1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * 4 * Copyright (c) 2014 Samsung Electronics Co., Ltd. 5 * Author: Andrey Ryabinin <a.ryabinin@samsung.com> 6 */ 7 8 #define pr_fmt(fmt) "kasan_test: " fmt 9 10 #include <kunit/test.h> 11 #include <linux/bitops.h> 12 #include <linux/delay.h> 13 #include <linux/io.h> 14 #include <linux/kasan.h> 15 #include <linux/kernel.h> 16 #include <linux/mm.h> 17 #include <linux/mman.h> 18 #include <linux/module.h> 19 #include <linux/printk.h> 20 #include <linux/random.h> 21 #include <linux/set_memory.h> 22 #include <linux/slab.h> 23 #include <linux/string.h> 24 #include <linux/tracepoint.h> 25 #include <linux/uaccess.h> 26 #include <linux/vmalloc.h> 27 #include <trace/events/printk.h> 28 29 #include <asm/page.h> 30 31 #include "kasan.h" 32 33 #define OOB_TAG_OFF (IS_ENABLED(CONFIG_KASAN_GENERIC) ? 0 : KASAN_GRANULE_SIZE) 34 35 static bool multishot; 36 37 /* Fields set based on lines observed in the console. */ 38 static struct { 39 bool report_found; 40 bool async_fault; 41 } test_status; 42 43 /* 44 * Some tests use these global variables to store return values from function 45 * calls that could otherwise be eliminated by the compiler as dead code. 46 */ 47 void *kasan_ptr_result; 48 int kasan_int_result; 49 50 /* Probe for console output: obtains test_status lines of interest. */ 51 static void probe_console(void *ignore, const char *buf, size_t len) 52 { 53 if (strnstr(buf, "BUG: KASAN: ", len)) 54 WRITE_ONCE(test_status.report_found, true); 55 else if (strnstr(buf, "Asynchronous fault: ", len)) 56 WRITE_ONCE(test_status.async_fault, true); 57 } 58 59 static void register_tracepoints(struct tracepoint *tp, void *ignore) 60 { 61 check_trace_callback_type_console(probe_console); 62 if (!strcmp(tp->name, "console")) 63 WARN_ON(tracepoint_probe_register(tp, probe_console, NULL)); 64 } 65 66 static void unregister_tracepoints(struct tracepoint *tp, void *ignore) 67 { 68 if (!strcmp(tp->name, "console")) 69 tracepoint_probe_unregister(tp, probe_console, NULL); 70 } 71 72 static int kasan_suite_init(struct kunit_suite *suite) 73 { 74 if (!kasan_enabled()) { 75 pr_err("Can't run KASAN tests with KASAN disabled"); 76 return -1; 77 } 78 79 /* Stop failing KUnit tests on KASAN reports. */ 80 kasan_kunit_test_suite_start(); 81 82 /* 83 * Temporarily enable multi-shot mode. Otherwise, KASAN would only 84 * report the first detected bug and panic the kernel if panic_on_warn 85 * is enabled. 86 */ 87 multishot = kasan_save_enable_multi_shot(); 88 89 /* 90 * Because we want to be able to build the test as a module, we need to 91 * iterate through all known tracepoints, since the static registration 92 * won't work here. 93 */ 94 for_each_kernel_tracepoint(register_tracepoints, NULL); 95 return 0; 96 } 97 98 static void kasan_suite_exit(struct kunit_suite *suite) 99 { 100 kasan_kunit_test_suite_end(); 101 kasan_restore_multi_shot(multishot); 102 for_each_kernel_tracepoint(unregister_tracepoints, NULL); 103 tracepoint_synchronize_unregister(); 104 } 105 106 static void kasan_test_exit(struct kunit *test) 107 { 108 KUNIT_EXPECT_FALSE(test, READ_ONCE(test_status.report_found)); 109 } 110 111 /** 112 * KUNIT_EXPECT_KASAN_FAIL() - check that the executed expression produces a 113 * KASAN report; causes a test failure otherwise. This relies on a KUnit 114 * resource named "kasan_status". Do not use this name for KUnit resources 115 * outside of KASAN tests. 116 * 117 * For hardware tag-based KASAN, when a synchronous tag fault happens, tag 118 * checking is auto-disabled. When this happens, this test handler reenables 119 * tag checking. As tag checking can be only disabled or enabled per CPU, 120 * this handler disables migration (preemption). 121 * 122 * Since the compiler doesn't see that the expression can change the test_status 123 * fields, it can reorder or optimize away the accesses to those fields. 124 * Use READ/WRITE_ONCE() for the accesses and compiler barriers around the 125 * expression to prevent that. 126 * 127 * In between KUNIT_EXPECT_KASAN_FAIL checks, test_status.report_found is kept 128 * as false. This allows detecting KASAN reports that happen outside of the 129 * checks by asserting !test_status.report_found at the start of 130 * KUNIT_EXPECT_KASAN_FAIL and in kasan_test_exit. 131 */ 132 #define KUNIT_EXPECT_KASAN_FAIL(test, expression) do { \ 133 if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) && \ 134 kasan_sync_fault_possible()) \ 135 migrate_disable(); \ 136 KUNIT_EXPECT_FALSE(test, READ_ONCE(test_status.report_found)); \ 137 barrier(); \ 138 expression; \ 139 barrier(); \ 140 if (kasan_async_fault_possible()) \ 141 kasan_force_async_fault(); \ 142 if (!READ_ONCE(test_status.report_found)) { \ 143 KUNIT_FAIL(test, KUNIT_SUBTEST_INDENT "KASAN failure " \ 144 "expected in \"" #expression \ 145 "\", but none occurred"); \ 146 } \ 147 if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) && \ 148 kasan_sync_fault_possible()) { \ 149 if (READ_ONCE(test_status.report_found) && \ 150 !READ_ONCE(test_status.async_fault)) \ 151 kasan_enable_tagging(); \ 152 migrate_enable(); \ 153 } \ 154 WRITE_ONCE(test_status.report_found, false); \ 155 WRITE_ONCE(test_status.async_fault, false); \ 156 } while (0) 157 158 #define KASAN_TEST_NEEDS_CONFIG_ON(test, config) do { \ 159 if (!IS_ENABLED(config)) \ 160 kunit_skip((test), "Test requires " #config "=y"); \ 161 } while (0) 162 163 #define KASAN_TEST_NEEDS_CONFIG_OFF(test, config) do { \ 164 if (IS_ENABLED(config)) \ 165 kunit_skip((test), "Test requires " #config "=n"); \ 166 } while (0) 167 168 static void kmalloc_oob_right(struct kunit *test) 169 { 170 char *ptr; 171 size_t size = 128 - KASAN_GRANULE_SIZE - 5; 172 173 ptr = kmalloc(size, GFP_KERNEL); 174 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 175 176 OPTIMIZER_HIDE_VAR(ptr); 177 /* 178 * An unaligned access past the requested kmalloc size. 179 * Only generic KASAN can precisely detect these. 180 */ 181 if (IS_ENABLED(CONFIG_KASAN_GENERIC)) 182 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 'x'); 183 184 /* 185 * An aligned access into the first out-of-bounds granule that falls 186 * within the aligned kmalloc object. 