Commit ca79a00b authored by Sabyrzhan Tasbolatov's avatar Sabyrzhan Tasbolatov Committed by Andrew Morton
Browse files

kasan: migrate copy_user_test to kunit 

Migrate the copy_user_test to the KUnit framework to verify out-of-bound
detection via KASAN reports in copy_from_user(), copy_to_user() and their
static functions.

This is the last migrated test in kasan_test_module.c, therefore delete
the file.

[arnd@arndb.de: export copy_to_kernel_nofault]
  Link: https://lkml.kernel.org/r/20241018151112.3533820-1-arnd@kernel.org
Link: https://lkml.kernel.org/r/20241016131802.3115788-3-snovitoll@gmail.com


Signed-off-by: default avatarSabyrzhan Tasbolatov <snovitoll@gmail.com>
Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
Reviewed-by: default avatarAndrey Konovalov <andreyknvl@gmail.com>
Acked-by: default avatarDavid Hildenbrand <david@redhat.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Alex Shi <alexs@kernel.org>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Hu Haowen <2023002089@link.tyut.edu.cn>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Marco Elver <elver@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Yanteng Si <siyanteng@loongson.cn>

Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent ae193dd7

mm/kasan/Makefile

+0 −2
Original line number Diff line number Diff line
@@ -46,7 +46,6 @@ endif 


CFLAGS_kasan_test_c.o := $(CFLAGS_KASAN_TEST)

RUSTFLAGS_kasan_test_rust.o := $(RUSTFLAGS_KASAN)

CFLAGS_kasan_test_module.o := $(CFLAGS_KASAN_TEST)



obj-y := common.o report.o

obj-$(CONFIG_KASAN_GENERIC) += init.o generic.o report_generic.o shadow.o quarantine.o
@@ -59,4 +58,3 @@ ifdef CONFIG_RUST 
endif



obj-$(CONFIG_KASAN_KUNIT_TEST) += kasan_test.o
 
obj-$(CONFIG_KASAN_MODULE_TEST) += kasan_test_module.o

mm/kasan/kasan_test_c.c

+47 −0
Original line number Diff line number Diff line
@@ -1963,6 +1963,52 @@ static void copy_to_kernel_nofault_oob(struct kunit *test) 
	kfree(ptr);

}



static void copy_user_test_oob(struct kunit *test)

{

	char *kmem;

	char __user *usermem;

	unsigned long useraddr;

	size_t size = 128 - KASAN_GRANULE_SIZE;

	int __maybe_unused unused;



	kmem = kunit_kmalloc(test, size, GFP_KERNEL);

	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, kmem);



	useraddr = kunit_vm_mmap(test, NULL, 0, PAGE_SIZE,

					PROT_READ | PROT_WRITE | PROT_EXEC,

					MAP_ANONYMOUS | MAP_PRIVATE, 0);

	KUNIT_ASSERT_NE_MSG(test, useraddr, 0,

		"Could not create userspace mm");

	KUNIT_ASSERT_LT_MSG(test, useraddr, (unsigned long)TASK_SIZE,

		"Failed to allocate user memory");



	OPTIMIZER_HIDE_VAR(size);

	usermem = (char __user *)useraddr;



	KUNIT_EXPECT_KASAN_FAIL(test,

		unused = copy_from_user(kmem, usermem, size + 1));

	KUNIT_EXPECT_KASAN_FAIL(test,

		unused = copy_to_user(usermem, kmem, size + 1));

	KUNIT_EXPECT_KASAN_FAIL(test,

		unused = __copy_from_user(kmem, usermem, size + 1));

	KUNIT_EXPECT_KASAN_FAIL(test,

		unused = __copy_to_user(usermem, kmem, size + 1));

	KUNIT_EXPECT_KASAN_FAIL(test,

		unused = __copy_from_user_inatomic(kmem, usermem, size + 1));

	KUNIT_EXPECT_KASAN_FAIL(test,

		unused = __copy_to_user_inatomic(usermem, kmem, size + 1));



	/*

	* Prepare a long string in usermem to avoid the strncpy_from_user test

	* bailing out on '\0' before it reaches out-of-bounds.

