1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * 4 * Copyright (c) 2014 Samsung Electronics Co., Ltd. 5 * Author: Andrey Ryabinin <a.ryabinin@samsung.com> 6 */ 7 8 #define pr_fmt(fmt) "kasan_test: " fmt 9 10 #include <kunit/test.h> 11 #include <linux/bitops.h> 12 #include <linux/delay.h> 13 #include <linux/io.h> 14 #include <linux/kasan.h> 15 #include <linux/kernel.h> 16 #include <linux/mm.h> 17 #include <linux/mman.h> 18 #include <linux/module.h> 19 #include <linux/printk.h> 20 #include <linux/random.h> 21 #include <linux/set_memory.h> 22 #include <linux/slab.h> 23 #include <linux/string.h> 24 #include <linux/tracepoint.h> 25 #include <linux/uaccess.h> 26 #include <linux/vmalloc.h> 27 #include <trace/events/printk.h> 28 29 #include <asm/page.h> 30 31 #include "kasan.h" 32 33 #define OOB_TAG_OFF (IS_ENABLED(CONFIG_KASAN_GENERIC) ? 0 : KASAN_GRANULE_SIZE) 34 35 static bool multishot; 36 37 /* Fields set based on lines observed in the console. */ 38 static struct { 39 bool report_found; 40 bool async_fault; 41 } test_status; 42 43 /* 44 * Some tests use these global variables to store return values from function 45 * calls that could otherwise be eliminated by the compiler as dead code. 46 */ 47 void *kasan_ptr_result; 48 int kasan_int_result; 49 50 /* Probe for console output: obtains test_status lines of interest. */ 51 static void probe_console(void *ignore, const char *buf, size_t len) 52 { 53 if (strnstr(buf, "BUG: KASAN: ", len)) 54 WRITE_ONCE(test_status.report_found, true); 55 else if (strnstr(buf, "Asynchronous fault: ", len)) 56 WRITE_ONCE(test_status.async_fault, true); 57 } 58 59 static void register_tracepoints(struct tracepoint *tp, void *ignore) 60 { 61 check_trace_callback_type_console(probe_console); 62 if (!strcmp(tp->name, "console")) 63 WARN_ON(tracepoint_probe_register(tp, probe_console, NULL)); 64 } 65 66 static void unregister_tracepoints(struct tracepoint *tp, void *ignore) 67 { 68 if (!strcmp(tp->name, "console")) 69 tracepoint_probe_unregister(tp, probe_console, NULL); 70 } 71 72 static int kasan_suite_init(struct kunit_suite *suite) 73 { 74 if (!kasan_enabled()) { 75 pr_err("Can't run KASAN tests with KASAN disabled"); 76 return -1; 77 } 78 79 /* Stop failing KUnit tests on KASAN reports. */ 80 kasan_kunit_test_suite_start(); 81 82 /* 83 * Temporarily enable multi-shot mode. Otherwise, KASAN would only 84 * report the first detected bug and panic the kernel if panic_on_warn 85 * is enabled. 86 */ 87 multishot = kasan_save_enable_multi_shot(); 88 89 /* 90 * Because we want to be able to build the test as a module, we need to 91 * iterate through all known tracepoints, since the static registration 92 * won't work here. 93 */ 94 for_each_kernel_tracepoint(register_tracepoints, NULL); 95 return 0; 96 } 97 98 static void kasan_suite_exit(struct kunit_suite *suite) 99 { 100 kasan_kunit_test_suite_end(); 101 kasan_restore_multi_shot(multishot); 102 for_each_kernel_tracepoint(unregister_tracepoints, NULL); 103 tracepoint_synchronize_unregister(); 104 } 105 106 static void kasan_test_exit(struct kunit *test) 107 { 108 KUNIT_EXPECT_FALSE(test, READ_ONCE(test_status.report_found)); 109 } 110 111 /** 112 * KUNIT_EXPECT_KASAN_FAIL() - check that the executed expression produces a 113 * KASAN report; causes a test failure otherwise. This relies on a KUnit 114 * resource named "kasan_status". Do not use this name for KUnit resources 115 * outside of KASAN tests. 116 * 117 * For hardware tag-based KASAN, when a synchronous tag fault happens, tag 118 * checking is auto-disabled. When this happens, this test handler reenables 119 * tag checking. As tag checking can be only disabled or enabled per CPU, 120 * this handler disables migration (preemption). 121 * 122 * Since the compiler doesn't see that the expression can change the test_status 123 * fields, it can reorder or optimize away the accesses to those fields. 124 * Use READ/WRITE_ONCE() for the accesses and compiler barriers around the 125 * expression to prevent that. 126 * 127 * In between KUNIT_EXPECT_KASAN_FAIL checks, test_status.report_found is kept 128 * as false. This allows detecting KASAN reports that happen outside of the 129 * checks by asserting !test_status.report_found at the start of 130 * KUNIT_EXPECT_KASAN_FAIL and in kasan_test_exit. 131 */ 132 #define KUNIT_EXPECT_KASAN_FAIL(test, expression) do { \ 133 if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) && \ 134 kasan_sync_fault_possible()) \ 135 migrate_disable(); \ 136 KUNIT_EXPECT_FALSE(test, READ_ONCE(test_status.report_found)); \ 137 barrier(); \ 138 expression; \ 139 barrier(); \ 140 if (kasan_async_fault_possible()) \ 141 kasan_force_async_fault(); \ 142 if (!READ_ONCE(test_status.report_found)) { \ 143 KUNIT_FAIL(test, KUNIT_SUBTEST_INDENT "KASAN failure " \ 144 "expected in \"" #expression \ 145 "\", but none occurred"); \ 146 } \ 147 if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) && \ 148 kasan_sync_fault_possible()) { \ 149 if (READ_ONCE(test_status.report_found) && \ 150 !READ_ONCE(test_status.async_fault)) \ 151 kasan_enable_tagging(); \ 152 migrate_enable(); \ 153 } \ 154 WRITE_ONCE(test_status.report_found, false); \ 155 WRITE_ONCE(test_status.async_fault, false); \ 156 } while (0) 157 158 #define KASAN_TEST_NEEDS_CONFIG_ON(test, config) do { \ 159 if (!IS_ENABLED(config)) \ 160 kunit_skip((test), "Test requires " #config "=y"); \ 161 } while (0) 162 163 #define KASAN_TEST_NEEDS_CONFIG_OFF(test, config) do { \ 164 if (IS_ENABLED(config)) \ 165 kunit_skip((test), "Test requires " #config "=n"); \ 166 } while (0) 167 168 static void kmalloc_oob_right(struct kunit *test) 169 { 170 char *ptr; 171 size_t size = 128 - KASAN_GRANULE_SIZE - 5; 172 173 ptr = kmalloc(size, GFP_KERNEL); 174 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 175 176 OPTIMIZER_HIDE_VAR(ptr); 177 /* 178 * An unaligned access past the requested kmalloc size. 179 * Only generic KASAN can precisely detect these. 