Blame view

lib/test_kasan.c 16.7 KB
d2912cb15   Thomas Gleixner   treewide: Replace...
1
  // SPDX-License-Identifier: GPL-2.0-only
3f15801cd   Andrey Ryabinin   lib: add kasan te...
2
3
4
5
  /*
   *
   * Copyright (c) 2014 Samsung Electronics Co., Ltd.
   * Author: Andrey Ryabinin <a.ryabinin@samsung.com>
3f15801cd   Andrey Ryabinin   lib: add kasan te...
6
7
8
   */
  
  #define pr_fmt(fmt) "kasan test: %s " fmt, __func__
19a33ca6c   Marco Elver   lib/test_kasan: a...
9
  #include <linux/bitops.h>
0386bf385   Greg Thelen   kasan: add memcg ...
10
  #include <linux/delay.h>
19a33ca6c   Marco Elver   lib/test_kasan: a...
11
  #include <linux/kasan.h>
3f15801cd   Andrey Ryabinin   lib: add kasan te...
12
  #include <linux/kernel.h>
eae08dcab   Andrey Ryabinin   kasan/tests: add ...
13
  #include <linux/mm.h>
19a33ca6c   Marco Elver   lib/test_kasan: a...
14
15
  #include <linux/mman.h>
  #include <linux/module.h>
3f15801cd   Andrey Ryabinin   lib: add kasan te...
16
17
18
  #include <linux/printk.h>
  #include <linux/slab.h>
  #include <linux/string.h>
eae08dcab   Andrey Ryabinin   kasan/tests: add ...
19
  #include <linux/uaccess.h>
b92a953cb   Mark Rutland   lib/test_kasan.c:...
20
21
22
  #include <linux/io.h>
  
  #include <asm/page.h>
3f15801cd   Andrey Ryabinin   lib: add kasan te...
23

828347f8f   Dmitry Vyukov   kasan: support us...
24
  /*
d6c2b4d24   Daniel Axtens   kasan: stop tests...
25
26
27
28
29
30
31
32
   * We assign some test results to these globals to make sure the tests
   * are not eliminated as dead code.
   */
  
  int kasan_int_result;
  void *kasan_ptr_result;
  
  /*
828347f8f   Dmitry Vyukov   kasan: support us...
33
34
35
   * Note: test functions are marked noinline so that their names appear in
   * reports.
   */
3f15801cd   Andrey Ryabinin   lib: add kasan te...
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
  static noinline void __init kmalloc_oob_right(void)
  {
  	char *ptr;
  	size_t size = 123;
  
  	pr_info("out-of-bounds to right
  ");
  	ptr = kmalloc(size, GFP_KERNEL);
  	if (!ptr) {
  		pr_err("Allocation failed
  ");
  		return;
  	}
  
  	ptr[size] = 'x';
  	kfree(ptr);
  }
  
  static noinline void __init kmalloc_oob_left(void)
  {
  	char *ptr;
  	size_t size = 15;
  
  	pr_info("out-of-bounds to left
  ");
  	ptr = kmalloc(size, GFP_KERNEL);
  	if (!ptr) {
  		pr_err("Allocation failed
  ");
  		return;
  	}
  
  	*ptr = *(ptr - 1);
  	kfree(ptr);
  }
  
  static noinline void __init kmalloc_node_oob_right(void)
  {
  	char *ptr;
  	size_t size = 4096;
  
  	pr_info("kmalloc_node(): out-of-bounds to right
  ");
  	ptr = kmalloc_node(size, GFP_KERNEL, 0);
  	if (!ptr) {
  		pr_err("Allocation failed
  ");
  		return;
  	}
  
