]>
Commit | Line | Data |
---|---|---|
00f496c4 KC |
1 | /* |
2 | * This is for all the tests related to logic bugs (e.g. bad dereferences, | |
3 | * bad alignment, bad loops, bad locking, bad scheduling, deep stacks, and | |
4 | * lockups) along with other things that don't fit well into existing LKDTM | |
5 | * test source files. | |
6 | */ | |
7 | #define pr_fmt(fmt) "lkdtm: " fmt | |
8 | ||
9 | #include <linux/kernel.h> | |
10 | #include <linux/sched.h> | |
11 | ||
12 | #include "lkdtm.h" | |
13 | ||
14 | /* | |
15 | * Make sure our attempts to over run the kernel stack doesn't trigger | |
16 | * a compiler warning when CONFIG_FRAME_WARN is set. Then make sure we | |
17 | * recurse past the end of THREAD_SIZE by default. | |
18 | */ | |
19 | #if defined(CONFIG_FRAME_WARN) && (CONFIG_FRAME_WARN > 0) | |
20 | #define REC_STACK_SIZE (CONFIG_FRAME_WARN / 2) | |
21 | #else | |
22 | #define REC_STACK_SIZE (THREAD_SIZE / 8) | |
23 | #endif | |
24 | #define REC_NUM_DEFAULT ((THREAD_SIZE / REC_STACK_SIZE) * 2) | |
25 | ||
26 | static int recur_count = REC_NUM_DEFAULT; | |
27 | ||
28 | static DEFINE_SPINLOCK(lock_me_up); | |
29 | ||
30 | static int recursive_loop(int remaining) | |
31 | { | |
32 | char buf[REC_STACK_SIZE]; | |
33 | ||
34 | /* Make sure compiler does not optimize this away. */ | |
35 | memset(buf, (remaining & 0xff) | 0x1, REC_STACK_SIZE); | |
36 | if (!remaining) | |
37 | return 0; | |
38 | else | |
39 | return recursive_loop(remaining - 1); | |
40 | } | |
41 | ||
42 | /* If the depth is negative, use the default, otherwise keep parameter. */ | |
43 | void __init lkdtm_bugs_init(int *recur_param) | |
44 | { | |
45 | if (*recur_param < 0) | |
46 | *recur_param = recur_count; | |
47 | else | |
48 | recur_count = *recur_param; | |
49 | } | |
50 | ||
51 | void lkdtm_PANIC(void) | |
52 | { | |
53 | panic("dumptest"); | |
54 | } | |
55 | ||
56 | void lkdtm_BUG(void) | |
57 | { | |
58 | BUG(); | |
59 | } | |
60 | ||
61 | void lkdtm_WARNING(void) | |
62 | { | |
63 | WARN_ON(1); | |
64 | } | |
65 | ||
66 | void lkdtm_EXCEPTION(void) | |
67 | { | |
68 | *((int *) 0) = 0; | |
69 | } | |
70 | ||
71 | void lkdtm_LOOP(void) | |
72 | { | |
73 | for (;;) | |
74 | ; | |
75 | } | |
76 | ||
77 | void lkdtm_OVERFLOW(void) | |
78 | { | |
79 | (void) recursive_loop(recur_count); | |
80 | } | |
81 | ||
82 | noinline void lkdtm_CORRUPT_STACK(void) | |
83 | { | |
84 | /* Use default char array length that triggers stack protection. */ | |
85 | char data[8]; | |
86 | ||
87 | memset((void *)data, 0, 64); | |
88 | } | |
89 | ||
90 | void lkdtm_UNALIGNED_LOAD_STORE_WRITE(void) | |
91 | { | |
92 | static u8 data[5] __attribute__((aligned(4))) = {1, 2, 3, 4, 5}; | |
93 | u32 *p; | |
94 | u32 val = 0x12345678; | |
95 | ||
96 | p = (u32 *)(data + 1); | |
97 | if (*p == 0) | |
98 | val = 0x87654321; | |
99 | *p = val; | |
100 | } | |
101 | ||
102 | void lkdtm_SOFTLOCKUP(void) | |
103 | { | |
104 | preempt_disable(); | |
105 | for (;;) | |
106 | cpu_relax(); | |
107 | } | |
108 | ||
109 | void lkdtm_HARDLOCKUP(void) | |
110 | { | |
111 | local_irq_disable(); | |
112 | for (;;) | |
113 | cpu_relax(); | |
114 | } | |
115 | ||
116 | void lkdtm_SPINLOCKUP(void) | |
117 | { | |
118 | /* Must be called twice to trigger. */ | |
119 | spin_lock(&lock_me_up); | |
120 | /* Let sparse know we intended to exit holding the lock. */ | |
121 | __release(&lock_me_up); | |
122 | } | |
123 | ||
124 | void lkdtm_HUNG_TASK(void) | |
125 | { | |
126 | set_current_state(TASK_UNINTERRUPTIBLE); | |
127 | schedule(); | |
128 | } | |
129 | ||
130 | void lkdtm_ATOMIC_UNDERFLOW(void) | |
131 | { | |
132 | atomic_t under = ATOMIC_INIT(INT_MIN); | |
133 | ||
134 | pr_info("attempting good atomic increment\n"); | |
135 | atomic_inc(&under); | |
136 | atomic_dec(&under); | |
137 | ||
138 | pr_info("attempting bad atomic underflow\n"); | |
139 | atomic_dec(&under); | |
140 | } | |
141 | ||
142 | void lkdtm_ATOMIC_OVERFLOW(void) | |
143 | { | |
144 | atomic_t over = ATOMIC_INIT(INT_MAX); | |
145 | ||
146 | pr_info("attempting good atomic decrement\n"); | |
147 | atomic_dec(&over); | |
148 | atomic_inc(&over); | |
149 | ||
150 | pr_info("attempting bad atomic overflow\n"); | |
151 | atomic_inc(&over); | |
152 | } |