lib/test_stackinit.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * Test cases for compiler-based stack variable zeroing via future
   4  * compiler flags or CONFIG_GCC_PLUGIN_STRUCTLEAK*.
   5  */
   6 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
   7
   8 #include <linux/init.h>
   9 #include <linux/kernel.h>
  10 #include <linux/module.h>
  11 #include <linux/string.h>
  12
  13 /* Exfiltration buffer. */
  14 #define MAX_VAR_SIZE    128
  15 static u8 check_buf[MAX_VAR_SIZE];
  16
  17 /* Character array to trigger stack protector in all functions. */
  18 #define VAR_BUFFER       32
  19
  20 /* Volatile mask to convince compiler to copy memory with 0xff. */
  21 static volatile u8 forced_mask = 0xff;
  22
  23 /* Location and size tracking to validate fill and test are colocated. */
  24 static void *fill_start, *target_start;
  25 static size_t fill_size, target_size;
  26
  27 static bool range_contains(char *haystack_start, size_t haystack_size,
  28                            char *needle_start, size_t needle_size)
  29 {
  30         if (needle_start >= haystack_start &&
  31             needle_start + needle_size <= haystack_start + haystack_size)
  32                 return true;
  33         return false;
  34 }
  35
  36 #define DO_NOTHING_TYPE_SCALAR(var_type)        var_type
  37 #define DO_NOTHING_TYPE_STRING(var_type)        void
  38 #define DO_NOTHING_TYPE_STRUCT(var_type)        void
  39
  40 #define DO_NOTHING_RETURN_SCALAR(ptr)           *(ptr)
  41 #define DO_NOTHING_RETURN_STRING(ptr)           /**/
  42 #define DO_NOTHING_RETURN_STRUCT(ptr)           /**/
  43
  44 #define DO_NOTHING_CALL_SCALAR(var, name)                       \
  45                 (var) = do_nothing_ ## name(&(var))
  46 #define DO_NOTHING_CALL_STRING(var, name)                       \
  47                 do_nothing_ ## name(var)
  48 #define DO_NOTHING_CALL_STRUCT(var, name)                       \
  49                 do_nothing_ ## name(&(var))
  50
  51 #define FETCH_ARG_SCALAR(var)           &var
  52 #define FETCH_ARG_STRING(var)           var
  53 #define FETCH_ARG_STRUCT(var)           &var
  54
  55 #define FILL_SIZE_STRING                16
  56
  57 #define INIT_CLONE_SCALAR               /**/
  58 #define INIT_CLONE_STRING               [FILL_SIZE_STRING]
  59 #define INIT_CLONE_STRUCT               /**/
  60
  61 #define INIT_SCALAR_none                /**/
  62 #define INIT_SCALAR_zero                = 0
  63
  64 #define INIT_STRING_none                [FILL_SIZE_STRING] /**/
  65 #define INIT_STRING_zero                [FILL_SIZE_STRING] = { }
  66
  67 #define INIT_STRUCT_none                /**/
  68 #define INIT_STRUCT_zero                = { }
  69 #define INIT_STRUCT_static_partial      = { .two = 0, }
  70 #define INIT_STRUCT_static_all          = { .one = 0,                   \
  71                                             .two = 0,                   \
  72                                             .three = 0,                 \
  73                                             .four = 0,                  \
  74                                         }
  75 #define INIT_STRUCT_dynamic_partial     = { .two = arg->two, }
  76 #define INIT_STRUCT_dynamic_all         = { .one = arg->one,            \
  77                                             .two = arg->two,            \
  78                                             .three = arg->three,        \
  79                                             .four = arg->four,          \
  80                                         }
  81 #define INIT_STRUCT_runtime_partial     ;                               \
  82                                         var.two = 0
  83 #define INIT_STRUCT_runtime_all         ;                               \
  84                                         var.one = 0;                    \
  85                                         var.two = 0;                    \
  86                                         var.three = 0;                  \
  87                                         var.four = 0
  88
  89 /*
  90  * @name: unique string name for the test
  91  * @var_type: type to be tested for zeroing initialization
  92  * @which: is this a SCALAR, STRING, or STRUCT type?