  	ptr[size] = 0;
  	kfree(ptr);
  }
e6e8379c8   Alexander Potapenko   kasan: modify kma...
89
90
  #ifdef CONFIG_SLUB
  static noinline void __init kmalloc_pagealloc_oob_right(void)
3f15801cd   Andrey Ryabinin   lib: add kasan te...
91
92
93
  {
  	char *ptr;
  	size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
e6e8379c8   Alexander Potapenko   kasan: modify kma...
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
  	/* Allocate a chunk that does not fit into a SLUB cache to trigger
  	 * the page allocator fallback.
  	 */
  	pr_info("kmalloc pagealloc allocation: out-of-bounds to right
  ");
  	ptr = kmalloc(size, GFP_KERNEL);
  	if (!ptr) {
  		pr_err("Allocation failed
  ");
  		return;
  	}
  
  	ptr[size] = 0;
  	kfree(ptr);
  }
47adccce3   Dmitry Vyukov   kasan: detect inv...
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
  
  static noinline void __init kmalloc_pagealloc_uaf(void)
  {
  	char *ptr;
  	size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
  
  	pr_info("kmalloc pagealloc allocation: use-after-free
  ");
  	ptr = kmalloc(size, GFP_KERNEL);
  	if (!ptr) {
  		pr_err("Allocation failed
  ");
  		return;
  	}
  
  	kfree(ptr);
  	ptr[0] = 0;
  }
  
  static noinline void __init kmalloc_pagealloc_invalid_free(void)
  {
  	char *ptr;
  	size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
  
  	pr_info("kmalloc pagealloc allocation: invalid-free
  ");
  	ptr = kmalloc(size, GFP_KERNEL);
  	if (!ptr) {
  		pr_err("Allocation failed
  ");
  		return;
  	}
  
  	kfree(ptr + 1);
  }
e6e8379c8   Alexander Potapenko   kasan: modify kma...
144
145
146
147
148
149
150
151
152
  #endif
  
  static noinline void __init kmalloc_large_oob_right(void)
  {
  	char *ptr;
  	size_t size = KMALLOC_MAX_CACHE_SIZE - 256;
  	/* Allocate a chunk that is large enough, but still fits into a slab
  	 * and does not trigger the page allocator fallback in SLUB.
  	 */
3f15801cd   Andrey Ryabinin   lib: add kasan te...
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
  	pr_info("kmalloc large allocation: out-of-bounds to right
  ");
  	ptr = kmalloc(size, GFP_KERNEL);
  	if (!ptr) {
  		pr_err("Allocation failed
  ");
  		return;
  	}
  
  	ptr[size] = 0;
  	kfree(ptr);
  }
  
  static noinline void __init kmalloc_oob_krealloc_more(void)
  {
  	char *ptr1, *ptr2;
  	size_t size1 = 17;
  	size_t size2 = 19;
  
  	pr_info("out-of-bounds after krealloc more
  ");
  	ptr1 = kmalloc(size1, GFP_KERNEL);
  	ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
  	if (!ptr1 || !ptr2) {
  		pr_err("Allocation failed
  ");
  		kfree(ptr1);
db165906c   Gustavo A. R. Silva   lib/test_kasan.c:...
180
  		kfree(ptr2);
3f15801cd   Andrey Ryabinin   lib: add kasan te...
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
  		return;
  	}
  
  	ptr2[size2] = 'x';
  	kfree(ptr2);
  }
  
  static noinline void __init kmalloc_oob_krealloc_less(void)
  {
  	char *ptr1, *ptr2;
  	size_t size1 = 17;
  	size_t size2 = 15;
  
  	pr_info("out-of-bounds after krealloc less
  ");
  	ptr1 = kmalloc(size1, GFP_KERNEL);
  	ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
  	if (!ptr1 || !ptr2) {
  		pr_err("Allocation failed
  ");
  		kfree(ptr1);
  		return;
  	}
6b4a35fc1   Wang Long   lib/test_kasan.c:...
204
  	ptr2[size2] = 'x';
3f15801cd   Andrey Ryabinin   lib: add kasan te...
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
  	kfree(ptr2);
  }
  
  static noinline void __init kmalloc_oob_16(void)
  {
  	struct {
  		u64 words[2];
  	} *ptr1, *ptr2;
  
