1 // SPDX-License-Identifier: GPL-2.0-only
4 * Copyright (c) 2014 Samsung Electronics Co., Ltd.
5 * Author: Andrey Ryabinin <a.ryabinin@samsung.com>
8 #define pr_fmt(fmt) "kasan test: %s " fmt, __func__
10 #include <linux/bitops.h>
11 #include <linux/delay.h>
12 #include <linux/kasan.h>
13 #include <linux/kernel.h>
15 #include <linux/mman.h>
16 #include <linux/module.h>
17 #include <linux/printk.h>
18 #include <linux/slab.h>
19 #include <linux/string.h>
20 #include <linux/uaccess.h>
26 * We assign some test results to these globals to make sure the tests
27 * are not eliminated as dead code.
31 void *kasan_ptr_result;
34 * Note: test functions are marked noinline so that their names appear in
38 static noinline void __init kmalloc_oob_right(void)
43 pr_info("out-of-bounds to right\n");
44 ptr = kmalloc(size, GFP_KERNEL);
46 pr_err("Allocation failed\n");
54 static noinline void __init kmalloc_oob_left(void)
59 pr_info("out-of-bounds to left\n");
60 ptr = kmalloc(size, GFP_KERNEL);
62 pr_err("Allocation failed\n");
70 static noinline void __init kmalloc_node_oob_right(void)
75 pr_info("kmalloc_node(): out-of-bounds to right\n");
76 ptr = kmalloc_node(size, GFP_KERNEL, 0);
78 pr_err("Allocation failed\n");
87 static noinline void __init kmalloc_pagealloc_oob_right(void)
90 size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
92 /* Allocate a chunk that does not fit into a SLUB cache to trigger
93 * the page allocator fallback.
95 pr_info("kmalloc pagealloc allocation: out-of-bounds to right\n");
96 ptr = kmalloc(size, GFP_KERNEL);
98 pr_err("Allocation failed\n");
106 static noinline void __init kmalloc_pagealloc_uaf(void)
109 size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
111 pr_info("kmalloc pagealloc allocation: use-after-free\n");
112 ptr = kmalloc(size, GFP_KERNEL);
114 pr_err("Allocation failed\n");
122 static noinline void __init kmalloc_pagealloc_invalid_free(void)
125 size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
127 pr_info("kmalloc pagealloc allocation: invalid-free\n");
128 ptr = kmalloc(size, GFP_KERNEL);
130 pr_err("Allocation failed\n");
138 static noinline void __init kmalloc_large_oob_right(void)
141 size_t size = KMALLOC_MAX_CACHE_SIZE - 256;
142 /* Allocate a chunk that is large enough, but still fits into a slab
143 * and does not trigger the page allocator fallback in SLUB.
145 pr_info("kmalloc large allocation: out-of-bounds to right\n");
146 ptr = kmalloc(size, GFP_KERNEL);
148 pr_err("Allocation failed\n");
156 static noinline void __init kmalloc_oob_krealloc_more(void)
162 pr_info("out-of-bounds after krealloc more\n");
163 ptr1 = kmalloc(size1, GFP_KERNEL);
164 ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
165 if (!ptr1 || !ptr2) {
166 pr_err("Allocation failed\n");
176 static noinline void __init kmalloc_oob_krealloc_less(void)
182 pr_info("out-of-bounds after krealloc less\n");
183 ptr1 = kmalloc(size1, GFP_KERNEL);
184 ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
185 if (!ptr1 || !ptr2) {
186 pr_err("Allocation failed\n");
194 static noinline void __init kmalloc_oob_16(void)
200 pr_info("kmalloc out-of-bounds for 16-bytes access\n");
201 ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL);
202 ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
203 if (!ptr1 || !ptr2) {
204 pr_err("Allocation failed\n");
214 static noinline void __init kmalloc_oob_memset_2(void)
219 pr_info("out-of-bounds in memset2\n");
220 ptr = kmalloc(size, GFP_KERNEL);