187 */ 188 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size + 5] = 'y'); 189 190 /* Out-of-bounds access past the aligned kmalloc object. */ 191 KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = 192 ptr[size + KASAN_GRANULE_SIZE + 5]); 193 194 kfree(ptr); 195 } 196 197 static void kmalloc_oob_left(struct kunit *test) 198 { 199 char *ptr; 200 size_t size = 15; 201 202 ptr = kmalloc(size, GFP_KERNEL); 203 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 204 205 OPTIMIZER_HIDE_VAR(ptr); 206 KUNIT_EXPECT_KASAN_FAIL(test, *ptr = *(ptr - 1)); 207 kfree(ptr); 208 } 209 210 static void kmalloc_node_oob_right(struct kunit *test) 211 { 212 char *ptr; 213 size_t size = 4096; 214 215 ptr = kmalloc_node(size, GFP_KERNEL, 0); 216 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 217 218 OPTIMIZER_HIDE_VAR(ptr); 219 KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = ptr[size]); 220 kfree(ptr); 221 } 222 223 /* 224 * These kmalloc_pagealloc_* tests try allocating a memory chunk that doesn't 225 * fit into a slab cache and therefore is allocated via the page allocator 226 * fallback. Since this kind of fallback is only implemented for SLUB, these 227 * tests are limited to that allocator. 228 */ 229 static void kmalloc_pagealloc_oob_right(struct kunit *test) 230 { 231 char *ptr; 232 size_t size = KMALLOC_MAX_CACHE_SIZE + 10; 233 234 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB); 235 236 ptr = kmalloc(size, GFP_KERNEL); 237 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 238 239 OPTIMIZER_HIDE_VAR(ptr); 240 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size + OOB_TAG_OFF] = 0); 241 242 kfree(ptr); 243 } 244 245 static void kmalloc_pagealloc_uaf(struct kunit *test) 246 { 247 char *ptr; 248 size_t size = KMALLOC_MAX_CACHE_SIZE + 10; 249 250 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB); 251 252 ptr = kmalloc(size, GFP_KERNEL); 253 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 254 kfree(ptr); 255 256 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]); 257 } 258 259 static void kmalloc_pagealloc_invalid_free(struct kunit *test) 260 { 261 char *ptr; 262 size_t size = KMALLOC_MAX_CACHE_SIZE + 10; 263 264 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB); 265 266 ptr = kmalloc(size, GFP_KERNEL); 267 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 268 269 KUNIT_EXPECT_KASAN_FAIL(test, kfree(ptr + 1)); 270 } 271 272 static void pagealloc_oob_right(struct kunit *test) 273 { 274 char *ptr; 275 struct page *pages; 276 size_t order = 4; 277 size_t size = (1UL << (PAGE_SHIFT + order)); 278 279 /* 280 * With generic KASAN page allocations have no redzones, thus 281 * out-of-bounds detection is not guaranteed. 282 * See https://bugzilla.kernel.org/show_bug.cgi?id=210503. 283 */ 284 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); 285 286 pages = alloc_pages(GFP_KERNEL, order); 287 ptr = page_address(pages); 288 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 289 290 KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = ptr[size]); 291 free_pages((unsigned long)ptr, order); 292 } 293 294 static void pagealloc_uaf(struct kunit *test) 295 { 296 char *ptr; 297 struct page *pages; 298 size_t order = 4; 299 300 pages = alloc_pages(GFP_KERNEL, order); 301 ptr = page_address(pages); 302 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 303 free_pages((unsigned long)ptr, order); 304 305 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]); 306 } 307 308 static void kmalloc_large_oob_right(struct kunit *test) 309 { 310 char *ptr; 311 size_t size = KMALLOC_MAX_CACHE_SIZE - 256; 312 313 /* 314 * Allocate a chunk that is large enough, but still fits into a slab 315 * and does not trigger the page allocator fallback in SLUB. 316 */ 317 ptr = kmalloc(size, GFP_KERNEL); 318 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 319 320 OPTIMIZER_HIDE_VAR(ptr); 321 KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0); 322 kfree(ptr); 323 } 324 325 static void krealloc_more_oob_helper(struct kunit *test, 326 size_t size1, size_t size2) 327 { 328 char *ptr1, *ptr2; 329 size_t middle; 330 331 KUNIT_ASSERT_LT(test, size1, size2); 332 middle = size1 + (size2 - size1) / 2; 333 334 ptr1 = kmalloc(size1, GFP_KERNEL); 335 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); 336 337 ptr2 = krealloc(ptr1, size2, GFP_KERNEL); 338 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); 339 340 /* Suppress -Warray-bounds warnings. */ 341 OPTIMIZER_HIDE_VAR(ptr2); 342 343 /* All offsets up to size2 must be accessible. */ 344 ptr2[size1 - 1] = 'x'; 345 ptr2[size1] = 'x'; 346 ptr2[middle] = 'x'; 347 ptr2[size2 - 1] = 'x'; 348 349 /* Generic mode is precise, so unaligned size2 must be inaccessible. */ 350 if (IS_ENABLED(CONFIG_KASAN_GENERIC)) 351 KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size2] = 'x'); 352 353 /* For all modes first aligned offset after size2 must be inaccessible. */ 354 KUNIT_EXPECT_KASAN_FAIL(test, 355 ptr2[round_up(size2, KASAN_GRANULE_SIZE)] = 'x'); 356 357 kfree(ptr2); 358 } 359 360 static void krealloc_less_oob_helper(struct kunit *test, 361 size_t size1, size_t size2) 362 { 363 char *ptr1, *ptr2; 364 size_t middle; 365 366 KUNIT_ASSERT_LT(test, size2, size1); 367 middle = size2 + (size1 - size2) / 2; 368 369 ptr1 = kmalloc(size1, GFP_KERNEL); 370 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); 371 372 ptr2 = krealloc(ptr1, size2, GFP_KERNEL); 373 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); 374 375 /* Suppress -Warray-bounds warnings. */ 376 OPTIMIZER_HIDE_VAR(ptr2); 377 378 /* Must be accessible for all modes. */ 379 ptr2[size2 - 1] = 'x'; 380 381 /* Generic mode is precise, so unaligned size2 must be inaccessible. */ 382 if (IS_ENABLED(CONFIG_KASAN_GENERIC)) 383 KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size2] = 'x'); 384 385 /* For all modes first aligned offset after size2 must be inaccessible. */ 386 KUNIT_EXPECT_KASAN_FAIL(test, 387 ptr2[round_up(size2, KASAN_GRANULE_SIZE)] = 'x'); 388 389 /* 390 * For all modes all size2, middle, and size1 should land in separate 391 * granules and thus the latter two offsets should be inaccessible. 