lib/test_stackinit: Fix static initializer test
[linux-2.6-microblaze.git] / lib / test_stackinit.c
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * Test cases for compiler-based stack variable zeroing via future
4  * compiler flags or CONFIG_GCC_PLUGIN_STRUCTLEAK*.
5  */
6 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
7
8 #include <linux/init.h>
9 #include <linux/kernel.h>
10 #include <linux/module.h>
11 #include <linux/string.h>
12
13 /* Exfiltration buffer. */
14 #define MAX_VAR_SIZE    128
15 static u8 check_buf[MAX_VAR_SIZE];
16
17 /* Character array to trigger stack protector in all functions. */
18 #define VAR_BUFFER       32
19
20 /* Volatile mask to convince compiler to copy memory with 0xff. */
21 static volatile u8 forced_mask = 0xff;
22
23 /* Location and size tracking to validate fill and test are colocated. */
24 static void *fill_start, *target_start;
25 static size_t fill_size, target_size;
26
27 static bool range_contains(char *haystack_start, size_t haystack_size,
28                            char *needle_start, size_t needle_size)
29 {
30         if (needle_start >= haystack_start &&
31             needle_start + needle_size <= haystack_start + haystack_size)
32                 return true;
33         return false;
34 }
35
36 #define DO_NOTHING_TYPE_SCALAR(var_type)        var_type
37 #define DO_NOTHING_TYPE_STRING(var_type)        void
38 #define DO_NOTHING_TYPE_STRUCT(var_type)        void
39
40 #define DO_NOTHING_RETURN_SCALAR(ptr)           *(ptr)
41 #define DO_NOTHING_RETURN_STRING(ptr)           /**/
42 #define DO_NOTHING_RETURN_STRUCT(ptr)           /**/
43
44 #define DO_NOTHING_CALL_SCALAR(var, name)                       \
45                 (var) = do_nothing_ ## name(&(var))
46 #define DO_NOTHING_CALL_STRING(var, name)                       \
47                 do_nothing_ ## name(var)
48 #define DO_NOTHING_CALL_STRUCT(var, name)                       \
49                 do_nothing_ ## name(&(var))
50
51 #define FETCH_ARG_SCALAR(var)           &var
52 #define FETCH_ARG_STRING(var)           var
53 #define FETCH_ARG_STRUCT(var)           &var
54
55 #define FILL_SIZE_STRING                16
56
57 #define INIT_CLONE_SCALAR               /**/
58 #define INIT_CLONE_STRING               [FILL_SIZE_STRING]
59 #define INIT_CLONE_STRUCT               /**/
60
61 #define INIT_SCALAR_none                /**/
62 #define INIT_SCALAR_zero                = 0
63
64 #define INIT_STRING_none                [FILL_SIZE_STRING] /**/
65 #define INIT_STRING_zero                [FILL_SIZE_STRING] = { }
66
67 #define INIT_STRUCT_none                /**/
68 #define INIT_STRUCT_zero                = { }
69 #define INIT_STRUCT_static_partial      = { .two = 0, }
70 #define INIT_STRUCT_static_all          = { .one = 0,                   \
71                                             .two = 0,                   \
72                                             .three = 0,                 \
73                                             .four = 0,                  \
74                                         }
75 #define INIT_STRUCT_dynamic_partial     = { .two = arg->two, }
76 #define INIT_STRUCT_dynamic_all         = { .one = arg->one,            \
77                                             .two = arg->two,            \
78                                             .three = arg->three,        \
79                                             .four = arg->four,          \
80                                         }
81 #define INIT_STRUCT_runtime_partial     ;                               \
82                                         var.two = 0
83 #define INIT_STRUCT_runtime_all         ;                               \
84                                         var.one = 0;                    \
85                                         var.two = 0;                    \
86                                         var.three = 0;                  \
87                                         var.four = 0
88
89 /*
90  * @name: unique string name for the test
91  * @var_type: type to be tested for zeroing initialization
92  * @which: is this a SCALAR, STRING, or STRUCT type?
