On 1/5/16 4:15 PM, Kees Cook wrote:
On Mon, Dec 21, 2015 at 7:40 PM, Laura Abbott <laura@xxxxxxxxxxxx> wrote:
In a similar manner to WRITE_AFTER_FREE, add a READ_AFTER_FREE
test to test free poisoning features. Sample output when
no poison is present:
[ 20.222501] lkdtm: Performing direct entry READ_AFTER_FREE
[ 20.226163] lkdtm: Freed val: 12345678
with poison:
[ 24.203748] lkdtm: Performing direct entry READ_AFTER_FREE
[ 24.207261] general protection fault: 0000 [#1] SMP
[ 24.208193] Modules linked in:
[ 24.208193] CPU: 0 PID: 866 Comm: sh Not tainted 4.4.0-rc5-work+ #108
Cc: Arnd Bergmann <arnd@xxxxxxxx>
Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Laura Abbott <laura@xxxxxxxxxxxx>
---
drivers/misc/lkdtm.c | 29 +++++++++++++++++++++++++++++
1 file changed, 29 insertions(+)
diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
index 11fdadc..c641fb7 100644
--- a/drivers/misc/lkdtm.c
+++ b/drivers/misc/lkdtm.c
@@ -92,6 +92,7 @@ enum ctype {
CT_UNALIGNED_LOAD_STORE_WRITE,
CT_OVERWRITE_ALLOCATION,
CT_WRITE_AFTER_FREE,
+ CT_READ_AFTER_FREE,
CT_SOFTLOCKUP,
CT_HARDLOCKUP,
CT_SPINLOCKUP,
@@ -129,6 +130,7 @@ static char* cp_type[] = {
"UNALIGNED_LOAD_STORE_WRITE",
"OVERWRITE_ALLOCATION",
"WRITE_AFTER_FREE",
+ "READ_AFTER_FREE",
"SOFTLOCKUP",
"HARDLOCKUP",
"SPINLOCKUP",
@@ -417,6 +419,33 @@ static void lkdtm_do_action(enum ctype which)
memset(data, 0x78, len);
break;
}
+ case CT_READ_AFTER_FREE: {
+ int **base;
+ int *val, *tmp;
+
+ base = kmalloc(1024, GFP_KERNEL);
+ if (!base)
+ return;
+
+ val = kmalloc(1024, GFP_KERNEL);
+ if (!val)
+ return;
For both of these test failure return, I think there should be a
pr_warn too (see CT_EXEC_USERSPACE).
I was going by the usual rule that messages on memory failures are
redundant because something somewhere else is going to be printing
out error messages.
+
+ *val = 0x12345678;
+
+ /*
+ * Don't just use the first entry since that's where the
+ * freelist goes for the slab allocator
+ */
+ base[1] = val;
Maybe just aim at the middle, in case allocator freelist tracking ever
grows? base[1024/sizeof(int)/2] or something?
Good point.
+ kfree(base);
+
+ tmp = base[1];
+ pr_info("Freed val: %x\n", *tmp);
Instead of depending on the deref to fail, maybe just use a simple
BUG_ON to test that the value did actually change? Or, change the
pr_info to "Failed to Oops when reading freed value: ..." just to be
slightly more verbose about what failed?
I'll come up with something to be more explicit here.
Thanks,
Laura
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@xxxxxxxxx. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>