1 // SPDX-License-Identifier: GPL-2.0-only 1
2 /*
3 * Kernel module for testing copy_to/from_user
4 *
5 * Copyright 2013 Google Inc. All Rights Reser
6 *
7 * Authors:
8 * Kees Cook <keescook@chromium.org
9 */
10
11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12
13 #include <linux/mman.h>
14 #include <linux/module.h>
15 #include <linux/sched.h>
16 #include <linux/slab.h>
17 #include <linux/uaccess.h>
18 #include <kunit/test.h>
19
20 /*
21 * Several 32-bit architectures support 64-bit
22 * As there doesn't appear to be anything that
23 * their capability at compile-time, we just h
24 */
25 #if BITS_PER_LONG == 64 || (!(defined(CONFIG_A
26 !defined(CONFIG_M6
27 !defined(CONFIG_MI
28 !defined(CONFIG_NI
29 !defined(CONFIG_PP
30 !defined(CONFIG_SU
31 # define TEST_U64
32 #endif
33
34 struct usercopy_test_priv {
35 char *kmem;
36 char __user *umem;
37 size_t size;
38 };
39
40 static bool is_zeroed(void *from, size_t size)
41 {
42 return memchr_inv(from, 0x0, size) ==
43 }
44
45 /* Test usage of check_nonzero_user(). */
46 static void usercopy_test_check_nonzero_user(s
47 {
48 size_t start, end, i, zero_start, zero
49 struct usercopy_test_priv *priv = test
50 char __user *umem = priv->umem;
51 char *kmem = priv->kmem;
52 size_t size = priv->size;
53
54 KUNIT_ASSERT_GE_MSG(test, size, 2 * PA
55
56 /*
57 * We want to cross a page boundary to
58 * effectively. We also don't want to
59 * otherwise the test can take a long
60 * scan a 1024 byte region across the
61 */
62 size = 1024;
63 start = PAGE_SIZE - (size / 2);
64
65 kmem += start;
66 umem += start;
67
68 zero_start = size / 4;
69 zero_end = size - zero_start;
70
71 /*
72 * We conduct a series of check_nonzer
73 * memory with the following byte-patt
74 * [start,end] pair):
75 *
76 * [ 00 ff 00 ff ... 00 00 00 00 ...
77 *
78 * And we verify that check_nonzero_us
79 * memchr_inv().
80 */
81
82 memset(kmem, 0x0, size);
83 for (i = 1; i < zero_start; i += 2)
84 kmem[i] = 0xff;
85 for (i = zero_end; i < size; i += 2)
86 kmem[i] = 0xff;
87
88 KUNIT_EXPECT_EQ_MSG(test, copy_to_user
89 "legitimate copy_to_user faile
90
91 for (start = 0; start <= size; start++
92 for (end = start; end <= size;
93 size_t len = end - sta
94 int retval = check_zer
95 int expected = is_zero
96
97 KUNIT_ASSERT_EQ_MSG(te
98 "check_nonzero
99 retval, expect
100 }
101 }
102 }
103
104 /* Test usage of copy_struct_from_user(). */
105 static void usercopy_test_copy_struct_from_use
106 {
107 char *umem_src = NULL, *expected = NUL
108 struct usercopy_test_priv *priv = test
109 char __user *umem = priv->umem;
110 char *kmem = priv->kmem;
111 size_t size = priv->size;
112 size_t ksize, usize;
113
114 umem_src = kunit_kmalloc(test, size, G
115 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ume
116
117 expected = kunit_kmalloc(test, size, G
118 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, exp
119
120 /* Fill umem with a fixed byte pattern
121 memset(umem_src, 0x3e, size);
122 KUNIT_ASSERT_EQ_MSG(test, copy_to_user
123 "legitimate copy_to_user f
124
125 /* Check basic case -- (usize == ksize
126 ksize = size;
127 usize = size;
128
129 memcpy(expected, umem_src, ksize);
130
131 memset(kmem, 0x0, size);