392 */ 393 KUNIT_EXPECT_LE(test, round_up(size2, KASAN_GRANULE_SIZE), 394 round_down(middle, KASAN_GRANULE_SIZE)); 395 KUNIT_EXPECT_LE(test, round_up(middle, KASAN_GRANULE_SIZE), 396 round_down(size1, KASAN_GRANULE_SIZE)); 397 KUNIT_EXPECT_KASAN_FAIL(test, ptr2[middle] = 'x'); 398 KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size1 - 1] = 'x'); 399 KUNIT_EXPECT_KASAN_FAIL(test, ptr2[size1] = 'x'); 400 401 kfree(ptr2); 402 } 403 404 static void krealloc_more_oob(struct kunit *test) 405 { 406 krealloc_more_oob_helper(test, 201, 235); 407 } 408 409 static void krealloc_less_oob(struct kunit *test) 410 { 411 krealloc_less_oob_helper(test, 235, 201); 412 } 413 414 static void krealloc_pagealloc_more_oob(struct kunit *test) 415 { 416 /* page_alloc fallback in only implemented for SLUB. */ 417 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB); 418 419 krealloc_more_oob_helper(test, KMALLOC_MAX_CACHE_SIZE + 201, 420 KMALLOC_MAX_CACHE_SIZE + 235); 421 } 422 423 static void krealloc_pagealloc_less_oob(struct kunit *test) 424 { 425 /* page_alloc fallback in only implemented for SLUB. */ 426 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB); 427 428 krealloc_less_oob_helper(test, KMALLOC_MAX_CACHE_SIZE + 235, 429 KMALLOC_MAX_CACHE_SIZE + 201); 430 } 431 432 /* 433 * Check that krealloc() detects a use-after-free, returns NULL, 434 * and doesn't unpoison the freed object. 435 */ 436 static void krealloc_uaf(struct kunit *test) 437 { 438 char *ptr1, *ptr2; 439 int size1 = 201; 440 int size2 = 235; 441 442 ptr1 = kmalloc(size1, GFP_KERNEL); 443 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); 444 kfree(ptr1); 445 446 KUNIT_EXPECT_KASAN_FAIL(test, ptr2 = krealloc(ptr1, size2, GFP_KERNEL)); 447 KUNIT_ASSERT_NULL(test, ptr2); 448 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)ptr1); 449 } 450 451 static void kmalloc_oob_16(struct kunit *test) 452 { 453 struct { 454 u64 words[2]; 455 } *ptr1, *ptr2; 456 457 /* This test is specifically crafted for the generic mode. */ 458 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); 459 460 ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL); 461 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); 462 463 ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL); 464 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); 465 466 OPTIMIZER_HIDE_VAR(ptr1); 467 OPTIMIZER_HIDE_VAR(ptr2); 468 KUNIT_EXPECT_KASAN_FAIL(test, *ptr1 = *ptr2); 469 kfree(ptr1); 470 kfree(ptr2); 471 } 472 473 static void kmalloc_uaf_16(struct kunit *test) 474 { 475 struct { 476 u64 words[2]; 477 } *ptr1, *ptr2; 478 479 ptr1 = kmalloc(sizeof(*ptr1), GFP_KERNEL); 480 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); 481 482 ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL); 483 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); 484 kfree(ptr2); 485 486 KUNIT_EXPECT_KASAN_FAIL(test, *ptr1 = *ptr2); 487 kfree(ptr1); 488 } 489 490 /* 491 * Note: in the memset tests below, the written range touches both valid and 492 * invalid memory. This makes sure that the instrumentation does not only check 493 * the starting address but the whole range. 494 */ 495 496 static void kmalloc_oob_memset_2(struct kunit *test) 497 { 498 char *ptr; 499 size_t size = 128 - KASAN_GRANULE_SIZE; 500 501 ptr = kmalloc(size, GFP_KERNEL); 502 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 503 504 OPTIMIZER_HIDE_VAR(size); 505 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 1, 0, 2)); 506 kfree(ptr); 507 } 508 509 static void kmalloc_oob_memset_4(struct kunit *test) 510 { 511 char *ptr; 512 size_t size = 128 - KASAN_GRANULE_SIZE; 513 514 ptr = kmalloc(size, GFP_KERNEL); 515 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 516 517 OPTIMIZER_HIDE_VAR(size); 518 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 3, 0, 4)); 519 kfree(ptr); 520 } 521 522 static void kmalloc_oob_memset_8(struct kunit *test) 523 { 524 char *ptr; 525 size_t size = 128 - KASAN_GRANULE_SIZE; 526 527 ptr = kmalloc(size, GFP_KERNEL); 528 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 529 530 OPTIMIZER_HIDE_VAR(size); 531 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 7, 0, 8)); 532 kfree(ptr); 533 } 534 535 static void kmalloc_oob_memset_16(struct kunit *test) 536 { 537 char *ptr; 538 size_t size = 128 - KASAN_GRANULE_SIZE; 539 540 ptr = kmalloc(size, GFP_KERNEL); 541 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 542 543 OPTIMIZER_HIDE_VAR(size); 544 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 15, 0, 16)); 545 kfree(ptr); 546 } 547 548 static void kmalloc_oob_in_memset(struct kunit *test) 549 { 550 char *ptr; 551 size_t size = 128 - KASAN_GRANULE_SIZE; 552 553 ptr = kmalloc(size, GFP_KERNEL); 554 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 555 556 OPTIMIZER_HIDE_VAR(ptr); 557 OPTIMIZER_HIDE_VAR(size); 558 KUNIT_EXPECT_KASAN_FAIL(test, 559 memset(ptr, 0, size + KASAN_GRANULE_SIZE)); 560 kfree(ptr); 561 } 562 563 static void kmalloc_memmove_negative_size(struct kunit *test) 564 { 565 char *ptr; 566 size_t size = 64; 567 size_t invalid_size = -2; 568 569 /* 570 * Hardware tag-based mode doesn't check memmove for negative size. 571 * As a result, this test introduces a side-effect memory corruption, 572 * which can result in a crash. 573 */ 574 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_HW_TAGS); 575 576 ptr = kmalloc(size, GFP_KERNEL); 577 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 578 579 memset((char *)ptr, 0, 64); 580 OPTIMIZER_HIDE_VAR(ptr); 581 OPTIMIZER_HIDE_VAR(invalid_size); 582 KUNIT_EXPECT_KASAN_FAIL(test, 583 memmove((char *)ptr, (char *)ptr + 4, invalid_size)); 584 kfree(ptr); 585 } 586 587 static void kmalloc_memmove_invalid_size(struct kunit *test) 588 { 589 char *ptr; 590 size_t size = 64; 591 size_t invalid_size = size; 592 593 ptr = kmalloc(size, GFP_KERNEL); 594 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 595 596 memset((char *)ptr, 0, 64); 597 OPTIMIZER_HIDE_VAR(ptr); 598 OPTIMIZER_HIDE_VAR(invalid_size); 599 KUNIT_EXPECT_KASAN_FAIL(test, 600 memmove((char *)ptr, (char *)ptr + 4, invalid_size)); 601 kfree(ptr); 602 } 603 604 static void kmalloc_uaf(struct kunit *test) 605 { 606 char *ptr; 607 size_t size = 10; 608 609 ptr = kmalloc(size, GFP_KERNEL); 610 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 611 612 kfree(ptr); 613 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[8]); 614 } 615 616 static void kmalloc_uaf_memset(struct kunit *test) 617 { 618 char *ptr; 619 size_t size = 33; 620 621 /* 622 * Only generic KASAN uses quarantine, which is required to avoid a 623 * kernel memory corruption this test causes. 