180 */ 181 if (IS_ENABLED(CONFIG_KASAN_GENERIC)) 182 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 'x'); 183 184 /* 185 * An aligned access into the first out-of-bounds granule that falls 186 * within the aligned kmalloc object. 187 */ 188 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size + 5] = 'y'); 189 190 /* Out-of-bounds access past the aligned kmalloc object. */ 191 KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = 192 ptr[size + KASAN_GRANULE_SIZE + 5]); 193 194 kfree(ptr); 195 } 196 197 static void kmalloc_oob_left(struct kunit *test) 198 { 199 char *ptr; 200 size_t size = 15; 201 202 ptr = kmalloc(size, GFP_KERNEL); 203 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 204 205 OPTIMIZER_HIDE_VAR(ptr); 206 KUNIT_EXPECT_KASAN_FAIL(test, *ptr = *(ptr - 1)); 207 kfree(ptr); 208 } 209 210 static void kmalloc_node_oob_right(struct kunit *test) 211 { 212 char *ptr; 213 size_t size = 4096; 214 215 ptr = kmalloc_node(size, GFP_KERNEL, 0); 216 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 217 218 OPTIMIZER_HIDE_VAR(ptr); 219 KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = ptr[size]); 220 kfree(ptr); 221 } 222 223 /* 224 * These kmalloc_pagealloc_* tests try allocating a memory chunk that doesn't 225 * fit into a slab cache and therefore is allocated via the page allocator 226 * fallback. Since this kind of fallback is only implemented for SLUB, these 227 * tests are limited to that allocator. 228 */ 229 static void kmalloc_pagealloc_oob_right(struct kunit *test) 230 { 231 char *ptr; 232 size_t size = KMALLOC_MAX_CACHE_SIZE + 10; 233 234 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB); 235 236 ptr = kmalloc(size, GFP_KERNEL); 237 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 238 239 OPTIMIZER_HIDE_VAR(ptr); 240 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size + OOB_TAG_OFF] = 0); 241 242 kfree(ptr); 243 } 244 245 static void kmalloc_pagealloc_uaf(struct kunit *test) 246 { 247 char *ptr; 248 size_t size = KMALLOC_MAX_CACHE_SIZE + 10; 249 250 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB); 251 252 ptr = kmalloc(size, GFP_KERNEL); 253 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 254 kfree(ptr); 255 256 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]); 257 } 258 259 static void kmalloc_pagealloc_invalid_free(struct kunit *test) 260 { 261 char *ptr; 262 size_t size = KMALLOC_MAX_CACHE_SIZE + 10; 263 264 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB); 265 266 ptr = kmalloc(size, GFP_KERNEL); 267 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 268 269 KUNIT_EXPECT_KASAN_FAIL(test, kfree(ptr + 1)); 270 } 271 272 static void pagealloc_oob_right(struct kunit *test) 273 { 274 char *ptr; 275 struct page *pages; 276 size_t order = 4; 277 size_t size = (1UL << (PAGE_SHIFT + order)); 278 279 /* 280 * With generic KASAN page allocations have no redzones, thus 281 * out-of-bounds detection is not guaranteed. 282 * See https://bugzilla.kernel.org/show_bug.cgi?id=210503. 283 */ 284 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); 285 286 pages = alloc_pages(GFP_KERNEL, order); 287 ptr = page_address(pages); 288 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 289 290 KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = ptr[size]); 291 free_pages((unsigned long)ptr, order); 292 } 293 294 static void pagealloc_uaf(struct kunit *test) 295 { 296 char *ptr; 297 struct page *pages; 298 size_t order = 4; 299 300 pages = alloc_pages(GFP_KERNEL, order); 301 ptr = page_address(pages); 302 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 303 free_pages((unsigned long)ptr, order); 304 305 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]); 306 } 307 308 static void kmalloc_large_oob_right(struct kunit *test) 309 { 310 char *ptr; 311 size_t size = KMALLOC_MAX_CACHE_SIZE - 256; 312 313 /* 314 * Allocate a chunk that is large enough, but still fits into a slab 315 * and does not trigger the page allocator fallback in SLUB. 316 */ 317 ptr = kmalloc(size, GFP_KERNEL); 318 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 319 320 OPTIMIZER_HIDE_VAR(ptr); 321 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0); 322 kfree(ptr); 323 } 324 325 static void krealloc_more_oob_helper(struct kunit *test, 326 size_t size1, size_t size2) 327 { 328 char *ptr1, *ptr2; 329 size_t middle; 330 331 KUNIT_ASSERT_LT(test, size1, size2); 332 middle = size1 + (size2 - size1) / 2; 333 334 ptr1 = kmalloc(size1, GFP_KERNEL); 335 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); 336 337 ptr2 = krealloc(ptr1, size2, GFP_KERNEL); 338 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); 339 340 /* Suppress -Warray-bounds warnings. */ 341 OPTIMIZER_HIDE_VAR(ptr2); 342 343 /* All offsets up to size2 must be accessible. */ 344 ptr2[size1 - 1] = 'x'; 345 ptr2[size1] = 'x'; 346 ptr2[middle] = 'x'; 347 ptr2[size2 - 1] = 'x'; 348 349 /* Generic mode is precise, so unaligned size2 must be inaccessible. */ 350 if (IS_ENABLED(CONFIG_KASAN_GENERIC)) 351 KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size2] = 'x'); 352 353 /* For all modes first aligned offset after size2 must be inaccessible. */ 354 KUNIT_EXPECT_KASAN_FAIL(test, 355 ptr2[round_up(size2, KASAN_GRANULE_SIZE)] = 'x'); 356 357 kfree(ptr2); 358 } 359 360 static void krealloc_less_oob_helper(struct kunit *test, 361 size_t size1, size_t size2) 362 { 363 char *ptr1, *ptr2; 364 size_t middle; 365 366 KUNIT_ASSERT_LT(test, size2, size1); 367 middle = size2 + (size1 - size2) / 2; 368 369 ptr1 = kmalloc(size1, GFP_KERNEL); 370 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); 371 372 ptr2 = krealloc(ptr1, size2, GFP_KERNEL); 373 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); 374 375 /* Suppress -Warray-bounds warnings. */ 376 OPTIMIZER_HIDE_VAR(ptr2); 377 378 /* Must be accessible for all modes. */ 379 ptr2[size2 - 1] = 'x'; 380 381 /* Generic mode is precise, so unaligned size2 must be inaccessible. */ 382 if (IS_ENABLED(CONFIG_KASAN_GENERIC)) 383 KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size2] = 'x'); 384 385 /* For all modes first aligned offset after size2 must be inaccessible. */ 386 KUNIT_EXPECT_KASAN_FAIL(test, 387 ptr2[round_up(size2, KASAN_GRANULE_SIZE)] = 'x'); 388 389 /* 390 * For all modes all size2, middle, and size1 should land in separate 391 * granules and thus the latter two offsets should be inaccessible. 