132 KUNIT_EXPECT_EQ_MSG(test, copy_struct_
133 "copy_struct_from_user(usi
134 KUNIT_EXPECT_MEMEQ_MSG(test, kmem, exp
135 "copy_struct_from_user(usi
136
137 /* Old userspace case -- (usize < ksiz
138 ksize = size;
139 usize = size / 2;
140
141 memcpy(expected, umem_src, usize);
142 memset(expected + usize, 0x0, ksize -
143
144 memset(kmem, 0x0, size);
145 KUNIT_EXPECT_EQ_MSG(test, copy_struct_
146 "copy_struct_from_user(usi
147 KUNIT_EXPECT_MEMEQ_MSG(test, kmem, exp
148 "copy_struct_from_user(usi
149
150 /* New userspace (-E2BIG) case -- (usi
151 ksize = size / 2;
152 usize = size;
153
154 memset(kmem, 0x0, size);
155 KUNIT_EXPECT_EQ_MSG(test, copy_struct_
156 "copy_struct_from_user(usi
157
158 /* New userspace (success) case -- (us
159 ksize = size / 2;
160 usize = size;
161
162 memcpy(expected, umem_src, ksize);
163 KUNIT_EXPECT_EQ_MSG(test, clear_user(u
164 "legitimate clear_user fai
165
166 memset(kmem, 0x0, size);
167 KUNIT_EXPECT_EQ_MSG(test, copy_struct_
168 "copy_struct_from_user(usi
169 KUNIT_EXPECT_MEMEQ_MSG(test, kmem, exp
170 "copy_struct_from_user(usi
171 }
172
173 /*
174 * Legitimate usage: none of these copies shou
175 */
176 static void usercopy_test_valid(struct kunit *
177 {
178 struct usercopy_test_priv *priv = test
179 char __user *usermem = priv->umem;
180 char *kmem = priv->kmem;
181
182 memset(kmem, 0x3a, PAGE_SIZE * 2);
183 KUNIT_EXPECT_EQ_MSG(test, 0, copy_to_u
184 "legitimate copy_to_user failed")
185 memset(kmem, 0x0, PAGE_SIZE);
186 KUNIT_EXPECT_EQ_MSG(test, 0, copy_from
187 "legitimate copy_from_user failed
188 KUNIT_EXPECT_MEMEQ_MSG(test, kmem, kme
189 "legitimate usercopy failed to co
190
191 #define test_legit(size, check)
192 do {
193 size val_##size = (check);
194 KUNIT_EXPECT_EQ_MSG(test, 0,
195 put_user(val_##size, (
196 "legitimate put_user (
197 val_##size = 0;
198 KUNIT_EXPECT_EQ_MSG(test, 0,
199 get_user(val_##size, (
200 "legitimate get_user (
201 KUNIT_EXPECT_EQ_MSG(test, val_
202 "legitimate get_user (
203 } while (0)
204
205 test_legit(u8, 0x5a);
206 test_legit(u16, 0x5a5b);
207 test_legit(u32, 0x5a5b5c5d);
208 #ifdef TEST_U64
209 test_legit(u64, 0x5a5b5c5d6a6b6c6d);
210 #endif
211 #undef test_legit
212 }
213
214 /*
215 * Invalid usage: none of these copies should
216 */
217 static void usercopy_test_invalid(struct kunit
218 {
219 struct usercopy_test_priv *priv = test
220 char __user *usermem = priv->umem;
221 char *bad_usermem = (char *)usermem;
222 char *kmem = priv->kmem;
223 u64 *kmem_u64 = (u64 *)kmem;
224
225 if (IS_ENABLED(CONFIG_ALTERNATE_USER_A
226 !IS_ENABLED(CONFIG_MMU)) {
227 kunit_skip(test, "Testing for
228 return;
229 }
230
231 /* Prepare kernel memory with check va
232 memset(kmem, 0x5a, PAGE_SIZE);
233 memset(kmem + PAGE_SIZE, 0, PAGE_SIZE)
234
235 /* Reject kernel-to-kernel copies thro
236 KUNIT_EXPECT_NE_MSG(test, copy_from_us
237
238 "illegal all-kernel copy_f
239
240 /* Destination half of buffer should h
241 KUNIT_EXPECT_MEMEQ_MSG(test, kmem + PA
242 "zeroing failure for illeg
243
244 #if 0
245 /*
246 * When running with SMAP/PAN/etc, thi
247 * due to the zeroing of userspace mem
248 * to be tested in LKDTM instead, sinc
249 * expect to explode.
