]>
Commit | Line | Data |
---|---|---|
3e2a4c18 KC |
1 | /* |
2 | * Kernel module for testing copy_to/from_user infrastructure. | |
3 | * | |
4 | * Copyright 2013 Google Inc. All Rights Reserved | |
5 | * | |
6 | * Authors: | |
7 | * Kees Cook <keescook@chromium.org> | |
8 | * | |
9 | * This software is licensed under the terms of the GNU General Public | |
10 | * License version 2, as published by the Free Software Foundation, and | |
11 | * may be copied, distributed, and modified under those terms. | |
12 | * | |
13 | * This program is distributed in the hope that it will be useful, | |
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
16 | * GNU General Public License for more details. | |
17 | */ | |
18 | ||
19 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt | |
20 | ||
21 | #include <linux/mman.h> | |
22 | #include <linux/module.h> | |
23 | #include <linux/sched.h> | |
24 | #include <linux/slab.h> | |
25 | #include <linux/uaccess.h> | |
26 | #include <linux/vmalloc.h> | |
27 | ||
28 | #define test(condition, msg) \ | |
29 | ({ \ | |
30 | int cond = (condition); \ | |
31 | if (cond) \ | |
32 | pr_warn("%s\n", msg); \ | |
33 | cond; \ | |
34 | }) | |
35 | ||
36 | static int __init test_user_copy_init(void) | |
37 | { | |
38 | int ret = 0; | |
39 | char *kmem; | |
40 | char __user *usermem; | |
41 | char *bad_usermem; | |
42 | unsigned long user_addr; | |
43 | unsigned long value = 0x5A; | |
44 | ||
45 | kmem = kmalloc(PAGE_SIZE * 2, GFP_KERNEL); | |
46 | if (!kmem) | |
47 | return -ENOMEM; | |
48 | ||
49 | user_addr = vm_mmap(NULL, 0, PAGE_SIZE * 2, | |
50 | PROT_READ | PROT_WRITE | PROT_EXEC, | |
51 | MAP_ANONYMOUS | MAP_PRIVATE, 0); | |
52 | if (user_addr >= (unsigned long)(TASK_SIZE)) { | |
53 | pr_warn("Failed to allocate user memory\n"); | |
54 | kfree(kmem); | |
55 | return -ENOMEM; | |
56 | } | |
57 | ||
58 | usermem = (char __user *)user_addr; | |
59 | bad_usermem = (char *)user_addr; | |
60 | ||
e0d37cb1 KC |
61 | /* |
62 | * Legitimate usage: none of these copies should fail. | |
63 | */ | |
3e2a4c18 KC |
64 | ret |= test(copy_from_user(kmem, usermem, PAGE_SIZE), |
65 | "legitimate copy_from_user failed"); | |
66 | ret |= test(copy_to_user(usermem, kmem, PAGE_SIZE), | |
67 | "legitimate copy_to_user failed"); | |
68 | ret |= test(get_user(value, (unsigned long __user *)usermem), | |
69 | "legitimate get_user failed"); | |
70 | ret |= test(put_user(value, (unsigned long __user *)usermem), | |
71 | "legitimate put_user failed"); | |
72 | ||
e0d37cb1 KC |
73 | /* |
74 | * Invalid usage: none of these copies should succeed. | |
75 | */ | |
76 | ||
77 | /* Reject kernel-to-kernel copies through copy_from_user(). */ | |
3e2a4c18 KC |
78 | ret |= test(!copy_from_user(kmem, (char __user *)(kmem + PAGE_SIZE), |
79 | PAGE_SIZE), | |
80 | "illegal all-kernel copy_from_user passed"); | |
e0d37cb1 KC |
81 | |
82 | #if 0 | |
83 | /* | |
84 | * When running with SMAP/PAN/etc, this will Oops the kernel | |
85 | * due to the zeroing of userspace memory on failure. This needs | |
86 | * to be tested in LKDTM instead, since this test module does not | |
87 | * expect to explode. | |
88 | */ | |
3e2a4c18 KC |
89 | ret |= test(!copy_from_user(bad_usermem, (char __user *)kmem, |
90 | PAGE_SIZE), | |
91 | "illegal reversed copy_from_user passed"); | |
e0d37cb1 | 92 | #endif |
3e2a4c18 KC |
93 | ret |= test(!copy_to_user((char __user *)kmem, kmem + PAGE_SIZE, |
94 | PAGE_SIZE), | |
95 | "illegal all-kernel copy_to_user passed"); | |
96 | ret |= test(!copy_to_user((char __user *)kmem, bad_usermem, | |
97 | PAGE_SIZE), | |
98 | "illegal reversed copy_to_user passed"); | |
e0d37cb1 | 99 | |
3e2a4c18 KC |
100 | ret |= test(!get_user(value, (unsigned long __user *)kmem), |
101 | "illegal get_user passed"); | |
102 | ret |= test(!put_user(value, (unsigned long __user *)kmem), | |
103 | "illegal put_user passed"); | |
104 | ||
105 | vm_munmap(user_addr, PAGE_SIZE * 2); | |
106 | kfree(kmem); | |
107 | ||
108 | if (ret == 0) { | |
109 | pr_info("tests passed.\n"); | |
110 | return 0; | |
111 | } | |
112 | ||
113 | return -EINVAL; | |
114 | } | |
115 | ||
116 | module_init(test_user_copy_init); | |
117 | ||
118 | static void __exit test_user_copy_exit(void) | |
119 | { | |
120 | pr_info("unloaded.\n"); | |
121 | } | |
122 | ||
123 | module_exit(test_user_copy_exit); | |
124 | ||
125 | MODULE_AUTHOR("Kees Cook <keescook@chromium.org>"); | |
126 | MODULE_LICENSE("GPL"); |