392 */ 393 KUNIT_EXPECT_LE(test, round_up(size2, KASAN_GRANULE_SIZE), 394 round_down(middle, KASAN_GRANULE_SIZE)); 395 KUNIT_EXPECT_LE(test, round_up(middle, KASAN_GRANULE_SIZE), 396 round_down(size1, KASAN_GRANULE_SIZE)); 397 KUNIT_EXPECT_KASAN_FAIL(test, ptr2[middle] = 'x'); 398 KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size1 - 1] = 'x'); 399 KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size1] = 'x'); 400 401 kfree(ptr2); 402 } 403 404 static void krealloc_more_oob(struct kunit *test) 405 { 406 krealloc_more_oob_helper(test, 201, 235); 407 } 408 409 static void krealloc_less_oob(struct kunit *test) 410 { 411 krealloc_less_oob_helper(test, 235, 201); 412 } 413 414 static void krealloc_pagealloc_more_oob(struct kunit *test) 415 { 416 /* page_alloc fallback in only implemented for SLUB. */ 417 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB); 418 419 krealloc_more_oob_helper(test, KMALLOC_MAX_CACHE_SIZE + 201, 420 KMALLOC_MAX_CACHE_SIZE + 235); 421 } 422 423 static void krealloc_pagealloc_less_oob(struct kunit *test) 424 { 425 /* page_alloc fallback in only implemented for SLUB. */ 426 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB); 427 428 krealloc_less_oob_helper(test, KMALLOC_MAX_CACHE_SIZE + 235, 429 KMALLOC_MAX_CACHE_SIZE + 201); 430 } 431 432 /* 433 * Check that krealloc() detects a use-after-free, returns NULL, 434 * and doesn't unpoison the freed object. 435 */ 436 static void krealloc_uaf(struct kunit *test) 437 { 438 char *ptr1, *ptr2; 439 int size1 = 201; 440 int size2 = 235; 441 442 ptr1 = kmalloc(size1, GFP_KERNEL); 443 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); 444 kfree(ptr1); 445 446 KUNIT_EXPECT_KASAN_FAIL(test, ptr2 = krealloc(ptr1, size2, GFP_KERNEL)); 447 KUNIT_ASSERT_NULL(test, ptr2); 448 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)ptr1); 449 } 450 451 static void kmalloc_oob_16(struct kunit *test) 452 { 453 struct { 454 u64 words[2]; 455 } *ptr1, *ptr2; 456 457 /* This test is specifically crafted for the generic mode. */ 458 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); 459 460 ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL); 461 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); 462 463 ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL); 464 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); 465 466 OPTIMIZER_HIDE_VAR(ptr1); 467 OPTIMIZER_HIDE_VAR(ptr2); 468 KUNIT_EXPECT_KASAN_FAIL(test, *ptr1 = *ptr2); 469 kfree(ptr1); 470 kfree(ptr2); 471 } 472 473 static void kmalloc_uaf_16(struct kunit *test) 474 { 475 struct { 476 u64 words[2]; 477 } *ptr1, *ptr2; 478 479 ptr1 = kmalloc(sizeof(*ptr1), GFP_KERNEL); 480 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); 481 482 ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL); 483 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); 484 kfree(ptr2); 485 486 KUNIT_EXPECT_KASAN_FAIL(test, *ptr1 = *ptr2); 487 kfree(ptr1); 488 } 489 490 /* 491 * Note: in the memset tests below, the written range touches both valid and 492 * invalid memory. This makes sure that the instrumentation does not only check 493 * the starting address but the whole range. 494 */ 495 496 static void kmalloc_oob_memset_2(struct kunit *test) 497 { 498 char *ptr; 499 size_t size = 128 - KASAN_GRANULE_SIZE; 500 501 ptr = kmalloc(size, GFP_KERNEL); 502 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 503 504 OPTIMIZER_HIDE_VAR(size); 505 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 1, 0, 2)); 506 kfree(ptr); 507 } 508 509 static void kmalloc_oob_memset_4(struct kunit *test) 510 { 511 char *ptr; 512 size_t size = 128 - KASAN_GRANULE_SIZE; 513 514 ptr = kmalloc(size, GFP_KERNEL); 515 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 516 517 OPTIMIZER_HIDE_VAR(size); 518 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 3, 0, 4)); 519 kfree(ptr); 520 } 521 522 static void kmalloc_oob_memset_8(struct kunit *test) 523 { 524 char *ptr; 525 size_t size = 128 - KASAN_GRANULE_SIZE; 526 527 ptr = kmalloc(size, GFP_KERNEL); 528 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 529 530 OPTIMIZER_HIDE_VAR(size); 531 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 7, 0, 8)); 532 kfree(ptr); 533 } 534 535 static void kmalloc_oob_memset_16(struct kunit *test) 536 { 537 char *ptr; 538 size_t size = 128 - KASAN_GRANULE_SIZE; 539 540 ptr = kmalloc(size, GFP_KERNEL); 541 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 542 543 OPTIMIZER_HIDE_VAR(size); 544 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 15, 0, 16)); 545 kfree(ptr); 546 } 547 548 static void kmalloc_oob_in_memset(struct kunit *test) 549 { 550 char *ptr; 551 size_t size = 128 - KASAN_GRANULE_SIZE; 552 553 ptr = kmalloc(size, GFP_KERNEL); 554 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 555 556 OPTIMIZER_HIDE_VAR(ptr); 557 OPTIMIZER_HIDE_VAR(size); 558 KUNIT_EXPECT_KASAN_FAIL(test, 559 memset(ptr, 0, size + KASAN_GRANULE_SIZE)); 560 kfree(ptr); 561 } 562 563 static void kmalloc_memmove_negative_size(struct kunit *test) 564 { 565 char *ptr; 566 size_t size = 64; 567 size_t invalid_size = -2; 568 569 /* 570 * Hardware tag-based mode doesn't check memmove for negative size. 571 * As a result, this test introduces a side-effect memory corruption, 572 * which can result in a crash. 