Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1343631 > unrolled thread

[PATCHv2 0/3] LKDTM use after free test updates

Back to article view | Back to linux.kernel

Contents

  [PATCHv2 0/3] LKDTM use after free test updates Laura Abbott <labbott@fedoraproject.org> - 2016-02-26 01:40 +0100
    [PATCHv4 1/3] lkdtm: Add READ_AFTER_FREE test Laura Abbott <labbott@fedoraproject.org> - 2016-02-26 01:40 +0100
    Re: [PATCHv2 0/3] LKDTM use after free test updates Kees Cook <keescook@chromium.org> - 2016-02-26 22:40 +0100
      Re: [PATCHv2 0/3] LKDTM use after free test updates Kees Cook <keescook@chromium.org> - 2016-02-27 00:00 +0100
      Re: [PATCHv2 0/3] LKDTM use after free test updates Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-27 00:20 +0100

#1343631 — [PATCHv2 0/3] LKDTM use after free test updates

Hi,

This is v2 of the LKDTM test update. This is mostly taking the updates
Kees gave for the previous series and bringing it in.

Laura Abbott (3):
  lkdtm: Add READ_AFTER_FREE test
  lkdtm: Update WRITE_AFTER_FREE test
  lkdtm: Add read/write after free tests for buddy memory

 drivers/misc/lkdtm.c | 98 ++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 95 insertions(+), 3 deletions(-)

-- 
2.5.0

[toc] | [next] | [standalone]

#1343634 — [PATCHv4 1/3] lkdtm: Add READ_AFTER_FREE test

In a similar manner to WRITE_AFTER_FREE, add a READ_AFTER_FREE
test to test free poisoning features. Sample output when
no sanitization is present:

 # echo READ_AFTER_FREE > /sys/kernel/debug/provoke-crash/DIRECT
[   17.542473] lkdtm: Performing direct entry READ_AFTER_FREE
[   17.543866] lkdtm: Value in memory before free: 12345678
[   17.545212] lkdtm: Attempting bad read from freed memory
[   17.546542] lkdtm: Memory was not poisoned

with slub_debug=P:

 # echo READ_AFTER_FREE > /sys/kernel/debug/provoke-crash/DIRECT
[   22.415531] lkdtm: Performing direct entry READ_AFTER_FREE
[   22.416366] lkdtm: Value in memory before free: 12345678
[   22.417137] lkdtm: Attempting bad read from freed memory
[   22.417897] lkdtm: Memory correctly poisoned, calling BUG

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
---
v4: Tweak the output as per the suggestion of Kees. Add explicit BUG for
failure.
---
 drivers/misc/lkdtm.c | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
index 11fdadc..8de4746 100644
--- a/drivers/misc/lkdtm.c
+++ b/drivers/misc/lkdtm.c
@@ -92,6 +92,7 @@ enum ctype {
 	CT_UNALIGNED_LOAD_STORE_WRITE,
 	CT_OVERWRITE_ALLOCATION,
 	CT_WRITE_AFTER_FREE,
+	CT_READ_AFTER_FREE,
 	CT_SOFTLOCKUP,
 	CT_HARDLOCKUP,
 	CT_SPINLOCKUP,
@@ -129,6 +130,7 @@ static char* cp_type[] = {
 	"UNALIGNED_LOAD_STORE_WRITE",
 	"OVERWRITE_ALLOCATION",
 	"WRITE_AFTER_FREE",
+	"READ_AFTER_FREE",
 	"SOFTLOCKUP",
 	"HARDLOCKUP",
 	"SPINLOCKUP",
@@ -417,6 +419,42 @@ static void lkdtm_do_action(enum ctype which)
 		memset(data, 0x78, len);
 		break;
 	}
+	case CT_READ_AFTER_FREE: {
+		int *base, *val, saw;
+		size_t len = 1024;
+		/*
+		 * The slub allocator uses the first word to store the free
+		 * pointer in some configurations. Use the middle of the
+		 * allocation to avoid running into the freelist
+		 */
+		size_t offset = (len / sizeof(*base)) / 2;
+
+		base = kmalloc(len, GFP_KERNEL);
+		if (!base)
+			break;
+
+		val = kmalloc(len, GFP_KERNEL);
+		if (!val)
+			break;
+
+		*val = 0x12345678;
+		base[offset] = *val;
+		pr_info("Value in memory before free: %x\n", base[offset]);
+
+		kfree(base);
+
+		pr_info("Attempting bad read from freed memory\n");
+		saw = base[offset];
+		if (saw != *val) {
+			/* Good! Poisoning happened, so declare a win. */
+			pr_info("Memory correctly poisoned, calling BUG\n");
+			BUG();
+		}
+		pr_info("Memory was not poisoned\n");
+
+		kfree(val);
+		break;
+	}
 	case CT_SOFTLOCKUP:
 		preempt_disable();
 		for (;;)
-- 
2.5.0