	*/

	memset(kmem, 'a', size);

	KUNIT_EXPECT_EQ(test, copy_to_user(usermem, kmem, size), 0);



	KUNIT_EXPECT_KASAN_FAIL(test,

		unused = strncpy_from_user(kmem, usermem, size + 1));

}



static struct kunit_case kasan_kunit_test_cases[] = {

	KUNIT_CASE(kmalloc_oob_right),

	KUNIT_CASE(kmalloc_oob_left),
@@ -2037,6 +2083,7 @@ static struct kunit_case kasan_kunit_test_cases[] = { 
	KUNIT_CASE(match_all_mem_tag),

	KUNIT_CASE(copy_to_kernel_nofault_oob),

	KUNIT_CASE(rust_uaf),

	KUNIT_CASE(copy_user_test_oob),

	{}

};

mm/kasan/kasan_test_module.c

deleted100644 → 0
+0 −81
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 *

 * Copyright (c) 2014 Samsung Electronics Co., Ltd.

 * Author: Andrey Ryabinin <a.ryabinin@samsung.com>

 */



#define pr_fmt(fmt) "kasan: test: " fmt



#include <linux/mman.h>

#include <linux/module.h>

#include <linux/printk.h>

#include <linux/slab.h>

#include <linux/uaccess.h>



#include "kasan.h"



static noinline void __init copy_user_test(void)

{

	char *kmem;

	char __user *usermem;

	size_t size = 128 - KASAN_GRANULE_SIZE;

	int __maybe_unused unused;



	kmem = kmalloc(size, GFP_KERNEL);

	if (!kmem)

		return;



	usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE,

			    PROT_READ | PROT_WRITE | PROT_EXEC,

			    MAP_ANONYMOUS | MAP_PRIVATE, 0);

	if (IS_ERR(usermem)) {

		pr_err("Failed to allocate user memory\n");

		kfree(kmem);

		return;

	}



	OPTIMIZER_HIDE_VAR(size);



	pr_info("out-of-bounds in copy_from_user()\n");

	unused = copy_from_user(kmem, usermem, size + 1);



	pr_info("out-of-bounds in copy_to_user()\n");

	unused = copy_to_user(usermem, kmem, size + 1);



	pr_info("out-of-bounds in __copy_from_user()\n");

	unused = __copy_from_user(kmem, usermem, size + 1);



	pr_info("out-of-bounds in __copy_to_user()\n");

	unused = __copy_to_user(usermem, kmem, size + 1);



	pr_info("out-of-bounds in __copy_from_user_inatomic()\n");

	unused = __copy_from_user_inatomic(kmem, usermem, size + 1);



	pr_info("out-of-bounds in __copy_to_user_inatomic()\n");

	unused = __copy_to_user_inatomic(usermem, kmem, size + 1);



	pr_info("out-of-bounds in strncpy_from_user()\n");

	unused = strncpy_from_user(kmem, usermem, size + 1);



	vm_munmap((unsigned long)usermem, PAGE_SIZE);

	kfree(kmem);

}



static int __init kasan_test_module_init(void)

{

	/*

	 * Temporarily enable multi-shot mode. Otherwise, KASAN would only

	 * report the first detected bug and panic the kernel if panic_on_warn

	 * is enabled.

	 */

	bool multishot = kasan_save_enable_multi_shot();



	copy_user_test();



	kasan_restore_multi_shot(multishot);

	return -EAGAIN;

}



module_init(kasan_test_module_init);

MODULE_LICENSE("GPL");

mm/maccess.c

+1 −0
Original line number Diff line number Diff line
@@ -82,6 +82,7 @@ long copy_to_kernel_nofault(void *dst, const void *src, size_t size) 
	pagefault_enable();

	return -EFAULT;

}

EXPORT_SYMBOL_GPL(copy_to_kernel_nofault);



long strncpy_from_kernel_nofault(char *dst, const void *unsafe_addr, long count)

{