573 */ 574 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_HW_TAGS); 575 576 ptr = kmalloc(size, GFP_KERNEL); 577 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 578 579 memset((char *)ptr, 0, 64); 580 OPTIMIZER_HIDE_VAR(ptr); 581 OPTIMIZER_HIDE_VAR(invalid_size); 582 KUNIT_EXPECT_KASAN_FAIL(test, 583 memmove((char *)ptr, (char *)ptr + 4, invalid_size)); 584 kfree(ptr); 585 } 586 587 static void kmalloc_memmove_invalid_size(struct kunit *test) 588 { 589 char *ptr; 590 size_t size = 64; 591 size_t invalid_size = size; 592 593 ptr = kmalloc(size, GFP_KERNEL); 594 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 595 596 memset((char *)ptr, 0, 64); 597 OPTIMIZER_HIDE_VAR(ptr); 598 OPTIMIZER_HIDE_VAR(invalid_size); 599 KUNIT_EXPECT_KASAN_FAIL(test, 600 memmove((char *)ptr, (char *)ptr + 4, invalid_size)); 601 kfree(ptr); 602 } 603 604 static void kmalloc_uaf(struct kunit *test) 605 { 606 char *ptr; 607 size_t size = 10; 608 609 ptr = kmalloc(size, GFP_KERNEL); 610 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 611 612 kfree(ptr); 613 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[8]); 614 } 615 616 static void kmalloc_uaf_memset(struct kunit *test) 617 { 618 char *ptr; 619 size_t size = 33; 620 621 /* 622 * Only generic KASAN uses quarantine, which is required to avoid a 623 * kernel memory corruption this test causes. 624 */ 625 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); 626 627 ptr = kmalloc(size, GFP_KERNEL); 628 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 629 630 kfree(ptr); 631 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr, 0, size)); 632 } 633 634 static void kmalloc_uaf2(struct kunit *test) 635 { 636 char *ptr1, *ptr2; 637 size_t size = 43; 638 int counter = 0; 639 640 again: 641 ptr1 = kmalloc(size, GFP_KERNEL); 642 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); 643 644 kfree(ptr1); 645 646 ptr2 = kmalloc(size, GFP_KERNEL); 647 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); 648 649 /* 650 * For tag-based KASAN ptr1 and ptr2 tags might happen to be the same. 651 * Allow up to 16 attempts at generating different tags. 652 */ 653 if (!IS_ENABLED(CONFIG_KASAN_GENERIC) && ptr1 == ptr2 && counter++ < 16) { 654 kfree(ptr2); 655 goto again; 656 } 657 658 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr1)[40]); 659 KUNIT_EXPECT_PTR_NE(test, ptr1, ptr2); 660 661 kfree(ptr2); 662 } 663 664 /* 665 * Check that KASAN detects use-after-free when another object was allocated in 666 * the same slot. Relevant for the tag-based modes, which do not use quarantine. 667 */ 668 static void kmalloc_uaf3(struct kunit *test) 669 { 670 char *ptr1, *ptr2; 671 size_t size = 100; 672 673 /* This test is specifically crafted for tag-based modes. */ 674 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); 675 676 ptr1 = kmalloc(size, GFP_KERNEL); 677 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); 678 kfree(ptr1); 679 680 ptr2 = kmalloc(size, GFP_KERNEL); 681 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); 682 kfree(ptr2); 683 684 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr1)[8]); 685 } 686 687 static void kfree_via_page(struct kunit *test) 688 { 689 char *ptr; 690 size_t size = 8; 691 struct page *page; 692 unsigned long offset; 693 694 ptr = kmalloc(size, GFP_KERNEL); 695 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 696 697 page = virt_to_page(ptr); 698 offset = offset_in_page(ptr); 699 kfree(page_address(page) + offset); 700 } 701 702 static void kfree_via_phys(struct kunit *test) 703 { 704 char *ptr; 705 size_t size = 8; 706 phys_addr_t phys; 707 708 ptr = kmalloc(size, GFP_KERNEL); 709 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 710 711 phys = virt_to_phys(ptr); 712 kfree(phys_to_virt(phys)); 713 } 714 715 static void kmem_cache_oob(struct kunit *test) 716 { 717 char *p; 718 size_t size = 200; 719 struct kmem_cache *cache; 720 721 cache = kmem_cache_create("test_cache", size, 0, 0, NULL); 722 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); 723 724 p = kmem_cache_alloc(cache, GFP_KERNEL); 725 if (!p) { 726 kunit_err(test, "Allocation failed: %s\n", __func__); 727 kmem_cache_destroy(cache); 728 return; 729 } 730 731 KUNIT_EXPECT_KASAN_FAIL(test, *p = p[size + OOB_TAG_OFF]); 732 733 kmem_cache_free(cache, p); 734 kmem_cache_destroy(cache); 735 } 736 737 static void kmem_cache_accounted(struct kunit *test) 738 { 739 int i; 740 char *p; 741 size_t size = 200; 742 struct kmem_cache *cache; 743 744 cache = kmem_cache_create("test_cache", size, 0, SLAB_ACCOUNT, NULL); 745 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); 746 747 /* 748 * Several allocations with a delay to allow for lazy per memcg kmem 749 * cache creation. 750 */ 751 for (i = 0; i < 5; i++) { 752 p = kmem_cache_alloc(cache, GFP_KERNEL); 753 if (!p) 754 goto free_cache; 755 756 kmem_cache_free(cache, p); 757 msleep(100); 758 } 759 760 free_cache: 761 kmem_cache_destroy(cache); 762 } 763 764 static void kmem_cache_bulk(struct kunit *test) 765 { 766 struct kmem_cache *cache; 767 size_t size = 200; 768 char *p[10]; 769 bool ret; 770 int i; 771 772 cache = kmem_cache_create("test_cache", size, 0, 0, NULL); 773 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); 774 775 ret = kmem_cache_alloc_bulk(cache, GFP_KERNEL, ARRAY_SIZE(p), (void **)&p); 776 if (!ret) { 777 kunit_err(test, "Allocation failed: %s\n", __func__); 778 kmem_cache_destroy(cache); 779 return; 780 } 781 782 for (i = 0; i < ARRAY_SIZE(p); i++) 783 p[i][0] = p[i][size - 1] = 42; 784 785 kmem_cache_free_bulk(cache, ARRAY_SIZE(p), (void **)&p); 786 kmem_cache_destroy(cache); 787 } 788 789 static char global_array[10]; 790 791 static void kasan_global_oob_right(struct kunit *test) 792 { 793 /* 794 * Deliberate out-of-bounds access. To prevent CONFIG_UBSAN_LOCAL_BOUNDS 795 * from failing here and panicking the kernel, access the array via a 796 * volatile pointer, which will prevent the compiler from being able to 797 * determine the array bounds. 798 * 799 * This access uses a volatile pointer to char (char *volatile) rather 800 * than the more conventional pointer to volatile char (volatile char *) 801 * because we want to prevent the compiler from making inferences about 802 * the pointer itself (i.e. its array bounds), not the data that it 803 * refers to. 804 */ 805 char *volatile array = global_array; 806 char *p = &array[ARRAY_SIZE(global_array) + 3]; 807 808 /* Only generic mode instruments globals. */ 809 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); 810 811 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); 812 } 813 814 static void kasan_global_oob_left(struct kunit *test) 815 { 816 char *volatile array = global_array; 817 char *p = array - 3; 818 819 /* 820 * GCC is known to fail this test, skip it. 821 * See https://bugzilla.kernel.org/show_bug.cgi?id=215051. 