On Fri, Nov 29, 2019 at 3:15 PM Andrey Konovalov <andreyknvl@xxxxxxxxxx> wrote:
>
> On Fri, Nov 22, 2019 at 12:27 PM <glider@xxxxxxxxxx> wrote:
> >
> > The initial commit adds several tests that trigger KMSAN warnings in
> > simple cases.
> > To use, build the kernel with CONFIG_TEST_KMSAN and do
> > `insmod test_kmsan.ko`
> >
> > Signed-off-by: Alexander Potapenko <glider@xxxxxxxxxx>
> > To: Alexander Potapenko <glider@xxxxxxxxxx>
> > Cc: Vegard Nossum <vegard.nossum@xxxxxxxxxx>
> > Cc: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
> > Cc: linux-mm@xxxxxxxxx
> > ---
> > v2:
> > - added printk_test()
> >
> > Change-Id: I287e86ae83a82b770f2baa46e5bbdce1dfa65195
> > ---
> > lib/Makefile | 1 +
> > lib/test_kmsan.c | 231 +++++++++++++++++++++++++++++++++++++++++++++++
> > 2 files changed, 232 insertions(+)
> > create mode 100644 lib/test_kmsan.c
> >
> > diff --git a/lib/Makefile b/lib/Makefile
> > index 58a3e1b1a868..08fcb37499a0 100644
> > --- a/lib/Makefile
> > +++ b/lib/Makefile
> > @@ -65,6 +65,7 @@ CFLAGS_test_kasan.o += $(call cc-disable-warning, vla)
> > obj-$(CONFIG_TEST_UBSAN) += test_ubsan.o
> > CFLAGS_test_ubsan.o += $(call cc-disable-warning, vla)
> > UBSAN_SANITIZE_test_ubsan.o := y
> > +obj-$(CONFIG_TEST_KMSAN) += test_kmsan.o
> > obj-$(CONFIG_TEST_KSTRTOX) += test-kstrtox.o
> > obj-$(CONFIG_TEST_LIST_SORT) += test_list_sort.o
> > obj-$(CONFIG_TEST_LKM) += test_module.o
> > diff --git a/lib/test_kmsan.c b/lib/test_kmsan.c
> > new file mode 100644
> > index 000000000000..dcbe02adbdb0
> > --- /dev/null
> > +++ b/lib/test_kmsan.c
> > @@ -0,0 +1,231 @@
> > +// SPDX-License-Identifier: GPL-2.0
> > +/*
> > + * Module for testing KMSAN.
> > + *
> > + * Copyright (C) 2017-2019 Google LLC
> > + * Author: Alexander Potapenko <glider@xxxxxxxxxx>
> > + *
> > + * This program is free software; you can redistribute it and/or modify
> > + * it under the terms of the GNU General Public License version 2 as
> > + * published by the Free Software Foundation.
> > + *
> > + */
> > +
> > +/*
> > + * Tests below use noinline and volatile to work around compiler optimizations
> > + * that may mask KMSAN bugs.
> > + */
> > +#define pr_fmt(fmt) "kmsan test: %s : " fmt, __func__
> > +
> > +#include <linux/mm.h>
> > +#include <linux/module.h>
> > +#include <linux/printk.h>
> > +#include <linux/slab.h>
> > +#include <linux/kmsan-checks.h>
> > +
> > +#define CHECK(x) \
> > + do { \
> > + if (x) \
> > + pr_info(#x " is true\n"); \
> > + else \
> > + pr_info(#x " is false\n"); \
> > + } while (0)
> > +
> > +noinline void use_integer(int cond)
> > +{
> > + CHECK(cond);
> > +}
>
> This function seems to be unused.
Removed it, thanks!
> > +
> > +int signed_sum3(int a, int b, int c)
> > +{
> > + return a + b + c;
> > +}
> > +
> > +noinline void uninit_kmalloc_test(void)
> > +{
> > + int *ptr;
> > +
> > + pr_info("-----------------------------\n");
> > + pr_info("uninitialized kmalloc test (UMR report)\n");
> > + ptr = kmalloc(sizeof(int), GFP_KERNEL);
> > + pr_info("kmalloc returned %p\n", ptr);
> > + CHECK(*ptr);
> > +}
> > +noinline void init_kmalloc_test(void)
> > +{
> > + int *ptr;
> > +
> > + pr_info("-----------------------------\n");
> > + pr_info("initialized kmalloc test (no reports)\n");
> > + ptr = kmalloc(sizeof(int), GFP_KERNEL);
> > + memset(ptr, 0, sizeof(int));
> > + pr_info("kmalloc returned %p\n", ptr);
> > + CHECK(*ptr);
> > +}
> > +
> > +noinline void init_kzalloc_test(void)
> > +{
> > + int *ptr;
> > +
> > + pr_info("-----------------------------\n");
> > + pr_info("initialized kzalloc test (no reports)\n");
> > + ptr = kzalloc(sizeof(int), GFP_KERNEL);
> > + pr_info("kzalloc returned %p\n", ptr);
> > + CHECK(*ptr);
> > +}
> > +
> > +noinline void uninit_multiple_args_test(void)
> > +{
> > + volatile int a;
> > + volatile char b = 3, c;
> > +
> > + pr_info("-----------------------------\n");
> > + pr_info("uninitialized local passed to fn (UMR report)\n");
> > + CHECK(signed_sum3(a, b, c));
> > +}
> > +
> > +noinline void uninit_stack_var_test(void)
> > +{
> > + int cond;
> > +
> > + pr_info("-----------------------------\n");
> > + pr_info("uninitialized stack variable (UMR report)\n");
> > + CHECK(cond);
> > +}
> > +
> > +noinline void init_stack_var_test(void)
> > +{
> > + volatile int cond = 1;
> > +
> > + pr_info("-----------------------------\n");
> > + pr_info("initialized stack variable (no reports)\n");
> > + CHECK(cond);
> > +}
> > +
> > +noinline void two_param_fn_2(int arg1, int arg2)
> > +{
> > + CHECK(arg1);
> > + CHECK(arg2);
> > +}
> > +
> > +noinline void one_param_fn(int arg)
> > +{
> > + two_param_fn_2(arg, arg);
> > + CHECK(arg);
> > +}
> > +
> > +noinline void two_param_fn(int arg1, int arg2)
> > +{
> > + int init = 0;
> > +
> > + one_param_fn(init);
> > + CHECK(arg1);
> > + CHECK(arg2);
> > +}
> > +
> > +void params_test(void)
> > +{
> > + int uninit, init = 1;
> > +
> > + two_param_fn(uninit, init);
> > +}
>
> This one as well.