93  * @init_level: what kind of initialization is performed
94  * @xfail: is this test expected to fail?
95  */
96 #define DEFINE_TEST_DRIVER(name, var_type, which, xfail)        \
97 /* Returns 0 on success, 1 on failure. */                       \
98 static noinline __init int test_ ## name (void)                 \
99 {                                                               \
100         var_type zero INIT_CLONE_ ## which;                     \
101         int ignored;                                            \
102         u8 sum = 0, i;                                          \
103                                                                 \
104         /* Notice when a new test is larger than expected. */   \
105         BUILD_BUG_ON(sizeof(zero) > MAX_VAR_SIZE);              \
106                                                                 \
107         /* Fill clone type with zero for per-field init. */     \
108         memset(&zero, 0x00, sizeof(zero));                      \
109         /* Clear entire check buffer for 0xFF overlap test. */  \
110         memset(check_buf, 0x00, sizeof(check_buf));             \
111         /* Fill stack with 0xFF. */                             \
112         ignored = leaf_ ##name((unsigned long)&ignored, 1,      \
113                                 FETCH_ARG_ ## which(zero));     \
114         /* Verify all bytes overwritten with 0xFF. */           \
115         for (sum = 0, i = 0; i < target_size; i++)              \
116                 sum += (check_buf[i] != 0xFF);                  \
117         if (sum) {                                              \
118                 pr_err(#name ": leaf fill was not 0xFF!?\n");   \
119                 return 1;                                       \
120         }                                                       \
121         /* Clear entire check buffer for later bit tests. */    \
122         memset(check_buf, 0x00, sizeof(check_buf));             \
123         /* Extract stack-defined variable contents. */          \
124         ignored = leaf_ ##name((unsigned long)&ignored, 0,      \
125                                 FETCH_ARG_ ## which(zero));     \
126                                                                 \
127         /* Validate that compiler lined up fill and target. */  \
128         if (!range_contains(fill_start, fill_size,              \
129                             target_start, target_size)) {       \
130                 pr_err(#name ": stack fill missed target!?\n"); \
131                 pr_err(#name ": fill %zu wide\n", fill_size);   \
132                 pr_err(#name ": target offset by %d\n", \
133                         (int)((ssize_t)(uintptr_t)fill_start -  \
134                         (ssize_t)(uintptr_t)target_start));     \
135                 return 1;                                       \
136         }                                                       \
137                                                                 \
138         /* Look for any bytes still 0xFF in check region. */    \
139         for (sum = 0, i = 0; i < target_size; i++)              \
140                 sum += (check_buf[i] == 0xFF);                  \
141                                                                 \
142         if (sum == 0) {                                         \
143                 pr_info(#name " ok\n");                         \
144                 return 0;                                       \
145         } else {                                                \
146                 pr_warn(#name " %sFAIL (uninit bytes: %d)\n",   \
147                         (xfail) ? "X" : "", sum);               \
148                 return (xfail) ? 0 : 1;                         \
149         }                                                       \
150 }
151 #define DEFINE_TEST(name, var_type, which, init_level)          \
152 /* no-op to force compiler into ignoring "uninitialized" vars */\
153 static noinline __init DO_NOTHING_TYPE_ ## which(var_type)      \
154 do_nothing_ ## name(var_type *ptr)                              \
155 {                                                               \
156         /* Will always be true, but compiler doesn't know. */   \
157         if ((unsigned long)ptr > 0x2)                           \
158                 return DO_NOTHING_RETURN_ ## which(ptr);        \
159         else                                                    \
160                 return DO_NOTHING_RETURN_ ## which(ptr + 1);    \
161 }                                                               \
162 static noinline __init int leaf_ ## name(unsigned long sp,      \
163                                          bool fill,             \
164                                          var_type *arg)         \
165 {                                                               \
166         char buf[VAR_BUFFER];                                   \