  93  * @init_level: what kind of initialization is performed
  94  */
  95 #define DEFINE_TEST_DRIVER(name, var_type, which)               \
  96 /* Returns 0 on success, 1 on failure. */                       \
  97 static noinline __init int test_ ## name (void)                 \
  98 {                                                               \
  99         var_type zero INIT_CLONE_ ## which;                     \
 100         int ignored;                                            \
 101         u8 sum = 0, i;                                          \
 102                                                                 \
 103         /* Notice when a new test is larger than expected. */   \
 104         BUILD_BUG_ON(sizeof(zero) > MAX_VAR_SIZE);              \
 105                                                                 \
 106         /* Fill clone type with zero for per-field init. */     \
 107         memset(&zero, 0x00, sizeof(zero));                      \
 108         /* Clear entire check buffer for 0xFF overlap test. */  \
 109         memset(check_buf, 0x00, sizeof(check_buf));             \
 110         /* Fill stack with 0xFF. */                             \
 111         ignored = leaf_ ##name((unsigned long)&ignored, 1,      \
 112                                 FETCH_ARG_ ## which(zero));     \
 113         /* Verify all bytes overwritten with 0xFF. */           \
 114         for (sum = 0, i = 0; i < target_size; i++)              \
 115                 sum += (check_buf[i] != 0xFF);                  \
 116         if (sum) {                                              \
 117                 pr_err(#name ": leaf fill was not 0xFF!?\n");   \
 118                 return 1;                                       \
 119         }                                                       \
 120         /* Clear entire check buffer for later bit tests. */    \
 121         memset(check_buf, 0x00, sizeof(check_buf));             \
 122         /* Extract stack-defined variable contents. */          \
 123         ignored = leaf_ ##name((unsigned long)&ignored, 0,      \
 124                                 FETCH_ARG_ ## which(zero));     \
 125                                                                 \
 126         /* Validate that compiler lined up fill and target. */  \
 127         if (!range_contains(fill_start, fill_size,              \
 128                             target_start, target_size)) {       \
 129                 pr_err(#name ": stack fill missed target!?\n"); \
 130                 pr_err(#name ": fill %zu wide\n", fill_size);   \
 131                 pr_err(#name ": target offset by %d\n", \
 132                         (int)((ssize_t)(uintptr_t)fill_start -  \
 133                         (ssize_t)(uintptr_t)target_start));     \
 134                 return 1;                                       \
 135         }                                                       \
 136                                                                 \
 137         /* Look for any bytes still 0xFF in check region. */    \
 138         for (sum = 0, i = 0; i < target_size; i++)              \
 139                 sum += (check_buf[i] == 0xFF);                  \
 140                                                                 \
 141         if (sum == 0)                                           \
 142                 pr_info(#name " ok\n");                         \
 143         else                                                    \
 144                 pr_warn(#name " FAIL (uninit bytes: %d)\n",     \
 145                         sum);                                   \
 146                                                                 \
 147         return (sum != 0);                                      \
 148 }
 149 #define DEFINE_TEST(name, var_type, which, init_level)          \
 150 /* no-op to force compiler into ignoring "uninitialized" vars */\
 151 static noinline __init DO_NOTHING_TYPE_ ## which(var_type)      \
 152 do_nothing_ ## name(var_type *ptr)                              \
 153 {                                                               \
 154         /* Will always be true, but compiler doesn't know. */   \
 155         if ((unsigned long)ptr > 0x2)                           \
 156                 return DO_NOTHING_RETURN_ ## which(ptr);        \
 157         else                                                    \
 158                 return DO_NOTHING_RETURN_ ## which(ptr + 1);    \
 159 }                                                               \
 160 static noinline __init int leaf_ ## name(unsigned long sp,      \
 161                                          bool fill,             \
 162                                          var_type *arg)         \
 163 {                                                               \
 164         char buf[VAR_BUFFER];                                   \
 165         var_type var INIT_ ## which ## _ ## init_level;         \
