From patchwork Fri Mar 9 10:22:47 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jinbum Park X-Patchwork-Id: 10270385 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id D93406016D for ; Fri, 9 Mar 2018 10:23:11 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C0F6B29A8E for ; Fri, 9 Mar 2018 10:23:11 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id B58BC29AA2; Fri, 9 Mar 2018 10:23:11 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 36A3729A8E for ; Fri, 9 Mar 2018 10:23:08 +0000 (UTC) Received: (qmail 11781 invoked by uid 550); 9 Mar 2018 10:23:07 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 11697 invoked from network); 9 Mar 2018 10:23:05 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=date:from:to:cc:subject:message-id:mime-version:content-disposition :user-agent; bh=412aKYKrKGBJ1QtNgMtMxCcCpdBW8gZGjra/C2spuSc=; b=s3EOrIyzhOquPzccKMjEAzQRcPL3ZrJIupKJOr4kv8pwzWK0COsdAcBmghjVmaqBTY qkTfbuzvLiGg0rJAOpGwgY4wq9MWblNaIKM4amvcBJKtXToykAvj6uniEeHAUCF7bR3m sBHRcicKejBMkbzUEjqoKh+Fgfvpz3JIw5DHT3WyEy3PcPullezqKomUg77gbjPxKJST +pdIZhhaGiZB6XT2hNnfbko/SQIHIdGkLQkQFa+d1EaIKBrzRTFFAHC8VGnCH0iuwh7x TPzwmuGJSiCCxUwAVs4+c4rLX78/F2W5fPpGdLoFap8O6T0zaez3efe/t8GTPMzRvsfX bN3A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition:user-agent; bh=412aKYKrKGBJ1QtNgMtMxCcCpdBW8gZGjra/C2spuSc=; b=mTQGT7tvtJ6fnZ8QHlBCw67iO8ietdysev+o4uWyKIl7myVMG8/F7ZcGEChEjno+cz zVlEQw3/UMIhxzjfNxeAF+5VDcwc5aEuGhSgCA1LI7WdHDZix3xlD91ip9NQRmtG7sig Thfe3Wz9KjpzgvYEizhJ55NpjO3EWoNm572hkg2Ssq1GLl90wjxxqWcoc7dOmmaiFJmp u3a9zrj8g3UtXwPI/ktx5TlhlfQxXKcDPorvw0LsiUJW6OE+Kc7MRX17Z+4C9jd8k20j dGCQMT/lasD9wdIQu359sYNG663zGrE1MsNSsk5amOkM2z7QaGeI2uX/3WzdzMMLRfi9 wOvw== X-Gm-Message-State: APf1xPC9AyK6tl6nDhsyYjSLlATy516FbazgvS1P8YOB2Ttj/Q9WilNu FNLflb43n+gkSPllkZa1Ypc= X-Google-Smtp-Source: AG47ELtXQvx3ZQDctbD2Jqra96ohbeZU7tPtEbRtravc2Zgr9jOs9aV9bl9MuhqeD0tyLuzDZeNGsA== X-Received: by 10.99.123.79 with SMTP id k15mr24061382pgn.173.1520590973546; Fri, 09 Mar 2018 02:22:53 -0800 (PST) Date: Fri, 9 Mar 2018 19:22:47 +0900 From: Jinbum Park To: linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com Cc: akpm@linux-foundation.org, aryabinin@virtuozzo.com, dvyukov@google.com, keescook@chromium.org Subject: [PATCH] lib: Add testing module for UBSAN Message-ID: <20180309102247.GA2944@pjb1027-Latitude-E5410> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) X-Virus-Scanned: ClamAV using ClamSMTP This is a test module for UBSAN. It triggers all undefined behaviors that linux supports now, and detect them. All test-cases have passed by compiling with gcc-5.5.0. If use gcc-4.9.x, misaligned, out-of-bounds, object-size-mismatch will not be detected. Because gcc-4.9.x doesn't support them. Signed-off-by: Jinbum Park --- lib/Kconfig.ubsan | 7 +++ lib/Makefile | 2 + lib/test_ubsan.c | 144 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 153 insertions(+) create mode 100644 lib/test_ubsan.c diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan index a669c19..19d42ea 100644 --- a/lib/Kconfig.ubsan +++ b/lib/Kconfig.ubsan @@ -46,3 +46,10 @@ config UBSAN_NULL help This option enables detection of memory accesses via a null pointer. + +config TEST_UBSAN + tristate "Module for testing for undefined behavior detection" + depends on m && UBSAN + help + This is a test module for UBSAN. + It triggers