1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Kernel module for testing copy_to/from_user infrastructure. 4 * 5 * Copyright 2013 Google Inc. All Rights Reserved 6 * 7 * Authors: 8 * Kees Cook <keescook@chromium.org> 9 */ 10 11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 12 13 #include <linux/mman.h> 14 #include <linux/module.h> 15 #include <linux/sched.h> 16 #include <linux/slab.h> 17 #include <linux/uaccess.h> 18 #include <linux/vmalloc.h> 19 20 /* 21 * Several 32-bit architectures support 64-bit {get,put}_user() calls. 22 * As there doesn't appear to be anything that can safely determine 23 * their capability at compile-time, we just have to opt-out certain archs. 24 */ 25 #if BITS_PER_LONG == 64 || (!(defined(CONFIG_ARM) && !defined(MMU)) && \ 26 !defined(CONFIG_M68K) && \ 27 !defined(CONFIG_MICROBLAZE) && \ 28 !defined(CONFIG_NIOS2) && \ 29 !defined(CONFIG_PPC32) && \ 30 !defined(CONFIG_SUPERH)) 31 # define TEST_U64 32 #endif 33 34 #define test(condition, msg) \ 35 ({ \ 36 int cond = (condition); \ 37 if (cond) \ 38 pr_warn("%s\n", msg); \ 39 cond; \ 40 }) 41 42 static int __init test_user_copy_init(void) 43 { 44 int ret = 0; 45 char *kmem; 46 char __user *usermem; 47 char *bad_usermem; 48 unsigned long user_addr; 49 u8 val_u8; 50 u16 val_u16; 51 u32 val_u32; 52 #ifdef TEST_U64 53 u64 val_u64; 54 #endif 55 56 kmem = kmalloc(PAGE_SIZE * 2, GFP_KERNEL); 57 if (!kmem) 58 return -ENOMEM; 59 60 user_addr = vm_mmap(NULL, 0, PAGE_SIZE * 2, 61 PROT_READ | PROT_WRITE | PROT_EXEC, 62 MAP_ANONYMOUS | MAP_PRIVATE, 0); 63 if (user_addr >= (unsigned long)(TASK_SIZE)) { 64 pr_warn("Failed to allocate user memory\n"); 65 kfree(kmem); 66 return -ENOMEM; 67 } 68 69 usermem = (char __user *)user_addr; 70 bad_usermem = (char *)user_addr; 71 72 /* 73 * Legitimate usage: none of these copies should fail. 74 */ 75 memset(kmem, 0x3a, PAGE_SIZE * 2); 76 ret |= test(copy_to_user(usermem, kmem, PAGE_SIZE), 77 "legitimate copy_to_user failed"); 78 memset(kmem, 0x0, PAGE_SIZE); 79 ret |= test(copy_from_user(kmem, usermem, PAGE_SIZE), 80 "legitimate copy_from_user failed"); 81 ret |= test(memcmp(kmem, kmem + PAGE_SIZE, PAGE_SIZE), 82 "legitimate usercopy failed to copy data"); 83 84 #define test_legit(size, check) \ 85 do { \ 86 val_##size = check; \ 87 ret |= test(put_user(val_##size, (size __user *)usermem), \ 88 "legitimate put_user (" #size ") failed"); \ 89 val_##size = 0; \ 90 ret |= test(get_user(val_##size, (size __user *)usermem), \ 91 "legitimate get_user (" #size ") failed"); \ 92 ret |= test(val_##size != check, \ 93 "legitimate get_user (" #size ") failed to do copy"); \ 94 if (val_##size != check) { \ 95 pr_info("0x%llx != 0x%llx\n", \ 96 (unsigned long long)val_##size, \ 97 (unsigned long long)check); \ 98 } \ 99 } while (0) 100 101 test_legit(u8, 0x5a); 102 test_legit(u16, 0x5a5b); 103 test_legit(u32, 0x5a5b5c5d); 104 #ifdef TEST_U64 105 test_legit(u64, 0x5a5b5c5d6a6b6c6d); 106 #endif 107 #undef test_legit 108 109 /* 110 * Invalid usage: none of these copies should succeed. 111 */ 112 113 /* Prepare kernel memory with check values. */ 114 memset(kmem, 0x5a, PAGE_SIZE); 115 memset(kmem + PAGE_SIZE, 0, PAGE_SIZE); 116 117 /* Reject kernel-to-kernel copies through copy_from_user(). */ 118 ret |= test(!copy_from_user(kmem, (char __user *)(kmem + PAGE_SIZE), 119 PAGE_SIZE), 120 "illegal all-kernel copy_from_user passed"); 121 122 /* Destination half of buffer should have been zeroed. */ 123 ret |= test(memcmp(kmem + PAGE_SIZE, kmem, PAGE_SIZE), 124 "zeroing failure for illegal all-kernel copy_from_user"); 125 126 #if 0 127 /* 128 * When running with SMAP/PAN/etc, this will Oops the kernel 129 * due to the zeroing of userspace memory on failure. This needs 130 * to be tested in LKDTM instead, since this test module does not 131 * expect to explode. 132 */ 133 ret |= test(!copy_from_user(bad_usermem, (char __user *)kmem, 134 PAGE_SIZE), 135 "illegal reversed copy_from_user passed"); 136 #endif 137 ret |= test(!copy_to_user((char __user *)kmem, kmem + PAGE_SIZE, 138 PAGE_SIZE), 139 "illegal all-kernel copy_to_user passed"); 140 ret |= test(!copy_to_user((char __user *)kmem, bad_usermem, 141 PAGE_SIZE), 142 "illegal reversed copy_to_user passed"); 143 144 #define test_illegal(size, check) \ 145 do { \ 146 val_##size = (check); \ 147 ret |= test(!get_user(val_##size, (size __user *)kmem), \ 148 "illegal get_user (" #size ") passed"); \ 149 ret |= test(val_##size != (size)0, \ 150 "zeroing failure for illegal get_user (" #size ")"); \ 151 if (val_##size != (size)0) { \ 152 pr_info("0x%llx != 0\n", \ 153 (unsigned long long)val_##size); \ 154 } \ 155 ret |= test(!put_user(val_##size, (size __user *)kmem), \ 156 "illegal put_user (" #size ") passed"); \ 157 } while (0) 158 159 test_illegal(u8, 0x5a); 160 test_illegal(u16, 0x5a5b); 161 test_illegal(u32, 0x5a5b5c5d); 162 #ifdef TEST_U64 163 test_illegal(u64, 0x5a5b5c5d6a6b6c6d); 164 #endif 165 #undef test_illegal 166 167 vm_munmap(user_addr, PAGE_SIZE * 2); 168 kfree(kmem); 169 170 if (ret == 0) { 171 pr_info("tests passed.\n"); 172 return 0; 173 } 174 175 return -EINVAL; 176 } 177 178 module_init(test_user_copy_init); 179 180 static void __exit test_user_copy_exit(void) 181 { 182 pr_info("unloaded.\n"); 183 } 184 185 module_exit(test_user_copy_exit); 186 187 MODULE_AUTHOR("Kees Cook <keescook@chromium.org>"); 188 MODULE_LICENSE("GPL"); 189