624 */ 625 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); 626 627 ptr = kmalloc(size, GFP_KERNEL); 628 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 629 630 kfree(ptr); 631 KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr, 0, size)); 632 } 633 634 static void kmalloc_uaf2(struct kunit *test) 635 { 636 char *ptr1, *ptr2; 637 size_t size = 43; 638 int counter = 0; 639 640 again: 641 ptr1 = kmalloc(size, GFP_KERNEL); 642 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); 643 644 kfree(ptr1); 645 646 ptr2 = kmalloc(size, GFP_KERNEL); 647 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); 648 649 /* 650 * For tag-based KASAN ptr1 and ptr2 tags might happen to be the same. 651 * Allow up to 16 attempts at generating different tags. 652 */ 653 if (!IS_ENABLED(CONFIG_KASAN_GENERIC) && ptr1 == ptr2 && counter++ < 16) { 654 kfree(ptr2); 655 goto again; 656 } 657 658 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr1)[40]); 659 KUNIT_EXPECT_PTR_NE(test, ptr1, ptr2); 660 661 kfree(ptr2); 662 } 663 664 /* 665 * Check that KASAN detects use-after-free when another object was allocated in 666 * the same slot. Relevant for the tag-based modes, which do not use quarantine. 667 */ 668 static void kmalloc_uaf3(struct kunit *test) 669 { 670 char *ptr1, *ptr2; 671 size_t size = 100; 672 673 /* This test is specifically crafted for tag-based modes. */ 674 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); 675 676 ptr1 = kmalloc(size, GFP_KERNEL); 677 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); 678 kfree(ptr1); 679 680 ptr2 = kmalloc(size, GFP_KERNEL); 681 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); 682 kfree(ptr2); 683 684 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr1)[8]); 685 } 686 687 static void kfree_via_page(struct kunit *test) 688 { 689 char *ptr; 690 size_t size = 8; 691 struct page *page; 692 unsigned long offset; 693 694 ptr = kmalloc(size, GFP_KERNEL); 695 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 696 697 page = virt_to_page(ptr); 698 offset = offset_in_page(ptr); 699 kfree(page_address(page) + offset); 700 } 701 702 static void kfree_via_phys(struct kunit *test) 703 { 704 char *ptr; 705 size_t size = 8; 706 phys_addr_t phys; 707 708 ptr = kmalloc(size, GFP_KERNEL); 709 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 710 711 phys = virt_to_phys(ptr); 712 kfree(phys_to_virt(phys)); 713 } 714 715 static void kmem_cache_oob(struct kunit *test) 716 { 717 char *p; 718 size_t size = 200; 719 struct kmem_cache *cache; 720 721 cache = kmem_cache_create("test_cache", size, 0, 0, NULL); 722 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); 723 724 p = kmem_cache_alloc(cache, GFP_KERNEL); 725 if (!p) { 726 kunit_err(test, "Allocation failed: %s\n", __func__); 727 kmem_cache_destroy(cache); 728 return; 729 } 730 731 KUNIT_EXPECT_KASAN_FAIL(test, *p = p[size + OOB_TAG_OFF]); 732 733 kmem_cache_free(cache, p); 734 kmem_cache_destroy(cache); 735 } 736 737 static void kmem_cache_accounted(struct kunit *test) 738 { 739 int i; 740 char *p; 741 size_t size = 200; 742 struct kmem_cache *cache; 743 744 cache = kmem_cache_create("test_cache", size, 0, SLAB_ACCOUNT, NULL); 745 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); 746 747 /* 748 * Several allocations with a delay to allow for lazy per memcg kmem 749 * cache creation. 750 */ 751 for (i = 0; i < 5; i++) { 752 p = kmem_cache_alloc(cache, GFP_KERNEL); 753 if (!p) 754 goto free_cache; 755 756 kmem_cache_free(cache, p); 757 msleep(100); 758 } 759 760 free_cache: 761 kmem_cache_destroy(cache); 762 } 763 764 static void kmem_cache_bulk(struct kunit *test) 765 { 766 struct kmem_cache *cache; 767 size_t size = 200; 768 char *p[10]; 769 bool ret; 770 int i; 771 772 cache = kmem_cache_create("test_cache", size, 0, 0, NULL); 773 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); 774 775 ret = kmem_cache_alloc_bulk(cache, GFP_KERNEL, ARRAY_SIZE(p), (void **)&p); 776 if (!ret) { 777 kunit_err(test, "Allocation failed: %s\n", __func__); 778 kmem_cache_destroy(cache); 779 return; 780 } 781 782 for (i = 0; i < ARRAY_SIZE(p); i++) 783 p[i][0] = p[i][size - 1] = 42; 784 785 kmem_cache_free_bulk(cache, ARRAY_SIZE(p), (void **)&p); 786 kmem_cache_destroy(cache); 787 } 788 789 static char global_array[10]; 790 791 static void kasan_global_oob_right(struct kunit *test) 792 { 793 /* 794 * Deliberate out-of-bounds access. To prevent CONFIG_UBSAN_LOCAL_BOUNDS 795 * from failing here and panicking the kernel, access the array via a 796 * volatile pointer, which will prevent the compiler from being able to 797 * determine the array bounds. 798 * 799 * This access uses a volatile pointer to char (char *volatile) rather 800 * than the more conventional pointer to volatile char (volatile char *) 801 * because we want to prevent the compiler from making inferences about 802 * the pointer itself (i.e. its array bounds), not the data that it 803 * refers to. 804 */ 805 char *volatile array = global_array; 806 char *p = &array[ARRAY_SIZE(global_array) + 3]; 807 808 /* Only generic mode instruments globals. */ 809 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); 810 811 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); 812 } 813 814 static void kasan_global_oob_left(struct kunit *test) 815 { 816 char *volatile array = global_array; 817 char *p = array - 3; 818 819 /* 820 * GCC is known to fail this test, skip it. 821 * See https://bugzilla.kernel.org/show_bug.cgi?id=215051. 