lkdtm: split usercopy tests to separate file

This splits the USERCOPY_* tests into the new lkdtm_usercopy.c file to
help separate things better for readability.

Signed-off-by: Kees Cook <keescook@chromium.org>

1 files changed, 13 insertions, 266 deletions

diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c
index 1454d58aa278..74376920ed55 100644
--- a/drivers/misc/lkdtm_core.c
+++ b/drivers/misc/lkdtm_core.c
@@ -193,10 +193,6 @@ static DEFINE_SPINLOCK(lock_me_up);
 
 static u8 data_area[EXEC_SIZE];
 
-static size_t cache_size = 1024;
-static struct kmem_cache *bad_cache;
-
-static const unsigned char test_text[] = "This is a test.\n";
 static const unsigned long rodata = 0xAA55AA55;
 static unsigned long ro_after_init __ro_after_init = 0x55AA5500;
 
@@ -403,255 +399,6 @@ static void execute_user_location(void *dst)
 	func();
 }
 
-/*
- * Instead of adding -Wno-return-local-addr, just pass the stack address
- * through a function to obfuscate it from the compiler.
- */
-static noinline unsigned char *trick_compiler(unsigned char *stack)
-{
-	return stack + 0;
-}
-
-static noinline unsigned char *do_usercopy_stack_callee(int value)
-{
-	unsigned char buf[32];
-	int i;
-
-	/* Exercise stack to avoid everything living in registers. */
-	for (i = 0; i < sizeof(buf); i++) {
-		buf[i] = value & 0xff;
-	}
-
-	return trick_compiler(buf);
-}
-
-static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
-{
-	unsigned long user_addr;
-	unsigned char good_stack[32];
-	unsigned char *bad_stack;
-	int i;
-
-	/* Exercise stack to avoid everything living in registers. */
-	for (i = 0; i < sizeof(good_stack); i++)
-		good_stack[i] = test_text[i % sizeof(test_text)];
-
-	/* This is a pointer to outside our current stack frame. */
-	if (bad_frame) {
-		bad_stack = do_usercopy_stack_callee((uintptr_t)bad_stack);
-	} else {
-		/* Put start address just inside stack. */
-		bad_stack = task_stack_page(current) + THREAD_SIZE;
-		bad_stack -= sizeof(unsigned long);
-	}
-
-	user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
-			    PROT_READ | PROT_WRITE | PROT_EXEC,
-			    MAP_ANONYMOUS | MAP_PRIVATE, 0);
-	if (user_addr >= TASK_SIZE) {
-		pr_warn("Failed to allocate user memory\n");
-		return;
-	}
-
-	if (to_user) {
-		pr_info("attempting good copy_to_user of local stack\n");
-		if (copy_to_user((void __user *)user_addr, good_stack,
-				 sizeof(good_stack))) {
-			pr_warn("copy_to_user failed unexpectedly?!\n");
-			goto free_user;
-		}
-
-		pr_info("attempting bad copy_to_user of distant stack\n");
-		if (copy_to_user((void __user *)user_addr, bad_stack,
-				 sizeof(good_stack))) {
-			pr_warn("copy_to_user failed, but lacked Oops\n");
-			goto free_user;
-		}
-	} else {
-		/*
-		 * There isn't a safe way to not be protected by usercopy
-		 * if we're going to write to another thread's stack.
-		 */
-		if (!bad_frame)
-			goto free_user;
-
-		pr_info("attempting good copy_from_user of local stack\n");
-		if (copy_from_user(good_stack, (void __user *)user_addr,
-				   sizeof(good_stack))) {
-			pr_warn("copy_from_user failed unexpectedly?!\n");
-			goto free_user;
-		}
-
-		pr_info("attempting bad copy_from_user of distant stack\n");
-		if (copy_from_user(bad_stack, (void __user *)user_addr,
-				   sizeof(good_stack))) {
-			pr_warn("copy_from_user failed, but lacked Oops\n");
-			goto free_user;
-		}
-	}
-
-free_user:
-	vm_munmap(user_addr, PAGE_SIZE);
-}
-
-static void do_usercopy_kernel(void)
-{
-	unsigned long user_addr;
-
-	user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
-			    PROT_READ | PROT_WRITE | PROT_EXEC,
-			    MAP_ANONYMOUS | MAP_PRIVATE, 0);
-	if (user_addr >= TASK_SIZE) {
-		pr_warn("Failed to allocate user memory\n");
-		return;
-	}
-
-	pr_info("attempting good copy_to_user from kernel rodata\n");
-	if (copy_to_user((void __user *)user_addr, test_text,
-			 sizeof(test_text))) {
-		pr_warn("copy_to_user failed unexpectedly?!\n");
