mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2025-04-19 20:58:31 +09:00

Running lib_ubsan.ko on arm64 (without CONFIG_UBSAN_TRAP) panics the kernel: [ 31.616546] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: test_ubsan_out_of_bounds+0x158/0x158 [test_ubsan] [ 31.646817] CPU: 3 UID: 0 PID: 179 Comm: insmod Not tainted 6.15.0-rc2 #1 PREEMPT [ 31.648153] Hardware name: linux,dummy-virt (DT) [ 31.648970] Call trace: [ 31.649345] show_stack+0x18/0x24 (C) [ 31.650960] dump_stack_lvl+0x40/0x84 [ 31.651559] dump_stack+0x18/0x24 [ 31.652264] panic+0x138/0x3b4 [ 31.652812] __ktime_get_real_seconds+0x0/0x10 [ 31.653540] test_ubsan_load_invalid_value+0x0/0xa8 [test_ubsan] [ 31.654388] init_module+0x24/0xff4 [test_ubsan] [ 31.655077] do_one_initcall+0xd4/0x280 [ 31.655680] do_init_module+0x58/0x2b4 That happens because the test corrupts other data in the stack: 400: d5384108 mrs x8, sp_el0 404: f9426d08 ldr x8, [x8, #1240] 408: f85f83a9 ldur x9, [x29, #-8] 40c: eb09011f cmp x8, x9 410: 54000301 b.ne 470 <test_ubsan_out_of_bounds+0x154> // b.any As there is no guarantee the compiler will order the local variables as declared in the module: volatile char above[4] = { }; /* Protect surrounding memory. */ volatile int arr[4]; volatile char below[4] = { }; /* Protect surrounding memory. */ There is another problem where the out-of-bound index is 5 which is larger than the extra surrounding memory for protection. So, use a struct to enforce the ordering, and fix the index to be 4. Also, remove some of the volatiles and rely on OPTIMIZER_HIDE_VAR() Signed-off-by: Mostafa Saleh <smostafa@google.com> Link: https://lore.kernel.org/r/20250415203354.4109415-1-smostafa@google.com Signed-off-by: Kees Cook <kees@kernel.org>
175 lines
3.4 KiB
C
175 lines
3.4 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
#include <linux/init.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/module.h>
|
|
|
|
typedef void(*test_ubsan_fp)(void);
|
|
|
|
#define UBSAN_TEST(config, ...) do { \
|
|
pr_info("%s " __VA_ARGS__ "%s(%s=%s)\n", __func__, \
|
|
sizeof(" " __VA_ARGS__) > 2 ? " " : "", \
|
|
#config, IS_ENABLED(config) ? "y" : "n"); \
|
|
} while (0)
|
|
|
|
static void test_ubsan_add_overflow(void)
|
|
{
|
|
volatile int val = INT_MAX;
|
|
|
|
UBSAN_TEST(CONFIG_UBSAN_INTEGER_WRAP);
|
|
val += 2;
|
|
}
|
|
|
|
static void test_ubsan_sub_overflow(void)
|
|
{
|
|
volatile int val = INT_MIN;
|
|
volatile int val2 = 2;
|
|
|
|
UBSAN_TEST(CONFIG_UBSAN_INTEGER_WRAP);
|
|
val -= val2;
|
|
}
|
|
|
|
static void test_ubsan_mul_overflow(void)
|
|
{
|
|
volatile int val = INT_MAX / 2;
|
|
|
|
UBSAN_TEST(CONFIG_UBSAN_INTEGER_WRAP);
|
|
val *= 3;
|
|
}
|
|
|
|
static void test_ubsan_negate_overflow(void)
|
|
{
|
|
volatile int val = INT_MIN;
|
|
|
|
UBSAN_TEST(CONFIG_UBSAN_INTEGER_WRAP);
|
|
val = -val;
|
|
}
|
|
|
|
static void test_ubsan_divrem_overflow(void)
|
|
{
|
|