822 */ 823 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_CC_IS_CLANG); 824 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); 825 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); 826 } 827 828 /* Check that ksize() does NOT unpoison whole object. */ 829 static void ksize_unpoisons_memory(struct kunit *test) 830 { 831 char *ptr; 832 size_t size = 128 - KASAN_GRANULE_SIZE - 5; 833 size_t real_size; 834 835 ptr = kmalloc(size, GFP_KERNEL); 836 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 837 838 real_size = ksize(ptr); 839 KUNIT_EXPECT_GT(test, real_size, size); 840 841 OPTIMIZER_HIDE_VAR(ptr); 842 843 /* These accesses shouldn't trigger a KASAN report. */ 844 ptr[0] = 'x'; 845 ptr[size - 1] = 'x'; 846 847 /* These must trigger a KASAN report. */ 848 if (IS_ENABLED(CONFIG_KASAN_GENERIC)) 849 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size]); 850 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size + 5]); 851 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[real_size - 1]); 852 853 kfree(ptr); 854 } 855 856 /* 857 * Check that a use-after-free is detected by ksize() and via normal accesses 858 * after it. 859 */ 860 static void ksize_uaf(struct kunit *test) 861 { 862 char *ptr; 863 int size = 128 - KASAN_GRANULE_SIZE; 864 865 ptr = kmalloc(size, GFP_KERNEL); 866 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 867 kfree(ptr); 868 869 OPTIMIZER_HIDE_VAR(ptr); 870 KUNIT_EXPECT_KASAN_FAIL(test, ksize(ptr)); 871 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]); 872 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size]); 873 } 874 875 static void kasan_stack_oob(struct kunit *test) 876 { 877 char stack_array[10]; 878 /* See comment in kasan_global_oob_right. */ 879 char *volatile array = stack_array; 880 char *p = &array[ARRAY_SIZE(stack_array) + OOB_TAG_OFF]; 881 882 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_STACK); 883 884 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); 885 } 886 887 static void kasan_alloca_oob_left(struct kunit *test) 888 { 889 volatile int i = 10; 890 char alloca_array[i]; 891 /* See comment in kasan_global_oob_right. */ 892 char *volatile array = alloca_array; 893 char *p = array - 1; 894 895 /* Only generic mode instruments dynamic allocas. */ 896 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); 897 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_STACK); 898 899 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); 900 } 901 902 static void kasan_alloca_oob_right(struct kunit *test) 903 { 904 volatile int i = 10; 905 char alloca_array[i]; 906 /* See comment in kasan_global_oob_right. */ 907 char *volatile array = alloca_array; 908 char *p = array + i; 909 910 /* Only generic mode instruments dynamic allocas. */ 911 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); 912 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_STACK); 913 914 KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); 915 } 916 917 static void kmem_cache_double_free(struct kunit *test) 918 { 919 char *p; 920 size_t size = 200; 921 struct kmem_cache *cache; 922 923 cache = kmem_cache_create("test_cache", size, 0, 0, NULL); 924 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); 925 926 p = kmem_cache_alloc(cache, GFP_KERNEL); 927 if (!p) { 928 kunit_err(test, "Allocation failed: %s\n", __func__); 929 kmem_cache_destroy(cache); 930 return; 931 } 932 933 kmem_cache_free(cache, p); 934 KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p)); 935 kmem_cache_destroy(cache); 936 } 937 938 static void kmem_cache_invalid_free(struct kunit *test) 939 { 940 char *p; 941 size_t size = 200; 942 struct kmem_cache *cache; 943 944 cache = kmem_cache_create("test_cache", size, 0, SLAB_TYPESAFE_BY_RCU, 945 NULL); 946 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); 947 948 p = kmem_cache_alloc(cache, GFP_KERNEL); 949 if (!p) { 950 kunit_err(test, "Allocation failed: %s\n", __func__); 951 kmem_cache_destroy(cache); 952 return; 953 } 954 955 /* Trigger invalid free, the object doesn't get freed. */ 956 KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p + 1)); 957 958 /* 959 * Properly free the object to prevent the "Objects remaining in 960 * test_cache on __kmem_cache_shutdown" BUG failure. 961 */ 962 kmem_cache_free(cache, p); 963 964 kmem_cache_destroy(cache); 965 } 966 967 static void empty_cache_ctor(void *object) { } 968 969 static void kmem_cache_double_destroy(struct kunit *test) 970 { 971 struct kmem_cache *cache; 972 973 /* Provide a constructor to prevent cache merging. */ 974 cache = kmem_cache_create("test_cache", 200, 0, 0, empty_cache_ctor); 975 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); 976 kmem_cache_destroy(cache); 977 KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_destroy(cache)); 978 } 979 980 static void kasan_memchr(struct kunit *test) 981 { 982 char *ptr; 983 size_t size = 24; 984 985 /* 986 * str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT. 987 * See https://bugzilla.kernel.org/show_bug.cgi?id=206337 for details. 988 */ 989 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_AMD_MEM_ENCRYPT); 990 991 if (OOB_TAG_OFF) 992 size = round_up(size, OOB_TAG_OFF); 993 994 ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO); 995 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 996 997 OPTIMIZER_HIDE_VAR(ptr); 998 OPTIMIZER_HIDE_VAR(size); 999 KUNIT_EXPECT_KASAN_FAIL(test, 1000 kasan_ptr_result = memchr(ptr, '1', size + 1)); 1001 1002 kfree(ptr); 1003 } 1004 1005 static void kasan_memcmp(struct kunit *test) 1006 { 1007 char *ptr; 1008 size_t size = 24; 1009 int arr[9]; 1010 1011 /* 1012 * str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT. 1013 * See https://bugzilla.kernel.org/show_bug.cgi?id=206337 for details. 