| From 5c3098ba6efea5df0e8357c6bc43a1642f57752e Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 25 Jun 2020 13:37:04 -0700 |
| Subject: lkdtm: Make arch-specific tests always available |
| |
| From: Kees Cook <keescook@chromium.org> |
| |
| [ Upstream commit ae56942c14740c2963222efdc36c667ab19555ef ] |
| |
| I'd like arch-specific tests to XFAIL when on a mismatched architecture |
| so that we can more easily compare test coverage across all systems. |
| Lacking kernel configs or CPU features count as a FAIL, not an XFAIL. |
| |
| Additionally fixes a build failure under 32-bit UML. |
| |
| Fixes: b09511c253e5 ("lkdtm: Add a DOUBLE_FAULT crash type on x86") |
| Fixes: cea23efb4de2 ("lkdtm/bugs: Make double-fault test always available") |
| Fixes: 6cb6982f42cb ("lkdtm: arm64: test kernel pointer authentication") |
| Signed-off-by: Kees Cook <keescook@chromium.org> |
| Link: https://lore.kernel.org/r/20200625203704.317097-5-keescook@chromium.org |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/misc/lkdtm/bugs.c | 38 ++++++++++++++----------- |
| drivers/misc/lkdtm/lkdtm.h | 2 -- |
| tools/testing/selftests/lkdtm/tests.txt | 1 + |
| 3 files changed, 22 insertions(+), 19 deletions(-) |
| |
| diff --git a/drivers/misc/lkdtm/bugs.c b/drivers/misc/lkdtm/bugs.c |
| index e1b43f6155496..7913c9ff216c9 100644 |
| --- a/drivers/misc/lkdtm/bugs.c |
| +++ b/drivers/misc/lkdtm/bugs.c |
| @@ -13,7 +13,7 @@ |
| #include <linux/uaccess.h> |
| #include <linux/slab.h> |
| |
| -#ifdef CONFIG_X86_32 |
| +#if IS_ENABLED(CONFIG_X86_32) && !IS_ENABLED(CONFIG_UML) |
| #include <asm/desc.h> |
| #endif |
| |
| @@ -418,7 +418,7 @@ void lkdtm_UNSET_SMEP(void) |
| |
| void lkdtm_DOUBLE_FAULT(void) |
| { |
| -#ifdef CONFIG_X86_32 |
| +#if IS_ENABLED(CONFIG_X86_32) && !IS_ENABLED(CONFIG_UML) |
| /* |
| * Trigger #DF by setting the stack limit to zero. This clobbers |
| * a GDT TLS slot, which is okay because the current task will die |
| @@ -453,38 +453,42 @@ void lkdtm_DOUBLE_FAULT(void) |
| #endif |
| } |
| |
| -#ifdef CONFIG_ARM64_PTR_AUTH |
| +#ifdef CONFIG_ARM64 |
| static noinline void change_pac_parameters(void) |
| { |
| - /* Reset the keys of current task */ |
| - ptrauth_thread_init_kernel(current); |
| - ptrauth_thread_switch_kernel(current); |
| + if (IS_ENABLED(CONFIG_ARM64_PTR_AUTH)) { |
| + /* Reset the keys of current task */ |
| + ptrauth_thread_init_kernel(current); |
| + ptrauth_thread_switch_kernel(current); |
| + } |
| } |
| +#endif |
| |
| -#define CORRUPT_PAC_ITERATE 10 |
| noinline void lkdtm_CORRUPT_PAC(void) |
| { |
| +#ifdef CONFIG_ARM64 |
| +#define CORRUPT_PAC_ITERATE 10 |
| int i; |
| |
| + if (!IS_ENABLED(CONFIG_ARM64_PTR_AUTH)) |
| + pr_err("FAIL: kernel not built with CONFIG_ARM64_PTR_AUTH\n"); |
| + |
| if (!system_supports_address_auth()) { |
| - pr_err("FAIL: arm64 pointer authentication feature not present\n"); |
| + pr_err("FAIL: CPU lacks pointer authentication feature\n"); |
| return; |
| } |
| |
| - pr_info("Change the PAC parameters to force function return failure\n"); |
| + pr_info("changing PAC parameters to force function return failure...\n"); |
| /* |
| - * Pac is a hash value computed from input keys, return address and |
| + * PAC is a hash value computed from input keys, return address and |
| * stack pointer. As pac has fewer bits so there is a chance of |
| * collision, so iterate few times to reduce the collision probability. |
| */ |
| for (i = 0; i < CORRUPT_PAC_ITERATE; i++) |
| change_pac_parameters(); |
| |
| - pr_err("FAIL: %s test failed. Kernel may be unstable from here\n", __func__); |
| -} |
| -#else /* !CONFIG_ARM64_PTR_AUTH */ |
| -noinline void lkdtm_CORRUPT_PAC(void) |
| -{ |
| - pr_err("FAIL: arm64 pointer authentication config disabled\n"); |
| -} |
| + pr_err("FAIL: survived PAC changes! Kernel may be unstable from here\n"); |
| +#else |
| + pr_err("XFAIL: this test is arm64-only\n"); |
| #endif |
| +} |
| diff --git a/drivers/misc/lkdtm/lkdtm.h b/drivers/misc/lkdtm/lkdtm.h |
| index 601a2156a0d48..8878538b2c132 100644 |
| --- a/drivers/misc/lkdtm/lkdtm.h |
| +++ b/drivers/misc/lkdtm/lkdtm.h |
| @@ -31,9 +31,7 @@ void lkdtm_CORRUPT_USER_DS(void); |
| void lkdtm_STACK_GUARD_PAGE_LEADING(void); |
| void lkdtm_STACK_GUARD_PAGE_TRAILING(void); |
| void lkdtm_UNSET_SMEP(void); |
| -#ifdef CONFIG_X86_32 |
| void lkdtm_DOUBLE_FAULT(void); |
| -#endif |
| void lkdtm_CORRUPT_PAC(void); |
| |
| /* lkdtm_heap.c */ |
| diff --git a/tools/testing/selftests/lkdtm/tests.txt b/tools/testing/selftests/lkdtm/tests.txt |
| index 92ca32143ae5f..9d266e79c6a27 100644 |
| --- a/tools/testing/selftests/lkdtm/tests.txt |
| +++ b/tools/testing/selftests/lkdtm/tests.txt |
| @@ -14,6 +14,7 @@ STACK_GUARD_PAGE_LEADING |
| STACK_GUARD_PAGE_TRAILING |
| UNSET_SMEP CR4 bits went missing |
| DOUBLE_FAULT |
| +CORRUPT_PAC |
| UNALIGNED_LOAD_STORE_WRITE |
| #OVERWRITE_ALLOCATION Corrupts memory on failure |
| #WRITE_AFTER_FREE Corrupts memory on failure |
| -- |
| 2.25.1 |
| |