-		goto free_user;
-	}
-
-	pr_info("attempting bad copy_to_user from kernel text\n");
-	if (copy_to_user((void __user *)user_addr, vm_mmap, PAGE_SIZE)) {
-		pr_warn("copy_to_user failed, but lacked Oops\n");
-		goto free_user;
-	}
-
-free_user:
-	vm_munmap(user_addr, PAGE_SIZE);
-}
-
-static void do_usercopy_heap_size(bool to_user)
-{
-	unsigned long user_addr;
-	unsigned char *one, *two;
-	size_t size = 1024;
-
-	one = kmalloc(size, GFP_KERNEL);
-	two = kmalloc(size, GFP_KERNEL);
-	if (!one || !two) {
-		pr_warn("Failed to allocate kernel memory\n");
-		goto free_kernel;
-	}
-
-	user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
-			    PROT_READ | PROT_WRITE | PROT_EXEC,
-			    MAP_ANONYMOUS | MAP_PRIVATE, 0);
-	if (user_addr >= TASK_SIZE) {
-		pr_warn("Failed to allocate user memory\n");
-		goto free_kernel;
-	}
-
-	memset(one, 'A', size);
-	memset(two, 'B', size);
-
-	if (to_user) {
-		pr_info("attempting good copy_to_user of correct size\n");
-		if (copy_to_user((void __user *)user_addr, one, size)) {
-			pr_warn("copy_to_user failed unexpectedly?!\n");
-			goto free_user;
-		}
-
-		pr_info("attempting bad copy_to_user of too large size\n");
-		if (copy_to_user((void __user *)user_addr, one, 2 * size)) {
-			pr_warn("copy_to_user failed, but lacked Oops\n");
-			goto free_user;
-		}
-	} else {
-		pr_info("attempting good copy_from_user of correct size\n");
-		if (copy_from_user(one, (void __user *)user_addr, size)) {
-			pr_warn("copy_from_user failed unexpectedly?!\n");
-			goto free_user;
-		}
-
-		pr_info("attempting bad copy_from_user of too large size\n");
-		if (copy_from_user(one, (void __user *)user_addr, 2 * size)) {
-			pr_warn("copy_from_user failed, but lacked Oops\n");
-			goto free_user;
-		}
-	}
-
-free_user:
-	vm_munmap(user_addr, PAGE_SIZE);
-free_kernel:
-	kfree(one);
-	kfree(two);
-}
-
-static void do_usercopy_heap_flag(bool to_user)
-{
-	unsigned long user_addr;
-	unsigned char *good_buf = NULL;
-	unsigned char *bad_buf = NULL;
-
-	/* Make sure cache was prepared. */
-	if (!bad_cache) {
-		pr_warn("Failed to allocate kernel cache\n");
-		return;
-	}
-
-	/*
-	 * Allocate one buffer from each cache (kmalloc will have the
-	 * SLAB_USERCOPY flag already, but "bad_cache" won't).
-	 */
-	good_buf = kmalloc(cache_size, GFP_KERNEL);
-	bad_buf = kmem_cache_alloc(bad_cache, GFP_KERNEL);
-	if (!good_buf || !bad_buf) {
-		pr_warn("Failed to allocate buffers from caches\n");
-		goto free_alloc;
-	}
-
-	/* Allocate user memory we'll poke at. */
-	user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
-			    PROT_READ | PROT_WRITE | PROT_EXEC,
-			    MAP_ANONYMOUS | MAP_PRIVATE, 0);
-	if (user_addr >= TASK_SIZE) {
-		pr_warn("Failed to allocate user memory\n");
-		goto free_alloc;
-	}
-
-	memset(good_buf, 'A', cache_size);
-	memset(bad_buf, 'B', cache_size);
-
-	if (to_user) {
-		pr_info("attempting good copy_to_user with SLAB_USERCOPY\n");
-		if (copy_to_user((void __user *)user_addr, good_buf,
-				 cache_size)) {
-			pr_warn("copy_to_user failed unexpectedly?!\n");
-			goto free_user;
-		}
-
-		pr_info("attempting bad copy_to_user w/o SLAB_USERCOPY\n");
-		if (copy_to_user((void __user *)user_addr, bad_buf,
-				 cache_size)) {
-			pr_warn("copy_to_user failed, but lacked Oops\n");
-			goto free_user;
-		}
-	} else {
-		pr_info("attempting good copy_from_user with SLAB_USERCOPY\n");
-		if (copy_from_user(good_buf, (void __user *)user_addr,
-				   cache_size)) {
-			pr_warn("copy_from_user failed unexpectedly?!\n");
-			goto free_user;
-		}
-
-		pr_info("attempting bad copy_from_user w/o SLAB_USERCOPY\n");
-		if (copy_from_user(bad_buf, (void __user *)user_addr,
-				   cache_size)) {
-			pr_warn("copy_from_user failed, but lacked Oops\n");
-			goto free_user;
-		}
-	}
-
-free_user:
-	vm_munmap(user_addr, PAGE_SIZE);
-free_alloc:
-	if (bad_buf)
-		kmem_cache_free(bad_cache, bad_buf);
-	kfree(good_buf);
-}
 