1014 */ 1015 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_AMD_MEM_ENCRYPT); 1016 1017 if (OOB_TAG_OFF) 1018 size = round_up(size, OOB_TAG_OFF); 1019 1020 ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO); 1021 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 1022 memset(arr, 0, sizeof(arr)); 1023 1024 OPTIMIZER_HIDE_VAR(ptr); 1025 OPTIMIZER_HIDE_VAR(size); 1026 KUNIT_EXPECT_KASAN_FAIL(test, 1027 kasan_int_result = memcmp(ptr, arr, size+1)); 1028 kfree(ptr); 1029 } 1030 1031 static void kasan_strings(struct kunit *test) 1032 { 1033 char *ptr; 1034 size_t size = 24; 1035 1036 /* 1037 * str* functions are not instrumented with CONFIG_AMD_MEM_ENCRYPT. 1038 * See https://bugzilla.kernel.org/show_bug.cgi?id=206337 for details. 1039 */ 1040 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_AMD_MEM_ENCRYPT); 1041 1042 ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO); 1043 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 1044 1045 kfree(ptr); 1046 1047 /* 1048 * Try to cause only 1 invalid access (less spam in dmesg). 1049 * For that we need ptr to point to zeroed byte. 1050 * Skip metadata that could be stored in freed object so ptr 1051 * will likely point to zeroed byte. 1052 */ 1053 ptr += 16; 1054 KUNIT_EXPECT_KASAN_FAIL(test, kasan_ptr_result = strchr(ptr, '1')); 1055 1056 KUNIT_EXPECT_KASAN_FAIL(test, kasan_ptr_result = strrchr(ptr, '1')); 1057 1058 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strcmp(ptr, "2")); 1059 1060 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strncmp(ptr, "2", 1)); 1061 1062 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strlen(ptr)); 1063 1064 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strnlen(ptr, 1)); 1065 } 1066 1067 static void kasan_bitops_modify(struct kunit *test, int nr, void *addr) 1068 { 1069 KUNIT_EXPECT_KASAN_FAIL(test, set_bit(nr, addr)); 1070 KUNIT_EXPECT_KASAN_FAIL(test, __set_bit(nr, addr)); 1071 KUNIT_EXPECT_KASAN_FAIL(test, clear_bit(nr, addr)); 1072 KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit(nr, addr)); 1073 KUNIT_EXPECT_KASAN_FAIL(test, clear_bit_unlock(nr, addr)); 1074 KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit_unlock(nr, addr)); 1075 KUNIT_EXPECT_KASAN_FAIL(test, change_bit(nr, addr)); 1076 KUNIT_EXPECT_KASAN_FAIL(test, __change_bit(nr, addr)); 1077 } 1078 1079 static void kasan_bitops_test_and_modify(struct kunit *test, int nr, void *addr) 1080 { 1081 KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit(nr, addr)); 1082 KUNIT_EXPECT_KASAN_FAIL(test, __test_and_set_bit(nr, addr)); 1083 KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit_lock(nr, addr)); 1084 KUNIT_EXPECT_KASAN_FAIL(test, test_and_clear_bit(nr, addr)); 1085 KUNIT_EXPECT_KASAN_FAIL(test, __test_and_clear_bit(nr, addr)); 1086 KUNIT_EXPECT_KASAN_FAIL(test, test_and_change_bit(nr, addr)); 1087 KUNIT_EXPECT_KASAN_FAIL(test, __test_and_change_bit(nr, addr)); 1088 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = test_bit(nr, addr)); 1089 1090 #if defined(clear_bit_unlock_is_negative_byte) 1091 KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = 1092 clear_bit_unlock_is_negative_byte(nr, addr)); 1093 #endif 1094 } 1095 1096 static void kasan_bitops_generic(struct kunit *test) 1097 { 1098 long *bits; 1099 1100 /* This test is specifically crafted for the generic mode. */ 1101 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); 1102 1103 /* 1104 * Allocate 1 more byte, which causes kzalloc to round up to 16 bytes; 1105 * this way we do not actually corrupt other memory. 1106 */ 1107 bits = kzalloc(sizeof(*bits) + 1, GFP_KERNEL); 1108 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits); 1109 1110 /* 1111 * Below calls try to access bit within allocated memory; however, the 1112 * below accesses are still out-of-bounds, since bitops are defined to 1113 * operate on the whole long the bit is in. 1114 */ 1115 kasan_bitops_modify(test, BITS_PER_LONG, bits); 1116 1117 /* 1118 * Below calls try to access bit beyond allocated memory. 1119 */ 1120 kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, bits); 1121 1122 kfree(bits); 1123 } 1124 1125 static void kasan_bitops_tags(struct kunit *test) 1126 { 1127 long *bits; 1128 1129 /* This test is specifically crafted for tag-based modes. */ 1130 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); 1131 1132 /* kmalloc-64 cache will be used and the last 16 bytes will be the redzone. */ 1133 bits = kzalloc(48, GFP_KERNEL); 1134 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits); 1135 1136 /* Do the accesses past the 48 allocated bytes, but within the redone. */ 1137 kasan_bitops_modify(test, BITS_PER_LONG, (void *)bits + 48); 1138 kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, (void *)bits + 48); 1139 1140 kfree(bits); 1141 } 1142 1143 static void kmalloc_double_kzfree(struct kunit *test) 1144 { 1145 char *ptr; 1146 size_t size = 16; 1147 1148 ptr = kmalloc(size, GFP_KERNEL); 1149 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 1150 1151 kfree_sensitive(ptr); 1152 KUNIT_EXPECT_KASAN_FAIL(test, kfree_sensitive(ptr)); 1153 } 1154 1155 /* 1156 * The two tests below check that Generic KASAN prints auxiliary stack traces 1157 * for RCU callbacks and workqueues. The reports need to be inspected manually. 1158 * 1159 * These tests are still enabled for other KASAN modes to make sure that all 1160 * modes report bad accesses in tested scenarios. 1161 */ 1162 1163 static struct kasan_rcu_info { 1164 int i; 1165 struct rcu_head rcu; 1166 } *global_rcu_ptr; 1167 1168 static void rcu_uaf_reclaim(struct rcu_head *rp) 1169 { 1170 struct kasan_rcu_info *fp = 1171 container_of(rp, struct kasan_rcu_info, rcu); 1172 1173 kfree(fp); 1174 ((volatile struct kasan_rcu_info *)fp)->i; 1175 } 1176 1177 static void rcu_uaf(struct kunit *test) 1178 { 1179 struct kasan_rcu_info *ptr; 1180 1181 ptr = kmalloc(sizeof(struct kasan_rcu_info), GFP_KERNEL); 1182 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 1183 1184 global_rcu_ptr = rcu_dereference_protected( 1185 (struct kasan_rcu_info __rcu *)ptr, NULL); 1186 1187 KUNIT_EXPECT_KASAN_FAIL(test, 1188 call_rcu(&global_rcu_ptr->rcu, rcu_uaf_reclaim); 1189 rcu_barrier()); 1190 } 1191 1192 static void workqueue_uaf_work(struct work_struct *work) 1193 { 1194 kfree(work); 1195 } 1196 1197 static void workqueue_uaf(struct kunit *test) 1198 { 1199 struct workqueue_struct *workqueue; 1200 struct work_struct *work; 1201 