  	pr_info("kmalloc out-of-bounds for 16-bytes access
  ");
  	ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL);
  	ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
  	if (!ptr1 || !ptr2) {
  		pr_err("Allocation failed
  ");
  		kfree(ptr1);
  		kfree(ptr2);
  		return;
  	}
  	*ptr1 = *ptr2;
  	kfree(ptr1);
  	kfree(ptr2);
  }
f523e737c   Wang Long   lib: test_kasan: ...
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
  static noinline void __init kmalloc_oob_memset_2(void)
  {
  	char *ptr;
  	size_t size = 8;
  
  	pr_info("out-of-bounds in memset2
  ");
  	ptr = kmalloc(size, GFP_KERNEL);
  	if (!ptr) {
  		pr_err("Allocation failed
  ");
  		return;
  	}
  
  	memset(ptr+7, 0, 2);
  	kfree(ptr);
  }
  
  static noinline void __init kmalloc_oob_memset_4(void)
  {
  	char *ptr;
  	size_t size = 8;
  
  	pr_info("out-of-bounds in memset4
  ");
  	ptr = kmalloc(size, GFP_KERNEL);
  	if (!ptr) {
  		pr_err("Allocation failed
  ");
  		return;
  	}
  
  	memset(ptr+5, 0, 4);
  	kfree(ptr);
  }
  
  
  static noinline void __init kmalloc_oob_memset_8(void)
  {
  	char *ptr;
  	size_t size = 8;
  
  	pr_info("out-of-bounds in memset8
  ");
  	ptr = kmalloc(size, GFP_KERNEL);
  	if (!ptr) {
  		pr_err("Allocation failed
  ");
  		return;
  	}
  
  	memset(ptr+1, 0, 8);
  	kfree(ptr);
  }
  
  static noinline void __init kmalloc_oob_memset_16(void)
  {
  	char *ptr;
  	size_t size = 16;
  
  	pr_info("out-of-bounds in memset16
  ");
  	ptr = kmalloc(size, GFP_KERNEL);
  	if (!ptr) {
  		pr_err("Allocation failed
  ");
  		return;
  	}
  
  	memset(ptr+1, 0, 16);
  	kfree(ptr);
  }
3f15801cd   Andrey Ryabinin   lib: add kasan te...
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
  static noinline void __init kmalloc_oob_in_memset(void)
  {
  	char *ptr;
  	size_t size = 666;
  
  	pr_info("out-of-bounds in memset
  ");
  	ptr = kmalloc(size, GFP_KERNEL);
  	if (!ptr) {
  		pr_err("Allocation failed
  ");
  		return;
  	}
  
  	memset(ptr, 0, size+5);
  	kfree(ptr);
  }
  
  static noinline void __init kmalloc_uaf(void)
  {
  	char *ptr;
  	size_t size = 10;
  
  	pr_info("use-after-free
  ");
  	ptr = kmalloc(size, GFP_KERNEL);
  	if (!ptr) {
  		pr_err("Allocation failed
  ");
  		return;
  	}
  
  	kfree(ptr);
  	*(ptr + 8) = 'x';
  }
  
  static noinline void __init kmalloc_uaf_memset(void)
  {
  	char *ptr;
  	size_t size = 33;
  
  	pr_info("use-after-free in memset
  ");
  	ptr = kmalloc(size, GFP_KERNEL);
  	if (!ptr) {
  		pr_err("Allocation failed
  ");
  		return;
  	}
  
  	kfree(ptr);
  	memset(ptr, 0, size);
  }
  
  static noinline void __init kmalloc_uaf2(void)
  {
  	char *ptr1, *ptr2;
  	size_t size = 43;
  
  	pr_info("use-after-free after another kmalloc
  ");
  	ptr1 = kmalloc(size, GFP_KERNEL);
  	if (!ptr1) {
  		pr_err("Allocation failed
  ");
  		return;
  	}
  
  	kfree(ptr1);
  	ptr2 = kmalloc(size, GFP_KERNEL);
  	if (!ptr2) {
  		pr_err("Allocation failed
  ");
  		return;
  	}
  