Added params_test to kmsan_tests_init() below.
> > +
> > +noinline void do_uninit_local_array(char *array, int start, int stop)
> > +{
> > + int i;
> > + volatile char uninit;
> > +
> > + for (i = start; i < stop; i++)
> > + array[i] = uninit;
> > +}
> > +
> > +noinline void uninit_kmsan_check_memory_test(void)
> > +{
> > + volatile char local_array[8];
> > +
> > + pr_info("-----------------------------\n");
> > + pr_info("kmsan_check_memory() called on uninit local (UMR report)\n");
> > + do_uninit_local_array((char *)local_array, 5, 7);
> > +
> > + kmsan_check_memory((char *)local_array, 8);
> > +}
> > +
> > +noinline void init_kmsan_vmap_vunmap_test(void)
> > +{
> > + const int npages = 2;
> > + struct page *pages[npages];
> > + void *vbuf;
> > + int i;
> > +
> > + pr_info("-----------------------------\n");
> > + pr_info("pages initialized via vmap (no reports)\n");
> > +
> > + for (i = 0; i < npages; i++)
> > + pages[i] = alloc_page(GFP_KERNEL);
> > + vbuf = vmap(pages, npages, VM_MAP, PAGE_KERNEL);
> > + memset(vbuf, 0xfe, npages * PAGE_SIZE);
> > + for (i = 0; i < npages; i++)
> > + kmsan_check_memory(page_address(pages[i]), PAGE_SIZE);
> > +
> > + if (vbuf)
> > + vunmap(vbuf);
> > + for (i = 0; i < npages; i++)
> > + if (pages[i])
> > + __free_page(pages[i]);
> > +}
> > +
> > +noinline void init_vmalloc(void)
> > +{
> > + char *buf;
> > + int npages = 8, i;
> > +
> > + pr_info("-----------------------------\n");
> > + pr_info("pages initialized via vmap (no reports)\n");
> > + buf = vmalloc(PAGE_SIZE * npages);
> > + buf[0] = 1;
> > + memset(buf, 0xfe, PAGE_SIZE * npages);
> > + CHECK(buf[0]);
> > + for (i = 0; i < npages; i++)
> > + kmsan_check_memory(&buf[PAGE_SIZE * i], PAGE_SIZE);
> > + vfree(buf);
> > +}
> > +
> > +noinline void uaf_test(void)
> > +{
> > + volatile int *var;
> > +
> > + pr_info("-----------------------------\n");
> > + pr_info("use-after-free in kmalloc-ed buffer (UMR report)\n");
> > + var = kmalloc(80, GFP_KERNEL);
> > + var[3] = 0xfeedface;
> > + kfree((int *)var);
> > + CHECK(var[3]);
> > +}
> > +
> > +noinline void printk_test(void)
> > +{
> > + volatile int uninit;
> > +
> > + pr_info("-----------------------------\n");
> > + pr_info("uninit local passed to pr_info() (UMR report)\n");
> > + pr_info("%px contains %d\n", &uninit, uninit);
> > +}
> > +
> > +static noinline int __init kmsan_tests_init(void)
> > +{
> > + uninit_kmalloc_test();
> > + init_kmalloc_test();
> > + init_kzalloc_test();
> > + uninit_multiple_args_test();
> > + uninit_stack_var_test();
> > + init_stack_var_test();
> > + uninit_kmsan_check_memory_test();
> > + init_kmsan_vmap_vunmap_test();
> > + init_vmalloc();
>
> Perhaps s/init_vmalloc/init_vmalloc_test?
Done
>
> > + uaf_test();
> > + printk_test();
> > + return -EAGAIN;
> > +}
> > +
> > +module_init(kmsan_tests_init);
> > +MODULE_LICENSE("GPL");
> > --
> > 2.24.0.432.g9d3f5f5b63-goog
> >
--
Alexander Potapenko
Software Engineer
Google Germany GmbH
Erika-Mann-Straße, 33
80636 München
Geschäftsführer: Paul Manicle, Halimah DeLaine Prado
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg
