linux-stable-mirror/lib/test_ubsan.c
Mostafa Saleh 9b044614be ubsan: Fix panic from test_ubsan_out_of_bounds
Running lib_ubsan.ko on arm64 (without CONFIG_UBSAN_TRAP) panics the
kernel:

[   31.616546] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: test_ubsan_out_of_bounds+0x158/0x158 [test_ubsan]
[   31.646817] CPU: 3 UID: 0 PID: 179 Comm: insmod Not tainted 6.15.0-rc2 #1 PREEMPT
[   31.648153] Hardware name: linux,dummy-virt (DT)
[   31.648970] Call trace:
[   31.649345]  show_stack+0x18/0x24 (C)
[   31.650960]  dump_stack_lvl+0x40/0x84
[   31.651559]  dump_stack+0x18/0x24
[   31.652264]  panic+0x138/0x3b4
[   31.652812]  __ktime_get_real_seconds+0x0/0x10
[   31.653540]  test_ubsan_load_invalid_value+0x0/0xa8 [test_ubsan]
[   31.654388]  init_module+0x24/0xff4 [test_ubsan]
[   31.655077]  do_one_initcall+0xd4/0x280
[   31.655680]  do_init_module+0x58/0x2b4

That happens because the test corrupts other data in the stack:
400:   d5384108        mrs     x8, sp_el0
404:   f9426d08        ldr     x8, [x8, #1240]
408:   f85f83a9        ldur    x9, [x29, #-8]
40c:   eb09011f        cmp     x8, x9
410:   54000301        b.ne    470 <test_ubsan_out_of_bounds+0x154>  // b.any

As there is no guarantee the compiler will order the local variables
as declared in the module:
        volatile char above[4] = { }; /* Protect surrounding memory. */
        volatile int arr[4];
        volatile char below[4] = { }; /* Protect surrounding memory. */

There is another problem where the out-of-bound index is 5 which is larger
than the extra surrounding memory for protection.

So, use a struct to enforce the ordering, and fix the index to be 4.
Also, remove some of the volatiles and rely on OPTIMIZER_HIDE_VAR()

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Link: https://lore.kernel.org/r/20250415203354.4109415-1-smostafa@google.com
Signed-off-by: Kees Cook <kees@kernel.org>
2025-04-15 13:50:17 -07:00

175 lines
3.4 KiB
C

// SPDX-License-Identifier: GPL-2.0
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/module.h>
typedef void(*test_ubsan_fp)(void);
#define UBSAN_TEST(config, ...) do { \
pr_info("%s " __VA_ARGS__ "%s(%s=%s)\n", __func__, \
sizeof(" " __VA_ARGS__) > 2 ? " " : "", \
#config, IS_ENABLED(config) ? "y" : "n"); \
} while (0)
static void test_ubsan_add_overflow(void)
{
volatile int val = INT_MAX;
UBSAN_TEST(CONFIG_UBSAN_INTEGER_WRAP);
val += 2;
}
static void test_ubsan_sub_overflow(void)
{
volatile int val = INT_MIN;
volatile int val2 = 2;
UBSAN_TEST(CONFIG_UBSAN_INTEGER_WRAP);
val -= val2;
}
static void test_ubsan_mul_overflow(void)
{
volatile int val = INT_MAX / 2;
UBSAN_TEST(CONFIG_UBSAN_INTEGER_WRAP);
val *= 3;
}
static void test_ubsan_negate_overflow(void)
{
volatile int val = INT_MIN;
UBSAN_TEST(CONFIG_UBSAN_INTEGER_WRAP);
val = -val;
}
static void test_ubsan_divrem_overflow(void)
{
volatile int val = 16;
volatile int val2 = 0;
UBSAN_TEST(CONFIG_UBSAN_DIV_ZERO);
val /= val2;
}
static void test_ubsan_truncate_signed(void)
{
volatile long val = LONG_MAX;
volatile int val2 = 0;
UBSAN_TEST(CONFIG_UBSAN_INTEGER_WRAP);
val2 = val;
}
static void test_ubsan_shift_out_of_bounds(void)
{
volatile int neg = -1, wrap = 4;
volatile int val1 = 10;
volatile int val2 = INT_MAX;
UBSAN_TEST(CONFIG_UBSAN_SHIFT, "negative exponent");
val1 <<= neg;
UBSAN_TEST(CONFIG_UBSAN_SHIFT, "left overflow");
val2 <<= wrap;
}
static void test_ubsan_out_of_bounds(void)
{
int i = 4, j = 4, k = -1;
volatile struct {
char above[4]; /* Protect surrounding memory. */
int arr[4];
char below[4]; /* Protect surrounding memory. */
} data;
OPTIMIZER_HIDE_VAR(i);
OPTIMIZER_HIDE_VAR(j);
OPTIMIZER_HIDE_VAR(k);
UBSAN_TEST(CONFIG_UBSAN_BOUNDS, "above");
data.arr[j] = i;
UBSAN_TEST(CONFIG_UBSAN_BOUNDS, "below");
data.arr[k] = i;
}
enum ubsan_test_enum {
UBSAN_TEST_ZERO = 0,
UBSAN_TEST_ONE,
UBSAN_TEST_MAX,
};
static void test_ubsan_load_invalid_value(void)
{
volatile char *dst, *src;
bool val, val2, *ptr;
enum ubsan_test_enum eval, eval2, *eptr;
unsigned char c = 0xff;
UBSAN_TEST(CONFIG_UBSAN_BOOL, "bool");
dst = (char *)&val;
src = &c;
*dst = *src;
ptr = &val2;
val2 = val;
UBSAN_TEST(CONFIG_UBSAN_ENUM, "enum");
dst = (char *)&eval;
src = &c;
*dst = *src;
eptr = &eval2;
eval2 = eval;
}
static void test_ubsan_misaligned_access(void)
{
volatile char arr[5] __aligned(4) = {1, 2, 3, 4, 5};
volatile int *ptr, val = 6;
UBSAN_TEST(CONFIG_UBSAN_ALIGNMENT);
ptr = (int *)(arr + 1);
*ptr = val;
}
static const test_ubsan_fp test_ubsan_array[] = {
test_ubsan_add_overflow,
test_ubsan_sub_overflow,
test_ubsan_mul_overflow,
test_ubsan_negate_overflow,
test_ubsan_truncate_signed,
test_ubsan_shift_out_of_bounds,
test_ubsan_out_of_bounds,
test_ubsan_load_invalid_value,
test_ubsan_misaligned_access,
};
/* Excluded because they Oops the module. */
static __used const test_ubsan_fp skip_ubsan_array[] = {
test_ubsan_divrem_overflow,
};
static int __init test_ubsan_init(void)
{
unsigned int i;
for (i = 0; i < ARRAY_SIZE(test_ubsan_array); i++)
test_ubsan_array[i]();
return 0;
}
module_init(test_ubsan_init);
static void __exit test_ubsan_exit(void)
{
/* do nothing */
}
module_exit(test_ubsan_exit);
MODULE_AUTHOR("Jinbum Park <jinb.park7@gmail.com>");
MODULE_DESCRIPTION("UBSAN unit test");
MODULE_LICENSE("GPL v2");