drivers/misc/lkdtm_bugs.c

   1 /*
   2  * This is for all the tests related to logic bugs (e.g. bad dereferences,
   3  * bad alignment, bad loops, bad locking, bad scheduling, deep stacks, and
   4  * lockups) along with other things that don't fit well into existing LKDTM
   5  * test source files.
   6  */
   7 #include "lkdtm.h"
   8 #include <linux/list.h>
   9 #include <linux/refcount.h>
  10 #include <linux/sched.h>
  11
  12 struct lkdtm_list {
  13         struct list_head node;
  14 };
  15
  16 /*
  17  * Make sure our attempts to over run the kernel stack doesn't trigger
  18  * a compiler warning when CONFIG_FRAME_WARN is set. Then make sure we
  19  * recurse past the end of THREAD_SIZE by default.
  20  */
  21 #if defined(CONFIG_FRAME_WARN) && (CONFIG_FRAME_WARN > 0)
  22 #define REC_STACK_SIZE (CONFIG_FRAME_WARN / 2)
  23 #else
  24 #define REC_STACK_SIZE (THREAD_SIZE / 8)
  25 #endif
  26 #define REC_NUM_DEFAULT ((THREAD_SIZE / REC_STACK_SIZE) * 2)
  27
  28 static int recur_count = REC_NUM_DEFAULT;
  29
  30 static DEFINE_SPINLOCK(lock_me_up);
  31
  32 static int recursive_loop(int remaining)
  33 {
  34         char buf[REC_STACK_SIZE];
  35
  36         /* Make sure compiler does not optimize this away. */
  37         memset(buf, (remaining & 0xff) | 0x1, REC_STACK_SIZE);
  38         if (!remaining)
  39                 return 0;
  40         else
  41                 return recursive_loop(remaining - 1);
  42 }
  43
  44 /* If the depth is negative, use the default, otherwise keep parameter. */
  45 void __init lkdtm_bugs_init(int *recur_param)
  46 {
  47         if (*recur_param < 0)
  48                 *recur_param = recur_count;
  49         else
  50                 recur_count = *recur_param;
  51 }
  52
  53 void lkdtm_PANIC(void)
  54 {
  55         panic("dumptest");
  56 }
  57
  58 void lkdtm_BUG(void)
  59 {
  60         BUG();
  61 }
  62
  63 void lkdtm_WARNING(void)
  64 {
  65         WARN_ON(1);
  66 }
  67
  68 void lkdtm_EXCEPTION(void)
  69 {
  70         *((int *) 0) = 0;
  71 }
  72
  73 void lkdtm_LOOP(void)
  74 {
  75         for (;;)
  76                 ;
  77 }
  78
  79 void lkdtm_OVERFLOW(void)
  80 {
  81         (void) recursive_loop(recur_count);
  82 }
  83
  84 static noinline void __lkdtm_CORRUPT_STACK(void *stack)
  85 {
  86         memset(stack, 'a', 64);
  87 }
  88
  89 noinline void lkdtm_CORRUPT_STACK(void)
  90 {
  91         /* Use default char array length that triggers stack protection. */
  92         char data[8];
  93         __lkdtm_CORRUPT_STACK(&data);
  94
  95         pr_info("Corrupted stack with '%16s'...\n", data);
  96 }
  97
  98 void lkdtm_UNALIGNED_LOAD_STORE_WRITE(void)
  99 {
 100         static u8 data[5] __attribute__((aligned(4))) = {1, 2, 3, 4, 5};
 101         u32 *p;
 102         u32 val = 0x12345678;
 103
 104         p = (u32 *)(data + 1);
 105         if (*p == 0)
 106                 val = 0x87654321;
 107         *p = val;
 108 }
 109
 110 void lkdtm_SOFTLOCKUP(void)
 111 {
 112         preempt_disable();
 113         for (;;)
 114                 cpu_relax();
 115 }
 116
 117 void lkdtm_HARDLOCKUP(void)
 118 {
 119         local_irq_disable();
 120         for (;;)
 121                 cpu_relax();
 122 }
 123
 124 void lkdtm_SPINLOCKUP(void)
 125 {
 126         /* Must be called twice to trigger. */
 127         spin_lock(&lock_me_up);
 128         /* Let sparse know we intended to exit holding the lock. */
 129         __release(&lock_me_up);
 130 }
 131
 132 void lkdtm_HUNG_TASK(void)
 133 {
 134         set_current_state(TASK_UNINTERRUPTIBLE);
 135         schedule();
 136 }
 137
 138 void lkdtm_REFCOUNT_SATURATE_INC(void)
 139 {
 140         refcount_t over = REFCOUNT_INIT(UINT_MAX - 1);
 141
 142         pr_info("attempting good refcount decrement\n");
 143         refcount_dec(&over);
 144         refcount_inc(&over);
 145
 146         pr_info("attempting bad refcount inc overflow\n");
 147         refcount_inc(&over);
 148         refcount_inc(&over);
 149         if (refcount_read(&over) == UINT_MAX)
 150                 pr_err("Correctly stayed saturated, but no BUG?!\n");
 151         else
 152                 pr_err("Fail: refcount wrapped\n");
 153 }
 154
 155 void lkdtm_REFCOUNT_SATURATE_ADD(void)
 156 {
 157         refcount_t over = REFCOUNT_INIT(UINT_MAX - 1);
 158
