drivers/misc/lkdtm/heap.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * This is for all the tests relating directly to heap memory, including
   4  * page allocation and slab allocations.
   5  */
   6 #include "lkdtm.h"
   7 #include <linux/slab.h>
   8 #include <linux/sched.h>
   9
  10 static struct kmem_cache *double_free_cache;
  11 static struct kmem_cache *a_cache;
  12 static struct kmem_cache *b_cache;
  13
  14 /*
  15  * This tries to stay within the next largest power-of-2 kmalloc cache
  16  * to avoid actually overwriting anything important if it's not detected
  17  * correctly.
  18  */
  19 void lkdtm_OVERWRITE_ALLOCATION(void)
  20 {
  21         size_t len = 1020;
  22         u32 *data = kmalloc(len, GFP_KERNEL);
  23         if (!data)
  24                 return;
  25
  26         data[1024 / sizeof(u32)] = 0x12345678;
  27         kfree(data);
  28 }
  29
  30 void lkdtm_WRITE_AFTER_FREE(void)
  31 {
  32         int *base, *again;
  33         size_t len = 1024;
  34         /*
  35          * The slub allocator uses the first word to store the free
  36          * pointer in some configurations. Use the middle of the
  37          * allocation to avoid running into the freelist
  38          */
  39         size_t offset = (len / sizeof(*base)) / 2;
  40
  41         base = kmalloc(len, GFP_KERNEL);
  42         if (!base)
  43                 return;
  44         pr_info("Allocated memory %p-%p\n", base, &base[offset * 2]);
  45         pr_info("Attempting bad write to freed memory at %p\n",
  46                 &base[offset]);
  47         kfree(base);
  48         base[offset] = 0x0abcdef0;
  49         /* Attempt to notice the overwrite. */
  50         again = kmalloc(len, GFP_KERNEL);
  51         kfree(again);
  52         if (again != base)
  53                 pr_info("Hmm, didn't get the same memory range.\n");
  54 }
  55
  56 void lkdtm_READ_AFTER_FREE(void)
  57 {
  58         int *base, *val, saw;
  59         size_t len = 1024;
  60         /*
  61          * The slub allocator will use the either the first word or
  62          * the middle of the allocation to store the free pointer,
  63          * depending on configurations. Store in the second word to
  64          * avoid running into the freelist.
  65          */
  66         size_t offset = sizeof(*base);
  67
  68         base = kmalloc(len, GFP_KERNEL);
  69         if (!base) {
  70                 pr_info("Unable to allocate base memory.\n");
  71                 return;
  72         }
  73
  74         val = kmalloc(len, GFP_KERNEL);
  75         if (!val) {
  76                 pr_info("Unable to allocate val memory.\n");
  77                 kfree(base);
  78                 return;
  79         }
  80
  81         *val = 0x12345678;
  82         base[offset] = *val;
  83         pr_info("Value in memory before free: %x\n", base[offset]);
  84
  85         kfree(base);
  86
  87         pr_info("Attempting bad read from freed memory\n");
  88         saw = base[offset];
  89         if (saw != *val) {
  90                 /* Good! Poisoning happened, so declare a win. */
  91                 pr_info("Memory correctly poisoned (%x)\n", saw);
  92                 BUG();
  93         }
  94         pr_info("Memory was not poisoned\n");
  95
  96         kfree(val);
  97 }
  98
  99 void lkdtm_WRITE_BUDDY_AFTER_FREE(void)
 100 {
 101         unsigned long p = __get_free_page(GFP_KERNEL);
 102         if (!p) {
 103                 pr_info("Unable to allocate free page\n");
 104                 return;
 105         }
 106
 107         pr_info("Writing to the buddy page before free\n");
 108         memset((void *)p, 0x3, PAGE_SIZE);
 109         free_page(p);
 110         schedule();
 111         pr_info("Attempting bad write to the buddy page after free\n");
 112         memset((void *)p, 0x78, PAGE_SIZE);
 113         /* Attempt to notice the overwrite. */
 114         p = __get_free_page(GFP_KERNEL);
 115         free_page(p);
 116         schedule();
 117 }
 118
 119 void lkdtm_READ_BUDDY_AFTER_FREE(void)
 120 {
 121         unsigned long p = __get_free_page(GFP_KERNEL);
 122         int saw, *val;
 123         int *base;
 124
 125         if (!p) {
 126                 pr_info("Unable to allocate free page\n");
 127                 return;
 128         }
 129
 130         val = kmalloc(1024, GFP_KERNEL);
 131         if (!val) {
 132                 pr_info("Unable to allocate val memory.\n");
 133                 free_page(p);
 134                 return;
 135         }
 136
 137         base = (int *)p;
 138
 139         *val = 0x12345678;
 140         base[0] = *val;
 141         pr_info("Value in memory before free: %x\n", base[0]);
 142         free_page(p);
 143         pr_info("Attempting to read from freed memory\n");
 144         saw = base[0];
 145         if (saw != *val) {
 146                 /* Good! Poisoning happened, so declare a win. */
 147                 pr_info("Memory correctly poisoned (%x)\n", saw);
 148                 BUG();
 149         }
 150         pr_info("Buddy page was not poisoned\n");
 151
 152         kfree(val);
 153 }
 154
 155 void lkdtm_SLAB_FREE_DOUBLE(void)
 156 {
 157         int *val;
 158
 159         val = kmem_cache_alloc(double_free_cache, GFP_KERNEL);
 160         if (!val) {
 161                 pr_info("Unable to allocate double_free_cache memory.\n");
 162                 return;
 163         }
 164
 165         /* Just make sure we got real memory. */
 166         *val = 0x12345678;
 167         pr_info("Attempting double slab free ...\n");
 168         kmem_cache_free(double_free_cache, val);
 169         kmem_cache_free(double_free_cache, val);
 170 }
 171
 172 void lkdtm_SLAB_FREE_CROSS(void)
 173 {
 174         int *val;
 175
 176         val = kmem_cache_alloc(a_cache, GFP_KERNEL);
 177         if (!val) {
 178                 pr_info("Unable to allocate a_cache memory.\n");
 179                 return;
 180         }
 181
 182         /* Just make sure we got real memory. */
 183         *val = 0x12345679;
 184         pr_info("Attempting cross-cache slab free ...\n");
 185         kmem_cache_free(b_cache, val);
 186 }
 187
 188 void lkdtm_SLAB_FREE_PAGE(void)
 189 {
 190         unsigned long p = __get_free_page(GFP_KERNEL);
 191
 192         pr_info("Attempting non-Slab slab free ...\n");
 193         kmem_cache_free(NULL, (void *)p);
 194         free_page(p);
 195 }
 196
 197 /*
 198  * We have constructors to keep the caches distinctly separated without
 199  * needing to boot with "slab_nomerge".
 200  */
 201 static void ctor_double_free(void *region)
 202 { }
 203 static void ctor_a(void *region)
 204 { }
 205 static void ctor_b(void *region)
 206 { }
 207
 208 void __init lkdtm_heap_init(void)
 209 {
 210         double_free_cache = kmem_cache_create("lkdtm-heap-double_free",
 211                                               64, 0, 0, ctor_double_free);
 212         a_cache = kmem_cache_create("lkdtm-heap-a", 64, 0, 0, ctor_a);
 213         b_cache = kmem_cache_create("lkdtm-heap-b", 64, 0, 0, ctor_b);
 214 }
 215
 216 void __exit lkdtm_heap_exit(void)
 217 {
 218         kmem_cache_destroy(double_free_cache);
 219         kmem_cache_destroy(a_cache);
 220         kmem_cache_destroy(b_cache);
 221 }