1202 workqueue = create_workqueue("kasan_workqueue_test"); 1203 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, workqueue); 1204 1205 work = kmalloc(sizeof(struct work_struct), GFP_KERNEL); 1206 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, work); 1207 1208 INIT_WORK(work, workqueue_uaf_work); 1209 queue_work(workqueue, work); 1210 destroy_workqueue(workqueue); 1211 1212 KUNIT_EXPECT_KASAN_FAIL(test, 1213 ((volatile struct work_struct *)work)->data); 1214 } 1215 1216 static void vmalloc_helpers_tags(struct kunit *test) 1217 { 1218 void *ptr; 1219 1220 /* This test is intended for tag-based modes. */ 1221 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); 1222 1223 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_VMALLOC); 1224 1225 ptr = vmalloc(PAGE_SIZE); 1226 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 1227 1228 /* Check that the returned pointer is tagged. */ 1229 KUNIT_EXPECT_GE(test, (u8)get_tag(ptr), (u8)KASAN_TAG_MIN); 1230 KUNIT_EXPECT_LT(test, (u8)get_tag(ptr), (u8)KASAN_TAG_KERNEL); 1231 1232 /* Make sure exported vmalloc helpers handle tagged pointers. */ 1233 KUNIT_ASSERT_TRUE(test, is_vmalloc_addr(ptr)); 1234 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, vmalloc_to_page(ptr)); 1235 1236 #if !IS_MODULE(CONFIG_KASAN_KUNIT_TEST) 1237 { 1238 int rv; 1239 1240 /* Make sure vmalloc'ed memory permissions can be changed. */ 1241 rv = set_memory_ro((unsigned long)ptr, 1); 1242 KUNIT_ASSERT_GE(test, rv, 0); 1243 rv = set_memory_rw((unsigned long)ptr, 1); 1244 KUNIT_ASSERT_GE(test, rv, 0); 1245 } 1246 #endif 1247 1248 vfree(ptr); 1249 } 1250 1251 static void vmalloc_oob(struct kunit *test) 1252 { 1253 char *v_ptr, *p_ptr; 1254 struct page *page; 1255 size_t size = PAGE_SIZE / 2 - KASAN_GRANULE_SIZE - 5; 1256 1257 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_VMALLOC); 1258 1259 v_ptr = vmalloc(size); 1260 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, v_ptr); 1261 1262 OPTIMIZER_HIDE_VAR(v_ptr); 1263 1264 /* 1265 * We have to be careful not to hit the guard page in vmalloc tests. 1266 * The MMU will catch that and crash us. 1267 */ 1268 1269 /* Make sure in-bounds accesses are valid. */ 1270 v_ptr[0] = 0; 1271 v_ptr[size - 1] = 0; 1272 1273 /* 1274 * An unaligned access past the requested vmalloc size. 1275 * Only generic KASAN can precisely detect these. 1276 */ 1277 if (IS_ENABLED(CONFIG_KASAN_GENERIC)) 1278 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)v_ptr)[size]); 1279 1280 /* An aligned access into the first out-of-bounds granule. */ 1281 KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)v_ptr)[size + 5]); 1282 1283 /* Check that in-bounds accesses to the physical page are valid. */ 1284 page = vmalloc_to_page(v_ptr); 1285 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, page); 1286 p_ptr = page_address(page); 1287 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, p_ptr); 1288 p_ptr[0] = 0; 1289 1290 vfree(v_ptr); 1291 1292 /* 1293 * We can't check for use-after-unmap bugs in this nor in the following 1294 * vmalloc tests, as the page might be fully unmapped and accessing it 1295 * will crash the kernel. 1296 */ 1297 } 1298 1299 static void vmap_tags(struct kunit *test) 1300 { 1301 char *p_ptr, *v_ptr; 1302 struct page *p_page, *v_page; 1303 1304 /* 1305 * This test is specifically crafted for the software tag-based mode, 1306 * the only tag-based mode that poisons vmap mappings. 1307 */ 1308 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_SW_TAGS); 1309 1310 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_VMALLOC); 1311 1312 p_page = alloc_pages(GFP_KERNEL, 1); 1313 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, p_page); 1314 p_ptr = page_address(p_page); 1315 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, p_ptr); 1316 1317 v_ptr = vmap(&p_page, 1, VM_MAP, PAGE_KERNEL); 1318 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, v_ptr); 1319 1320 /* 1321 * We can't check for out-of-bounds bugs in this nor in the following 1322 * vmalloc tests, as allocations have page granularity and accessing 1323 * the guard page will crash the kernel. 1324 */ 1325 1326 KUNIT_EXPECT_GE(test, (u8)get_tag(v_ptr), (u8)KASAN_TAG_MIN); 1327 KUNIT_EXPECT_LT(test, (u8)get_tag(v_ptr), (u8)KASAN_TAG_KERNEL); 1328 1329 /* Make sure that in-bounds accesses through both pointers work. */ 1330 *p_ptr = 0; 1331 *v_ptr = 0; 1332 1333 /* Make sure vmalloc_to_page() correctly recovers the page pointer. */ 1334 v_page = vmalloc_to_page(v_ptr); 1335 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, v_page); 1336 KUNIT_EXPECT_PTR_EQ(test, p_page, v_page); 1337 1338 vunmap(v_ptr); 1339 free_pages((unsigned long)p_ptr, 1); 1340 } 1341 1342 static void vm_map_ram_tags(struct kunit *test) 1343 { 1344 char *p_ptr, *v_ptr; 1345 struct page *page; 1346 1347 /* 1348 * This test is specifically crafted for the software tag-based mode, 1349 * the only tag-based mode that poisons vm_map_ram mappings. 1350 */ 1351 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_SW_TAGS); 1352 1353 page = alloc_pages(GFP_KERNEL, 1); 1354 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, page); 1355 p_ptr = page_address(page); 1356 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, p_ptr); 1357 1358 v_ptr = vm_map_ram(&page, 1, -1); 1359 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, v_ptr); 1360 1361 KUNIT_EXPECT_GE(test, (u8)get_tag(v_ptr), (u8)KASAN_TAG_MIN); 1362 KUNIT_EXPECT_LT(test, (u8)get_tag(v_ptr), (u8)KASAN_TAG_KERNEL); 1363 1364 /* Make sure that in-bounds accesses through both pointers work. */ 1365 *p_ptr = 0; 1366 *v_ptr = 0; 1367 1368 vm_unmap_ram(v_ptr, 1); 1369 free_pages((unsigned long)p_ptr, 1); 1370 } 1371 1372 static void vmalloc_percpu(struct kunit *test) 1373 { 1374 char __percpu *ptr; 1375 int cpu; 1376 1377 /* 1378 * This test is specifically crafted for the software tag-based mode, 1379 * the only tag-based mode that poisons percpu mappings. 