Commit 5b777131 authored by Kees Cook's avatar Kees Cook Committed by Greg Kroah-Hartman
Browse files

lkdtm: Add CONFIG hints in errors where possible 



For various failure conditions, try to include some details about where
to look for reasons about the failure.

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210623203936.3151093-8-keescook@chromium.org


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent f123c42b

drivers/misc/lkdtm/bugs.c

+6 −2
Original line number Diff line number Diff line
@@ -303,8 +303,10 @@ void lkdtm_CORRUPT_LIST_ADD(void) 


	if (target[0] == NULL && target[1] == NULL)

		pr_err("Overwrite did not happen, but no BUG?!\n");

	else

	else {

		pr_err("list_add() corruption not detected!\n");

		pr_expected_config(CONFIG_DEBUG_LIST);

	}

}



void lkdtm_CORRUPT_LIST_DEL(void)
@@ -328,8 +330,10 @@ void lkdtm_CORRUPT_LIST_DEL(void) 


	if (target[0] == NULL && target[1] == NULL)

		pr_err("Overwrite did not happen, but no BUG?!\n");

	else

	else {

		pr_err("list_del() corruption not detected!\n");

		pr_expected_config(CONFIG_DEBUG_LIST);

	}

}



/* Test that VMAP_STACK is actually allocating with a leading guard page */

drivers/misc/lkdtm/cfi.c

+2 −1
Original line number Diff line number Diff line
@@ -38,5 +38,6 @@ void lkdtm_CFI_FORWARD_PROTO(void) 
	func = (void *)lkdtm_increment_int;

	func(&called_count);



	pr_info("Fail: survived mismatched prototype function call!\n");

	pr_err("FAIL: survived mismatched prototype function call!\n");

	pr_expected_config(CONFIG_CFI_CLANG);

}

drivers/misc/lkdtm/core.c

+51 −0
Original line number Diff line number Diff line
@@ -26,6 +26,7 @@ 
#include <linux/init.h>

#include <linux/slab.h>

#include <linux/debugfs.h>

#include <linux/init.h>



#define DEFAULT_COUNT 10
@@ -398,6 +399,56 @@ static ssize_t direct_entry(struct file *f, const char __user *user_buf, 
	return count;

}



#ifndef MODULE

/*

 * To avoid needing to export parse_args(), just don't use this code

 * when LKDTM is built as a module.

 */

struct check_cmdline_args {

	const char *param;

	int value;

};



static int lkdtm_parse_one(char *param, char *val,

			   const char *unused, void *arg)

{

	struct check_cmdline_args *args = arg;



	/* short circuit if we already found a value. */

	if (args->value != -ESRCH)

		return 0;

	if (strncmp(param, args->param, strlen(args->param)) == 0) {

		bool bool_result;

		int ret;



		ret = kstrtobool(val, &bool_result);

		if (ret == 0)

			args->value = bool_result;

	}

	return 0;

}



int lkdtm_check_bool_cmdline(const char *param)

{

	char *command_line;

	struct check_cmdline_args args = {

		.param = param,

		.value = -ESRCH,

	};



	command_line = kstrdup(saved_command_line, GFP_KERNEL);

	if (!command_line)

		return -ENOMEM;



	parse_args("Setting sysctl args", command_line,

		   NULL, 0, -1, -1, &args, lkdtm_parse_one);



	kfree(command_line);



	return args.value;

}

#endif



static struct dentry *lkdtm_debugfs_root;



static int __init lkdtm_module_init(void)

drivers/misc/lkdtm/fortify.c

+2 −1
Original line number Diff line number Diff line
@@ -76,7 +76,8 @@ void lkdtm_FORTIFIED_STRSCPY(void) 
	 */

	strscpy(dst, src, strlen(src));



	pr_warn("FAIL: No overflow in above strscpy()\n");

	pr_err("FAIL: strscpy() overflow not detected!\n");

	pr_expected_config(CONFIG_FORTIFY_SOURCE);



	kfree(src);

}

drivers/misc/lkdtm/heap.c

+6 −4
Original line number Diff line number Diff line
@@ -109,9 +109,10 @@ void lkdtm_READ_AFTER_FREE(void) 
	if (saw != *val) {

		/* Good! Poisoning happened, so declare a win. */

		pr_info("Memory correctly poisoned (%x)\n", saw);

		BUG();

	} else {

		pr_err("FAIL: Memory was not poisoned!\n");

		pr_expected_config_param(CONFIG_INIT_ON_FREE_DEFAULT_ON, "init_on_free");

	}

	pr_info("Memory was not poisoned\n");



	kfree(val);

}
@@ -165,9 +166,10 @@ void lkdtm_READ_BUDDY_AFTER_FREE(void) 
	if (saw != *val) {

		/* Good! Poisoning happened, so declare a win. */

		pr_info("Memory correctly poisoned (%x)\n", saw);

		BUG();

	} else {

		pr_err("FAIL: Buddy page was not poisoned!\n");

		pr_expected_config_param(CONFIG_INIT_ON_FREE_DEFAULT_ON, "init_on_free");

	}

	pr_info("Buddy page was not poisoned\n");



	kfree(val);

}