blob: 5e6db6b1e3bdc54b0405dd8033e61f31dd8c8c71
1 | /* |
2 | * Kernel module for testing copy_to/from_user infrastructure. |
3 | * |
4 | * Copyright 2013 Google Inc. All Rights Reserved |
5 | * |
6 | * Authors: |
7 | * Kees Cook <keescook@chromium.org> |
8 | * |
9 | * This software is licensed under the terms of the GNU General Public |
10 | * License version 2, as published by the Free Software Foundation, and |
11 | * may be copied, distributed, and modified under those terms. |
12 | * |
13 | * This program is distributed in the hope that it will be useful, |
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
16 | * GNU General Public License for more details. |
17 | */ |
18 | |
19 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
20 | |
21 | #include <linux/mman.h> |
22 | #include <linux/module.h> |
23 | #include <linux/sched.h> |
24 | #include <linux/slab.h> |
25 | #include <linux/uaccess.h> |
26 | #include <linux/vmalloc.h> |
27 | |
28 | #define test(condition, msg) \ |
29 | ({ \ |
30 | int cond = (condition); \ |
31 | if (cond) \ |
32 | pr_warn("%s\n", msg); \ |
33 | cond; \ |
34 | }) |
35 | |
36 | static int __init test_user_copy_init(void) |
37 | { |
38 | int ret = 0; |
39 | char *kmem; |
40 | char __user *usermem; |
41 | char *bad_usermem; |
42 | unsigned long user_addr; |
43 | unsigned long value = 0x5A; |
44 | |
45 | kmem = kmalloc(PAGE_SIZE * 2, GFP_KERNEL); |
46 | if (!kmem) |
47 | return -ENOMEM; |
48 | |
49 | user_addr = vm_mmap(NULL, 0, PAGE_SIZE * 2, |
50 | PROT_READ | PROT_WRITE | PROT_EXEC, |
51 | MAP_ANONYMOUS | MAP_PRIVATE, 0); |
52 | if (user_addr >= (unsigned long)(TASK_SIZE)) { |
53 | pr_warn("Failed to allocate user memory\n"); |
54 | kfree(kmem); |
55 | return -ENOMEM; |
56 | } |
57 | |
58 | usermem = (char __user *)user_addr; |
59 | bad_usermem = (char *)user_addr; |
60 | |
61 | /* |
62 | * Legitimate usage: none of these copies should fail. |
63 | */ |
64 | ret |= test(copy_from_user(kmem, usermem, PAGE_SIZE), |
65 | "legitimate copy_from_user failed"); |
66 | ret |= test(copy_to_user(usermem, kmem, PAGE_SIZE), |
67 | "legitimate copy_to_user failed"); |
68 | ret |= test(get_user(value, (unsigned long __user *)usermem), |
69 | "legitimate get_user failed"); |
70 | ret |= test(put_user(value, (unsigned long __user *)usermem), |
71 | "legitimate put_user failed"); |
72 | |
73 | /* |
74 | * Invalid usage: none of these copies should succeed. |
75 | */ |
76 | |
77 | /* Reject kernel-to-kernel copies through copy_from_user(). */ |
78 | ret |= test(!copy_from_user(kmem, (char __user *)(kmem + PAGE_SIZE), |
79 | PAGE_SIZE), |
80 | "illegal all-kernel copy_from_user passed"); |
81 | |
82 | #if 0 |
83 | /* |
84 | * When running with SMAP/PAN/etc, this will Oops the kernel |
85 | * due to the zeroing of userspace memory on failure. This needs |
86 | * to be tested in LKDTM instead, since this test module does not |
87 | * expect to explode. |
88 | */ |
89 | ret |= test(!copy_from_user(bad_usermem, (char __user *)kmem, |
90 | PAGE_SIZE), |
91 | "illegal reversed copy_from_user passed"); |
92 | #endif |
93 | ret |= test(!copy_to_user((char __user *)kmem, kmem + PAGE_SIZE, |
94 | PAGE_SIZE), |
95 | "illegal all-kernel copy_to_user passed"); |
96 | ret |= test(!copy_to_user((char __user *)kmem, bad_usermem, |
97 | PAGE_SIZE), |
98 | "illegal reversed copy_to_user passed"); |
99 | |
100 | ret |= test(!get_user(value, (unsigned long __user *)kmem), |
101 | "illegal get_user passed"); |
102 | ret |= test(!put_user(value, (unsigned long __user *)kmem), |
103 | "illegal put_user passed"); |
104 | |
105 | vm_munmap(user_addr, PAGE_SIZE * 2); |
106 | kfree(kmem); |
107 | |
108 | if (ret == 0) { |
109 | pr_info("tests passed.\n"); |
110 | return 0; |
111 | } |
112 | |
113 | return -EINVAL; |
114 | } |
115 | |
116 | module_init(test_user_copy_init); |
117 | |
118 | static void __exit test_user_copy_exit(void) |
119 | { |
120 | pr_info("unloaded.\n"); |
121 | } |
122 | |
123 | module_exit(test_user_copy_exit); |
124 | |
125 | MODULE_AUTHOR("Kees Cook <keescook@chromium.org>"); |
126 | MODULE_LICENSE("GPL"); |
127 |