Commit ae56942c authored by Kees Cook's avatar Kees Cook Committed by Greg Kroah-Hartman
Browse files

lkdtm: Make arch-specific tests always available 



I'd like arch-specific tests to XFAIL when on a mismatched architecture
so that we can more easily compare test coverage across all systems.
Lacking kernel configs or CPU features count as a FAIL, not an XFAIL.

Additionally fixes a build failure under 32-bit UML.

Fixes: b09511c2 ("lkdtm: Add a DOUBLE_FAULT crash type on x86")
Fixes: cea23efb ("lkdtm/bugs: Make double-fault test always available")
Fixes: 6cb6982f ("lkdtm: arm64: test kernel pointer authentication")
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20200625203704.317097-5-keescook@chromium.org


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 4fccc8c0

drivers/misc/lkdtm/bugs.c

+21 −17
Original line number Diff line number Diff line
@@ -13,7 +13,7 @@ 
#include <linux/uaccess.h>

#include <linux/slab.h>



#ifdef CONFIG_X86_32

#if IS_ENABLED(CONFIG_X86_32) && !IS_ENABLED(CONFIG_UML)

#include <asm/desc.h>

#endif
@@ -418,7 +418,7 @@ void lkdtm_UNSET_SMEP(void) 


void lkdtm_DOUBLE_FAULT(void)

{

#ifdef CONFIG_X86_32

#if IS_ENABLED(CONFIG_X86_32) && !IS_ENABLED(CONFIG_UML)

	/*

	 * Trigger #DF by setting the stack limit to zero.  This clobbers

	 * a GDT TLS slot, which is okay because the current task will die
@@ -453,38 +453,42 @@ void lkdtm_DOUBLE_FAULT(void) 
#endif

}



#ifdef CONFIG_ARM64_PTR_AUTH

#ifdef CONFIG_ARM64

static noinline void change_pac_parameters(void)

{

	if (IS_ENABLED(CONFIG_ARM64_PTR_AUTH)) {

		/* Reset the keys of current task */

		ptrauth_thread_init_kernel(current);

		ptrauth_thread_switch_kernel(current);

	}

}

#endif



#define CORRUPT_PAC_ITERATE	10

noinline void lkdtm_CORRUPT_PAC(void)

{

#ifdef CONFIG_ARM64

#define CORRUPT_PAC_ITERATE	10

	int i;



	if (!IS_ENABLED(CONFIG_ARM64_PTR_AUTH))

		pr_err("FAIL: kernel not built with CONFIG_ARM64_PTR_AUTH\n");



	if (!system_supports_address_auth()) {

		pr_err("FAIL: arm64 pointer authentication feature not present\n");

		pr_err("FAIL: CPU lacks pointer authentication feature\n");

		return;

	}



	pr_info("Change the PAC parameters to force function return failure\n");

	pr_info("changing PAC parameters to force function return failure...\n");

	/*

	 * Pac is a hash value computed from input keys, return address and

	 * PAC is a hash value computed from input keys, return address and

	 * stack pointer. As pac has fewer bits so there is a chance of

	 * collision, so iterate few times to reduce the collision probability.

	 */

	for (i = 0; i < CORRUPT_PAC_ITERATE; i++)

		change_pac_parameters();



	pr_err("FAIL: %s test failed. Kernel may be unstable from here\n", __func__);

}

#else /* !CONFIG_ARM64_PTR_AUTH */

noinline void lkdtm_CORRUPT_PAC(void)

{

	pr_err("FAIL: arm64 pointer authentication config disabled\n");

}

	pr_err("FAIL: survived PAC changes! Kernel may be unstable from here\n");

#else

	pr_err("XFAIL: this test is arm64-only\n");

#endif

}

drivers/misc/lkdtm/lkdtm.h

+0 −2
Original line number Diff line number Diff line
@@ -31,9 +31,7 @@ void lkdtm_CORRUPT_USER_DS(void); 
void lkdtm_STACK_GUARD_PAGE_LEADING(void);

void lkdtm_STACK_GUARD_PAGE_TRAILING(void);

void lkdtm_UNSET_SMEP(void);

#ifdef CONFIG_X86_32

void lkdtm_DOUBLE_FAULT(void);

#endif

void lkdtm_CORRUPT_PAC(void);



/* lkdtm_heap.c */

tools/testing/selftests/lkdtm/tests.txt

+1 −0
Original line number Diff line number Diff line
@@ -14,6 +14,7 @@ STACK_GUARD_PAGE_LEADING 
STACK_GUARD_PAGE_TRAILING

UNSET_SMEP CR4 bits went missing

DOUBLE_FAULT

CORRUPT_PAC

UNALIGNED_LOAD_STORE_WRITE

#OVERWRITE_ALLOCATION Corrupts memory on failure

#WRITE_AFTER_FREE Corrupts memory on failure