From patchwork Sun Feb 12 06:13:33 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hoeun Ryu X-Patchwork-Id: 9568285 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id C13CB60442 for ; Sun, 12 Feb 2017 06:14:10 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B21982853A for ; Sun, 12 Feb 2017 06:14:10 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A5EA828546; Sun, 12 Feb 2017 06:14:10 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id BD55D2853A for ; Sun, 12 Feb 2017 06:14:09 +0000 (UTC) Received: (qmail 11712 invoked by uid 550); 12 Feb 2017 06:14:06 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 11680 invoked from network); 12 Feb 2017 06:14:05 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=SLjGyBSi+WCXfvPWV+Wb4ongRHgN7vgp2lkLF3Bm+kE=; b=sLodSdus825Kjqy3j7X1t2RGLe/BY5neZ8fB6d4PjlZD3tezpeCRK1rhOuA8vswkpI tS68/geX8GFZs3do4dEVxwWLyKPsmMCzhygS0HcSPt3zVj4KUKwkLEmWFqf66FQCzBa3 Wt83tikcdI8ogCa1fUP8PrYnncHlDqDijnXEUyCf7pEC/+HbmaY26Z8OzZGQ07M+Ewbe iDiU8YGJeJXysclIQbFPC+FSE3yUng0HeZVBODS2C3yXW7iDf1kYM1u9CHUzxo9Oji6u tMfujpFSRxGsSEmZTYfjtsUpPHyBuN04TcUP8urnBm/51SADbKpsSF7YCFGBf6yxterl 1bYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=SLjGyBSi+WCXfvPWV+Wb4ongRHgN7vgp2lkLF3Bm+kE=; b=ujJW6w09xkt9fch4lf6I5VEd2hDMOGmQ49g2MEQxYpnvNDn9kDSZq0e7l3qGiiXdJV yTMy5KmTeGTYElC1m47MFNRpEwhEaa6vf7L0F0H7I3cZppgIQ9AA7GtsfgvgwZcA/2P/ b3LCFf/MWBOT0uzMUb8rwdMc2N+PYGBIpsQ2bdYkFVe161yfSkg64Pktqijp7eRa8SSp T7CNgK17+SbfgKWWzqrmh24xsOiuFg7Bk4JVEN/DDpeqJHVfbHNwXBYcgAoxfodfc0/Q nUPIBzhDiKFFLWlmSMvsjMid4RZ3kg60/C8aWvafFx/4UO/pDTyFN0XtxVCd1IW7eEre iSdw== X-Gm-Message-State: AMke39l9EMCRe8cvlmPJRHV3LhJ37rd/BnzlO48PenDGjxnrbf+wrG/xXMnsJH0FazZaig== X-Received: by 10.98.72.88 with SMTP id v85mr19222570pfa.54.1486880033299; Sat, 11 Feb 2017 22:13:53 -0800 (PST) From: Hoeun Ryu To: Kees Cook Cc: linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, Hoeun Ryu Date: Sun, 12 Feb 2017 15:13:33 +0900 Message-Id: <1486880019-8201-1-git-send-email-hoeun.ryu@gmail.com> X-Mailer: git-send-email 2.7.4 Subject: [kernel-hardening] [PATCH] usercopy: add testcases to check zeroing on failure of usercopy X-Virus-Scanned: ClamAV using ClamSMTP In the hardend usercopy, the destination buffer will be zeroed if copy_from_user/get_user fails. This patch adds testcases for it. The destination buffer is set with non-zero value before illegal copy_from_user/get_user is executed and the buffer is compared to zero after usercopy is done. Signed-off-by: Hoeun Ryu --- lib/test_user_copy.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/lib/test_user_copy.c b/lib/test_user_copy.c index 0ecef3e..54bd898 100644 --- a/lib/test_user_copy.c +++ b/lib/test_user_copy.c @@ -41,11 +41,18 @@ static int __init test_user_copy_init(void) char *bad_usermem; unsigned long user_addr; unsigned long value = 0x5A; + char *zerokmem; kmem = kmalloc(PAGE_SIZE * 2, GFP_KERNEL); if (!kmem) return -ENOMEM; + zerokmem = kzalloc(PAGE_SIZE * 2, GFP_KERNEL); + if (!zerokmem) { + kfree(kmem); + return -ENOMEM; + } + user_addr = vm_mmap(NULL, 0, PAGE_SIZE * 2, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_ANONYMOUS | MAP_PRIVATE, 0); @@ -69,25 +76,35 @@ static int __init test_user_copy_init(void) "legitimate put_user failed"); /* Invalid usage: none of these should succeed. */ + memset(kmem, 0x5A, PAGE_SIZE); ret |= test(!copy_from_user(kmem, (char __user *)(kmem + PAGE_SIZE), PAGE_SIZE), "illegal all-kernel copy_from_user passed"); + ret |= test(memcmp(zerokmem, kmem, PAGE_SIZE), + "zeroing failure for illegal all-kernel copy_from_user"); + memset(bad_usermem, 0x5A, PAGE_SIZE); ret |= test(!copy_from_user(bad_usermem, (char __user *)kmem, PAGE_SIZE), "illegal reversed copy_from_user passed"); + ret |= test(memcmp(zerokmem, bad_usermem, PAGE_SIZE), + "zeroing failure for illegal reversed copy_from_user"); ret |= test(!copy_to_user((char __user *)kmem, kmem + PAGE_SIZE, PAGE_SIZE), "illegal all-kernel copy_to_user passed"); ret |= test(!copy_to_user((char __user *)kmem, bad_usermem, PAGE_SIZE), "illegal reversed copy_to_user passed"); + memset(kmem, 0x5A, PAGE_SIZE); ret |= test(!get_user(value, (unsigned long __user *)kmem), "illegal get_user passed"); + ret |= test(memcmp(zerokmem, kmem, sizeof(value)), + "zeroing failure for illegal get_user"); ret |= test(!put_user(value, (unsigned long __user *)kmem), "illegal put_user passed"); vm_munmap(user_addr, PAGE_SIZE * 2); kfree(kmem); + kfree(zerokmem); if (ret == 0) { pr_info("tests passed.\n");