summaryrefslogtreecommitdiffstats
path: root/drivers/misc/lkdtm_core.c
diff options
context:
space:
mode:
authorKees Cook <keescook@chromium.org>2016-06-23 22:01:26 -0700
committerKees Cook <keescook@chromium.org>2016-07-07 11:09:19 -0700
commit6c3521400c345fa2575a6f5b212c215db38c5d93 (patch)
treeda82894be96d44bc48809e6871dd096db1106f22 /drivers/misc/lkdtm_core.c
parente2402b1d214e5d50e807773563d590115a161f45 (diff)
downloadlinux-6c3521400c345fa2575a6f5b212c215db38c5d93.tar.bz2
lkdtm: add usercopy test for blocking kernel text
The upcoming HARDENED_USERCOPY checks will also block access to the kernel text, so provide a test for this as well. Signed-off-by: Kees Cook <keescook@chromium.org>
Diffstat (limited to 'drivers/misc/lkdtm_core.c')
-rw-r--r--drivers/misc/lkdtm_core.c34
1 files changed, 34 insertions, 0 deletions
diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c
index a595a6f2615a..c915961c4df2 100644
--- a/drivers/misc/lkdtm_core.c
+++ b/drivers/misc/lkdtm_core.c
@@ -120,6 +120,7 @@ enum ctype {
CT_USERCOPY_STACK_FRAME_TO,
CT_USERCOPY_STACK_FRAME_FROM,
CT_USERCOPY_STACK_BEYOND,
+ CT_USERCOPY_KERNEL,
};
static char* cp_name[] = {
@@ -171,6 +172,7 @@ static char* cp_type[] = {
"USERCOPY_STACK_FRAME_TO",
"USERCOPY_STACK_FRAME_FROM",
"USERCOPY_STACK_BEYOND",
+ "USERCOPY_KERNEL",
};
static struct jprobe lkdtm;
@@ -495,6 +497,35 @@ free_user:
vm_munmap(user_addr, PAGE_SIZE);
}
+static void do_usercopy_kernel(void)
+{
+ unsigned long user_addr;
+
+ user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
+ PROT_READ | PROT_WRITE | PROT_EXEC,
+ MAP_ANONYMOUS | MAP_PRIVATE, 0);
+ if (user_addr >= TASK_SIZE) {
+ pr_warn("Failed to allocate user memory\n");
+ return;
+ }
+
+ pr_info("attempting good copy_to_user from kernel rodata\n");
+ if (copy_to_user((void __user *)user_addr, test_text,
+ sizeof(test_text))) {
+ pr_warn("copy_to_user failed unexpectedly?!\n");
+ goto free_user;
+ }
+
+ pr_info("attempting bad copy_to_user from kernel text\n");
+ if (copy_to_user((void __user *)user_addr, vm_mmap, PAGE_SIZE)) {
+ pr_warn("copy_to_user failed, but lacked Oops\n");
+ goto free_user;
+ }
+
+free_user:
+ vm_munmap(user_addr, PAGE_SIZE);
+}
+
static void do_usercopy_heap_size(bool to_user)
{
unsigned long user_addr;
@@ -957,6 +988,9 @@ static void lkdtm_do_action(enum ctype which)
case CT_USERCOPY_STACK_BEYOND:
do_usercopy_stack(true, false);
break;
+ case CT_USERCOPY_KERNEL:
+ do_usercopy_kernel();
+ break;
case CT_NONE:
default:
break;