[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 3 Oct 2016 09:41:26 +0300
From: Elena Reshetova <elena.reshetova@...el.com>
To: kernel-hardening@...ts.openwall.com
Cc: keescook@...omium.org,
Hans Liljestrand <ishkamiel@...il.com>,
Elena Reshetova <elena.reshetova@...el.com>,
David Windsor <dwindsor@...il.com>
Subject: [RFC PATCH 13/13] lkdtm: add tests for atomic over-/underflow
From: Hans Liljestrand <ishkamiel@...il.com>
This adds additional tests for modified atomic
functions.
Signed-off-by: Hans Liljestrand <ishkamiel@...il.com>
Signed-off-by: Elena Reshetova <elena.reshetova@...el.com>
Signed-off-by: David Windsor <dwindsor@...il.com>
---
drivers/misc/lkdtm.h | 17 ++++
drivers/misc/lkdtm_bugs.c | 205 ++++++++++++++++++++++++++++++++++++++++++++++
drivers/misc/lkdtm_core.c | 17 ++++
3 files changed, 239 insertions(+)
diff --git a/drivers/misc/lkdtm.h b/drivers/misc/lkdtm.h
index cfa1039..224713a 100644
--- a/drivers/misc/lkdtm.h
+++ b/drivers/misc/lkdtm.h
@@ -20,7 +20,24 @@ void lkdtm_HARDLOCKUP(void);
void lkdtm_SPINLOCKUP(void);
void lkdtm_HUNG_TASK(void);
void lkdtm_ATOMIC_UNDERFLOW(void);
+void lkdtm_ATOMIC_DEC_RETURN_UNDERFLOW(void);
+void lkdtm_ATOMIC_SUB_UNDERFLOW(void);
+void lkdtm_ATOMIC_SUB_RETURN_UNDERFLOW(void);
void lkdtm_ATOMIC_OVERFLOW(void);
+void lkdtm_ATOMIC_INC_RETURN_OVERFLOW(void);
+void lkdtm_ATOMIC_ADD_OVERFLOW(void);
+void lkdtm_ATOMIC_ADD_RETURN_OVERFLOW(void);
+void lkdtm_ATOMIC_ADD_UNLESS_OVERFLOW(void);
+void lkdtm_ATOMIC_INC_AND_TEST_OVERFLOW(void);
+void lkdtm_ATOMIC_LONG_UNDERFLOW(void);
+void lkdtm_ATOMIC_LONG_DEC_RETURN_UNDERFLOW(void);
+void lkdtm_ATOMIC_LONG_SUB_UNDERFLOW(void);
+void lkdtm_ATOMIC_LONG_SUB_RETURN_UNDERFLOW(void);
+void lkdtm_ATOMIC_LONG_OVERFLOW(void);
+void lkdtm_ATOMIC_LONG_INC_RETURN_OVERFLOW(void);
+void lkdtm_ATOMIC_LONG_ADD_OVERFLOW(void);
+void lkdtm_ATOMIC_LONG_ADD_RETURN_OVERFLOW(void);
+void lkdtm_ATOMIC_LONG_SUB_AND_TEST(void);
void lkdtm_CORRUPT_LIST_ADD(void);
void lkdtm_CORRUPT_LIST_DEL(void);
diff --git a/drivers/misc/lkdtm_bugs.c b/drivers/misc/lkdtm_bugs.c
index f336206..f6a09c6 100644
--- a/drivers/misc/lkdtm_bugs.c
+++ b/drivers/misc/lkdtm_bugs.c
@@ -140,6 +140,42 @@ void lkdtm_ATOMIC_UNDERFLOW(void)
atomic_dec(&under);
}
+void lkdtm_ATOMIC_DEC_RETURN_UNDERFLOW(void)
+{
+ atomic_t under = ATOMIC_INIT(INT_MIN);
+
+ pr_info("attempting good atomic_dec_return\n");
+ atomic_inc(&under);
+ atomic_dec_return(&under);
+
+ pr_info("attempting bad atomic_dec_return\n");
+ atomic_dec_return(&under);
+}
+
+void lkdtm_ATOMIC_SUB_UNDERFLOW(void) {
+ atomic_t under = ATOMIC_INIT(INT_MIN);
+
+ pr_info("attempting good atomic subtract\n");
+ atomic_add(10, &under);
+ atomic_sub(10, &under);
+
+ pr_info("attempting bad atomic subtract underflow\n");
+ atomic_sub(10, &under);
+}
+
+void lkdtm_ATOMIC_SUB_RETURN_UNDERFLOW(void)
+{
+ atomic_t under = ATOMIC_INIT(INT_MIN);
+
