1 /* 2 * Kernel module for testing copy_to/from_user infrastructure. 3 * 4 * Copyright 2013 Google Inc. All Rights Reserved 5 * 6 * Authors: 7 * Kees Cook <keescook@chromium.org> 8 * 9 * This software is licensed under the terms of the GNU General Public 10 * License version 2, as published by the Free Software Foundation, and 11 * may be copied, distributed, and modified under those terms. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 */ 18 19 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 20 21 #include <linux/mman.h> 22 #include <linux/module.h> 23 #include <linux/sched.h> 24 #include <linux/slab.h> 25 #include <linux/uaccess.h> 26 #include <linux/vmalloc.h> 27 28 /* 29 * Several 32-bit architectures support 64-bit {get,put}_user() calls. 30 * As there doesn't appear to be anything that can safely determine 31 * their capability at compile-time, we just have to opt-out certain archs. 32 */ 33 #if BITS_PER_LONG == 64 || (!(defined(CONFIG_ARM) && !defined(MMU)) && \ 34 !defined(CONFIG_BLACKFIN) && \ 35 !defined(CONFIG_M32R) && \ 36 !defined(CONFIG_M68K) && \ 37 !defined(CONFIG_MICROBLAZE) && \ 38 !defined(CONFIG_MN10300) && \ 39 !defined(CONFIG_NIOS2) && \ 40 !defined(CONFIG_PPC32) && \ 41 !defined(CONFIG_SUPERH)) 42 # define TEST_U64 43 #endif 44 45 #define test(condition, msg) \ 46 ({ \ 47 int cond = (condition); \ 48 if (cond) \ 49 pr_warn("%s\n", msg); \ 50 cond; \ 51 }) 52 53 static int __init test_user_copy_init(void) 54 { 55 int ret = 0; 56 char *kmem; 57 char __user *usermem; 58 char *bad_usermem; 59 unsigned long user_addr; 60 u8 val_u8; 61 u16 val_u16; 62 u32 val_u32; 63 #ifdef TEST_U64 64 u64 val_u64; 65 #endif 66 67 kmem = kmalloc(PAGE_SIZE * 2, GFP_KERNEL); 68 if (!kmem) 69 return -ENOMEM; 70 71 user_addr = vm_mmap(NULL, 0, PAGE_SIZE * 2, 72 PROT_READ | PROT_WRITE | PROT_EXEC, 73 MAP_ANONYMOUS | MAP_PRIVATE, 0); 74 if (user_addr >= (unsigned long)(TASK_SIZE)) { 75 pr_warn("Failed to allocate user memory\n"); 76 kfree(kmem); 77 return -ENOMEM; 78 } 79 80 usermem = (char __user *)user_addr; 81 bad_usermem = (char *)user_addr; 82 83 /* 84 * Legitimate usage: none of these copies should fail. 85 */ 86 memset(kmem, 0x3a, PAGE_SIZE * 2); 87 ret |= test(copy_to_user(usermem, kmem, PAGE_SIZE), 88 "legitimate copy_to_user failed"); 89 memset(kmem, 0x0, PAGE_SIZE); 90 ret |= test(copy_from_user(kmem, usermem, PAGE_SIZE), 91 "legitimate copy_from_user failed"); 92 ret |= test(memcmp(kmem, kmem + PAGE_SIZE, PAGE_SIZE), 93 "legitimate usercopy failed to copy data"); 94 95 #define test_legit(size, check) \ 96 do { \ 97 val_##size = check; \ 98 ret |= test(put_user(val_##size, (size __user *)usermem), \ 99 "legitimate put_user (" #size ") failed"); \ 100 val_##size = 0; \ 101 ret |= test(get_user(val_##size, (size __user *)usermem), \ 102 "legitimate get_user (" #size ") failed"); \ 103 ret |= test(val_##size != check, \ 104 "legitimate get_user (" #size ") failed to do copy"); \ 105 if (val_##size != check) { \ 106 pr_info("0x%llx != 0x%llx\n", \ 107 (unsigned long long)val_##size, \ 108 (unsigned long long)check); \ 109 } \ 110 } while (0) 111 112 test_legit(u8, 0x5a); 113 test_legit(u16, 0x5a5b); 114 test_legit(u32, 0x5a5b5c5d); 115 #ifdef TEST_U64 116 test_legit(u64, 0x5a5b5c5d6a6b6c6d); 117 #endif 118 #undef test_legit 119 120 /* 121 * Invalid usage: none of these copies should succeed. 122 */ 123 124 /* Prepare kernel memory with check values. */ 125 memset(kmem, 0x5a, PAGE_SIZE); 126 memset(kmem + PAGE_SIZE, 0, PAGE_SIZE); 127 128 /* Reject kernel-to-kernel copies through copy_from_user(). */ 129 ret |= test(!copy_from_user(kmem, (char __user *)(kmem + PAGE_SIZE), 130 PAGE_SIZE), 131 "illegal all-kernel copy_from_user passed"); 132 133 /* Destination half of buffer should have been zeroed. */ 134 ret |= test(memcmp(kmem + PAGE_SIZE, kmem, PAGE_SIZE), 135 "zeroing failure for illegal all-kernel copy_from_user"); 136 137 #if 0 138 /* 139 * When running with SMAP/PAN/etc, this will Oops the kernel 140 * due to the zeroing of userspace memory on failure. This needs 141 * to be tested in LKDTM instead, since this test module does not 142 * expect to explode. 143 */ 144 ret |= test(!copy_from_user(bad_usermem, (char __user *)kmem, 145 PAGE_SIZE), 146 "illegal reversed copy_from_user passed"); 147 #endif 148 ret |= test(!copy_to_user((char __user *)kmem, kmem + PAGE_SIZE, 149 PAGE_SIZE), 150 "illegal all-kernel copy_to_user passed"); 151 ret |= test(!copy_to_user((char __user *)kmem, bad_usermem, 152 PAGE_SIZE), 153 "illegal reversed copy_to_user passed"); 154 155 #define test_illegal(size, check) \ 156 do { \ 157 val_##size = (check); \ 158 ret |= test(!get_user(val_##size, (size __user *)kmem), \ 159 "illegal get_user (" #size ") passed"); \ 160 ret |= test(val_##size != (size)0, \ 161 "zeroing failure for illegal get_user (" #size ")"); \ 162 if (val_##size != (size)0) { \ 163 pr_info("0x%llx != 0\n", \ 164 (unsigned long long)val_##size); \ 165 } \ 166 ret |= test(!put_user(val_##size, (size __user *)kmem), \ 167 "illegal put_user (" #size ") passed"); \ 168 } while (0) 169 170 test_illegal(u8, 0x5a); 171 test_illegal(u16, 0x5a5b); 172 test_illegal(u32, 0x5a5b5c5d); 173 #ifdef TEST_U64 174 test_illegal(u64, 0x5a5b5c5d6a6b6c6d); 175 #endif 176 #undef test_illegal 177 178 vm_munmap(user_addr, PAGE_SIZE * 2); 179 kfree(kmem); 180 181 if (ret == 0) { 182 pr_info("tests passed.\n"); 183 return 0; 184 } 185 186 return -EINVAL; 187 } 188 189 module_init(test_user_copy_init); 190 191 static void __exit test_user_copy_exit(void) 192 { 193 pr_info("unloaded.\n"); 194 } 195 196 module_exit(test_user_copy_exit); 197 198 MODULE_AUTHOR("Kees Cook <keescook@chromium.org>"); 199 MODULE_LICENSE("GPL"); 200