222 pr_err("Allocation failed\n");
230 static noinline void __init kmalloc_oob_memset_4(void)
235 pr_info("out-of-bounds in memset4\n");
236 ptr = kmalloc(size, GFP_KERNEL);
238 pr_err("Allocation failed\n");
247 static noinline void __init kmalloc_oob_memset_8(void)
252 pr_info("out-of-bounds in memset8\n");
253 ptr = kmalloc(size, GFP_KERNEL);
255 pr_err("Allocation failed\n");
263 static noinline void __init kmalloc_oob_memset_16(void)
268 pr_info("out-of-bounds in memset16\n");
269 ptr = kmalloc(size, GFP_KERNEL);
271 pr_err("Allocation failed\n");
275 memset(ptr+1, 0, 16);
279 static noinline void __init kmalloc_oob_in_memset(void)
284 pr_info("out-of-bounds in memset\n");
285 ptr = kmalloc(size, GFP_KERNEL);
287 pr_err("Allocation failed\n");
291 memset(ptr, 0, size+5);
295 static noinline void __init kmalloc_uaf(void)
300 pr_info("use-after-free\n");
301 ptr = kmalloc(size, GFP_KERNEL);
303 pr_err("Allocation failed\n");
311 static noinline void __init kmalloc_uaf_memset(void)
316 pr_info("use-after-free in memset\n");
317 ptr = kmalloc(size, GFP_KERNEL);
319 pr_err("Allocation failed\n");
324 memset(ptr, 0, size);
327 static noinline void __init kmalloc_uaf2(void)
332 pr_info("use-after-free after another kmalloc\n");
333 ptr1 = kmalloc(size, GFP_KERNEL);
335 pr_err("Allocation failed\n");
340 ptr2 = kmalloc(size, GFP_KERNEL);
342 pr_err("Allocation failed\n");
348 pr_err("Could not detect use-after-free: ptr1 == ptr2\n");
352 static noinline void __init kfree_via_page(void)
357 unsigned long offset;
359 pr_info("invalid-free false positive (via page)\n");
360 ptr = kmalloc(size, GFP_KERNEL);
362 pr_err("Allocation failed\n");
366 page = virt_to_page(ptr);
367 offset = offset_in_page(ptr);
368 kfree(page_address(page) + offset);
371 static noinline void __init kfree_via_phys(void)
377 pr_info("invalid-free false positive (via phys)\n");
378 ptr = kmalloc(size, GFP_KERNEL);
380 pr_err("Allocation failed\n");
384 phys = virt_to_phys(ptr);
385 kfree(phys_to_virt(phys));
388 static noinline void __init kmem_cache_oob(void)
392 struct kmem_cache *cache = kmem_cache_create("test_cache",
396 pr_err("Cache allocation failed\n");
399 pr_info("out-of-bounds in kmem_cache_alloc\n");
400 p = kmem_cache_alloc(cache, GFP_KERNEL);
402 pr_err("Allocation failed\n");
403 kmem_cache_destroy(cache);
408 kmem_cache_free(cache, p);
409 kmem_cache_destroy(cache);
412 static noinline void __init memcg_accounted_kmem_cache(void)
417 struct kmem_cache *cache;
419 cache = kmem_cache_create("test_cache", size, 0, SLAB_ACCOUNT, NULL);
421 pr_err("Cache allocation failed\n");
425 pr_info("allocate memcg accounted object\n");
427 * Several allocations with a delay to allow for lazy per memcg kmem
430 for (i = 0; i < 5; i++) {
431 p = kmem_cache_alloc(cache, GFP_KERNEL);
435 kmem_cache_free(cache, p);
440 kmem_cache_destroy(cache);
443 static char global_array[10];
445 static noinline void __init kasan_global_oob(void)
448 char *p = &global_array[ARRAY_SIZE(global_array) + i];
450 pr_info("out-of-bounds global variable\n");
454 static noinline void __init kasan_stack_oob(void)
456 char stack_array[10];
458 char *p = &stack_array[ARRAY_SIZE(stack_array) + i];
460 pr_info("out-of-bounds on stack\n");
464 static noinline void __init ksize_unpoisons_memory(void)
467 size_t size = 123, real_size;
469 pr_info("ksize() unpoisons the whole allocated chunk\n");
470 ptr = kmalloc(size, GFP_KERNEL);
472 pr_err("Allocation failed\n");
475 real_size = ksize(ptr);
