drivers/misc/lkdtm_usercopy.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * This is for all the tests related to copy_to_user() and copy_from_user()
   4  * hardening.
   5  */
   6 #include "lkdtm.h"
   7 #include <linux/slab.h>
   8 #include <linux/vmalloc.h>
   9 #include <linux/sched/task_stack.h>
  10 #include <linux/mman.h>
  11 #include <linux/uaccess.h>
  12 #include <asm/cacheflush.h>
  13
  14 /*
  15  * Many of the tests here end up using const sizes, but those would
  16  * normally be ignored by hardened usercopy, so force the compiler
  17  * into choosing the non-const path to make sure we trigger the
  18  * hardened usercopy checks by added "unconst" to all the const copies,
  19  * and making sure "cache_size" isn't optimized into a const.
  20  */
  21 static volatile size_t unconst = 0;
  22 static volatile size_t cache_size = 1024;
  23 static struct kmem_cache *bad_cache;
  24
  25 static const unsigned char test_text[] = "This is a test.\n";
  26
  27 /*
  28  * Instead of adding -Wno-return-local-addr, just pass the stack address
  29  * through a function to obfuscate it from the compiler.
  30  */
  31 static noinline unsigned char *trick_compiler(unsigned char *stack)
  32 {
  33         return stack + unconst;
  34 }
  35
  36 static noinline unsigned char *do_usercopy_stack_callee(int value)
  37 {
  38         unsigned char buf[128];
  39         int i;
  40
  41         /* Exercise stack to avoid everything living in registers. */
  42         for (i = 0; i < sizeof(buf); i++) {
  43                 buf[i] = value & 0xff;
  44         }
  45
  46         /*
  47          * Put the target buffer in the middle of stack allocation
  48          * so that we don't step on future stack users regardless
  49          * of stack growth direction.
  50          */
  51         return trick_compiler(&buf[(128/2)-32]);
  52 }
  53
  54 static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
  55 {
  56         unsigned long user_addr;
  57         unsigned char good_stack[32];
  58         unsigned char *bad_stack;
  59         int i;
  60
  61         /* Exercise stack to avoid everything living in registers. */
  62         for (i = 0; i < sizeof(good_stack); i++)
  63                 good_stack[i] = test_text[i % sizeof(test_text)];
  64
  65         /* This is a pointer to outside our current stack frame. */
  66         if (bad_frame) {
  67                 bad_stack = do_usercopy_stack_callee((uintptr_t)&bad_stack);
  68         } else {
  69                 /* Put start address just inside stack. */
  70                 bad_stack = task_stack_page(current) + THREAD_SIZE;
  71                 bad_stack -= sizeof(unsigned long);
  72         }
  73
  74 #ifdef ARCH_HAS_CURRENT_STACK_POINTER
  75         pr_info("stack     : %px\n", (void *)current_stack_pointer);
  76 #endif
  77         pr_info("good_stack: %px-%px\n", good_stack, good_stack + sizeof(good_stack));
  78         pr_info("bad_stack : %px-%px\n", bad_stack, bad_stack + sizeof(good_stack));
  79
  80         user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
  81                             PROT_READ | PROT_WRITE | PROT_EXEC,
  82                             MAP_ANONYMOUS | MAP_PRIVATE, 0);
  83         if (user_addr >= TASK_SIZE) {
  84                 pr_warn("Failed to allocate user memory\n");
  85                 return;
  86         }
  87
  88         if (to_user) {
  89                 pr_info("attempting good copy_to_user of local stack\n");
  90                 if (copy_to_user((void __user *)user_addr, good_stack,
  91                                  unconst + sizeof(good_stack))) {
  92                         pr_warn("copy_to_user failed unexpectedly?!\n");
  93                         goto free_user;
  94                 }
  95
  96                 pr_info("attempting bad copy_to_user of distant stack\n");
  97                 if (copy_to_user((void __user *)user_addr, bad_stack,
  98                                  unconst + sizeof(good_stack))) {
  99                         pr_warn("copy_to_user failed, but lacked Oops\n");
 100                         goto free_user;
 101                 }
 102         } else {
 103                 /*
 104                  * There isn't a safe way to not be protected by usercopy
 105                  * if we're going to write to another thread's stack.