  	ptr1[40] = 'x';
9dcadd381   Alexander Potapenko   kasan: test fix: ...
378
379
380
  	if (ptr1 == ptr2)
  		pr_err("Could not detect use-after-free: ptr1 == ptr2
  ");
3f15801cd   Andrey Ryabinin   lib: add kasan te...
381
382
  	kfree(ptr2);
  }
b92a953cb   Mark Rutland   lib/test_kasan.c:...
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
  static noinline void __init kfree_via_page(void)
  {
  	char *ptr;
  	size_t size = 8;
  	struct page *page;
  	unsigned long offset;
  
  	pr_info("invalid-free false positive (via page)
  ");
  	ptr = kmalloc(size, GFP_KERNEL);
  	if (!ptr) {
  		pr_err("Allocation failed
  ");
  		return;
  	}
  
  	page = virt_to_page(ptr);
  	offset = offset_in_page(ptr);
  	kfree(page_address(page) + offset);
  }
  
  static noinline void __init kfree_via_phys(void)
  {
  	char *ptr;
  	size_t size = 8;
  	phys_addr_t phys;
  
  	pr_info("invalid-free false positive (via phys)
  ");
  	ptr = kmalloc(size, GFP_KERNEL);
  	if (!ptr) {
  		pr_err("Allocation failed
  ");
  		return;
  	}
  
  	phys = virt_to_phys(ptr);
  	kfree(phys_to_virt(phys));
  }
3f15801cd   Andrey Ryabinin   lib: add kasan te...
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
  static noinline void __init kmem_cache_oob(void)
  {
  	char *p;
  	size_t size = 200;
  	struct kmem_cache *cache = kmem_cache_create("test_cache",
  						size, 0,
  						0, NULL);
  	if (!cache) {
  		pr_err("Cache allocation failed
  ");
  		return;
  	}
  	pr_info("out-of-bounds in kmem_cache_alloc
  ");
  	p = kmem_cache_alloc(cache, GFP_KERNEL);
  	if (!p) {
  		pr_err("Allocation failed
  ");
  		kmem_cache_destroy(cache);
  		return;
  	}
  
  	*p = p[size];
  	kmem_cache_free(cache, p);
  	kmem_cache_destroy(cache);
  }
0386bf385   Greg Thelen   kasan: add memcg ...
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
  static noinline void __init memcg_accounted_kmem_cache(void)
  {
  	int i;
  	char *p;
  	size_t size = 200;
  	struct kmem_cache *cache;
  
  	cache = kmem_cache_create("test_cache", size, 0, SLAB_ACCOUNT, NULL);
  	if (!cache) {
  		pr_err("Cache allocation failed
  ");
  		return;
  	}
  
  	pr_info("allocate memcg accounted object
  ");
  	/*
  	 * Several allocations with a delay to allow for lazy per memcg kmem
  	 * cache creation.
  	 */
  	for (i = 0; i < 5; i++) {
  		p = kmem_cache_alloc(cache, GFP_KERNEL);
dc2bf000a   Markus Elfring   lib/test: delete ...
470
  		if (!p)
0386bf385   Greg Thelen   kasan: add memcg ...
471
  			goto free_cache;
dc2bf000a   Markus Elfring   lib/test: delete ...
472

0386bf385   Greg Thelen   kasan: add memcg ...
473
474
475
476
477
478
479
  		kmem_cache_free(cache, p);
  		msleep(100);
  	}
  
  free_cache:
  	kmem_cache_destroy(cache);
  }
3f15801cd   Andrey Ryabinin   lib: add kasan te...
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
  static char global_array[10];
  
  static noinline void __init kasan_global_oob(void)
  {
  	volatile int i = 3;
  	char *p = &global_array[ARRAY_SIZE(global_array) + i];
  
  	pr_info("out-of-bounds global variable
  ");
  	*(volatile char *)p;
  }
  
  static noinline void __init kasan_stack_oob(void)
  {
  	char stack_array[10];
  	volatile int i = 0;
  	char *p = &stack_array[ARRAY_SIZE(stack_array) + i];
  
  	pr_info("out-of-bounds on stack
  ");
  	*(volatile char *)p;
  }
96fe805fb   Alexander Potapenko   mm, kasan: add a ...
502
503
504
  static noinline void __init ksize_unpoisons_memory(void)
  {
  	char *ptr;
48c232395   Colin Ian King   kasan: remove red...
505
  	size_t size = 123, real_size;
96fe805fb   Alexander Potapenko   mm, kasan: add a ...
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
  
  	pr_info("ksize() unpoisons the whole allocated chunk
  ");
  	ptr = kmalloc(size, GFP_KERNEL);
  	if (!ptr) {
  		pr_err("Allocation failed
  ");
  		return;
  	}
  	real_size = ksize(ptr);
  	/* This access doesn't trigger an error. */
  	ptr[size] = 'x';
  	/* This one does. */
  	ptr[real_size] = 'y';
  	kfree(ptr);
  }
eae08dcab   Andrey Ryabinin   kasan/tests: add ...
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
  static noinline void __init copy_user_test(void)
  {
  	char *kmem;
  	char __user *usermem;
  	size_t size = 10;
  	int unused;
  
  	kmem = kmalloc(size, GFP_KERNEL);
  	if (!kmem)
  		return;
  
  	usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE,
  			    PROT_READ | PROT_WRITE | PROT_EXEC,
  			    MAP_ANONYMOUS | MAP_PRIVATE, 0);
  	if (IS_ERR(usermem)) {
  		pr_err("Failed to allocate user memory
  ");
  		kfree(kmem);
  		return;
  	}
  
  	pr_info("out-of-bounds in copy_from_user()
  ");
  	unused = copy_from_user(kmem, usermem, size + 1);
  
  	pr_info("out-of-bounds in copy_to_user()
  ");
  	unused = copy_to_user(usermem, kmem, size + 1);
  
  	pr_info("out-of-bounds in __copy_from_user()
  ");
  	unused = __copy_from_user(kmem, usermem, size + 1);
  
  	pr_info("out-of-bounds in __copy_to_user()
  ");
  	unused = __copy_to_user(usermem, kmem, size + 1);
  
  	pr_info("out-of-bounds in __copy_from_user_inatomic()
  ");
  	unused = __copy_from_user_inatomic(kmem, usermem, size + 1);
  
  	pr_info("out-of-bounds in __copy_to_user_inatomic()
  ");
  	unused = __copy_to_user_inatomic(usermem, kmem, size + 1);
  
  	pr_info("out-of-bounds in strncpy_from_user()
  ");
  	unused = strncpy_from_user(kmem, usermem, size + 1);
  
  	vm_munmap((unsigned long)usermem, PAGE_SIZE);
  	kfree(kmem);
  }
00a14294b   Paul Lawrence   kasan: add tests ...
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
  static noinline void __init kasan_alloca_oob_left(void)
  {
  	volatile int i = 10;
  	char alloca_array[i];
  	char *p = alloca_array - 1;
  
  	pr_info("out-of-bounds to left on alloca
  ");
  	*(volatile char *)p;
  }
  
  static noinline void __init kasan_alloca_oob_right(void)
  {
  	volatile int i = 10;
  	char alloca_array[i];
  	char *p = alloca_array + i;
  
  	pr_info("out-of-bounds to right on alloca
  ");
  	*(volatile char *)p;
  }
b1d572893   Dmitry Vyukov   kasan: detect inv...
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
  static noinline void __init kmem_cache_double_free(void)
  {
  	char *p;
  	size_t size = 200;
  	struct kmem_cache *cache;
  
  	cache = kmem_cache_create("test_cache", size, 0, 0, NULL);
  	if (!cache) {
  		pr_err("Cache allocation failed
  ");
  		return;
  	}
  	pr_info("double-free on heap object
  ");
  	p = kmem_cache_alloc(cache, GFP_KERNEL);
  	if (!p) {
  		pr_err("Allocation failed
  ");
  		kmem_cache_destroy(cache);
  		return;
  	}
  
  	kmem_cache_free(cache, p);
  	kmem_cache_free(cache, p);
  	kmem_cache_destroy(cache);
  }
  