822 */ 823 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_CC_IS_CLANG); 824 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); 825 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); 826 } 827 828 /* Check that ksize() makes the whole object accessible. */ 829 static void ksize_unpoisons_memory(struct kunit *test) 830 { 831 char *ptr; 832 size_t size = 123, real_size; 833 834 ptr = kmalloc(size, GFP_KERNEL); 835 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 836 real_size = ksize(ptr); 837 838 OPTIMIZER_HIDE_VAR(ptr); 839 840 /* This access shouldn't trigger a KASAN report. */ 841 ptr[size] = 'x'; 842 843 /* This one must. */ 844 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[real_size]); 845 846 kfree(ptr); 847 } 848 849 /* 850 * Check that a use-after-free is detected by ksize() and via normal accesses 851 * after it. 852 */ 853 static void ksize_uaf(struct kunit *test) 854 { 855 char *ptr; 856 int size = 128 - KASAN_GRANULE_SIZE; 857 858 ptr = kmalloc(size, GFP_KERNEL); 859 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 860 kfree(ptr); 861 862 OPTIMIZER_HIDE_VAR(ptr); 863 KUNIT_EXPECT_KASAN_FAIL(test, ksize(ptr)); 864 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]); 865 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size]); 866 } 867 868 static void kasan_stack_oob(struct kunit *test) 869 { 870 char stack_array[10]; 871 /* See comment in kasan_global_oob_right. */ 872 char *volatile array = stack_array; 873 char *p = &array[ARRAY_SIZE(stack_array) + OOB_TAG_OFF]; 874 875 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_STACK); 876 877 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); 878 } 879 880 static void kasan_alloca_oob_left(struct kunit *test) 881 { 882 volatile int i = 10; 883 char alloca_array[i]; 884 /* See comment in kasan_global_oob_right. */ 885 char *volatile array = alloca_array; 886 char *p = array - 1; 887 888 /* Only generic mode instruments dynamic allocas. */ 889 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); 890 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_STACK); 891 892 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); 893 } 894 895 static void kasan_alloca_oob_right(struct kunit *test) 896 { 897 volatile int i = 10; 898 char alloca_array[i]; 899 /* See comment in kasan_global_oob_right. */ 900 char *volatile array = alloca_array; 901 char *p = array + i; 902 903 /* Only generic mode instruments dynamic allocas. */ 904 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); 905 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_STACK); 906 907 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); 908 } 909 910 static void kmem_cache_double_free(struct kunit *test) 911 { 912 char *p; 913 size_t size = 200; 914 struct kmem_cache *cache; 915 916 cache = kmem_cache_create("test_cache", size, 0, 0, NULL); 917 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); 918 919 p = kmem_cache_alloc(cache, GFP_KERNEL); 920 if (!p) { 921 kunit_err(test, "Allocation failed: %s\n", __func__); 922 kmem_cache_destroy(cache); 923 return; 924 } 925 926 kmem_cache_free(cache, p); 927 KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p)); 928 kmem_cache_destroy(cache); 929 } 930 931 static void kmem_cache_invalid_free(struct kunit *test) 932 { 933 char *p; 934 size_t size = 200; 935 struct kmem_cache *cache; 936 937 cache = kmem_cache_create("test_cache", size, 0, SLAB_TYPESAFE_BY_RCU, 938 NULL); 939 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); 940 941 p = kmem_cache_alloc(cache, GFP_KERNEL); 942 if (!p) { 943 kunit_err(test, "Allocation failed: %s\n", __func__); 944 kmem_cache_destroy(cache); 945 return; 946 } 947 948 /* Trigger invalid free, the object doesn't get freed. */ 949 KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p + 1)); 950 951 /* 952 * Properly free the object to prevent the "Objects remaining in 953 * test_cache on __kmem_cache_shutdown" BUG failure. 954 */ 955 kmem_cache_free(cache, p); 956 957 kmem_cache_destroy(cache); 958 } 959 960 static void empty_cache_ctor(void *object) { } 961 962 static void kmem_cache_double_destroy(struct kunit *test) 963 { 964 struct kmem_cache *cache; 965 966 /* Provide a constructor to prevent cache merging. */ 967 cache = kmem_cache_create("test_cache", 200, 0, 0, empty_cache_ctor); 968 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); 969 kmem_cache_destroy(cache); 970 KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_destroy(cache)); 971 } 972 973 static void kasan_memchr(struct kunit *test) 974 { 975 char *ptr; 976 size_t size = 24; 977 978 /* 979 * str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT. 980 * See https://bugzilla.kernel.org/show_bug.cgi?id=206337 for details. 981 */ 982 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_AMD_MEM_ENCRYPT); 983 984 if (OOB_TAG_OFF) 985 size = round_up(size, OOB_TAG_OFF); 986 987 ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO); 988 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 989 990 OPTIMIZER_HIDE_VAR(ptr); 991 OPTIMIZER_HIDE_VAR(size); 992 KUNIT_EXPECT_KASAN_FAIL(test, 993 kasan_ptr_result = memchr(ptr, '1', size + 1)); 994 995 kfree(ptr); 996 } 997 998 static void kasan_memcmp(struct kunit *test) 999 { 1000 char *ptr; 1001 size_t size = 24; 1002 int arr[9]; 1003 1004 /* 1005 * str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT. 1006 * See https://bugzilla.kernel.org/show_bug.cgi?id=206337 for details. 1007 */ 1008 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_AMD_MEM_ENCRYPT); 1009 1010 if (OOB_TAG_OFF) 1011 size = round_up(size, OOB_TAG_OFF); 1012 1013 ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO); 1014 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 1015 memset(arr, 0, sizeof(arr)); 1016 1017 OPTIMIZER_HIDE_VAR(ptr); 1018 OPTIMIZER_HIDE_VAR(size); 1019 KUNIT_EXPECT_KASAN_FAIL(test, 1020 kasan_int_result = memcmp(ptr, arr, size+1)); 1021 kfree(ptr); 1022 } 1023 1024 static void kasan_strings(struct kunit *test) 1025 { 1026 char *ptr; 1027 size_t size = 24; 1028 1029 /* 1030 * str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT. 1031 * See https://bugzilla.kernel.org/show_bug.cgi?id=206337 for details. 