From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751137AbdBLGNz (ORCPT ); Sun, 12 Feb 2017 01:13:55 -0500 Received: from mail-pf0-f194.google.com ([209.85.192.194]:33673 "EHLO mail-pf0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750780AbdBLGNy (ORCPT ); Sun, 12 Feb 2017 01:13:54 -0500 From: Hoeun Ryu To: Kees Cook Cc: linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, Hoeun Ryu Subject: [PATCH] usercopy: add testcases to check zeroing on failure of usercopy Date: Sun, 12 Feb 2017 15:13:33 +0900 Message-Id: <1486880019-8201-1-git-send-email-hoeun.ryu@gmail.com> X-Mailer: git-send-email 2.7.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org In the hardend usercopy, the destination buffer will be zeroed if copy_from_user/get_user fails. This patch adds testcases for it. The destination buffer is set with non-zero value before illegal copy_from_user/get_user is executed and the buffer is compared to zero after usercopy is done. Signed-off-by: Hoeun Ryu --- lib/test_user_copy.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/lib/test_user_copy.c b/lib/test_user_copy.c index 0ecef3e..54bd898 100644 --- a/lib/test_user_copy.c +++ b/lib/test_user_copy.c @@ -41,11 +41,18 @@ static int __init test_user_copy_init(void) char *bad_usermem; unsigned long user_addr; unsigned long value = 0x5A; + char *zerokmem; kmem = kmalloc(PAGE_SIZE * 2, GFP_KERNEL); if (!kmem) return -ENOMEM; + zerokmem = kzalloc(PAGE_SIZE * 2, GFP_KERNEL); + if (!zerokmem) { + kfree(kmem); + return -ENOMEM; + } + user_addr = vm_mmap(NULL, 0, PAGE_SIZE * 2, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_ANONYMOUS | MAP_PRIVATE, 0); @@ -69,25 +76,35 @@ static int __init test_user_copy_init(void) "legitimate put_user failed"); /* Invalid usage: none of these should succeed. */ + memset(kmem, 0x5A, PAGE_SIZE); ret |= test(!copy_from_user(kmem, (char __user *)(kmem + PAGE_SIZE), PAGE_SIZE), "illegal all-kernel copy_from_user passed"); + ret |= test(memcmp(zerokmem, kmem, PAGE_SIZE), + "zeroing failure for illegal all-kernel copy_from_user"); + memset(bad_usermem, 0x5A, PAGE_SIZE); ret |= test(!copy_from_user(bad_usermem, (char __user *)kmem, PAGE_SIZE), "illegal reversed copy_from_user passed"); + ret |= test(memcmp(zerokmem, bad_usermem, PAGE_SIZE), + "zeroing failure for illegal reversed copy_from_user"); ret |= test(!copy_to_user((char __user *)kmem, kmem + PAGE_SIZE, PAGE_SIZE), "illegal all-kernel copy_to_user passed"); ret |= test(!copy_to_user((char __user *)kmem, bad_usermem, PAGE_SIZE), "illegal reversed copy_to_user passed"); + memset(kmem, 0x5A, PAGE_SIZE); ret |= test(!get_user(value, (unsigned long __user *)kmem), "illegal get_user passed"); + ret |= test(memcmp(zerokmem, kmem, sizeof(value)), + "zeroing failure for illegal get_user"); ret |= test(!put_user(value, (unsigned long __user *)kmem), "illegal put_user passed"); vm_munmap(user_addr, PAGE_SIZE * 2); kfree(kmem); + kfree(zerokmem); if (ret == 0) { pr_info("tests passed.\n"); -- 2.7.4