  static noinline void __init kmem_cache_invalid_free(void)
  {
  	char *p;
  	size_t size = 200;
  	struct kmem_cache *cache;
  
  	cache = kmem_cache_create("test_cache", size, 0, SLAB_TYPESAFE_BY_RCU,
  				  NULL);
  	if (!cache) {
  		pr_err("Cache allocation failed
  ");
  		return;
  	}
  	pr_info("invalid-free of heap object
  ");
  	p = kmem_cache_alloc(cache, GFP_KERNEL);
  	if (!p) {
  		pr_err("Allocation failed
  ");
  		kmem_cache_destroy(cache);
  		return;
  	}
91c93ed07   Andrey Konovalov   kasan: fix invali...
644
  	/* Trigger invalid free, the object doesn't get freed */
b1d572893   Dmitry Vyukov   kasan: detect inv...
645
  	kmem_cache_free(cache, p + 1);
91c93ed07   Andrey Konovalov   kasan: fix invali...
646
647
648
649
650
651
  
  	/*
  	 * Properly free the object to prevent the "Objects remaining in
  	 * test_cache on __kmem_cache_shutdown" BUG failure.
  	 */
  	kmem_cache_free(cache, p);
b1d572893   Dmitry Vyukov   kasan: detect inv...
652
653
  	kmem_cache_destroy(cache);
  }
0c96350a2   Andrey Ryabinin   lib/test_kasan.c:...
654
655
656
657
658
659
660
661
662
663
  static noinline void __init kasan_memchr(void)
  {
  	char *ptr;
  	size_t size = 24;
  
  	pr_info("out-of-bounds in memchr
  ");
  	ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
  	if (!ptr)
  		return;
d6c2b4d24   Daniel Axtens   kasan: stop tests...
664
  	kasan_ptr_result = memchr(ptr, '1', size + 1);
0c96350a2   Andrey Ryabinin   lib/test_kasan.c:...
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
  	kfree(ptr);
  }
  
  static noinline void __init kasan_memcmp(void)
  {
  	char *ptr;
  	size_t size = 24;
  	int arr[9];
  
  	pr_info("out-of-bounds in memcmp
  ");
  	ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
  	if (!ptr)
  		return;
  
  	memset(arr, 0, sizeof(arr));
d6c2b4d24   Daniel Axtens   kasan: stop tests...
681
  	kasan_int_result = memcmp(ptr, arr, size + 1);
0c96350a2   Andrey Ryabinin   lib/test_kasan.c:...
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
  	kfree(ptr);
  }
  
  static noinline void __init kasan_strings(void)
  {
  	char *ptr;
  	size_t size = 24;
  
  	pr_info("use-after-free in strchr
  ");
  	ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
  	if (!ptr)
  		return;
  
  	kfree(ptr);
  
  	/*
  	 * Try to cause only 1 invalid access (less spam in dmesg).
  	 * For that we need ptr to point to zeroed byte.
  	 * Skip metadata that could be stored in freed object so ptr
  	 * will likely point to zeroed byte.
  	 */
  	ptr += 16;
d6c2b4d24   Daniel Axtens   kasan: stop tests...
705
  	kasan_ptr_result = strchr(ptr, '1');
0c96350a2   Andrey Ryabinin   lib/test_kasan.c:...
706
707
708
  
  	pr_info("use-after-free in strrchr
  ");
d6c2b4d24   Daniel Axtens   kasan: stop tests...
709
  	kasan_ptr_result = strrchr(ptr, '1');
0c96350a2   Andrey Ryabinin   lib/test_kasan.c:...
710
711
712
  
  	pr_info("use-after-free in strcmp
  ");
d6c2b4d24   Daniel Axtens   kasan: stop tests...
713
  	kasan_int_result = strcmp(ptr, "2");
0c96350a2   Andrey Ryabinin   lib/test_kasan.c:...
714
715
716
  
  	pr_info("use-after-free in strncmp
  ");
d6c2b4d24   Daniel Axtens   kasan: stop tests...
717
  	kasan_int_result = strncmp(ptr, "2", 1);
0c96350a2   Andrey Ryabinin   lib/test_kasan.c:...
718
719
720
  
