1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * This is for all the tests related to refcount bugs (e.g. overflow, 4 * underflow, reaching zero untested, etc). 5 */ 6 #include "lkdtm.h" 7 #include <linux/refcount.h> 8 9 #ifdef CONFIG_REFCOUNT_FULL 10 #define REFCOUNT_MAX (UINT_MAX - 1) 11 #define REFCOUNT_SATURATED UINT_MAX 12 #else 13 #define REFCOUNT_MAX INT_MAX 14 #define REFCOUNT_SATURATED (INT_MIN / 2) 15 #endif 16 17 static void overflow_check(refcount_t *ref) 18 { 19 switch (refcount_read(ref)) { 20 case REFCOUNT_SATURATED: 21 pr_info("Overflow detected: saturated\n"); 22 break; 23 case REFCOUNT_MAX: 24 pr_warn("Overflow detected: unsafely reset to max\n"); 25 break; 26 default: 27 pr_err("Fail: refcount wrapped to %d\n", refcount_read(ref)); 28 } 29 } 30 31 /* 32 * A refcount_inc() above the maximum value of the refcount implementation, 33 * should at least saturate, and at most also WARN. 34 */ 35 void lkdtm_REFCOUNT_INC_OVERFLOW(void) 36 { 37 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX - 1); 38 39 pr_info("attempting good refcount_inc() without overflow\n"); 40 refcount_dec(&over); 41 refcount_inc(&over); 42 43 pr_info("attempting bad refcount_inc() overflow\n"); 44 refcount_inc(&over); 45 refcount_inc(&over); 46 47 overflow_check(&over); 48 } 49 50 /* refcount_add() should behave just like refcount_inc() above. */ 51 void lkdtm_REFCOUNT_ADD_OVERFLOW(void) 52 { 53 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX - 1); 54 55 pr_info("attempting good refcount_add() without overflow\n"); 56 refcount_dec(&over); 57 refcount_dec(&over); 58 refcount_dec(&over); 59 refcount_dec(&over); 60 refcount_add(4, &over); 61 62 pr_info("attempting bad refcount_add() overflow\n"); 63 refcount_add(4, &over); 64 65 overflow_check(&over); 66 } 67 68 /* refcount_inc_not_zero() should behave just like refcount_inc() above. */ 69 void lkdtm_REFCOUNT_INC_NOT_ZERO_OVERFLOW(void) 70 { 71 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX); 72 73 pr_info("attempting bad refcount_inc_not_zero() overflow\n"); 74 if (!refcount_inc_not_zero(&over)) 75 pr_warn("Weird: refcount_inc_not_zero() reported zero\n"); 76 77 overflow_check(&over); 78 } 79 80 /* refcount_add_not_zero() should behave just like refcount_inc() above. */ 81 void lkdtm_REFCOUNT_ADD_NOT_ZERO_OVERFLOW(void) 82 { 83 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX); 84 85 pr_info("attempting bad refcount_add_not_zero() overflow\n"); 86 if (!refcount_add_not_zero(6, &over)) 87 pr_warn("Weird: refcount_add_not_zero() reported zero\n"); 88 89 overflow_check(&over); 90 } 91 92 static void check_zero(refcount_t *ref) 93 { 94 switch (refcount_read(ref)) { 95 case REFCOUNT_SATURATED: 96 pr_info("Zero detected: saturated\n"); 97 break; 98 case REFCOUNT_MAX: 99 pr_warn("Zero detected: unsafely reset to max\n"); 100 break; 101 case 0: 102 pr_warn("Still at zero: refcount_inc/add() must not inc-from-0\n"); 103 break; 104 default: 105 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref)); 106 } 107 } 108 109 /* 110 * A refcount_dec(), as opposed to a refcount_dec_and_test(), when it hits 111 * zero it should either saturate (when inc-from-zero isn't protected) 112 * or stay at zero (when inc-from-zero is protected) and should WARN for both. 113 */ 114 void lkdtm_REFCOUNT_DEC_ZERO(void) 115 { 116 refcount_t zero = REFCOUNT_INIT(2); 117 118 pr_info("attempting good refcount_dec()\n"); 119 refcount_dec(&zero); 120 121 pr_info("attempting bad refcount_dec() to zero\n"); 122 refcount_dec(&zero); 123 124 check_zero(&zero); 125 } 126 127 static void check_negative(refcount_t *ref, int start) 128 { 129 /* 130 * CONFIG_REFCOUNT_FULL refuses to move a refcount at all on an 131 * over-sub, so we have to track our starting position instead of 132 * looking only at zero-pinning. 