[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 5 Jan 2016 16:15:35 -0800
From: Kees Cook <keescook@...omium.org>
To: Laura Abbott <laura@...bott.name>
Cc: Christoph Lameter <cl@...ux.com>, Pekka Enberg <penberg@...nel.org>,
David Rientjes <rientjes@...gle.com>, Joonsoo Kim <iamjoonsoo.kim@....com>,
Andrew Morton <akpm@...ux-foundation.org>, Linux-MM <linux-mm@...ck.org>,
LKML <linux-kernel@...r.kernel.org>,
"kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com>, Arnd Bergmann <arnd@...db.de>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Re: [RFC][PATCH 7/7] lkdtm: Add READ_AFTER_FREE test
On Mon, Dec 21, 2015 at 7:40 PM, Laura Abbott <laura@...bott.name> wrote:
>
> In a similar manner to WRITE_AFTER_FREE, add a READ_AFTER_FREE
> test to test free poisoning features. Sample output when
> no poison is present:
>
> [ 20.222501] lkdtm: Performing direct entry READ_AFTER_FREE
> [ 20.226163] lkdtm: Freed val: 12345678
>
> with poison:
>
> [ 24.203748] lkdtm: Performing direct entry READ_AFTER_FREE
> [ 24.207261] general protection fault: 0000 [#1] SMP
> [ 24.208193] Modules linked in:
> [ 24.208193] CPU: 0 PID: 866 Comm: sh Not tainted 4.4.0-rc5-work+ #108
>
> Cc: Arnd Bergmann <arnd@...db.de>
> Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> Signed-off-by: Laura Abbott <laura@...bott.name>
> ---
> drivers/misc/lkdtm.c | 29 +++++++++++++++++++++++++++++
> 1 file changed, 29 insertions(+)
>
> diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
> index 11fdadc..c641fb7 100644
> --- a/drivers/misc/lkdtm.c
> +++ b/drivers/misc/lkdtm.c
> @@ -92,6 +92,7 @@ enum ctype {
> CT_UNALIGNED_LOAD_STORE_WRITE,
> CT_OVERWRITE_ALLOCATION,
> CT_WRITE_AFTER_FREE,
> + CT_READ_AFTER_FREE,
> CT_SOFTLOCKUP,
> CT_HARDLOCKUP,
> CT_SPINLOCKUP,
> @@ -129,6 +130,7 @@ static char* cp_type[] = {
> "UNALIGNED_LOAD_STORE_WRITE",
> "OVERWRITE_ALLOCATION",
> "WRITE_AFTER_FREE",
> + "READ_AFTER_FREE",
> "SOFTLOCKUP",
> "HARDLOCKUP",
> "SPINLOCKUP",
> @@ -417,6 +419,33 @@ static void lkdtm_do_action(enum ctype which)
> memset(data, 0x78, len);
> break;
> }
> + case CT_READ_AFTER_FREE: {
> + int **base;
> + int *val, *tmp;
> +
> + base = kmalloc(1024, GFP_KERNEL);
> + if (!base)
> + return;
> +
> + val = kmalloc(1024, GFP_KERNEL);
> + if (!val)
> + return;
For both of these test failure return, I think there should be a
pr_warn too (see CT_EXEC_USERSPACE).
> +
> + *val = 0x12345678;
> +
> + /*
> + * Don't just use the first entry since that's where the
> + * freelist goes for the slab allocator
> + */
> + base[1] = val;
Maybe just aim at the middle, in case allocator freelist tracking ever
grows? base[1024/sizeof(int)/2] or something?
> + kfree(base);
> +
> + tmp = base[1];
> + pr_info("Freed val: %x\n", *tmp);
Instead of depending on the deref to fail, maybe just use a simple
BUG_ON to test that the value did actually change? Or, change the
pr_info to "Failed to Oops when reading freed value: ..." just to be
slightly more verbose about what failed?
> +
> + kfree(val);
> + break;
> + }
> case CT_SOFTLOCKUP:
> preempt_disable();
> for (;;)
> --
> 2.5.0
>
-Kees
--
Kees Cook
Chrome OS & Brillo Security
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