various undefined behavior, and detect it. diff --git a/lib/Makefile b/lib/Makefile index c25957d1..f3503f8 100644 --- a/lib/Makefile +++ b/lib/Makefile @@ -54,6 +54,8 @@ obj-$(CONFIG_TEST_SYSCTL) += test_sysctl.o obj-$(CONFIG_TEST_HASH) += test_hash.o test_siphash.o obj-$(CONFIG_TEST_KASAN) += test_kasan.o CFLAGS_test_kasan.o += -fno-builtin +obj-$(CONFIG_TEST_UBSAN) += test_ubsan.o +UBSAN_SANITIZE_test_ubsan.o := y obj-$(CONFIG_TEST_KSTRTOX) += test-kstrtox.o obj-$(CONFIG_TEST_LIST_SORT) += test_list_sort.o obj-$(CONFIG_TEST_LKM) += test_module.o diff --git a/lib/test_ubsan.c b/lib/test_ubsan.c new file mode 100644 index 0000000..58dedff --- /dev/null +++ b/lib/test_ubsan.c @@ -0,0 +1,144 @@ +// SPDX-License-Identifier: GPL-2.0 +#include +#include +#include + +typedef void(*test_ubsan_fp)(void); + +static void test_ubsan_add_overflow(void) +{ + volatile int val = INT_MAX; + + val += 2; +} + +static void test_ubsan_sub_overflow(void) +{ + volatile int val = INT_MIN; + volatile int val2 = 2; + + val -= val2; +} + +static void test_ubsan_mul_overflow(void) +{ + volatile int val = INT_MAX / 2; + + val *= 3; +} + +static void test_ubsan_negate_overflow(void) +{ + volatile int val = INT_MIN; + + val = -val; +} + +static void test_ubsan_divrem_overflow(void) +{ + volatile int val = 16; + volatile int val2 = 0; + + val /= val2; +} + +static void test_ubsan_vla_bound_not_positive(void) +{ + volatile int size = -1; + char buf[size]; + + (void)buf; +} + +static void test_ubsan_shift_out_of_bounds(void) +{ + volatile int val = -1; + int val2 = 10; + + val2 <<= val; +} + +static void test_ubsan_out_of_bounds(void) +{ + volatile int i = 4, j = 5; + volatile int arr[i]; + + arr[j] = i; +} + +static void test_ubsan_load_invalid_value(void) +{ + volatile char *dst, *src; + bool val, val2, *ptr; + char c = 4; + + dst = (char *)&val; + src = &c; + *dst = *src; + + ptr = &val2; + val2 = val; +} + +static void test_ubsan_null_ptr_deref(void) +{ + volatile int *ptr = NULL; + int val; + + val = *ptr; +} + +void test_ubsan_misaligned_access(void) +{ + volatile char arr[5] __aligned(4) = {1, 2, 3, 4, 5}; + volatile int *ptr, val = 6; + + ptr = (int *)(arr + 1); + *ptr = val; +} + +static void test_ubsan_object_size_mismatch(void) +{ + /* "((aligned(8)))" helps this not into be misaligned for ptr-access. */ + volatile int val __aligned(8) = 4; + volatile long long *ptr, val2; + + ptr = (long long *)&val; + val2 = *ptr; +} + +static const test_ubsan_fp test_ubsan_array[] = { + test_ubsan_add_overflow, + test_ubsan_sub_overflow, + test_ubsan_mul_overflow, + test_ubsan_negate_overflow, + test_ubsan_divrem_overflow, + test_ubsan_vla_bound_not_positive, + test_ubsan_shift_out_of_bounds, + test_ubsan_out_of_bounds, + test_ubsan_load_invalid_value, + //test_ubsan_null_ptr_deref, /* exclude it because there is a crash */ + test_ubsan_misaligned_access, + test_ubsan_object_size_mismatch, +}; + +static int __init test_ubsan_init(void) +{ + unsigned int i; + + for (i = 0; i < ARRAY_SIZE(test_ubsan_array); i++) + test_ubsan_array[i](); + + (void)test_ubsan_null_ptr_deref; /* to avoid unsed-function warning */ + return 0; +} +module_init(test_ubsan_init); + +static void __exit test_ubsan_exit(void) +{ + /* do nothing */ +} +module_exit(test_ubsan_exit); + +MODULE_AUTHOR("Jinbum Park "); +MODULE_LICENSE("GPL v2");