \ 131 ; var = (var_type)__static_all 132 #define INIT_STRUCT_assigned_dynamic_partial(var_type) \ 133 ; var = (var_type)__dynamic_partial 134 #define INIT_STRUCT_assigned_dynamic_all(var_type) \ 135 ; var = (var_type)__dynamic_all 136 137 #define INIT_STRUCT_assigned_copy(var_type) \ 138 ; var = *(arg) 139 140 /* 141 * @name: unique string name for the test 142 * @var_type: type to be tested for zeroing initialization 143 * @which: is this a SCALAR, STRING, or STRUCT type? 144 * @init_level: what kind of initialization is performed 145 * @xfail: is this test expected to fail? 146 */ 147 #define DEFINE_TEST_DRIVER(name, var_type, which, xfail) \ 148 /* Returns 0 on success, 1 on failure. */ \ 149 static noinline void test_ ## name (struct kunit *test) \ 150 { \ 151 var_type zero INIT_CLONE_ ## which; \ 152 int ignored; \ 153 u8 sum = 0, i; \ 154 \ 155 /* Notice when a new test is larger than expected. */ \ 156 BUILD_BUG_ON(sizeof(zero) > MAX_VAR_SIZE); \ 157 \ 158 /* Fill clone type with zero for per-field init. */ \ 159 ZERO_CLONE_ ## which(zero); \ 160 /* Clear entire check buffer for 0xFF overlap test. */ \ 161 memset(check_buf, 0x00, sizeof(check_buf)); \ 162 /* Fill stack with 0xFF. */ \ 163 ignored = leaf_ ##name((unsigned long)&ignored, 1, \ 164 FETCH_ARG_ ## which(zero)); \ 165 /* Verify all bytes overwritten with 0xFF. */ \ 166 for (sum = 0, i = 0; i < target_size; i++) \ 167 sum += (check_buf[i] != 0xFF); \ 168 KUNIT_ASSERT_EQ_MSG(test, sum, 0, \ 169 "leaf fill was not 0xFF!?\n"); \ 170 /* Clear entire check buffer for later bit tests. */ \ 171 memset(check_buf, 0x00, sizeof(check_buf)); \ 172 /* Extract stack-defined variable contents. */ \ 173 ignored = leaf_ ##name((unsigned long)&ignored, 0, \ 174 FETCH_ARG_ ## which(zero)); \ 175 \ 176 /* Validate that compiler lined up fill and target. */ \ 177 KUNIT_ASSERT_TRUE_MSG(test, \ 178 stackinit_range_contains(fill_start, fill_size, \ 179 target_start, target_size), \ 180 "stack fill missed target!? " \ 181 "(fill %zu wide, target offset by %d)\n", \ 182 fill_size, \ 183 (int)((ssize_t)(uintptr_t)fill_start - \ 184 (ssize_t)(uintptr_t)target_start)); \ 185 \ 186 /* Look for any bytes still 0xFF in check region. */ \ 187 for (sum = 0, i = 0; i < target_size; i++) \ 188 sum += (check_buf[i] == 0xFF); \ 189 \ 190 if (sum != 0 && xfail) \ 191 kunit_skip(test, \ 192 "XFAIL uninit bytes: %d\n", \ 193 sum); \ 194 KUNIT_ASSERT_EQ_MSG(test, sum, 0, \ 195 "uninit bytes: %d\n", sum); \ 196 } 197 #define DEFINE_TEST(name, var_type, which, init_level, xfail) \ 198 /* no-op to force compiler into ignoring "uninitialized" vars */\ 199 static noinline DO_NOTHING_TYPE_ ## which(var_type) \ 200 do_nothing_ ## name(var_type *ptr) \ 201 { \ 202 OPTIMIZER_HIDE_VAR(ptr); \ 203 /* Will always be true, but compiler doesn't know. */ \ 204 if ((unsigned long)ptr > 0x2) \ 205 return DO_NOTHING_RETURN_ ## which(ptr); \ 206 else \ 207 return DO_NOTHING_RETURN_ ## which(ptr + 1); \ 208 } \ 209 static noinline int leaf_ ## name(unsigned long sp, bool fill, \ 210 var_type *arg) \ 211 { \ 212 char buf[VAR_BUFFER]; \ 213 var_type var \ 214 INIT_ ## which ## _ ## init_level(var_type); \ 215 \ 216 target_start = &var; \ 217 target_size = sizeof(var); \ 218 /* \ 219 * Keep this buffer around to make sure we've got a \ 220 * stack frame of SOME kind... \ 221 */ \ 222 memset(buf, (char)(sp & 0xff), sizeof(buf)); \ 223 /* Fill variable with 0xFF. */ \ 224 if (fill) { \ 225 fill_start = &var; \ 226 fill_size = sizeof(var); \ 227 memset(fill_start, \ 228 (char)((sp & 0xff) | forced_mask), \ 229 fill_size); \ 230 } \ 231 \ 232 /* Silence "never initialized" warnings. */ \ 233 DO_NOTHING_CALL_ ## which(var, name); \ 234 \ 235 /* Exfiltrate "var". */ \ 236 memcpy(check_buf, target_start, target_size); \ 237 \ 238 return (int)buf[0] | (int)buf[sizeof(buf) - 1]; \ 239 } \ 240 DEFINE_TEST_DRIVER(name, var_type, which, xfail) 241 242 /* Structure with no padding. */ 243 struct test_packed { 244 unsigned long one; 245 unsigned long two; 246 unsigned long three; 247 unsigned long four; 248 }; 249 250 /* Simple structure with padding likely to be covered by compiler. */ 251 struct test_small_hole { 252 size_t one; 253 char two; 254 /* 3 byte padding hole here. */ 255 int three; 256 unsigned long four; 257 }; 258 259 /* Trigger unhandled padding in a structure. */ 260 struct test_big_hole { 261 u8 one; 262 u8 two; 263 u8 three; 264 /* 61 byte padding hole here. */ 265 u8 four __aligned(64); 266 } __aligned(64); 267 268 struct test_trailing_hole { 269 char *one; 270 char *two; 271 char *three; 272 char four; 273 /* "sizeof(unsigned long) - 1" byte padding hole here. */ 274 }; 275 276 /* Test if STRUCTLEAK is clearing structs with __user fields. */ 277 struct test_user { 278 u8 one; 279 unsigned long two; 280 char __user *three; 281 unsigned long four; 282 }; 283 284 #define ALWAYS_PASS WANT_SUCCESS 285 #define ALWAYS_FAIL XFAIL 286 287 #ifdef CONFIG_INIT_STACK_NONE 288 # define USER_PASS XFAIL 289 # define BYREF_PASS XFAIL 290 # define STRONG_PASS XFAIL 291 #elif defined(CONFIG_GCC_PLUGIN_STRUCTLEAK_USER) 292 # define USER_PASS WANT_SUCCESS 293 # define BYREF_PASS XFAIL 294 # define STRONG_PASS XFAIL 295 #elif defined(CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF) 296 # define USER_PASS WANT_SUCCESS 297 # define BYREF_PASS WANT_SUCCESS 298 # define STRONG_PASS XFAIL 299 #else 300 # define USER_PASS WANT_SUCCESS 301 # define BYREF_PASS WANT_SUCCESS 302 # define STRONG_PASS WANT_SUCCESS 303 #endif 304 305 #define DEFINE_SCALAR_TEST(name, init, xfail) \ 306 DEFINE_TEST(name ## _ ## init, name, SCALAR, \ 307 init, xfail) 308 309 #define DEFINE_SCALAR_TESTS(init, xfail) \ 310 DEFINE_SCALAR_TEST(u8, init, xfail); \ 311 DEFINE_SCALAR_TEST(u16, init, xfail); \ 312 DEFINE_SCALAR_TEST(u32, init, xfail); \ 313 DEFINE_SCALAR_TEST(u64, init, xfail); \ 314 DEFINE_TEST(char_array_ ## init, unsigned char, \ 315 STRING, init, xfail) 316 317 #define DEFINE_STRUCT_TEST(name, init, xfail) \ 318 DEFINE_TEST(name ## _ ## init, \ 319 struct test_ ## name, STRUCT, init, \ 320 xfail) 321 322 #define DEFINE_STRUCT_TESTS(init, xfail) \ 323 DEFINE_STRUCT_TEST(small_hole, init, xfail); \ 324 DEFINE_STRUCT_TEST(big_hole, init, xfail); \ 325 DEFINE_STRUCT_TEST(trailing_hole, init, xfail); \ 326 DEFINE_STRUCT_TEST(packed, init, xfail) 327 328 #define DEFINE_STRUCT_INITIALIZER_TESTS(base, xfail) \ 329 DEFINE_STRUCT_TESTS(base ## _ ## partial, \ 330 xfail); \ 331 DEFINE_STRUCT_TESTS(base ## _ ## all, xfail) 332 333 /* These should be fully initialized all the time! */ 334 DEFINE_SCALAR_TESTS(zero, ALWAYS_PASS); 335 DEFINE_STRUCT_TESTS(zero, ALWAYS_PASS); 336 /* Struct initializers: padding may be left uninitialized. */ 337 DEFINE_STRUCT_INITIALIZER_TESTS(static, STRONG_PASS); 338 DEFINE_STRUCT_INITIALIZER_TESTS(dynamic, STRONG_PASS); 339 DEFINE_STRUCT_INITIALIZER_TESTS(runtime, STRONG_PASS); 340 DEFINE_STRUCT_INITIALIZER_TESTS(assigned_static, STRONG_PASS); 341 DEFINE_STRUCT_INITIALIZER_TESTS(assigned_dynamic, STRONG_PASS); 342 DEFINE_STRUCT_TESTS(assigned_copy, ALWAYS_FAIL); 343 /* No initialization without compiler instrumentation. */ 344 DEFINE_SCALAR_TESTS(none, STRONG_PASS); 345 DEFINE_STRUCT_TESTS(none, BYREF_PASS); 346 /* Initialization of members with __user attribute. */ 347 DEFINE_TEST(user, struct test_user, STRUCT, none, USER_PASS); 348 349 /* 350 * Check two uses through a variable declaration outside either path, 351 * which was noticed as a special case in porting earlier stack init 352 * compiler logic. 