 166                                                                 \
 167         target_start = &var;                                    \
 168         target_size = sizeof(var);                              \
 169         /*                                                      \
 170          * Keep this buffer around to make sure we've got a     \
 171          * stack frame of SOME kind...                          \
 172          */                                                     \
 173         memset(buf, (char)(sp & 0xff), sizeof(buf));            \
 174         /* Fill variable with 0xFF. */                          \
 175         if (fill) {                                             \
 176                 fill_start = &var;                              \
 177                 fill_size = sizeof(var);                        \
 178                 memset(fill_start,                              \
 179                        (char)((sp & 0xff) | forced_mask),       \
 180                        fill_size);                              \
 181         }                                                       \
 182                                                                 \
 183         /* Silence "never initialized" warnings. */             \
 184         DO_NOTHING_CALL_ ## which(var, name);                   \
 185                                                                 \
 186         /* Exfiltrate "var". */                                 \
 187         memcpy(check_buf, target_start, target_size);           \
 188                                                                 \
 189         return (int)buf[0] | (int)buf[sizeof(buf) - 1];         \
 190 }                                                               \
 191 DEFINE_TEST_DRIVER(name, var_type, which)
 192
 193 /* Structure with no padding. */
 194 struct test_packed {
 195         unsigned long one;
 196         unsigned long two;
 197         unsigned long three;
 198         unsigned long four;
 199 };
 200
 201 /* Simple structure with padding likely to be covered by compiler. */
 202 struct test_small_hole {
 203         size_t one;
 204         char two;
 205         /* 3 byte padding hole here. */
 206         int three;
 207         unsigned long four;
 208 };
 209
 210 /* Trigger unhandled padding in a structure. */
 211 struct test_big_hole {
 212         u8 one;
 213         u8 two;
 214         u8 three;
 215         /* 61 byte padding hole here. */
 216         u8 four __aligned(64);
 217 } __aligned(64);
 218
 219 struct test_trailing_hole {
 220         char *one;
 221         char *two;
 222         char *three;
 223         char four;
 224         /* "sizeof(unsigned long) - 1" byte padding hole here. */
 225 };
 226
 227 /* Test if STRUCTLEAK is clearing structs with __user fields. */
 228 struct test_user {
 229         u8 one;
 230         unsigned long two;
 231         char __user *three;
 232         unsigned long four;
 233 };
 234
 235 #define DEFINE_SCALAR_TEST(name, init)                          \
 236                 DEFINE_TEST(name ## _ ## init, name, SCALAR, init)
 237
 238 #define DEFINE_SCALAR_TESTS(init)                               \
 239                 DEFINE_SCALAR_TEST(u8, init);                   \
 240                 DEFINE_SCALAR_TEST(u16, init);                  \
 241                 DEFINE_SCALAR_TEST(u32, init);                  \
 242                 DEFINE_SCALAR_TEST(u64, init);                  \
 243                 DEFINE_TEST(char_array_ ## init, unsigned char, STRING, init)
 244
 245 #define DEFINE_STRUCT_TEST(name, init)                          \
 246                 DEFINE_TEST(name ## _ ## init,                  \
 247                             struct test_ ## name, STRUCT, init)
 248
 249 #define DEFINE_STRUCT_TESTS(init)                               \
 250                 DEFINE_STRUCT_TEST(small_hole, init);           \
 251                 DEFINE_STRUCT_TEST(big_hole, init);             \
 252                 DEFINE_STRUCT_TEST(trailing_hole, init);        \
 253                 DEFINE_STRUCT_TEST(packed, init)
 254
 255 /* These should be fully initialized all the time! */
 256 DEFINE_SCALAR_TESTS(zero);
 257 DEFINE_STRUCT_TESTS(zero);
 258 /* Static initialization: padding may be left uninitialized. */
 259 DEFINE_STRUCT_TESTS(static_partial);
 260 DEFINE_STRUCT_TESTS(static_all);
 261 /* Dynamic initialization: padding may be left uninitialized. */
 262 DEFINE_STRUCT_TESTS(dynamic_partial);
 263 DEFINE_STRUCT_TESTS(dynamic_all);
 264 /* Runtime initialization: padding may be left uninitialized. */
 265 DEFINE_STRUCT_TESTS(runtime_partial);
 266 DEFINE_STRUCT_TESTS(runtime_all);
 267 /* No initialization without compiler instrumentation. */
 268 DEFINE_SCALAR_TESTS(none);
 269 DEFINE_STRUCT_TESTS(none);
 270 DEFINE_TEST(user, struct test_user, STRUCT, none);
 271
 272 /*
 273  * Check two uses through a variable declaration outside either path,
 274  * which was noticed as a special case in porting earlier stack init
 275  * compiler logic.