476 /* This access doesn't trigger an error. */
479 ptr[real_size] = 'y';
483 static noinline void __init copy_user_test(void)
486 char __user *usermem;
490 kmem = kmalloc(size, GFP_KERNEL);
494 usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE,
495 PROT_READ | PROT_WRITE | PROT_EXEC,
496 MAP_ANONYMOUS | MAP_PRIVATE, 0);
497 if (IS_ERR(usermem)) {
498 pr_err("Failed to allocate user memory\n");
503 pr_info("out-of-bounds in copy_from_user()\n");
504 unused = copy_from_user(kmem, usermem, size + 1);
506 pr_info("out-of-bounds in copy_to_user()\n");
507 unused = copy_to_user(usermem, kmem, size + 1);
509 pr_info("out-of-bounds in __copy_from_user()\n");
510 unused = __copy_from_user(kmem, usermem, size + 1);
512 pr_info("out-of-bounds in __copy_to_user()\n");
513 unused = __copy_to_user(usermem, kmem, size + 1);
515 pr_info("out-of-bounds in __copy_from_user_inatomic()\n");
516 unused = __copy_from_user_inatomic(kmem, usermem, size + 1);
518 pr_info("out-of-bounds in __copy_to_user_inatomic()\n");
519 unused = __copy_to_user_inatomic(usermem, kmem, size + 1);
521 pr_info("out-of-bounds in strncpy_from_user()\n");
522 unused = strncpy_from_user(kmem, usermem, size + 1);
524 vm_munmap((unsigned long)usermem, PAGE_SIZE);
528 static noinline void __init kasan_alloca_oob_left(void)
531 char alloca_array[i];
532 char *p = alloca_array - 1;
534 pr_info("out-of-bounds to left on alloca\n");
538 static noinline void __init kasan_alloca_oob_right(void)
541 char alloca_array[i];
542 char *p = alloca_array + i;
544 pr_info("out-of-bounds to right on alloca\n");
548 static noinline void __init kmem_cache_double_free(void)
552 struct kmem_cache *cache;
554 cache = kmem_cache_create("test_cache", size, 0, 0, NULL);
556 pr_err("Cache allocation failed\n");
559 pr_info("double-free on heap object\n");
560 p = kmem_cache_alloc(cache, GFP_KERNEL);
562 pr_err("Allocation failed\n");
563 kmem_cache_destroy(cache);
567 kmem_cache_free(cache, p);
568 kmem_cache_free(cache, p);
569 kmem_cache_destroy(cache);
572 static noinline void __init kmem_cache_invalid_free(void)
576 struct kmem_cache *cache;
578 cache = kmem_cache_create("test_cache", size, 0, SLAB_TYPESAFE_BY_RCU,
581 pr_err("Cache allocation failed\n");
584 pr_info("invalid-free of heap object\n");
585 p = kmem_cache_alloc(cache, GFP_KERNEL);
587 pr_err("Allocation failed\n");
588 kmem_cache_destroy(cache);
592 /* Trigger invalid free, the object doesn't get freed */
593 kmem_cache_free(cache, p + 1);
596 * Properly free the object to prevent the "Objects remaining in
597 * test_cache on __kmem_cache_shutdown" BUG failure.
599 kmem_cache_free(cache, p);
601 kmem_cache_destroy(cache);
604 static noinline void __init kasan_memchr(void)
609 pr_info("out-of-bounds in memchr\n");
610 ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
614 kasan_ptr_result = memchr(ptr, '1', size + 1);
618 static noinline void __init kasan_memcmp(void)
624 pr_info("out-of-bounds in memcmp\n");
625 ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
629 memset(arr, 0, sizeof(arr));
630 kasan_int_result = memcmp(ptr, arr, size + 1);
634 static noinline void __init kasan_strings(void)
639 pr_info("use-after-free in strchr\n");
640 ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
647 * Try to cause only 1 invalid access (less spam in dmesg).
648 * For that we need ptr to point to zeroed byte.
649 * Skip metadata that could be stored in freed object so ptr
650 * will likely point to zeroed byte.