 106                  */
 107                 if (!bad_frame)
 108                         goto free_user;
 109
 110                 pr_info("attempting good copy_from_user of local stack\n");
 111                 if (copy_from_user(good_stack, (void __user *)user_addr,
 112                                    unconst + sizeof(good_stack))) {
 113                         pr_warn("copy_from_user failed unexpectedly?!\n");
 114                         goto free_user;
 115                 }
 116
 117                 pr_info("attempting bad copy_from_user of distant stack\n");
 118                 if (copy_from_user(bad_stack, (void __user *)user_addr,
 119                                    unconst + sizeof(good_stack))) {
 120                         pr_warn("copy_from_user failed, but lacked Oops\n");
 121                         goto free_user;
 122                 }
 123         }
 124
 125 free_user:
 126         vm_munmap(user_addr, PAGE_SIZE);
 127 }
 128
 129 static void do_usercopy_heap_size(bool to_user)
 130 {
 131         unsigned long user_addr;
 132         unsigned char *one, *two;
 133         size_t size = unconst + 1024;
 134
 135         one = kmalloc(size, GFP_KERNEL);
 136         two = kmalloc(size, GFP_KERNEL);
 137         if (!one || !two) {
 138                 pr_warn("Failed to allocate kernel memory\n");
 139                 goto free_kernel;
 140         }
 141
 142         user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
 143                             PROT_READ | PROT_WRITE | PROT_EXEC,
 144                             MAP_ANONYMOUS | MAP_PRIVATE, 0);
 145         if (user_addr >= TASK_SIZE) {
 146                 pr_warn("Failed to allocate user memory\n");
 147                 goto free_kernel;
 148         }
 149
 150         memset(one, 'A', size);
 151         memset(two, 'B', size);
 152
 153         if (to_user) {
 154                 pr_info("attempting good copy_to_user of correct size\n");
 155                 if (copy_to_user((void __user *)user_addr, one, size)) {
 156                         pr_warn("copy_to_user failed unexpectedly?!\n");
 157                         goto free_user;
 158                 }
 159
 160                 pr_info("attempting bad copy_to_user of too large size\n");
 161                 if (copy_to_user((void __user *)user_addr, one, 2 * size)) {
 162                         pr_warn("copy_to_user failed, but lacked Oops\n");
 163                         goto free_user;
 164                 }
 165         } else {
 166                 pr_info("attempting good copy_from_user of correct size\n");
 167                 if (copy_from_user(one, (void __user *)user_addr, size)) {
 168                         pr_warn("copy_from_user failed unexpectedly?!\n");
 169                         goto free_user;
 170                 }
 171
 172                 pr_info("attempting bad copy_from_user of too large size\n");
 173                 if (copy_from_user(one, (void __user *)user_addr, 2 * size)) {
 174                         pr_warn("copy_from_user failed, but lacked Oops\n");
 175                         goto free_user;
 176                 }
 177         }
 178
 179 free_user:
 180         vm_munmap(user_addr, PAGE_SIZE);
 181 free_kernel:
 182         kfree(one);
 183         kfree(two);
 184 }
 185
 186 static void do_usercopy_heap_flag(bool to_user)
 187 {
 188         unsigned long user_addr;
 189         unsigned char *good_buf = NULL;
 190         unsigned char *bad_buf = NULL;
 191
 192         /* Make sure cache was prepared. */
 193         if (!bad_cache) {
 194                 pr_warn("Failed to allocate kernel cache\n");
 195                 return;
 196         }
 197
 198         /*
 199          * Allocate one buffer from each cache (kmalloc will have the
 200          * SLAB_USERCOPY flag already, but "bad_cache" won't).