  	pr_info("use-after-free in strlen
  ");
d6c2b4d24   Daniel Axtens   kasan: stop tests...
721
  	kasan_int_result = strlen(ptr);
0c96350a2   Andrey Ryabinin   lib/test_kasan.c:...
722
723
724
  
  	pr_info("use-after-free in strnlen
  ");
d6c2b4d24   Daniel Axtens   kasan: stop tests...
725
  	kasan_int_result = strnlen(ptr, 1);
0c96350a2   Andrey Ryabinin   lib/test_kasan.c:...
726
  }
19a33ca6c   Marco Elver   lib/test_kasan: a...
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
  static noinline void __init kasan_bitops(void)
  {
  	/*
  	 * Allocate 1 more byte, which causes kzalloc to round up to 16-bytes;
  	 * this way we do not actually corrupt other memory.
  	 */
  	long *bits = kzalloc(sizeof(*bits) + 1, GFP_KERNEL);
  	if (!bits)
  		return;
  
  	/*
  	 * Below calls try to access bit within allocated memory; however, the
  	 * below accesses are still out-of-bounds, since bitops are defined to
  	 * operate on the whole long the bit is in.
  	 */
  	pr_info("out-of-bounds in set_bit
  ");
  	set_bit(BITS_PER_LONG, bits);
  
  	pr_info("out-of-bounds in __set_bit
  ");
  	__set_bit(BITS_PER_LONG, bits);
  
  	pr_info("out-of-bounds in clear_bit
  ");
  	clear_bit(BITS_PER_LONG, bits);
  
  	pr_info("out-of-bounds in __clear_bit
  ");
  	__clear_bit(BITS_PER_LONG, bits);
  
  	pr_info("out-of-bounds in clear_bit_unlock
  ");
  	clear_bit_unlock(BITS_PER_LONG, bits);
  
  	pr_info("out-of-bounds in __clear_bit_unlock
  ");
  	__clear_bit_unlock(BITS_PER_LONG, bits);
  
  	pr_info("out-of-bounds in change_bit
  ");
  	change_bit(BITS_PER_LONG, bits);
  
  	pr_info("out-of-bounds in __change_bit
  ");
  	__change_bit(BITS_PER_LONG, bits);
  
  	/*
  	 * Below calls try to access bit beyond allocated memory.
  	 */
  	pr_info("out-of-bounds in test_and_set_bit
  ");
  	test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
  
  	pr_info("out-of-bounds in __test_and_set_bit
  ");
  	__test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
  
  	pr_info("out-of-bounds in test_and_set_bit_lock
  ");
  	test_and_set_bit_lock(BITS_PER_LONG + BITS_PER_BYTE, bits);
  
  	pr_info("out-of-bounds in test_and_clear_bit
  ");
  	test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
  
  	pr_info("out-of-bounds in __test_and_clear_bit
  ");
  	__test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
  
  	pr_info("out-of-bounds in test_and_change_bit
  ");
  	test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
  
  	pr_info("out-of-bounds in __test_and_change_bit
  ");
  	__test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
  
  	pr_info("out-of-bounds in test_bit
  ");
d6c2b4d24   Daniel Axtens   kasan: stop tests...
807
  	kasan_int_result = test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits);
19a33ca6c   Marco Elver   lib/test_kasan: a...
808
809
810
811
  