1032 */ 1033 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_AMD_MEM_ENCRYPT); 1034 1035 ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO); 1036 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 1037 1038 kfree(ptr); 1039 1040 /* 1041 * Try to cause only 1 invalid access (less spam in dmesg). 1042 * For that we need ptr to point to zeroed byte. 1043 * Skip metadata that could be stored in freed object so ptr 1044 * will likely point to zeroed byte. 1045 */ 1046 ptr += 16; 1047 KUNIT_EXPECT_KASAN_FAIL(test, kasan_ptr_result = strchr(ptr, '1')); 1048 1049 KUNIT_EXPECT_KASAN_FAIL(test, kasan_ptr_result = strrchr(ptr, '1')); 1050 1051 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strcmp(ptr, "2")); 1052 1053 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strncmp(ptr, "2", 1)); 1054 1055 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strlen(ptr)); 1056 1057 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strnlen(ptr, 1)); 1058 } 1059 1060 static void kasan_bitops_modify(struct kunit *test, int nr, void *addr) 1061 { 1062 KUNIT_EXPECT_KASAN_FAIL(test, set_bit(nr, addr)); 1063 KUNIT_EXPECT_KASAN_FAIL(test, __set_bit(nr, addr)); 1064 KUNIT_EXPECT_KASAN_FAIL(test, clear_bit(nr, addr)); 1065 KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit(nr, addr)); 1066 KUNIT_EXPECT_KASAN_FAIL(test, clear_bit_unlock(nr, addr)); 1067 KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit_unlock(nr, addr)); 1068 KUNIT_EXPECT_KASAN_FAIL(test, change_bit(nr, addr)); 1069 KUNIT_EXPECT_KASAN_FAIL(test, __change_bit(nr, addr)); 1070 } 1071 1072 static void kasan_bitops_test_and_modify(struct kunit *test, int nr, void *addr) 1073 { 1074 KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit(nr, addr)); 1075 KUNIT_EXPECT_KASAN_FAIL(test, __test_and_set_bit(nr, addr)); 1076 KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit_lock(nr, addr)); 1077 KUNIT_EXPECT_KASAN_FAIL(test, test_and_clear_bit(nr, addr)); 1078 KUNIT_EXPECT_KASAN_FAIL(test, __test_and_clear_bit(nr, addr)); 1079 KUNIT_EXPECT_KASAN_FAIL(test, test_and_change_bit(nr, addr)); 1080 KUNIT_EXPECT_KASAN_FAIL(test, __test_and_change_bit(nr, addr)); 1081 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = test_bit(nr, addr)); 1082 1083 #if defined(clear_bit_unlock_is_negative_byte) 1084 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = 1085 clear_bit_unlock_is_negative_byte(nr, addr)); 1086 #endif 1087 } 1088 1089 static void kasan_bitops_generic(struct kunit *test) 1090 { 1091 long *bits; 1092 1093 /* This test is specifically crafted for the generic mode. */ 1094 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); 1095 1096 /* 1097 * Allocate 1 more byte, which causes kzalloc to round up to 16 bytes; 1098 * this way we do not actually corrupt other memory. 1099 */ 1100 bits = kzalloc(sizeof(*bits) + 1, GFP_KERNEL); 1101 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits); 1102 1103 /* 1104 * Below calls try to access bit within allocated memory; however, the 1105 * below accesses are still out-of-bounds, since bitops are defined to 1106 * operate on the whole long the bit is in. 1107 */ 1108 kasan_bitops_modify(test, BITS_PER_LONG, bits); 1109 1110 /* 1111 * Below calls try to access bit beyond allocated memory. 1112 */ 1113 kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, bits); 1114 1115 kfree(bits); 1116 } 1117 1118 static void kasan_bitops_tags(struct kunit *test) 1119 { 1120 long *bits; 1121 1122 /* This test is specifically crafted for tag-based modes. */ 1123 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); 1124 1125 /* kmalloc-64 cache will be used and the last 16 bytes will be the redzone. */ 1126 bits = kzalloc(48, GFP_KERNEL); 1127 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits); 1128 1129 /* Do the accesses past the 48 allocated bytes, but within the redone. */ 1130 kasan_bitops_modify(test, BITS_PER_LONG, (void *)bits + 48); 1131 kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, (void *)bits + 48); 1132 1133 kfree(bits); 1134 } 1135 1136 static void kmalloc_double_kzfree(struct kunit *test) 1137 { 1138 char *ptr; 1139 size_t size = 16; 1140 1141 ptr = kmalloc(size, GFP_KERNEL); 1142 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 1143 1144 kfree_sensitive(ptr); 1145 KUNIT_EXPECT_KASAN_FAIL(test, kfree_sensitive(ptr)); 1146 } 1147 1148 /* 1149 * The two tests below check that Generic KASAN prints auxiliary stack traces 1150 * for RCU callbacks and workqueues. The reports need to be inspected manually. 1151 * 1152 * These tests are still enabled for other KASAN modes to make sure that all 1153 * modes report bad accesses in tested scenarios. 1154 */ 1155 1156 static struct kasan_rcu_info { 1157 int i; 1158 struct rcu_head rcu; 1159 } *global_rcu_ptr; 1160 1161 static void rcu_uaf_reclaim(struct rcu_head *rp) 1162 { 1163 struct kasan_rcu_info *fp = 1164 container_of(rp, struct kasan_rcu_info, rcu); 1165 1166 kfree(fp); 1167 ((volatile struct kasan_rcu_info *)fp)->i; 1168 } 1169 1170 static void rcu_uaf(struct kunit *test) 1171 { 1172 struct kasan_rcu_info *ptr; 1173 1174 ptr = kmalloc(sizeof(struct kasan_rcu_info), GFP_KERNEL); 1175 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 1176 1177 global_rcu_ptr = rcu_dereference_protected( 1178 (struct kasan_rcu_info __rcu *)ptr, NULL); 1179 1180 KUNIT_EXPECT_KASAN_FAIL(test, 1181 call_rcu(&global_rcu_ptr->rcu, rcu_uaf_reclaim); 1182 rcu_barrier()); 1183 } 1184 1185 static void workqueue_uaf_work(struct work_struct *work) 1186 { 1187 kfree(work); 1188 } 1189 1190 static void workqueue_uaf(struct kunit *test) 1191 { 1192 struct workqueue_struct *workqueue; 1193 struct work_struct *work; 1194 1195 workqueue = create_workqueue("kasan_workqueue_test"); 