167         var_type var INIT_ ## which ## _ ## init_level;         \
168                                                                 \
169         target_start = &var;                                    \
170         target_size = sizeof(var);                              \
171         /*                                                      \
172          * Keep this buffer around to make sure we've got a     \
173          * stack frame of SOME kind...                          \
174          */                                                     \
175         memset(buf, (char)(sp & 0xff), sizeof(buf));            \
176         /* Fill variable with 0xFF. */                          \
177         if (fill) {                                             \
178                 fill_start = &var;                              \
179                 fill_size = sizeof(var);                        \
180                 memset(fill_start,                              \
181                        (char)((sp & 0xff) | forced_mask),       \
182                        fill_size);                              \
183         }                                                       \
184                                                                 \
185         /* Silence "never initialized" warnings. */             \
186         DO_NOTHING_CALL_ ## which(var, name);                   \
187                                                                 \
188         /* Exfiltrate "var". */                                 \
189         memcpy(check_buf, target_start, target_size);           \
190                                                                 \
191         return (int)buf[0] | (int)buf[sizeof(buf) - 1];         \
192 }                                                               \
193 DEFINE_TEST_DRIVER(name, var_type, which, 0)
194
195 /* Structure with no padding. */
196 struct test_packed {
197         unsigned long one;
198         unsigned long two;
199         unsigned long three;
200         unsigned long four;
201 };
202
203 /* Simple structure with padding likely to be covered by compiler. */
204 struct test_small_hole {
205         size_t one;
206         char two;
207         /* 3 byte padding hole here. */
208         int three;
209         unsigned long four;
210 };
211
212 /* Trigger unhandled padding in a structure. */
213 struct test_big_hole {
214         u8 one;
215         u8 two;
216         u8 three;
217         /* 61 byte padding hole here. */
218         u8 four __aligned(64);
219 } __aligned(64);
220
221 struct test_trailing_hole {
222         char *one;
223         char *two;
224         char *three;
225         char four;
226         /* "sizeof(unsigned long) - 1" byte padding hole here. */
227 };
228
229 /* Test if STRUCTLEAK is clearing structs with __user fields. */
230 struct test_user {
231         u8 one;
232         unsigned long two;
233         char __user *three;
234         unsigned long four;
235 };
236
237 #define DEFINE_SCALAR_TEST(name, init)                          \
238                 DEFINE_TEST(name ## _ ## init, name, SCALAR, init)
239
240 #define DEFINE_SCALAR_TESTS(init)                               \
241                 DEFINE_SCALAR_TEST(u8, init);                   \
242                 DEFINE_SCALAR_TEST(u16, init);                  \
243                 DEFINE_SCALAR_TEST(u32, init);                  \
244                 DEFINE_SCALAR_TEST(u64, init);                  \
245                 DEFINE_TEST(char_array_ ## init, unsigned char, STRING, init)
246
247 #define DEFINE_STRUCT_TEST(name, init)                          \
248                 DEFINE_TEST(name ## _ ## init,                  \
249                             struct test_ ## name, STRUCT, init)
250
251 #define DEFINE_STRUCT_TESTS(init)                               \
252                 DEFINE_STRUCT_TEST(small_hole, init);           \
253                 DEFINE_STRUCT_TEST(big_hole, init);             \
254                 DEFINE_STRUCT_TEST(trailing_hole, init);        \
255                 DEFINE_STRUCT_TEST(packed, init)
256
257 /* These should be fully initialized all the time! */
258 DEFINE_SCALAR_TESTS(zero);
259 DEFINE_STRUCT_TESTS(zero);
260 /* Static initialization: padding may be left uninitialized. */
261 DEFINE_STRUCT_TESTS(static_partial);
262 DEFINE_STRUCT_TESTS(static_all);
263 /* Dynamic initialization: padding may be left uninitialized. */
264 DEFINE_STRUCT_TESTS(dynamic_partial);
265 DEFINE_STRUCT_TESTS(dynamic_all);
266 /* Runtime initialization: padding may be left uninitialized. */
267 DEFINE_STRUCT_TESTS(runtime_partial);
268 DEFINE_STRUCT_TESTS(runtime_all);
269 /* No initialization without compiler instrumentation. */
270 DEFINE_SCALAR_TESTS(none);
271 DEFINE_STRUCT_TESTS(none);
272 DEFINE_TEST(user, struct test_user, STRUCT, none);
273
274 /*
275  * Check two uses through a variable declaration outside either path,
276  * which was noticed as a special case in porting earlier stack init
277  * compiler logic.