 static void lkdtm_do_action(enum ctype which)
 {
@@ -964,28 +711,28 @@ static void lkdtm_do_action(enum ctype which)
 		return;
 	}
 	case CT_USERCOPY_HEAP_SIZE_TO:
-		do_usercopy_heap_size(true);
+		lkdtm_USERCOPY_HEAP_SIZE_TO();
 		break;
 	case CT_USERCOPY_HEAP_SIZE_FROM:
-		do_usercopy_heap_size(false);
+		lkdtm_USERCOPY_HEAP_SIZE_FROM();
 		break;
 	case CT_USERCOPY_HEAP_FLAG_TO:
-		do_usercopy_heap_flag(true);
+		lkdtm_USERCOPY_HEAP_FLAG_TO();
 		break;
 	case CT_USERCOPY_HEAP_FLAG_FROM:
-		do_usercopy_heap_flag(false);
+		lkdtm_USERCOPY_HEAP_FLAG_FROM();
 		break;
 	case CT_USERCOPY_STACK_FRAME_TO:
-		do_usercopy_stack(true, true);
+		lkdtm_USERCOPY_STACK_FRAME_TO();
 		break;
 	case CT_USERCOPY_STACK_FRAME_FROM:
-		do_usercopy_stack(false, true);
+		lkdtm_USERCOPY_STACK_FRAME_FROM();
 		break;
 	case CT_USERCOPY_STACK_BEYOND:
-		do_usercopy_stack(true, false);
+		lkdtm_USERCOPY_STACK_BEYOND();
 		break;
 	case CT_USERCOPY_KERNEL:
-		do_usercopy_kernel();
+		lkdtm_USERCOPY_KERNEL();
 		break;
 	case CT_NONE:
 	default:
@@ -1276,13 +1023,12 @@ static int __init lkdtm_module_init(void)
 	int n_debugfs_entries = 1; /* Assume only the direct entry */
 	int i;
 
+	/* Handle test-specific initialization. */
+	lkdtm_usercopy_init();
+
 	/* Make sure we can write to __ro_after_init values during __init */
 	ro_after_init |= 0xAA;
 
-	/* Prepare cache that lacks SLAB_USERCOPY flag. */
-	bad_cache = kmem_cache_create("lkdtm-no-usercopy", cache_size, 0,
-				      0, NULL);
-
 	/* Register debugfs interface */
 	lkdtm_debugfs_root = debugfs_create_dir("provoke-crash", NULL);
 	if (!lkdtm_debugfs_root) {
@@ -1334,7 +1080,8 @@ static void __exit lkdtm_module_exit(void)
 {
 	debugfs_remove_recursive(lkdtm_debugfs_root);
 
-	kmem_cache_destroy(bad_cache);
+	/* Handle test-specific clean-up. */
+	lkdtm_usercopy_exit();
 
 	unregister_jprobe(&lkdtm);
 	pr_info("Crash point unregistered\n");