+ pr_info("attempting good atomic_sub_return\n");
+ atomic_add(10, &under);
+ atomic_sub_return(10, &under);
+
+ pr_info("attempting bad atomic_sub_return underflow\n");
+ atomic_sub_return(10, &under);
+
+}
+
void lkdtm_ATOMIC_OVERFLOW(void)
{
atomic_t over = ATOMIC_INIT(INT_MAX);
@@ -214,3 +250,172 @@ void lkdtm_CORRUPT_LIST_DEL(void)
else
pr_err("list_del() corruption not detected!\n");
}
+
+void lkdtm_ATOMIC_INC_RETURN_OVERFLOW(void)
+{
+ atomic_t over = ATOMIC_INIT(INT_MAX);
+
+ pr_info("attempting good atomic_inc_return\n");
+ atomic_dec(&over);
+ atomic_inc_return(&over);
+
+ pr_info("attempting bad atomic_inc_return overflow\n");
+ atomic_inc_return(&over);
+}
+
+void lkdtm_ATOMIC_ADD_OVERFLOW(void) {
+ atomic_t over = ATOMIC_INIT(INT_MAX);
+
+ pr_info("attempting good atomic add\n");
+ atomic_sub(10, &over);
+ atomic_add(10, &over);
+
+ pr_info("attempting bad atomic add overflow\n");
+ atomic_add(10, &over);
+}
+
+void lkdtm_ATOMIC_ADD_RETURN_OVERFLOW(void)
+{
+ atomic_t over = ATOMIC_INIT(INT_MAX);
+
+ pr_info("attempting good atomic_add_return\n");
+ atomic_sub(10, &over);
+ atomic_add_return(10, &over);
+
+ pr_info("attempting bad atomic_add_return overflow\n");
+ atomic_add_return(10, &over);
+}
+
+void lkdtm_ATOMIC_ADD_UNLESS_OVERFLOW(void)
+{
+ atomic_t over = ATOMIC_INIT(INT_MAX);
+
+ pr_info("attempting good atomic_add_unless\n");
+ atomic_sub(10, &over);
+ atomic_add_unless(&over, 10, 0);
+
+ pr_info("attempting bad atomic_add_unless overflow\n");
+ atomic_add_unless(&over, 10, 0);
+}
+
+void lkdtm_ATOMIC_INC_AND_TEST_OVERFLOW(void)
+{
+ atomic_t over = ATOMIC_INIT(INT_MAX);
+
+ pr_info("attempting good atomic_inc_and_test\n");
+ atomic_dec(&over);
+ atomic_inc_and_test(&over);
+
+ pr_info("attempting bad atomic_inc_and_test overflow\n");
+ atomic_inc_and_test(&over);
+}
+
+void lkdtm_ATOMIC_LONG_UNDERFLOW(void)
+{
+ atomic_long_t under = ATOMIC_LONG_INIT(LONG_MIN);
+
+ pr_info("attempting good atomic_long_dec\n");
+ atomic_long_inc(&under);
+ atomic_long_dec(&under);
+
+ pr_info("attempting bad atomic_long_dec underflow\n");
+ atomic_long_dec(&under);
+}
+
+void lkdtm_ATOMIC_LONG_DEC_RETURN_UNDERFLOW(void)
+{
+ atomic_long_t under = ATOMIC_LONG_INIT(LONG_MIN);
+
+ pr_info("attempting good atomic_long_dec_return\n");
+ atomic_long_inc(&under);
+ atomic_long_dec_return(&under);
+
+ pr_info("attempting bad atomic_long_dec_return underflow\n");
+ atomic_long_dec_return(&under);
+}
+
+void lkdtm_ATOMIC_LONG_SUB_UNDERFLOW(void)
+{
+ atomic_long_t under = ATOMIC_INIT(LONG_MIN);
+
+ pr_info("attempting good atomic_long_sub\n");
+ atomic_long_add(10, &under);
+ atomic_long_sub(10, &under);
+
+ pr_info("attempting bad atomic_long_sub underflow\n");
+ atomic_long_sub(10, &under);
+
+}
+
+void lkdtm_ATOMIC_LONG_SUB_RETURN_UNDERFLOW(void)
+{
+ atomic_long_t under = ATOMIC_INIT(LONG_MIN);
+
+ pr_info("attempting good atomic_long_sub_return \n");
+ atomic_long_add(10, &under);