  #if defined(clear_bit_unlock_is_negative_byte)
  	pr_info("out-of-bounds in clear_bit_unlock_is_negative_byte
  ");
d6c2b4d24   Daniel Axtens   kasan: stop tests...
812
813
  	kasan_int_result = clear_bit_unlock_is_negative_byte(BITS_PER_LONG +
  		BITS_PER_BYTE, bits);
19a33ca6c   Marco Elver   lib/test_kasan: a...
814
815
816
  #endif
  	kfree(bits);
  }
bb104ed78   Marco Elver   lib/test_kasan: A...
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
  static noinline void __init kmalloc_double_kzfree(void)
  {
  	char *ptr;
  	size_t size = 16;
  
  	pr_info("double-free (kzfree)
  ");
  	ptr = kmalloc(size, GFP_KERNEL);
  	if (!ptr) {
  		pr_err("Allocation failed
  ");
  		return;
  	}
  
  	kzfree(ptr);
  	kzfree(ptr);
  }
3f15801cd   Andrey Ryabinin   lib: add kasan te...
834
835
  static int __init kmalloc_tests_init(void)
  {
b0845ce58   Mark Rutland   kasan: report onl...
836
837
838
839
840
  	/*
  	 * Temporarily enable multi-shot mode. Otherwise, we'd only get a
  	 * report for the first case.
  	 */
  	bool multishot = kasan_save_enable_multi_shot();
3f15801cd   Andrey Ryabinin   lib: add kasan te...
841
842
843
  	kmalloc_oob_right();
  	kmalloc_oob_left();
  	kmalloc_node_oob_right();
e6e8379c8   Alexander Potapenko   kasan: modify kma...
844
845
  #ifdef CONFIG_SLUB
  	kmalloc_pagealloc_oob_right();
47adccce3   Dmitry Vyukov   kasan: detect inv...
846
847
  	kmalloc_pagealloc_uaf();
  	kmalloc_pagealloc_invalid_free();
e6e8379c8   Alexander Potapenko   kasan: modify kma...
848
  #endif
9789d8e0c   Wang Long   lib/test_kasan.c:...
849
  	kmalloc_large_oob_right();
3f15801cd   Andrey Ryabinin   lib: add kasan te...
850
851
852
853
  	kmalloc_oob_krealloc_more();
  	kmalloc_oob_krealloc_less();
  	kmalloc_oob_16();
  	kmalloc_oob_in_memset();
f523e737c   Wang Long   lib: test_kasan: ...
854
855
856
857
  	kmalloc_oob_memset_2();
  	kmalloc_oob_memset_4();
  	kmalloc_oob_memset_8();
  	kmalloc_oob_memset_16();
3f15801cd   Andrey Ryabinin   lib: add kasan te...
858
859
860
  	kmalloc_uaf();
  	kmalloc_uaf_memset();
  	kmalloc_uaf2();
b92a953cb   Mark Rutland   lib/test_kasan.c:...
861
862
  	kfree_via_page();
  	kfree_via_phys();
3f15801cd   Andrey Ryabinin   lib: add kasan te...
863
  	kmem_cache_oob();
0386bf385   Greg Thelen   kasan: add memcg ...
864
  	memcg_accounted_kmem_cache();
3f15801cd   Andrey Ryabinin   lib: add kasan te...
865
866
  	kasan_stack_oob();
  	kasan_global_oob();
00a14294b   Paul Lawrence   kasan: add tests ...
867
868
  	kasan_alloca_oob_left();
  	kasan_alloca_oob_right();
96fe805fb   Alexander Potapenko   mm, kasan: add a ...
869
  	ksize_unpoisons_memory();
eae08dcab   Andrey Ryabinin   kasan/tests: add ...
870
  	copy_user_test();
b1d572893   Dmitry Vyukov   kasan: detect inv...
871
872
  	kmem_cache_double_free();
  	kmem_cache_invalid_free();
0c96350a2   Andrey Ryabinin   lib/test_kasan.c:...
873
874
875
  	kasan_memchr();
  	kasan_memcmp();
  	kasan_strings();
19a33ca6c   Marco Elver   lib/test_kasan: a...
876
  	kasan_bitops();
bb104ed78   Marco Elver   lib/test_kasan: A...
877
  	kmalloc_double_kzfree();
b0845ce58   Mark Rutland   kasan: report onl...
878
879
  
  	kasan_restore_multi_shot(multishot);
3f15801cd   Andrey Ryabinin   lib: add kasan te...
880
881
882
883
884
  	return -EAGAIN;
  }
  
  module_init(kmalloc_tests_init);
  MODULE_LICENSE("GPL");