 276  */
 277 static int noinline __leaf_switch_none(int path, bool fill)
 278 {
 279         switch (path) {
 280                 uint64_t var;
 281
 282         case 1:
 283                 target_start = &var;
 284                 target_size = sizeof(var);
 285                 if (fill) {
 286                         fill_start = &var;
 287                         fill_size = sizeof(var);
 288
 289                         memset(fill_start, forced_mask | 0x55, fill_size);
 290                 }
 291                 memcpy(check_buf, target_start, target_size);
 292                 break;
 293         case 2:
 294                 target_start = &var;
 295                 target_size = sizeof(var);
 296                 if (fill) {
 297                         fill_start = &var;
 298                         fill_size = sizeof(var);
 299
 300                         memset(fill_start, forced_mask | 0xaa, fill_size);
 301                 }
 302                 memcpy(check_buf, target_start, target_size);
 303                 break;
 304         default:
 305                 var = 5;
 306                 return var & forced_mask;
 307         }
 308         return 0;
 309 }
 310
 311 static noinline __init int leaf_switch_1_none(unsigned long sp, bool fill,
 312                                               uint64_t *arg)
 313 {
 314         return __leaf_switch_none(1, fill);
 315 }
 316
 317 static noinline __init int leaf_switch_2_none(unsigned long sp, bool fill,
 318                                               uint64_t *arg)
 319 {
 320         return __leaf_switch_none(2, fill);
 321 }
 322
 323 DEFINE_TEST_DRIVER(switch_1_none, uint64_t, SCALAR);
 324 DEFINE_TEST_DRIVER(switch_2_none, uint64_t, SCALAR);
 325
 326 static int __init test_stackinit_init(void)
 327 {
 328         unsigned int failures = 0;
 329
 330 #define test_scalars(init)      do {                            \
 331                 failures += test_u8_ ## init ();                \
 332                 failures += test_u16_ ## init ();               \
 333                 failures += test_u32_ ## init ();               \
 334                 failures += test_u64_ ## init ();               \
 335                 failures += test_char_array_ ## init ();        \
 336         } while (0)
 337
 338 #define test_structs(init)      do {                            \
 339                 failures += test_small_hole_ ## init ();        \
 340                 failures += test_big_hole_ ## init ();          \
 341                 failures += test_trailing_hole_ ## init ();     \
 342                 failures += test_packed_ ## init ();            \
 343         } while (0)
 344
 345         /* These are explicitly initialized and should always pass. */
 346         test_scalars(zero);
 347         test_structs(zero);
 348         /* Padding here appears to be accidentally always initialized? */
 349         test_structs(dynamic_partial);
 350         /* Padding initialization depends on compiler behaviors. */
 351         test_structs(static_partial);
 352         test_structs(static_all);
 353         test_structs(dynamic_all);
 354         test_structs(runtime_partial);
 355         test_structs(runtime_all);
 356
 357         /* STRUCTLEAK_BYREF_ALL should cover everything from here down. */
 358         test_scalars(none);
 359         failures += test_switch_1_none();
 360         failures += test_switch_2_none();
 361
 362         /* STRUCTLEAK_BYREF should cover from here down. */
 363         test_structs(none);
 364
 365         /* STRUCTLEAK will only cover this. */
 366         failures += test_user();
 367
 368         if (failures == 0)
 369                 pr_info("all tests passed!\n");
 370         else
 371                 pr_err("failures: %u\n", failures);
 372
 373         return failures ? -EINVAL : 0;
 374 }
 375 module_init(test_stackinit_init);
 376
 377 static void __exit test_stackinit_exit(void)
 378 { }
 379 module_exit(test_stackinit_exit);
 380
 381 MODULE_LICENSE("GPL");