 201          */
 202         good_buf = kmalloc(cache_size, GFP_KERNEL);
 203         bad_buf = kmem_cache_alloc(bad_cache, GFP_KERNEL);
 204         if (!good_buf || !bad_buf) {
 205                 pr_warn("Failed to allocate buffers from caches\n");
 206                 goto free_alloc;
 207         }
 208
 209         /* Allocate user memory we'll poke at. */
 210         user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
 211                             PROT_READ | PROT_WRITE | PROT_EXEC,
 212                             MAP_ANONYMOUS | MAP_PRIVATE, 0);
 213         if (user_addr >= TASK_SIZE) {
 214                 pr_warn("Failed to allocate user memory\n");
 215                 goto free_alloc;
 216         }
 217
 218         memset(good_buf, 'A', cache_size);
 219         memset(bad_buf, 'B', cache_size);
 220
 221         if (to_user) {
 222                 pr_info("attempting good copy_to_user with SLAB_USERCOPY\n");
 223                 if (copy_to_user((void __user *)user_addr, good_buf,
 224                                  cache_size)) {
 225                         pr_warn("copy_to_user failed unexpectedly?!\n");
 226                         goto free_user;
 227                 }
 228
 229                 pr_info("attempting bad copy_to_user w/o SLAB_USERCOPY\n");
 230                 if (copy_to_user((void __user *)user_addr, bad_buf,
 231                                  cache_size)) {
 232                         pr_warn("copy_to_user failed, but lacked Oops\n");
 233                         goto free_user;
 234                 }
 235         } else {
 236                 pr_info("attempting good copy_from_user with SLAB_USERCOPY\n");
 237                 if (copy_from_user(good_buf, (void __user *)user_addr,
 238                                    cache_size)) {
 239                         pr_warn("copy_from_user failed unexpectedly?!\n");
 240                         goto free_user;
 241                 }
 242
 243                 pr_info("attempting bad copy_from_user w/o SLAB_USERCOPY\n");
 244                 if (copy_from_user(bad_buf, (void __user *)user_addr,
 245                                    cache_size)) {
 246                         pr_warn("copy_from_user failed, but lacked Oops\n");
 247                         goto free_user;
 248                 }
 249         }
 250
 251 free_user:
 252         vm_munmap(user_addr, PAGE_SIZE);
 253 free_alloc:
 254         if (bad_buf)
 255                 kmem_cache_free(bad_cache, bad_buf);
 256         kfree(good_buf);
 257 }
 258
 259 /* Callable tests. */
 260 void lkdtm_USERCOPY_HEAP_SIZE_TO(void)
 261 {
 262         do_usercopy_heap_size(true);
 263 }
 264
 265 void lkdtm_USERCOPY_HEAP_SIZE_FROM(void)
 266 {
 267         do_usercopy_heap_size(false);
 268 }
 269
 270 void lkdtm_USERCOPY_HEAP_FLAG_TO(void)
 271 {
 272         do_usercopy_heap_flag(true);
 273 }
 274
 275 void lkdtm_USERCOPY_HEAP_FLAG_FROM(void)
 276 {
 277         do_usercopy_heap_flag(false);
 278 }
 279
 280 void lkdtm_USERCOPY_STACK_FRAME_TO(void)
 281 {
 282         do_usercopy_stack(true, true);
 283 }
 284
 285 void lkdtm_USERCOPY_STACK_FRAME_FROM(void)
 286 {
 287         do_usercopy_stack(false, true);
 288 }
 289
 290 void lkdtm_USERCOPY_STACK_BEYOND(void)
 291 {
 292         do_usercopy_stack(true, false);
 293 }
 294
 295 void lkdtm_USERCOPY_KERNEL(void)
 296 {
 297         unsigned long user_addr;
 298
 299         user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
 300                             PROT_READ | PROT_WRITE | PROT_EXEC,
 301                             MAP_ANONYMOUS | MAP_PRIVATE, 0);
 302         if (user_addr >= TASK_SIZE) {
 303                 pr_warn("Failed to allocate user memory\n");
 304                 return;
 305         }
 306
 307         pr_info("attempting good copy_to_user from kernel rodata\n");
 308         if (copy_to_user((void __user *)user_addr, test_text,
 309                          unconst + sizeof(test_text))) {
 310                 pr_warn("copy_to_user failed unexpectedly?!\n");
 311                 goto free_user;
 312         }
 313
 314         pr_info("attempting bad copy_to_user from kernel text\n");
 315         if (copy_to_user((void __user *)user_addr, vm_mmap,
 316                          unconst + PAGE_SIZE)) {
 317                 pr_warn("copy_to_user failed, but lacked Oops\n");
 318                 goto free_user;
 319         }
 320
 321 free_user:
 322         vm_munmap(user_addr, PAGE_SIZE);
 323 }
 324
 325 void __init lkdtm_usercopy_init(void)
 326 {
 327         /* Prepare cache that lacks SLAB_USERCOPY flag. */
 328         bad_cache = kmem_cache_create("lkdtm-no-usercopy", cache_size, 0,
 329                                       0, NULL);
 330 }
 331
 332 void __exit lkdtm_usercopy_exit(void)
 333 {
 334         kmem_cache_destroy(bad_cache);
 335 }