+ atomic_long_sub_return(10, &under);
+
+ pr_info("attempting bad atomic_long_sub_return underflow\n");
+ atomic_long_sub_return(10, &under);
+
+}
+
+void lkdtm_ATOMIC_LONG_OVERFLOW(void)
+{
+ atomic_long_t over = ATOMIC_LONG_INIT(LONG_MAX);
+
+ pr_info("attempting good atomic_long_inc\n");
+ atomic_long_dec(&over);
+ atomic_long_inc(&over);
+
+ pr_info("attempting bad atomic_long_inc overflow\n");
+ atomic_long_inc(&over);
+}
+
+void lkdtm_ATOMIC_LONG_INC_RETURN_OVERFLOW(void)
+{
+ atomic_long_t over = ATOMIC_LONG_INIT(LONG_MAX);
+
+ pr_info("attempting good atomic_ong_inc_return\n");
+ atomic_long_dec(&over);
+ atomic_long_inc_return(&over);
+
+ pr_info("attempting bad atomic_long_inc_return overflow\n");
+ atomic_long_inc_return(&over);
+}
+
+void lkdtm_ATOMIC_LONG_ADD_OVERFLOW(void)
+{
+ atomic_long_t over = ATOMIC_LONG_INIT(LONG_MAX);
+
+ pr_info("attempting good atomic_long_add\n");
+ atomic_long_sub(10, &over);
+ atomic_long_add(10, &over);
+
+ pr_info("attempting bad atomic_long_add overflow\n");
+ atomic_long_add(10, &over);
+}
+
+void lkdtm_ATOMIC_LONG_ADD_RETURN_OVERFLOW(void)
+{
+ atomic_long_t over = ATOMIC_LONG_INIT(LONG_MAX);
+
+ pr_info("attempting good atomic_long_add_return\n");
+ atomic_long_sub(10, &over);
+ atomic_long_add_return(10, &over);
+
+ pr_info("attempting bad atomic_long_add_return overflow\n");
+ atomic_long_add_return(10, &over);
+}
+
+void lkdtm_ATOMIC_LONG_SUB_AND_TEST(void)
+{
+ atomic_long_t over = ATOMIC_LONG_INIT(LONG_MIN);
+
+ pr_info("attempting good atomic_long_sub_and_test\n");
+ atomic_long_add(10, &over);
+ atomic_long_sub_and_test(10, &over);
+
+ pr_info("attempting bad atomic_long_sub_and_test overflow\n");
+ atomic_long_sub_and_test(10, &over);
+}
diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c
index 7eeb71a..4b05803 100644
--- a/drivers/misc/lkdtm_core.c
+++ b/drivers/misc/lkdtm_core.c
@@ -221,7 +221,24 @@ struct crashtype crashtypes[] = {
CRASHTYPE(WRITE_RO_AFTER_INIT),
CRASHTYPE(WRITE_KERN),
CRASHTYPE(ATOMIC_UNDERFLOW),
+ CRASHTYPE(ATOMIC_DEC_RETURN_UNDERFLOW),
+ CRASHTYPE(ATOMIC_SUB_UNDERFLOW),
+ CRASHTYPE(ATOMIC_SUB_RETURN_UNDERFLOW),
CRASHTYPE(ATOMIC_OVERFLOW),
+ CRASHTYPE(ATOMIC_INC_RETURN_OVERFLOW),
+ CRASHTYPE(ATOMIC_ADD_OVERFLOW),
+ CRASHTYPE(ATOMIC_ADD_RETURN_OVERFLOW),
+ CRASHTYPE(ATOMIC_ADD_UNLESS_OVERFLOW),
+ CRASHTYPE(ATOMIC_INC_AND_TEST_OVERFLOW),
+ CRASHTYPE(ATOMIC_LONG_UNDERFLOW),
+ CRASHTYPE(ATOMIC_LONG_DEC_RETURN_UNDERFLOW),
+ CRASHTYPE(ATOMIC_LONG_SUB_UNDERFLOW),
+ CRASHTYPE(ATOMIC_LONG_SUB_RETURN_UNDERFLOW),
+ CRASHTYPE(ATOMIC_LONG_OVERFLOW),
+ CRASHTYPE(ATOMIC_LONG_INC_RETURN_OVERFLOW),
+ CRASHTYPE(ATOMIC_LONG_ADD_OVERFLOW),
+ CRASHTYPE(ATOMIC_LONG_ADD_RETURN_OVERFLOW),
+ CRASHTYPE(ATOMIC_LONG_SUB_AND_TEST),
CRASHTYPE(USERCOPY_HEAP_SIZE_TO),
CRASHTYPE(USERCOPY_HEAP_SIZE_FROM),
CRASHTYPE(USERCOPY_HEAP_FLAG_TO),
--
2.7.4
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