133 */ 134 if (refcount_read(ref) == start) { 135 pr_warn("Still at %d: refcount_inc/add() must not inc-from-0\n", 136 start); 137 return; 138 } 139 140 switch (refcount_read(ref)) { 141 case REFCOUNT_SATURATED: 142 pr_info("Negative detected: saturated\n"); 143 break; 144 case REFCOUNT_MAX: 145 pr_warn("Negative detected: unsafely reset to max\n"); 146 break; 147 default: 148 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref)); 149 } 150 } 151 152 /* A refcount_dec() going negative should saturate and may WARN. */ 153 void lkdtm_REFCOUNT_DEC_NEGATIVE(void) 154 { 155 refcount_t neg = REFCOUNT_INIT(0); 156 157 pr_info("attempting bad refcount_dec() below zero\n"); 158 refcount_dec(&neg); 159 160 check_negative(&neg, 0); 161 } 162 163 /* 164 * A refcount_dec_and_test() should act like refcount_dec() above when 165 * going negative. 166 */ 167 void lkdtm_REFCOUNT_DEC_AND_TEST_NEGATIVE(void) 168 { 169 refcount_t neg = REFCOUNT_INIT(0); 170 171 pr_info("attempting bad refcount_dec_and_test() below zero\n"); 172 if (refcount_dec_and_test(&neg)) 173 pr_warn("Weird: refcount_dec_and_test() reported zero\n"); 174 175 check_negative(&neg, 0); 176 } 177 178 /* 179 * A refcount_sub_and_test() should act like refcount_dec_and_test() 180 * above when going negative. 181 */ 182 void lkdtm_REFCOUNT_SUB_AND_TEST_NEGATIVE(void) 183 { 184 refcount_t neg = REFCOUNT_INIT(3); 185 186 pr_info("attempting bad refcount_sub_and_test() below zero\n"); 187 if (refcount_sub_and_test(5, &neg)) 188 pr_warn("Weird: refcount_sub_and_test() reported zero\n"); 189 190 check_negative(&neg, 3); 191 } 192 193 static void check_from_zero(refcount_t *ref) 194 { 195 switch (refcount_read(ref)) { 196 case 0: 197 pr_info("Zero detected: stayed at zero\n"); 198 break; 199 case REFCOUNT_SATURATED: 200 pr_info("Zero detected: saturated\n"); 201 break; 202 case REFCOUNT_MAX: 203 pr_warn("Zero detected: unsafely reset to max\n"); 204 break; 205 default: 206 pr_info("Fail: zero not detected, incremented to %d\n", 207 refcount_read(ref)); 208 } 209 } 210 211 /* 212 * A refcount_inc() from zero should pin to zero or saturate and may WARN. 213 * Only CONFIG_REFCOUNT_FULL provides this protection currently. 214 */ 215 void lkdtm_REFCOUNT_INC_ZERO(void) 216 { 217 refcount_t zero = REFCOUNT_INIT(0); 218 219 pr_info("attempting safe refcount_inc_not_zero() from zero\n"); 220 if (!refcount_inc_not_zero(&zero)) { 221 pr_info("Good: zero detected\n"); 222 if (refcount_read(&zero) == 0) 223 pr_info("Correctly stayed at zero\n"); 224 else 225 pr_err("Fail: refcount went past zero!\n"); 226 } else { 227 pr_err("Fail: Zero not detected!?\n"); 228 } 229 230 pr_info("attempting bad refcount_inc() from zero\n"); 231 refcount_inc(&zero); 232 233 check_from_zero(&zero); 234 } 235 236 /* 237 * A refcount_add() should act like refcount_inc() above when starting 238 * at zero. 239 */ 240 void lkdtm_REFCOUNT_ADD_ZERO(void) 241 { 242 refcount_t zero = REFCOUNT_INIT(0); 243 244 pr_info("attempting safe refcount_add_not_zero() from zero\n"); 245 if (!refcount_add_not_zero(3, &zero)) { 246 pr_info("Good: zero detected\n"); 247 if (refcount_read(&zero) == 0) 248 pr_info("Correctly stayed at zero\n"); 249 else 250 pr_err("Fail: refcount went past zero\n"); 251 } else { 252 pr_err("Fail: Zero not detected!?\n"); 253 } 254 255 pr_info("attempting bad refcount_add() from zero\n"); 256 refcount_add(3, &zero); 257 258 check_from_zero(&zero); 259 } 260 261 static void check_saturated(refcount_t *ref) 262 { 263 switch (refcount_read(ref)) { 264 case REFCOUNT_SATURATED: 265 pr_info("Saturation detected: still saturated\n"); 266 break; 267 case REFCOUNT_MAX: 268 pr_warn("Saturation detected: unsafely reset to max\n"); 269 break; 270 default: 271 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref)); 272 } 273 } 274 275 /* 276 * A refcount_inc() from a saturated value should at most warn about 277 * being saturated already. 