353 */ __leaf_switch_none(int path,bool fill)354 static int noinline __leaf_switch_none(int path, bool fill) 355 { 356 switch (path) { 357 /* 358 * This is intentionally unreachable. To silence the 359 * warning, build with -Wno-switch-unreachable 360 */ 361 uint64_t var[10]; 362 363 case 1: 364 target_start = &var; 365 target_size = sizeof(var); 366 if (fill) { 367 fill_start = &var; 368 fill_size = sizeof(var); 369 370 memset(fill_start, forced_mask | 0x55, fill_size); 371 } 372 memcpy(check_buf, target_start, target_size); 373 break; 374 case 2: 375 target_start = &var; 376 target_size = sizeof(var); 377 if (fill) { 378 fill_start = &var; 379 fill_size = sizeof(var); 380 381 memset(fill_start, forced_mask | 0xaa, fill_size); 382 } 383 memcpy(check_buf, target_start, target_size); 384 break; 385 default: 386 var[1] = 5; 387 return var[1] & forced_mask; 388 } 389 return 0; 390 } 391 leaf_switch_1_none(unsigned long sp,bool fill,uint64_t * arg)392 static noinline int leaf_switch_1_none(unsigned long sp, bool fill, 393 uint64_t *arg) 394 { 395 return __leaf_switch_none(1, fill); 396 } 397 leaf_switch_2_none(unsigned long sp,bool fill,uint64_t * arg)398 static noinline int leaf_switch_2_none(unsigned long sp, bool fill, 399 uint64_t *arg) 400 { 401 return __leaf_switch_none(2, fill); 402 } 403 404 /* 405 * These are expected to fail for most configurations because neither 406 * GCC nor Clang have a way to perform initialization of variables in 407 * non-code areas (i.e. in a switch statement before the first "case"). 408 * https://bugs.llvm.org/show_bug.cgi?id=44916 409 */ 410 DEFINE_TEST_DRIVER(switch_1_none, uint64_t, SCALAR, ALWAYS_FAIL); 411 DEFINE_TEST_DRIVER(switch_2_none, uint64_t, SCALAR, ALWAYS_FAIL); 412 413 #define KUNIT_test_scalars(init) \ 414 KUNIT_CASE(test_u8_ ## init), \ 415 KUNIT_CASE(test_u16_ ## init), \ 416 KUNIT_CASE(test_u32_ ## init), \ 417 KUNIT_CASE(test_u64_ ## init), \ 418 KUNIT_CASE(test_char_array_ ## init) 419 420 #define KUNIT_test_structs(init) \ 421 KUNIT_CASE(test_small_hole_ ## init), \ 422 KUNIT_CASE(test_big_hole_ ## init), \ 423 KUNIT_CASE(test_trailing_hole_ ## init),\ 424 KUNIT_CASE(test_packed_ ## init) \ 425 426 static struct kunit_case stackinit_test_cases[] = { 427 /* These are explicitly initialized and should always pass. */ 428 KUNIT_test_scalars(zero), 429 KUNIT_test_structs(zero), 430 /* Padding here appears to be accidentally always initialized? */ 431 KUNIT_test_structs(dynamic_partial), 432 KUNIT_test_structs(assigned_dynamic_partial), 433 /* Padding initialization depends on compiler behaviors. */ 434 KUNIT_test_structs(static_partial), 435 KUNIT_test_structs(static_all), 436 KUNIT_test_structs(dynamic_all), 437 KUNIT_test_structs(runtime_partial), 438 KUNIT_test_structs(runtime_all), 439 KUNIT_test_structs(assigned_static_partial), 440 KUNIT_test_structs(assigned_static_all), 441 KUNIT_test_structs(assigned_dynamic_all), 442 /* Everything fails this since it effectively performs a memcpy(). */ 443 KUNIT_test_structs(assigned_copy), 444 /* STRUCTLEAK_BYREF_ALL should cover everything from here down. */ 445 KUNIT_test_scalars(none), 446 KUNIT_CASE(test_switch_1_none), 447 KUNIT_CASE(test_switch_2_none), 448 /* STRUCTLEAK_BYREF should cover from here down. */ 449 KUNIT_test_structs(none), 450 /* STRUCTLEAK will only cover this. */ 451 KUNIT_CASE(test_user), 452 {} 453 }; 454 455 static struct kunit_suite stackinit_test_suite = { 456 .name = "stackinit", 457 .test_cases = stackinit_test_cases, 458 }; 459 460 kunit_test_suites(&stackinit_test_suite); 461 462 MODULE_LICENSE("GPL"); 463