volatile int val = 16;
|
|
volatile int val2 = 0;
|
|
|
|
UBSAN_TEST(CONFIG_UBSAN_DIV_ZERO);
|
|
val /= val2;
|
|
}
|
|
|
|
static void test_ubsan_truncate_signed(void)
|
|
{
|
|
volatile long val = LONG_MAX;
|
|
volatile int val2 = 0;
|
|
|
|
UBSAN_TEST(CONFIG_UBSAN_INTEGER_WRAP);
|
|
val2 = val;
|
|
}
|
|
|
|
static void test_ubsan_shift_out_of_bounds(void)
|
|
{
|
|
volatile int neg = -1, wrap = 4;
|
|
volatile int val1 = 10;
|
|
volatile int val2 = INT_MAX;
|
|
|
|
UBSAN_TEST(CONFIG_UBSAN_SHIFT, "negative exponent");
|
|
val1 <<= neg;
|
|
|
|
UBSAN_TEST(CONFIG_UBSAN_SHIFT, "left overflow");
|
|
val2 <<= wrap;
|
|
}
|
|
|
|
static void test_ubsan_out_of_bounds(void)
|
|
{
|
|
int i = 4, j = 4, k = -1;
|
|
volatile struct {
|
|
char above[4]; /* Protect surrounding memory. */
|
|
int arr[4];
|
|
char below[4]; /* Protect surrounding memory. */
|
|
} data;
|
|
|
|
OPTIMIZER_HIDE_VAR(i);
|
|
OPTIMIZER_HIDE_VAR(j);
|
|
OPTIMIZER_HIDE_VAR(k);
|
|
|
|
UBSAN_TEST(CONFIG_UBSAN_BOUNDS, "above");
|
|
data.arr[j] = i;
|
|
|
|
UBSAN_TEST(CONFIG_UBSAN_BOUNDS, "below");
|
|
data.arr[k] = i;
|
|
}
|
|
|
|
enum ubsan_test_enum {
|
|
UBSAN_TEST_ZERO = 0,
|
|
UBSAN_TEST_ONE,
|
|
UBSAN_TEST_MAX,
|
|
};
|
|
|
|
static void test_ubsan_load_invalid_value(void)
|
|
{
|
|
volatile char *dst, *src;
|
|
bool val, val2, *ptr;
|
|
enum ubsan_test_enum eval, eval2, *eptr;
|
|
unsigned char c = 0xff;
|
|
|
|
UBSAN_TEST(CONFIG_UBSAN_BOOL, "bool");
|
|
dst = (char *)&val;
|
|
src = &c;
|
|
*dst = *src;
|
|
|
|
ptr = &val2;
|
|
val2 = val;
|
|
|
|
UBSAN_TEST(CONFIG_UBSAN_ENUM, "enum");
|
|
dst = (char *)&eval;
|
|
src = &c;
|
|
*dst = *src;
|
|
|
|
eptr = &eval2;
|
|
eval2 = eval;
|
|
}
|
|
|
|
static void test_ubsan_misaligned_access(void)
|
|
{
|
|
volatile char arr[5] __aligned(4) = {1, 2, 3, 4, 5};
|
|
volatile int *ptr, val = 6;
|
|
|
|
UBSAN_TEST(CONFIG_UBSAN_ALIGNMENT);
|
|
ptr = (int *)(arr + 1);
|
|
*ptr = val;
|
|
}
|
|
|
|
static const test_ubsan_fp test_ubsan_array[] = {
|
|
test_ubsan_add_overflow,
|
|
test_ubsan_sub_overflow,
|
|
test_ubsan_mul_overflow,
|
|
test_ubsan_negate_overflow,
|
|
test_ubsan_truncate_signed,
|
|
test_ubsan_shift_out_of_bounds,
|
|
test_ubsan_out_of_bounds,
|
|
test_ubsan_load_invalid_value,
|
|
test_ubsan_misaligned_access,
|
|
};
|
|
|
|
/* Excluded because they Oops the module. */
|
|
static __used const test_ubsan_fp skip_ubsan_array[] = {
|
|
test_ubsan_divrem_overflow,
|
|
};
|
|
|
|
static int __init test_ubsan_init(void)
|
|
{
|
|
unsigned int i;
|
|
|
|
for (i = 0; i < ARRAY_SIZE(test_ubsan_array); i++)
|
|
test_ubsan_array[i]();
|
|
|
|
return 0;
|
|
}
|
|
module_init(test_ubsan_init);
|
|
|
|
static void __exit test_ubsan_exit(void)
|
|
{
|
|
/* do nothing */
|
|
}
|
|
module_exit(test_ubsan_exit);
|
|
|
|
MODULE_AUTHOR("Jinbum Park <jinb.park7@gmail.com>");
|
|
MODULE_DESCRIPTION("UBSAN unit test");
|
|
MODULE_LICENSE("GPL v2");
|