1196 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, workqueue); 1197 1198 work = kmalloc(sizeof(struct work_struct), GFP_KERNEL); 1199 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, work); 1200 1201 INIT_WORK(work, workqueue_uaf_work); 1202 queue_work(workqueue, work); 1203 destroy_workqueue(workqueue); 1204 1205 KUNIT_EXPECT_KASAN_FAIL(test, 1206 ((volatile struct work_struct *)work)->data); 1207 } 1208 1209 static void vmalloc_helpers_tags(struct kunit *test) 1210 { 1211 void *ptr; 1212 1213 /* This test is intended for tag-based modes. */ 1214 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); 1215 1216 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_VMALLOC); 1217 1218 ptr = vmalloc(PAGE_SIZE); 1219 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 1220 1221 /* Check that the returned pointer is tagged. */ 1222 KUNIT_EXPECT_GE(test, (u8)get_tag(ptr), (u8)KASAN_TAG_MIN); 1223 KUNIT_EXPECT_LT(test, (u8)get_tag(ptr), (u8)KASAN_TAG_KERNEL); 1224 1225 /* Make sure exported vmalloc helpers handle tagged pointers. */ 1226 KUNIT_ASSERT_TRUE(test, is_vmalloc_addr(ptr)); 1227 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, vmalloc_to_page(ptr)); 1228 1229 #if !IS_MODULE(CONFIG_KASAN_KUNIT_TEST) 1230 { 1231 int rv; 1232 1233 /* Make sure vmalloc'ed memory permissions can be changed. */ 1234 rv = set_memory_ro((unsigned long)ptr, 1); 1235 KUNIT_ASSERT_GE(test, rv, 0); 1236 rv = set_memory_rw((unsigned long)ptr, 1); 1237 KUNIT_ASSERT_GE(test, rv, 0); 1238 } 1239 #endif 1240 1241 vfree(ptr); 1242 } 1243 1244 static void vmalloc_oob(struct kunit *test) 1245 { 1246 char *v_ptr, *p_ptr; 1247 struct page *page; 1248 size_t size = PAGE_SIZE / 2 - KASAN_GRANULE_SIZE - 5; 1249 1250 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_VMALLOC); 1251 1252 v_ptr = vmalloc(size); 1253 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, v_ptr); 1254 1255 OPTIMIZER_HIDE_VAR(v_ptr); 1256 1257 /* 1258 * We have to be careful not to hit the guard page in vmalloc tests. 1259 * The MMU will catch that and crash us. 1260 */ 1261 1262 /* Make sure in-bounds accesses are valid. */ 1263 v_ptr[0] = 0; 1264 v_ptr[size - 1] = 0; 1265 1266 /* 1267 * An unaligned access past the requested vmalloc size. 1268 * Only generic KASAN can precisely detect these. 1269 */ 1270 if (IS_ENABLED(CONFIG_KASAN_GENERIC)) 1271 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)v_ptr)[size]); 1272 1273 /* An aligned access into the first out-of-bounds granule. */ 1274 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)v_ptr)[size + 5]); 1275 1276 /* Check that in-bounds accesses to the physical page are valid. */ 1277 page = vmalloc_to_page(v_ptr); 1278 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, page); 1279 p_ptr = page_address(page); 1280 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, p_ptr); 1281 p_ptr[0] = 0; 1282 1283 vfree(v_ptr); 1284 1285 /* 1286 * We can't check for use-after-unmap bugs in this nor in the following 1287 * vmalloc tests, as the page might be fully unmapped and accessing it 1288 * will crash the kernel. 1289 */ 1290 } 1291 1292 static void vmap_tags(struct kunit *test) 1293 { 1294 char *p_ptr, *v_ptr; 1295 struct page *p_page, *v_page; 1296 1297 /* 1298 * This test is specifically crafted for the software tag-based mode, 1299 * the only tag-based mode that poisons vmap mappings. 1300 */ 1301 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_SW_TAGS); 1302 1303 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_VMALLOC); 1304 1305 p_page = alloc_pages(GFP_KERNEL, 1); 1306 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, p_page); 1307 p_ptr = page_address(p_page); 1308 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, p_ptr); 1309 1310 v_ptr = vmap(&p_page, 1, VM_MAP, PAGE_KERNEL); 1311 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, v_ptr); 1312 1313 /* 1314 * We can't check for out-of-bounds bugs in this nor in the following 1315 * vmalloc tests, as allocations have page granularity and accessing 1316 * the guard page will crash the kernel. 1317 */ 1318 1319 KUNIT_EXPECT_GE(test, (u8)get_tag(v_ptr), (u8)KASAN_TAG_MIN); 1320 KUNIT_EXPECT_LT(test, (u8)get_tag(v_ptr), (u8)KASAN_TAG_KERNEL); 1321 1322 /* Make sure that in-bounds accesses through both pointers work. */ 1323 *p_ptr = 0; 1324 *v_ptr = 0; 1325 1326 /* Make sure vmalloc_to_page() correctly recovers the page pointer. */ 1327 v_page = vmalloc_to_page(v_ptr); 1328 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, v_page); 1329 KUNIT_EXPECT_PTR_EQ(test, p_page, v_page); 1330 1331 vunmap(v_ptr); 1332 free_pages((unsigned long)p_ptr, 1); 1333 } 1334 1335 static void vm_map_ram_tags(struct kunit *test) 1336 { 1337 char *p_ptr, *v_ptr; 1338 struct page *page; 1339 1340 /* 1341 * This test is specifically crafted for the software tag-based mode, 1342 * the only tag-based mode that poisons vm_map_ram mappings. 1343 */ 1344 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_SW_TAGS); 1345 1346 page = alloc_pages(GFP_KERNEL, 1); 1347 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, page); 1348 p_ptr = page_address(page); 1349 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, p_ptr); 1350 1351 v_ptr = vm_map_ram(&page, 1, -1); 1352 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, v_ptr); 1353 1354 KUNIT_EXPECT_GE(test, (u8)get_tag(v_ptr), (u8)KASAN_TAG_MIN); 1355 KUNIT_EXPECT_LT(test, (u8)get_tag(v_ptr), (u8)KASAN_TAG_KERNEL); 1356 1357 /* Make sure that in-bounds accesses through both pointers work. */ 1358 *p_ptr = 0; 1359 *v_ptr = 0; 1360 1361 vm_unmap_ram(v_ptr, 1); 1362 free_pages((unsigned long)p_ptr, 1); 1363 } 1364 1365 static void vmalloc_percpu(struct kunit *test) 1366 { 1367 char __percpu *ptr; 1368 int cpu; 1369 1370 /* 1371 * This test is specifically crafted for the software tag-based mode, 1372 * the only tag-based mode that poisons percpu mappings. 