1 /* 2 * Kernel module for testing copy_to/from_user infrastructure. 3 * 4 * Copyright 2013 Google Inc. All Rights Reserved 5 * 6 * Authors: 7 * Kees Cook <keescook@chromium.org> 8 * 9 * This software is licensed under the terms of the GNU General Public 10 * License version 2, as published by the Free Software Foundation, and 11 * may be copied, distributed, and modified under those terms. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 */ 18 19 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 20 21 #include <linux/mman.h> 22 #include <linux/module.h> 23 #include <linux/sched.h> 24 #include <linux/slab.h> 25 #include <linux/uaccess.h> 26 #include <linux/vmalloc.h> 27 28 /* 29 * Several 32-bit architectures support 64-bit {get,put}_user() calls. 30 * As there doesn't appear to be anything that can safely determine 31 * their capability at compile-time, we just have to opt-out certain archs. 32 */ 33 #if BITS_PER_LONG == 64 || (!(defined(CONFIG_ARM) && !defined(MMU)) && \ 34 !defined(CONFIG_M68K) && \ 35 !defined(CONFIG_MICROBLAZE) && \ 36 !defined(CONFIG_NIOS2) && \ 37 !defined(CONFIG_PPC32) && \ 38 !defined(CONFIG_SUPERH)) 39 # define TEST_U64 40 #endif 41 42 #define test(condition, msg) \ 43 ({ \ 44 int cond = (condition); \ 45 if (cond) \ 46 pr_warn("%s\n", msg); \ 47 cond; \ 48 }) 49 50 static int __init test_user_copy_init(void) 51 { 52 int ret = 0; 53 char *kmem; 54 char __user *usermem; 55 char *bad_usermem; 56 unsigned long user_addr; 57 u8 val_u8; 58 u16 val_u16; 59 u32 val_u32; 60 #ifdef TEST_U64 61 u64 val_u64; 62 #endif 63 64 kmem = kmalloc(PAGE_SIZE * 2, GFP_KERNEL); 65 if (!kmem) 66 return -ENOMEM; 67 68 user_addr = vm_mmap(NULL, 0, PAGE_SIZE * 2, 69 PROT_READ | PROT_WRITE | PROT_EXEC, 70 MAP_ANONYMOUS | MAP_PRIVATE, 0); 71 if (user_addr >= (unsigned long)(TASK_SIZE)) { 72 pr_warn("Failed to allocate user memory\n"); 73 kfree(kmem); 74 return -ENOMEM; 75 } 76 77 usermem = (char __user *)user_addr; 78 bad_usermem = (char *)user_addr; 79 80 /* 81 * Legitimate usage: none of these copies should fail. 82 */ 83 memset(kmem, 0x3a, PAGE_SIZE * 2); 84 ret |= test(copy_to_user(usermem, kmem, PAGE_SIZE), 85 "legitimate copy_to_user failed"); 86 memset(kmem, 0x0, PAGE_SIZE); 87 ret |= test(copy_from_user(kmem, usermem, PAGE_SIZE), 88 "legitimate copy_from_user failed"); 89 ret |= test(memcmp(kmem, kmem + PAGE_SIZE, PAGE_SIZE), 90 "legitimate usercopy failed to copy data"); 91 92 #define test_legit(size, check) \ 93 do { \ 94 val_##size = check; \ 95 ret |= test(put_user(val_##size, (size __user *)usermem), \ 96 "legitimate put_user (" #size ") failed"); \ 97 val_##size = 0; \ 98 ret |= test(get_user(val_##size, (size __user *)usermem), \ 99 "legitimate get_user (" #size ") failed"); \ 100 ret |= test(val_##size != check, \ 101 "legitimate get_user (" #size ") failed to do copy"); \ 102 if (val_##size != check) { \ 103 pr_info("0x%llx != 0x%llx\n", \ 104 (unsigned long long)val_##size, \ 105 (unsigned long long)check); \ 106 } \ 107 } while (0) 108 109 test_legit(u8, 0x5a); 110 test_legit(u16, 0x5a5b); 111 test_legit(u32, 0x5a5b5c5d); 112 #ifdef TEST_U64 113 test_legit(u64, 0x5a5b5c5d6a6b6c6d); 114 #endif 115 #undef test_legit 116 117 /* 118 * Invalid usage: none of these copies should succeed. 119 */ 120 121 /* Prepare kernel memory with check values. */ 122 memset(kmem, 0x5a, PAGE_SIZE); 123 memset(kmem + PAGE_SIZE, 0, PAGE_SIZE); 124 125 /* Reject kernel-to-kernel copies through copy_from_user(). */ 126 ret |= test(!copy_from_user(kmem, (char __user *)(kmem + PAGE_SIZE), 127 PAGE_SIZE), 128 "illegal all-kernel copy_from_user passed"); 129 130 /* Destination half of buffer should have been zeroed. */ 131 ret |= test(memcmp(kmem + PAGE_SIZE, kmem, PAGE_SIZE), 132 "zeroing failure for illegal all-kernel copy_from_user"); 133 134 #if 0 135 /* 136 * When running with SMAP/PAN/etc, this will Oops the kernel 137 * due to the zeroing of userspace memory on failure. This needs 138 * to be tested in LKDTM instead, since this test module does not 139 * expect to explode. 140 */ 141 ret |= test(!copy_from_user(bad_usermem, (char __user *)kmem, 142 PAGE_SIZE), 143 "illegal reversed copy_from_user passed"); 144 #endif 145 ret |= test(!copy_to_user((char __user *)kmem, kmem + PAGE_SIZE, 146 PAGE_SIZE), 147 "illegal all-kernel copy_to_user passed"); 148 ret |= test(!copy_to_user((char __user *)kmem, bad_usermem, 149 PAGE_SIZE), 150 "illegal reversed copy_to_user passed"); 151 152 #define test_illegal(size, check) \ 153 do { \ 154 val_##size = (check); \ 155 ret |= test(!get_user(val_##size, (size __user *)kmem), \ 156 "illegal get_user (" #size ") passed"); \ 157 ret |= test(val_##size != (size)0, \ 158 "zeroing failure for illegal get_user (" #size ")"); \ 159 if (val_##size != (size)0) { \ 160 pr_info("0x%llx != 0\n", \ 161 (unsigned long long)val_##size); \ 162 } \ 163 ret |= test(!put_user(val_##size, (size __user *)kmem), \ 164 "illegal put_user (" #size ") passed"); \ 165 } while (0) 166 167 test_illegal(u8, 0x5a); 168 test_illegal(u16, 0x5a5b); 169 test_illegal(u32, 0x5a5b5c5d); 170 #ifdef TEST_U64 171 test_illegal(u64, 0x5a5b5c5d6a6b6c6d); 172 #endif 173 #undef test_illegal 174 175 vm_munmap(user_addr, PAGE_SIZE * 2); 176 kfree(kmem); 177 178 if (ret == 0) { 179 pr_info("tests passed.\n"); 180 return 0; 181 } 182 183 return -EINVAL; 184 } 185 186 module_init(test_user_copy_init); 187 188 static void __exit test_user_copy_exit(void) 189 { 190 pr_info("unloaded.\n"); 191 } 192 193 module_exit(test_user_copy_exit); 194 195 MODULE_AUTHOR("Kees Cook <keescook@chromium.org>"); 196 MODULE_LICENSE("GPL"); 197