250 */
251 KUNIT_EXPECT_NE_MSG(test, copy_from_us
252
253 "illegal reversed copy_fro
254 #endif
255 KUNIT_EXPECT_NE_MSG(test, copy_to_user
256
257 "illegal all-kernel copy_t
258
259 KUNIT_EXPECT_NE_MSG(test, copy_to_user
260
261 "illegal reversed copy_to_
262
263 #define test_illegal(size, check)
264 do {
265 size val_##size = (check);
266 /* get_user() */
267 KUNIT_EXPECT_NE_MSG(test, get_
268 "illegal get_user (" #size
269 KUNIT_EXPECT_EQ_MSG(test, val_
270 "zeroing failure for illeg
271 /* put_user() */
272 *kmem_u64 = 0xF09FA4AFF09FA4AF
273 KUNIT_EXPECT_NE_MSG(test, put_
274 "illegal put_user (" #size
275 KUNIT_EXPECT_EQ_MSG(test, *kme
276 "illegal put_user (" #size
277 } while (0)
278
279 test_illegal(u8, 0x5a);
280 test_illegal(u16, 0x5a5b);
281 test_illegal(u32, 0x5a5b5c5d);
282 #ifdef TEST_U64
283 test_illegal(u64, 0x5a5b5c5d6a6b6c6d);
284 #endif
285 #undef test_illegal
286 }
287
288 static int usercopy_test_init(struct kunit *te
289 {
290 struct usercopy_test_priv *priv;
291 unsigned long user_addr;
292
293 if (!IS_ENABLED(CONFIG_MMU)) {
294 kunit_skip(test, "Userspace al
295 return 0;
296 }
297
298 priv = kunit_kzalloc(test, sizeof(*pri
299 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, pri
300 test->priv = priv;
301 priv->size = PAGE_SIZE * 2;
302
303 priv->kmem = kunit_kmalloc(test, priv-
304 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, pri
305
306 user_addr = kunit_vm_mmap(test, NULL,
307 PROT_READ | PROT_W
308 MAP_ANONYMOUS | MA
309 KUNIT_ASSERT_NE_MSG(test, user_addr, 0
310 "Could not create userspace mm
311 KUNIT_ASSERT_LT_MSG(test, user_addr, (
312 "Failed to allocate user memor
313 priv->umem = (char __user *)user_addr;
314
315 return 0;
316 }
317
318 static struct kunit_case usercopy_test_cases[]
319 KUNIT_CASE(usercopy_test_valid),
320 KUNIT_CASE(usercopy_test_invalid),
321 KUNIT_CASE(usercopy_test_check_nonzero
322 KUNIT_CASE(usercopy_test_copy_struct_f
323 {}
324 };
325
326 static struct kunit_suite usercopy_test_suite
327 .name = "usercopy",
328 .init = usercopy_test_init,
329 .test_cases = usercopy_test_cases,
330 };
331
332 kunit_test_suites(&usercopy_test_suite);
333 MODULE_AUTHOR("Kees Cook <kees@kernel.org>");
334 MODULE_DESCRIPTION("Kernel module for testing
335 MODULE_LICENSE("GPL");
336
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.