1380 */ 1381 KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_SW_TAGS); 1382 1383 ptr = __alloc_percpu(PAGE_SIZE, PAGE_SIZE); 1384 1385 for_each_possible_cpu(cpu) { 1386 char *c_ptr = per_cpu_ptr(ptr, cpu); 1387 1388 KUNIT_EXPECT_GE(test, (u8)get_tag(c_ptr), (u8)KASAN_TAG_MIN); 1389 KUNIT_EXPECT_LT(test, (u8)get_tag(c_ptr), (u8)KASAN_TAG_KERNEL); 1390 1391 /* Make sure that in-bounds accesses don't crash the kernel. */ 1392 *c_ptr = 0; 1393 } 1394 1395 free_percpu(ptr); 1396 } 1397 1398 /* 1399 * Check that the assigned pointer tag falls within the [KASAN_TAG_MIN, 1400 * KASAN_TAG_KERNEL) range (note: excluding the match-all tag) for tag-based 1401 * modes. 1402 */ 1403 static void match_all_not_assigned(struct kunit *test) 1404 { 1405 char *ptr; 1406 struct page *pages; 1407 int i, size, order; 1408 1409 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); 1410 1411 for (i = 0; i < 256; i++) { 1412 size = get_random_u32_inclusive(1, 1024); 1413 ptr = kmalloc(size, GFP_KERNEL); 1414 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 1415 KUNIT_EXPECT_GE(test, (u8)get_tag(ptr), (u8)KASAN_TAG_MIN); 1416 KUNIT_EXPECT_LT(test, (u8)get_tag(ptr), (u8)KASAN_TAG_KERNEL); 1417 kfree(ptr); 1418 } 1419 1420 for (i = 0; i < 256; i++) { 1421 order = get_random_u32_inclusive(1, 4); 1422 pages = alloc_pages(GFP_KERNEL, order); 1423 ptr = page_address(pages); 1424 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 1425 KUNIT_EXPECT_GE(test, (u8)get_tag(ptr), (u8)KASAN_TAG_MIN); 1426 KUNIT_EXPECT_LT(test, (u8)get_tag(ptr), (u8)KASAN_TAG_KERNEL); 1427 free_pages((unsigned long)ptr, order); 1428 } 1429 1430 if (!IS_ENABLED(CONFIG_KASAN_VMALLOC)) 1431 return; 1432 1433 for (i = 0; i < 256; i++) { 1434 size = get_random_u32_inclusive(1, 1024); 1435 ptr = vmalloc(size); 1436 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 1437 KUNIT_EXPECT_GE(test, (u8)get_tag(ptr), (u8)KASAN_TAG_MIN); 1438 KUNIT_EXPECT_LT(test, (u8)get_tag(ptr), (u8)KASAN_TAG_KERNEL); 1439 vfree(ptr); 1440 } 1441 } 1442 1443 /* Check that 0xff works as a match-all pointer tag for tag-based modes. */ 1444 static void match_all_ptr_tag(struct kunit *test) 1445 { 1446 char *ptr; 1447 u8 tag; 1448 1449 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); 1450 1451 ptr = kmalloc(128, GFP_KERNEL); 1452 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 1453 1454 /* Backup the assigned tag. */ 1455 tag = get_tag(ptr); 1456 KUNIT_EXPECT_NE(test, tag, (u8)KASAN_TAG_KERNEL); 1457 1458 /* Reset the tag to 0xff.*/ 1459 ptr = set_tag(ptr, KASAN_TAG_KERNEL); 1460 1461 /* This access shouldn't trigger a KASAN report. */ 1462 *ptr = 0; 1463 1464 /* Recover the pointer tag and free. */ 1465 ptr = set_tag(ptr, tag); 1466 kfree(ptr); 1467 } 1468 1469 /* Check that there are no match-all memory tags for tag-based modes. */ 1470 static void match_all_mem_tag(struct kunit *test) 1471 { 1472 char *ptr; 1473 int tag; 1474 1475 KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); 1476 1477 ptr = kmalloc(128, GFP_KERNEL); 1478 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 1479 KUNIT_EXPECT_NE(test, (u8)get_tag(ptr), (u8)KASAN_TAG_KERNEL); 1480 1481 /* For each possible tag value not matching the pointer tag. */ 1482 for (tag = KASAN_TAG_MIN; tag <= KASAN_TAG_KERNEL; tag++) { 1483 if (tag == get_tag(ptr)) 1484 continue; 1485 1486 /* Mark the first memory granule with the chosen memory tag. */ 1487 kasan_poison(ptr, KASAN_GRANULE_SIZE, (u8)tag, false); 1488 1489 /* This access must cause a KASAN report. */ 1490 KUNIT_EXPECT_KASAN_FAIL(test, *ptr = 0); 1491 } 1492 1493 /* Recover the memory tag and free. */ 1494 kasan_poison(ptr, KASAN_GRANULE_SIZE, get_tag(ptr), false); 1495 kfree(ptr); 1496 } 1497 1498 static struct kunit_case kasan_kunit_test_cases[] = { 1499 KUNIT_CASE(kmalloc_oob_right), 1500 KUNIT_CASE(kmalloc_oob_left), 1501 KUNIT_CASE(kmalloc_node_oob_right), 1502 KUNIT_CASE(kmalloc_pagealloc_oob_right), 1503 KUNIT_CASE(kmalloc_pagealloc_uaf), 1504 KUNIT_CASE(kmalloc_pagealloc_invalid_free), 1505 KUNIT_CASE(pagealloc_oob_right), 1506 KUNIT_CASE(pagealloc_uaf), 1507 KUNIT_CASE(kmalloc_large_oob_right), 1508 KUNIT_CASE(krealloc_more_oob), 1509 KUNIT_CASE(krealloc_less_oob), 1510 KUNIT_CASE(krealloc_pagealloc_more_oob), 1511 KUNIT_CASE(krealloc_pagealloc_less_oob), 1512 KUNIT_CASE(krealloc_uaf), 1513 KUNIT_CASE(kmalloc_oob_16), 1514 KUNIT_CASE(kmalloc_uaf_16), 1515 KUNIT_CASE(kmalloc_oob_in_memset), 1516 KUNIT_CASE(kmalloc_oob_memset_2), 1517 KUNIT_CASE(kmalloc_oob_memset_4), 1518 KUNIT_CASE(kmalloc_oob_memset_8), 1519 KUNIT_CASE(kmalloc_oob_memset_16), 1520 KUNIT_CASE(kmalloc_memmove_negative_size), 1521 KUNIT_CASE(kmalloc_memmove_invalid_size), 1522 KUNIT_CASE(kmalloc_uaf), 1523 KUNIT_CASE(kmalloc_uaf_memset), 1524 KUNIT_CASE(kmalloc_uaf2), 1525 KUNIT_CASE(kmalloc_uaf3), 1526 KUNIT_CASE(kfree_via_page), 1527 KUNIT_CASE(kfree_via_phys), 1528 KUNIT_CASE(kmem_cache_oob), 1529 KUNIT_CASE(kmem_cache_accounted), 1530 KUNIT_CASE(kmem_cache_bulk), 1531 KUNIT_CASE(kasan_global_oob_right), 1532 KUNIT_CASE(kasan_global_oob_left), 1533 KUNIT_CASE(kasan_stack_oob), 1534 KUNIT_CASE(kasan_alloca_oob_left), 1535 KUNIT_CASE(kasan_alloca_oob_right), 1536 KUNIT_CASE(ksize_unpoisons_memory), 1537 KUNIT_CASE(ksize_uaf), 1538 KUNIT_CASE(kmem_cache_double_free), 1539 KUNIT_CASE(kmem_cache_invalid_free), 1540 KUNIT_CASE(kmem_cache_double_destroy), 1541 KUNIT_CASE(kasan_memchr), 1542 KUNIT_CASE(kasan_memcmp), 1543 KUNIT_CASE(kasan_strings), 1544 KUNIT_CASE(kasan_bitops_generic), 1545 KUNIT_CASE(kasan_bitops_tags), 1546 KUNIT_CASE(kmalloc_double_kzfree), 1547 KUNIT_CASE(rcu_uaf), 1548 KUNIT_CASE(workqueue_uaf), 1549 KUNIT_CASE(vmalloc_helpers_tags), 1550 KUNIT_CASE(vmalloc_oob), 1551 KUNIT_CASE(vmap_tags), 1552 KUNIT_CASE(vm_map_ram_tags), 1553 KUNIT_CASE(vmalloc_percpu), 1554 KUNIT_CASE(match_all_not_assigned), 1555 KUNIT_CASE(match_all_ptr_tag), 1556 KUNIT_CASE(match_all_mem_tag), 1557 {} 1558 }; 1559 1560 static struct kunit_suite kasan_kunit_test_suite = { 1561 .name = "kasan", 1562 .test_cases = kasan_kunit_test_cases, 1563 .exit = kasan_test_exit, 1564 .suite_init = kasan_suite_init, 1565 .suite_exit = kasan_suite_exit, 1566 }; 1567 1568 kunit_test_suite(kasan_kunit_test_suite); 1569 1570 MODULE_LICENSE("GPL"); 1571