653 kasan_ptr_result = strchr(ptr, '1');
655 pr_info("use-after-free in strrchr\n");
656 kasan_ptr_result = strrchr(ptr, '1');
658 pr_info("use-after-free in strcmp\n");
659 kasan_int_result = strcmp(ptr, "2");
661 pr_info("use-after-free in strncmp\n");
662 kasan_int_result = strncmp(ptr, "2", 1);
664 pr_info("use-after-free in strlen\n");
665 kasan_int_result = strlen(ptr);
667 pr_info("use-after-free in strnlen\n");
668 kasan_int_result = strnlen(ptr, 1);
671 static noinline void __init kasan_bitops(void)
674 * Allocate 1 more byte, which causes kzalloc to round up to 16-bytes;
675 * this way we do not actually corrupt other memory.
677 long *bits = kzalloc(sizeof(*bits) + 1, GFP_KERNEL);
682 * Below calls try to access bit within allocated memory; however, the
683 * below accesses are still out-of-bounds, since bitops are defined to
684 * operate on the whole long the bit is in.
686 pr_info("out-of-bounds in set_bit\n");
687 set_bit(BITS_PER_LONG, bits);
689 pr_info("out-of-bounds in __set_bit\n");
690 __set_bit(BITS_PER_LONG, bits);
692 pr_info("out-of-bounds in clear_bit\n");
693 clear_bit(BITS_PER_LONG, bits);
695 pr_info("out-of-bounds in __clear_bit\n");
696 __clear_bit(BITS_PER_LONG, bits);
698 pr_info("out-of-bounds in clear_bit_unlock\n");
699 clear_bit_unlock(BITS_PER_LONG, bits);
701 pr_info("out-of-bounds in __clear_bit_unlock\n");
702 __clear_bit_unlock(BITS_PER_LONG, bits);
704 pr_info("out-of-bounds in change_bit\n");
705 change_bit(BITS_PER_LONG, bits);
707 pr_info("out-of-bounds in __change_bit\n");
708 __change_bit(BITS_PER_LONG, bits);
711 * Below calls try to access bit beyond allocated memory.
713 pr_info("out-of-bounds in test_and_set_bit\n");
714 test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
716 pr_info("out-of-bounds in __test_and_set_bit\n");
717 __test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
719 pr_info("out-of-bounds in test_and_set_bit_lock\n");
720 test_and_set_bit_lock(BITS_PER_LONG + BITS_PER_BYTE, bits);
722 pr_info("out-of-bounds in test_and_clear_bit\n");
723 test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
725 pr_info("out-of-bounds in __test_and_clear_bit\n");
726 __test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
728 pr_info("out-of-bounds in test_and_change_bit\n");
729 test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
731 pr_info("out-of-bounds in __test_and_change_bit\n");
732 __test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
734 pr_info("out-of-bounds in test_bit\n");
735 kasan_int_result = test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
737 #if defined(clear_bit_unlock_is_negative_byte)
738 pr_info("out-of-bounds in clear_bit_unlock_is_negative_byte\n");
739 kasan_int_result = clear_bit_unlock_is_negative_byte(BITS_PER_LONG +
740 BITS_PER_BYTE, bits);
745 static noinline void __init kmalloc_double_kzfree(void)
750 pr_info("double-free (kzfree)\n");
751 ptr = kmalloc(size, GFP_KERNEL);
753 pr_err("Allocation failed\n");
761 static int __init kmalloc_tests_init(void)
764 * Temporarily enable multi-shot mode. Otherwise, we'd only get a
765 * report for the first case.
767 bool multishot = kasan_save_enable_multi_shot();
771 kmalloc_node_oob_right();
773 kmalloc_pagealloc_oob_right();
774 kmalloc_pagealloc_uaf();
775 kmalloc_pagealloc_invalid_free();
777 kmalloc_large_oob_right();
778 kmalloc_oob_krealloc_more();
779 kmalloc_oob_krealloc_less();
781 kmalloc_oob_in_memset();
782 kmalloc_oob_memset_2();
783 kmalloc_oob_memset_4();
784 kmalloc_oob_memset_8();
785 kmalloc_oob_memset_16();
787 kmalloc_uaf_memset();
792 memcg_accounted_kmem_cache();
795 kasan_alloca_oob_left();
796 kasan_alloca_oob_right();
797 ksize_unpoisons_memory();
799 kmem_cache_double_free();
800 kmem_cache_invalid_free();
805 kmalloc_double_kzfree();
807 kasan_restore_multi_shot(multishot);
812 module_init(kmalloc_tests_init);
813 MODULE_LICENSE("GPL");