278 */ 279 void lkdtm_REFCOUNT_INC_SATURATED(void) 280 { 281 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED); 282 283 pr_info("attempting bad refcount_inc() from saturated\n"); 284 refcount_inc(&sat); 285 286 check_saturated(&sat); 287 } 288 289 /* Should act like refcount_inc() above from saturated. */ 290 void lkdtm_REFCOUNT_DEC_SATURATED(void) 291 { 292 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED); 293 294 pr_info("attempting bad refcount_dec() from saturated\n"); 295 refcount_dec(&sat); 296 297 check_saturated(&sat); 298 } 299 300 /* Should act like refcount_inc() above from saturated. */ 301 void lkdtm_REFCOUNT_ADD_SATURATED(void) 302 { 303 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED); 304 305 pr_info("attempting bad refcount_dec() from saturated\n"); 306 refcount_add(8, &sat); 307 308 check_saturated(&sat); 309 } 310 311 /* Should act like refcount_inc() above from saturated. */ 312 void lkdtm_REFCOUNT_INC_NOT_ZERO_SATURATED(void) 313 { 314 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED); 315 316 pr_info("attempting bad refcount_inc_not_zero() from saturated\n"); 317 if (!refcount_inc_not_zero(&sat)) 318 pr_warn("Weird: refcount_inc_not_zero() reported zero\n"); 319 320 check_saturated(&sat); 321 } 322 323 /* Should act like refcount_inc() above from saturated. */ 324 void lkdtm_REFCOUNT_ADD_NOT_ZERO_SATURATED(void) 325 { 326 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED); 327 328 pr_info("attempting bad refcount_add_not_zero() from saturated\n"); 329 if (!refcount_add_not_zero(7, &sat)) 330 pr_warn("Weird: refcount_add_not_zero() reported zero\n"); 331 332 check_saturated(&sat); 333 } 334 335 /* Should act like refcount_inc() above from saturated. */ 336 void lkdtm_REFCOUNT_DEC_AND_TEST_SATURATED(void) 337 { 338 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED); 339 340 pr_info("attempting bad refcount_dec_and_test() from saturated\n"); 341 if (refcount_dec_and_test(&sat)) 342 pr_warn("Weird: refcount_dec_and_test() reported zero\n"); 343 344 check_saturated(&sat); 345 } 346 347 /* Should act like refcount_inc() above from saturated. */ 348 void lkdtm_REFCOUNT_SUB_AND_TEST_SATURATED(void) 349 { 350 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED); 351 352 pr_info("attempting bad refcount_sub_and_test() from saturated\n"); 353 if (refcount_sub_and_test(8, &sat)) 354 pr_warn("Weird: refcount_sub_and_test() reported zero\n"); 355 356 check_saturated(&sat); 357 } 358 359 /* Used to time the existing atomic_t when used for reference counting */ 360 void lkdtm_ATOMIC_TIMING(void) 361 { 362 unsigned int i; 363 atomic_t count = ATOMIC_INIT(1); 364 365 for (i = 0; i < INT_MAX - 1; i++) 366 atomic_inc(&count); 367 368 for (i = INT_MAX; i > 0; i--) 369 if (atomic_dec_and_test(&count)) 370 break; 371 372 if (i != 1) 373 pr_err("atomic timing: out of sync up/down cycle: %u\n", i - 1); 374 else 375 pr_info("atomic timing: done\n"); 376 } 377 378 /* 379 * This can be compared to ATOMIC_TIMING when implementing fast refcount 380 * protections. Looking at the number of CPU cycles tells the real story 381 * about performance. For example: 382 * cd /sys/kernel/debug/provoke-crash 383 * perf stat -B -- cat <(echo REFCOUNT_TIMING) > DIRECT 384 */ 385 void lkdtm_REFCOUNT_TIMING(void) 386 { 387 unsigned int i; 388 refcount_t count = REFCOUNT_INIT(1); 389 390 for (i = 0; i < INT_MAX - 1; i++) 391 refcount_inc(&count); 392 393 for (i = INT_MAX; i > 0; i--) 394 if (refcount_dec_and_test(&count)) 395 break; 396 397 if (i != 1) 398 pr_err("refcount: out of sync up/down cycle: %u\n", i - 1); 399 else 400 pr_info("refcount timing: done\n"); 401 } 402