1373 */ 1374 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_SW_TAGS); 1375 1376 ptr = __alloc_percpu(PAGE_SIZE, PAGE_SIZE); 1377 1378 for_each_possible_cpu(cpu) { 1379 char *c_ptr = per_cpu_ptr(ptr, cpu); 1380 1381 KUNIT_EXPECT_GE(test, (u8)get_tag(c_ptr), (u8)KASAN_TAG_MIN); 1382 KUNIT_EXPECT_LT(test, (u8)get_tag(c_ptr), (u8)KASAN_TAG_KERNEL); 1383 1384 /* Make sure that in-bounds accesses don't crash the kernel. */ 1385 *c_ptr = 0; 1386 } 1387 1388 free_percpu(ptr); 1389 } 1390 1391 /* 1392 * Check that the assigned pointer tag falls within the [KASAN_TAG_MIN, 1393 * KASAN_TAG_KERNEL) range (note: excluding the match-all tag) for tag-based 1394 * modes. 1395 */ 1396 static void match_all_not_assigned(struct kunit *test) 1397 { 1398 char *ptr; 1399 struct page *pages; 1400 int i, size, order; 1401 1402 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); 1403 1404 for (i = 0; i < 256; i++) { 1405 size = prandom_u32_max(1024) + 1; 1406 ptr = kmalloc(size, GFP_KERNEL); 1407 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 1408 KUNIT_EXPECT_GE(test, (u8)get_tag(ptr), (u8)KASAN_TAG_MIN); 1409 KUNIT_EXPECT_LT(test, (u8)get_tag(ptr), (u8)KASAN_TAG_KERNEL); 1410 kfree(ptr); 1411 } 1412 1413 for (i = 0; i < 256; i++) { 1414 order = prandom_u32_max(4) + 1; 1415 pages = alloc_pages(GFP_KERNEL, order); 1416 ptr = page_address(pages); 1417 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 1418 KUNIT_EXPECT_GE(test, (u8)get_tag(ptr), (u8)KASAN_TAG_MIN); 1419 KUNIT_EXPECT_LT(test, (u8)get_tag(ptr), (u8)KASAN_TAG_KERNEL); 1420 free_pages((unsigned long)ptr, order); 1421 } 1422 1423 if (!IS_ENABLED(CONFIG_KASAN_VMALLOC)) 1424 return; 1425 1426 for (i = 0; i < 256; i++) { 1427 size = prandom_u32_max(1024) + 1; 1428 ptr = vmalloc(size); 1429 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 1430 KUNIT_EXPECT_GE(test, (u8)get_tag(ptr), (u8)KASAN_TAG_MIN); 1431 KUNIT_EXPECT_LT(test, (u8)get_tag(ptr), (u8)KASAN_TAG_KERNEL); 1432 vfree(ptr); 1433 } 1434 } 1435 1436 /* Check that 0xff works as a match-all pointer tag for tag-based modes. */ 1437 static void match_all_ptr_tag(struct kunit *test) 1438 { 1439 char *ptr; 1440 u8 tag; 1441 1442 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); 1443 1444 ptr = kmalloc(128, GFP_KERNEL); 1445 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 1446 1447 /* Backup the assigned tag. */ 1448 tag = get_tag(ptr); 1449 KUNIT_EXPECT_NE(test, tag, (u8)KASAN_TAG_KERNEL); 1450 1451 /* Reset the tag to 0xff.*/ 1452 ptr = set_tag(ptr, KASAN_TAG_KERNEL); 1453 1454 /* This access shouldn't trigger a KASAN report. */ 1455 *ptr = 0; 1456 1457 /* Recover the pointer tag and free. */ 1458 ptr = set_tag(ptr, tag); 1459 kfree(ptr); 1460 } 1461 1462 /* Check that there are no match-all memory tags for tag-based modes. */ 1463 static void match_all_mem_tag(struct kunit *test) 1464 { 1465 char *ptr; 1466 int tag; 1467 1468 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); 1469 1470 ptr = kmalloc(128, GFP_KERNEL); 1471 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 1472 KUNIT_EXPECT_NE(test, (u8)get_tag(ptr), (u8)KASAN_TAG_KERNEL); 1473 1474 /* For each possible tag value not matching the pointer tag. */ 1475 for (tag = KASAN_TAG_MIN; tag <= KASAN_TAG_KERNEL; tag++) { 1476 if (tag == get_tag(ptr)) 1477 continue; 1478 1479 /* Mark the first memory granule with the chosen memory tag. */ 1480 kasan_poison(ptr, KASAN_GRANULE_SIZE, (u8)tag, false); 1481 1482 /* This access must cause a KASAN report. */ 1483 KUNIT_EXPECT_KASAN_FAIL(test, *ptr = 0); 1484 } 1485 1486 /* Recover the memory tag and free. */ 1487 kasan_poison(ptr, KASAN_GRANULE_SIZE, get_tag(ptr), false); 1488 kfree(ptr); 1489 } 1490 1491 static struct kunit_case kasan_kunit_test_cases[] = { 1492 KUNIT_CASE(kmalloc_oob_right), 1493 KUNIT_CASE(kmalloc_oob_left), 1494 KUNIT_CASE(kmalloc_node_oob_right), 1495 KUNIT_CASE(kmalloc_pagealloc_oob_right), 1496 KUNIT_CASE(kmalloc_pagealloc_uaf), 1497 KUNIT_CASE(kmalloc_pagealloc_invalid_free), 1498 KUNIT_CASE(pagealloc_oob_right), 1499 KUNIT_CASE(pagealloc_uaf), 1500 KUNIT_CASE(kmalloc_large_oob_right), 1501 KUNIT_CASE(krealloc_more_oob), 1502 KUNIT_CASE(krealloc_less_oob), 1503 KUNIT_CASE(krealloc_pagealloc_more_oob), 1504 KUNIT_CASE(krealloc_pagealloc_less_oob), 1505 KUNIT_CASE(krealloc_uaf), 1506 KUNIT_CASE(kmalloc_oob_16), 1507 KUNIT_CASE(kmalloc_uaf_16), 1508 KUNIT_CASE(kmalloc_oob_in_memset), 1509 KUNIT_CASE(kmalloc_oob_memset_2), 1510 KUNIT_CASE(kmalloc_oob_memset_4), 1511 KUNIT_CASE(kmalloc_oob_memset_8), 1512 KUNIT_CASE(kmalloc_oob_memset_16), 1513 KUNIT_CASE(kmalloc_memmove_negative_size), 1514 KUNIT_CASE(kmalloc_memmove_invalid_size), 1515 KUNIT_CASE(kmalloc_uaf), 1516 KUNIT_CASE(kmalloc_uaf_memset), 1517 KUNIT_CASE(kmalloc_uaf2), 1518 KUNIT_CASE(kmalloc_uaf3), 1519 KUNIT_CASE(kfree_via_page), 1520 KUNIT_CASE(kfree_via_phys), 1521 KUNIT_CASE(kmem_cache_oob), 1522 KUNIT_CASE(kmem_cache_accounted), 1523 KUNIT_CASE(kmem_cache_bulk), 1524 KUNIT_CASE(kasan_global_oob_right), 1525 KUNIT_CASE(kasan_global_oob_left), 1526 KUNIT_CASE(kasan_stack_oob), 1527 KUNIT_CASE(kasan_alloca_oob_left), 1528 KUNIT_CASE(kasan_alloca_oob_right), 1529 KUNIT_CASE(ksize_unpoisons_memory), 1530 KUNIT_CASE(ksize_uaf), 1531 KUNIT_CASE(kmem_cache_double_free), 1532 KUNIT_CASE(kmem_cache_invalid_free), 1533 KUNIT_CASE(kmem_cache_double_destroy), 1534 KUNIT_CASE(kasan_memchr), 1535 KUNIT_CASE(kasan_memcmp), 1536 KUNIT_CASE(kasan_strings), 1537 KUNIT_CASE(kasan_bitops_generic), 1538 KUNIT_CASE(kasan_bitops_tags), 1539 KUNIT_CASE(kmalloc_double_kzfree), 1540 KUNIT_CASE(rcu_uaf), 1541 KUNIT_CASE(workqueue_uaf), 1542 KUNIT_CASE(vmalloc_helpers_tags), 1543 KUNIT_CASE(vmalloc_oob), 1544 KUNIT_CASE(vmap_tags), 1545 KUNIT_CASE(vm_map_ram_tags), 1546 KUNIT_CASE(vmalloc_percpu), 1547 KUNIT_CASE(match_all_not_assigned), 1548 KUNIT_CASE(match_all_ptr_tag), 1549 KUNIT_CASE(match_all_mem_tag), 1550 {} 1551 }; 1552 1553 static struct kunit_suite kasan_kunit_test_suite = { 1554 .name = "kasan", 1555 .test_cases = kasan_kunit_test_cases, 1556 .exit = kasan_test_exit, 1557 .suite_init = kasan_suite_init, 1558 .suite_exit = kasan_suite_exit, 1559 }; 1560 1561 kunit_test_suite(kasan_kunit_test_suite); 1562 1563 MODULE_LICENSE("GPL"); 1564