[toc] | [prev] | [next] | [standalone]

#1344706

On Thu, Feb 25, 2016 at 4:36 PM, Laura Abbott <labbott@fedoraproject.org> wrote:
> Hi,
>
> This is v2 of the LKDTM test update. This is mostly taking the updates
> Kees gave for the previous series and bringing it in.
>
> Laura Abbott (3):
>   lkdtm: Add READ_AFTER_FREE test
>   lkdtm: Update WRITE_AFTER_FREE test
>   lkdtm: Add read/write after free tests for buddy memory
>
>  drivers/misc/lkdtm.c | 98 ++++++++++++++++++++++++++++++++++++++++++++++++++--
>  1 file changed, 95 insertions(+), 3 deletions(-)

Thanks!

Please consider the series:

Acked-by: Kees Cook <keescook@chromium.org>

And, say, while we're at it... Greg, would you mind if I became the
lkdtm maintainer?

-Kees

-- 
Kees Cook
Chrome OS & Brillo Security

[toc] | [prev] | [next] | [standalone]

#1344808

On Fri, Feb 26, 2016 at 2:57 PM, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> On Fri, Feb 26, 2016 at 01:39:14PM -0800, Kees Cook wrote:
>> On Thu, Feb 25, 2016 at 4:36 PM, Laura Abbott <labbott@fedoraproject.org> wrote:
>> > Hi,
>> >
>> > This is v2 of the LKDTM test update. This is mostly taking the updates
>> > Kees gave for the previous series and bringing it in.
>> >
>> > Laura Abbott (3):
>> >   lkdtm: Add READ_AFTER_FREE test
>> >   lkdtm: Update WRITE_AFTER_FREE test
>> >   lkdtm: Add read/write after free tests for buddy memory
>> >
>> >  drivers/misc/lkdtm.c | 98 ++++++++++++++++++++++++++++++++++++++++++++++++++--
>> >  1 file changed, 95 insertions(+), 3 deletions(-)
>>
>> Thanks!
>>
>> Please consider the series:
>>
>> Acked-by: Kees Cook <keescook@chromium.org>
>>
>> And, say, while we're at it... Greg, would you mind if I became the
>> lkdtm maintainer?
>
> Not at all, I was treating you as one anyway, waiting till I got acks
> from you before committing anything :)
>
> Feel free to send a patch to MAINTAINERS for me to add for this.

Sounds good, thanks!

-Kees

-- 
Kees Cook
Chrome OS & Brillo Security

[toc] | [prev] | [next] | [standalone]

#1344818

On Fri, Feb 26, 2016 at 01:39:14PM -0800, Kees Cook wrote:
> On Thu, Feb 25, 2016 at 4:36 PM, Laura Abbott <labbott@fedoraproject.org> wrote:
> > Hi,
> >
> > This is v2 of the LKDTM test update. This is mostly taking the updates
> > Kees gave for the previous series and bringing it in.
> >
> > Laura Abbott (3):
> >   lkdtm: Add READ_AFTER_FREE test
> >   lkdtm: Update WRITE_AFTER_FREE test
> >   lkdtm: Add read/write after free tests for buddy memory
> >
> >  drivers/misc/lkdtm.c | 98 ++++++++++++++++++++++++++++++++++++++++++++++++++--
> >  1 file changed, 95 insertions(+), 3 deletions(-)
> 
> Thanks!
> 
> Please consider the series:
> 
> Acked-by: Kees Cook <keescook@chromium.org>
> 
> And, say, while we're at it... Greg, would you mind if I became the
> lkdtm maintainer?

Not at all, I was treating you as one anyway, waiting till I got acks
from you before committing anything :)

Feel free to send a patch to MAINTAINERS for me to add for this.

thanks,

greg k-h

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web