 159         pr_info("attempting good refcount decrement\n");
 160         refcount_dec(&over);
 161         refcount_inc(&over);
 162
 163         pr_info("attempting bad refcount add overflow\n");
 164         refcount_add(2, &over);
 165         if (refcount_read(&over) == UINT_MAX)
 166                 pr_err("Correctly stayed saturated, but no BUG?!\n");
 167         else
 168                 pr_err("Fail: refcount wrapped\n");
 169 }
 170
 171 void lkdtm_REFCOUNT_ZERO_DEC(void)
 172 {
 173         refcount_t zero = REFCOUNT_INIT(1);
 174
 175         pr_info("attempting bad refcount decrement to zero\n");
 176         refcount_dec(&zero);
 177         if (refcount_read(&zero) == 0)
 178                 pr_err("Stayed at zero, but no BUG?!\n");
 179         else
 180                 pr_err("Fail: refcount went crazy\n");
 181 }
 182
 183 void lkdtm_REFCOUNT_ZERO_SUB(void)
 184 {
 185         refcount_t zero = REFCOUNT_INIT(1);
 186
 187         pr_info("attempting bad refcount subtract past zero\n");
 188         if (!refcount_sub_and_test(2, &zero))
 189                 pr_info("wrap attempt was noticed\n");
 190         if (refcount_read(&zero) == 1)
 191                 pr_err("Correctly stayed above 0, but no BUG?!\n");
 192         else
 193                 pr_err("Fail: refcount wrapped\n");
 194 }
 195
 196 void lkdtm_REFCOUNT_ZERO_INC(void)
 197 {
 198         refcount_t zero = REFCOUNT_INIT(0);
 199
 200         pr_info("attempting bad refcount increment from zero\n");
 201         refcount_inc(&zero);
 202         if (refcount_read(&zero) == 0)
 203                 pr_err("Stayed at zero, but no BUG?!\n");
 204         else
 205                 pr_err("Fail: refcount went past zero\n");
 206 }
 207
 208 void lkdtm_REFCOUNT_ZERO_ADD(void)
 209 {
 210         refcount_t zero = REFCOUNT_INIT(0);
 211
 212         pr_info("attempting bad refcount addition from zero\n");
 213         refcount_add(2, &zero);
 214         if (refcount_read(&zero) == 0)
 215                 pr_err("Stayed at zero, but no BUG?!\n");
 216         else
 217                 pr_err("Fail: refcount went past zero\n");
 218 }
 219
 220 void lkdtm_CORRUPT_LIST_ADD(void)
 221 {
 222         /*
 223          * Initially, an empty list via LIST_HEAD:
 224          *      test_head.next = &test_head
 225          *      test_head.prev = &test_head
 226          */
 227         LIST_HEAD(test_head);
 228         struct lkdtm_list good, bad;
 229         void *target[2] = { };
 230         void *redirection = &target;
 231
 232         pr_info("attempting good list addition\n");
 233
 234         /*
 235          * Adding to the list performs these actions:
 236          *      test_head.next->prev = &good.node
 237          *      good.node.next = test_head.next
 238          *      good.node.prev = test_head
 239          *      test_head.next = good.node
 240          */
 241         list_add(&good.node, &test_head);
 242
 243         pr_info("attempting corrupted list addition\n");
 244         /*
 245          * In simulating this "write what where" primitive, the "what" is
 246          * the address of &bad.node, and the "where" is the address held
 247          * by "redirection".
 248          */
 249         test_head.next = redirection;
 250         list_add(&bad.node, &test_head);
 251
 252         if (target[0] == NULL && target[1] == NULL)
 253                 pr_err("Overwrite did not happen, but no BUG?!\n");
 254         else
 255                 pr_err("list_add() corruption not detected!\n");
 256 }
 257
 258 void lkdtm_CORRUPT_LIST_DEL(void)
 259 {
 260         LIST_HEAD(test_head);
 261         struct lkdtm_list item;
 262         void *target[2] = { };
 263         void *redirection = &target;
 264
 265         list_add(&item.node, &test_head);
 266
 267         pr_info("attempting good list removal\n");
 268         list_del(&item.node);
 269
 270         pr_info("attempting corrupted list removal\n");
 271         list_add(&item.node, &test_head);
 272
 273         /* As with the list_add() test above, this corrupts "next". */
 274         item.node.next = redirection;
 275         list_del(&item.node);
 276
 277         if (target[0] == NULL && target[1] == NULL)
 278                 pr_err("Overwrite did not happen, but no BUG?!\n");
 279         else
 280                 pr_err("list_del() corruption not detected!\n");
 281 }