1 /* 2 * Kernel module for testing copy_to/from_user infrastructure. 3 * 4 * Copyright 2013 Google Inc. All Rights Reserved 5 * 6 * Authors: 7 * Kees Cook <keescook@chromium.org> 8 * 9 * This software is licensed under the terms of the GNU General Public 10 * License version 2, as published by the Free Software Foundation, and 11 * may be copied, distributed, and modified under those terms. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 */ 18 19 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 20 21 #include <linux/mman.h> 22 #include <linux/module.h> 23 #include <linux/sched.h> 24 #include <linux/slab.h> 25 #include <linux/uaccess.h> 26 #include <linux/vmalloc.h> 27 28 /* 29 * Several 32-bit architectures support 64-bit {get,put}_user() calls. 30 * As there doesn't appear to be anything that can safely determine 31 * their capability at compile-time, we just have to opt-out certain archs. 32 */ 33 #if BITS_PER_LONG == 64 || (!(defined(CONFIG_ARM) && !defined(MMU)) && \ 34 !defined(CONFIG_AVR32) && \ 35 !defined(CONFIG_BLACKFIN) && \ 36 !defined(CONFIG_M32R) && \ 37 !defined(CONFIG_M68K) && \ 38 !defined(CONFIG_MICROBLAZE) && \ 39 !defined(CONFIG_MN10300) && \ 40 !defined(CONFIG_NIOS2) && \ 41 !defined(CONFIG_PPC32) && \ 42 !defined(CONFIG_SUPERH)) 43 # define TEST_U64 44 #endif 45 46 #define test(condition, msg) \ 47 ({ \ 48 int cond = (condition); \ 49 if (cond) \ 50 pr_warn("%s\n", msg); \ 51 cond; \ 52 }) 53 54 static int __init test_user_copy_init(void) 55 { 56 int ret = 0; 57 char *kmem; 58 char __user *usermem; 59 char *bad_usermem; 60 unsigned long user_addr; 61 u8 val_u8; 62 u16 val_u16; 63 u32 val_u32; 64 #ifdef TEST_U64 65 u64 val_u64; 66 #endif 67 68 kmem = kmalloc(PAGE_SIZE * 2, GFP_KERNEL); 69 if (!kmem) 70 return -ENOMEM; 71 72 user_addr = vm_mmap(NULL, 0, PAGE_SIZE * 2, 73 PROT_READ | PROT_WRITE | PROT_EXEC, 74 MAP_ANONYMOUS | MAP_PRIVATE, 0); 75 if (user_addr >= (unsigned long)(TASK_SIZE)) { 76 pr_warn("Failed to allocate user memory\n"); 77 kfree(kmem); 78 return -ENOMEM; 79 } 80 81 usermem = (char __user *)user_addr; 82 bad_usermem = (char *)user_addr; 83 84 /* 85 * Legitimate usage: none of these copies should fail. 86 */ 87 memset(kmem, 0x3a, PAGE_SIZE * 2); 88 ret |= test(copy_to_user(usermem, kmem, PAGE_SIZE), 89 "legitimate copy_to_user failed"); 90 memset(kmem, 0x0, PAGE_SIZE); 91 ret |= test(copy_from_user(kmem, usermem, PAGE_SIZE), 92 "legitimate copy_from_user failed"); 93 ret |= test(memcmp(kmem, kmem + PAGE_SIZE, PAGE_SIZE), 94 "legitimate usercopy failed to copy data"); 95 96 #define test_legit(size, check) \ 97 do { \ 98 val_##size = check; \ 99 ret |= test(put_user(val_##size, (size __user *)usermem), \ 100 "legitimate put_user (" #size ") failed"); \ 101 val_##size = 0; \ 102 ret |= test(get_user(val_##size, (size __user *)usermem), \ 103 "legitimate get_user (" #size ") failed"); \ 104 ret |= test(val_##size != check, \ 105 "legitimate get_user (" #size ") failed to do copy"); \ 106 if (val_##size != check) { \ 107 pr_info("0x%llx != 0x%llx\n", \ 108 (unsigned long long)val_##size, \ 109 (unsigned long long)check); \ 110 } \ 111 } while (0) 112 113 test_legit(u8, 0x5a); 114 test_legit(u16, 0x5a5b); 115 test_legit(u32, 0x5a5b5c5d); 116 #ifdef TEST_U64 117 test_legit(u64, 0x5a5b5c5d6a6b6c6d); 118 #endif 119 #undef test_legit 120 121 /* 122 * Invalid usage: none of these copies should succeed. 123 */ 124 125 /* Prepare kernel memory with check values. */ 126 memset(kmem, 0x5a, PAGE_SIZE); 127 memset(kmem + PAGE_SIZE, 0, PAGE_SIZE); 128 129 /* Reject kernel-to-kernel copies through copy_from_user(). */ 130 ret |= test(!copy_from_user(kmem, (char __user *)(kmem + PAGE_SIZE), 131 PAGE_SIZE), 132 "illegal all-kernel copy_from_user passed"); 133 134 /* Destination half of buffer should have been zeroed. */ 135 ret |= test(memcmp(kmem + PAGE_SIZE, kmem, PAGE_SIZE), 136 "zeroing failure for illegal all-kernel copy_from_user"); 137 138 #if 0 139 /* 140 * When running with SMAP/PAN/etc, this will Oops the kernel 141 * due to the zeroing of userspace memory on failure. This needs 142 * to be tested in LKDTM instead, since this test module does not 143 * expect to explode. 144 */ 145 ret |= test(!copy_from_user(bad_usermem, (char __user *)kmem, 146 PAGE_SIZE), 147 "illegal reversed copy_from_user passed"); 148 #endif 149 ret |= test(!copy_to_user((char __user *)kmem, kmem + PAGE_SIZE, 150 PAGE_SIZE), 151 "illegal all-kernel copy_to_user passed"); 152 ret |= test(!copy_to_user((char __user *)kmem, bad_usermem, 153 PAGE_SIZE), 154 "illegal reversed copy_to_user passed"); 155 156 #define test_illegal(size, check) \ 157 do { \ 158 val_##size = (check); \ 159 ret |= test(!get_user(val_##size, (size __user *)kmem), \ 160 "illegal get_user (" #size ") passed"); \ 161 ret |= test(val_##size != (size)0, \ 162 "zeroing failure for illegal get_user (" #size ")"); \ 163 if (val_##size != (size)0) { \ 164 pr_info("0x%llx != 0\n", \ 165 (unsigned long long)val_##size); \ 166 } \ 167 ret |= test(!put_user(val_##size, (size __user *)kmem), \ 168 "illegal put_user (" #size ") passed"); \ 169 } while (0) 170 171 test_illegal(u8, 0x5a); 172 test_illegal(u16, 0x5a5b); 173 test_illegal(u32, 0x5a5b5c5d); 174 #ifdef TEST_U64 175 test_illegal(u64, 0x5a5b5c5d6a6b6c6d); 176 #endif 177 #undef test_illegal 178 179 vm_munmap(user_addr, PAGE_SIZE * 2); 180 kfree(kmem); 181 182 if (ret == 0) { 183 pr_info("tests passed.\n"); 184 return 0; 185 } 186 187 return -EINVAL; 188 } 189 190 module_init(test_user_copy_init); 191 192 static void __exit test_user_copy_exit(void) 193 { 194 pr_info("unloaded.\n"); 195 } 196 197 module_exit(test_user_copy_exit); 198 199 MODULE_AUTHOR("Kees Cook <keescook@chromium.org>"); 200 MODULE_LICENSE("GPL"); 201