278  */
279 static int noinline __leaf_switch_none(int path, bool fill)
280 {
281         switch (path) {
282                 uint64_t var;
283
284         case 1:
285                 target_start = &var;
286                 target_size = sizeof(var);
287                 if (fill) {
288                         fill_start = &var;
289                         fill_size = sizeof(var);
290
291                         memset(fill_start, forced_mask | 0x55, fill_size);
292                 }
293                 memcpy(check_buf, target_start, target_size);
294                 break;
295         case 2:
296                 target_start = &var;
297                 target_size = sizeof(var);
298                 if (fill) {
299                         fill_start = &var;
300                         fill_size = sizeof(var);
301
302                         memset(fill_start, forced_mask | 0xaa, fill_size);
303                 }
304                 memcpy(check_buf, target_start, target_size);
305                 break;
306         default:
307                 var = 5;
308                 return var & forced_mask;
309         }
310         return 0;
311 }
312
313 static noinline __init int leaf_switch_1_none(unsigned long sp, bool fill,
314                                               uint64_t *arg)
315 {
316         return __leaf_switch_none(1, fill);
317 }
318
319 static noinline __init int leaf_switch_2_none(unsigned long sp, bool fill,
320                                               uint64_t *arg)
321 {
322         return __leaf_switch_none(2, fill);
323 }
324
325 /*
326  * These are expected to fail for most configurations because neither
327  * GCC nor Clang have a way to perform initialization of variables in
328  * non-code areas (i.e. in a switch statement before the first "case").
329  * https://bugs.llvm.org/show_bug.cgi?id=44916
330  */
331 DEFINE_TEST_DRIVER(switch_1_none, uint64_t, SCALAR, 1);
332 DEFINE_TEST_DRIVER(switch_2_none, uint64_t, SCALAR, 1);
333
334 static int __init test_stackinit_init(void)
335 {
336         unsigned int failures = 0;
337
338 #define test_scalars(init)      do {                            \
339                 failures += test_u8_ ## init ();                \
340                 failures += test_u16_ ## init ();               \
341                 failures += test_u32_ ## init ();               \
342                 failures += test_u64_ ## init ();               \
343                 failures += test_char_array_ ## init ();        \
344         } while (0)
345
346 #define test_structs(init)      do {                            \
347                 failures += test_small_hole_ ## init ();        \
348                 failures += test_big_hole_ ## init ();          \
349                 failures += test_trailing_hole_ ## init ();     \
350                 failures += test_packed_ ## init ();            \
351         } while (0)
352
353         /* These are explicitly initialized and should always pass. */
354         test_scalars(zero);
355         test_structs(zero);
356         /* Padding here appears to be accidentally always initialized? */
357         test_structs(dynamic_partial);
358         /* Padding initialization depends on compiler behaviors. */
359         test_structs(static_partial);
360         test_structs(static_all);
361         test_structs(dynamic_all);
362         test_structs(runtime_partial);
363         test_structs(runtime_all);
364
365         /* STRUCTLEAK_BYREF_ALL should cover everything from here down. */
366         test_scalars(none);
367         failures += test_switch_1_none();
368         failures += test_switch_2_none();
369
370         /* STRUCTLEAK_BYREF should cover from here down. */
371         test_structs(none);
372
373         /* STRUCTLEAK will only cover this. */
374         failures += test_user();
375
376         if (failures == 0)
377                 pr_info("all tests passed!\n");
378         else
379                 pr_err("failures: %u\n", failures);
380
381         return failures ? -EINVAL : 0;
382 }
383 module_init(test_stackinit_init);
384
385 static void __exit test_stackinit_exit(void)
386 { }
387 module_exit(test_stackinit_exit);
388
389 MODULE_LICENSE("GPL");