Re: [PATCH 6/7] lkdtm: crash on overwriting protected pmalloc var

[J Freyensee]

On 3/7/18 5:18 AM, Igor Stoppa wrote:


On 06/03/18 19:20, J Freyensee wrote:


On 2/28/18 12:06 PM, Igor Stoppa wrote:

[...]


   void __init lkdtm_perms_init(void);
   void lkdtm_WRITE_RO(void);
   void lkdtm_WRITE_RO_AFTER_INIT(void);
+void lkdtm_WRITE_RO_PMALLOC(void);

Does this need some sort of #ifdef too?

Not strictly. It's just a function declaration.
As long as it is not used, the linker will not complain.
The #ifdef placed around the use and definition is sufficient, from a
correctness perspective.

But it's a different question if there is any standard in linux about
hiding also the declaration.



I'd prefer hiding it if it's contents are being ifdef'ed out, but I 
really think it's more of a maintainer preference question.





I am not very fond of #ifdefs, so when I can I try to avoid them.

Re: [PATCH 6/7] lkdtm: crash on overwriting protected pmalloc var

[J Freyensee]

On 3/7/18 5:18 AM, Igor Stoppa wrote:


On 06/03/18 19:20, J Freyensee wrote:


On 2/28/18 12:06 PM, Igor Stoppa wrote:

[...]


   void __init lkdtm_perms_init(void);
   void lkdtm_WRITE_RO(void);
   void lkdtm_WRITE_RO_AFTER_INIT(void);
+void lkdtm_WRITE_RO_PMALLOC(void);

Does this need some sort of #ifdef too?

Not strictly. It's just a function declaration.
As long as it is not used, the linker will not complain.
The #ifdef placed around the use and definition is sufficient, from a
correctness perspective.

But it's a different question if there is any standard in linux about
hiding also the declaration.



I'd prefer hiding it if it's contents are being ifdef'ed out, but I 
really think it's more of a maintainer preference question.





I am not very fond of #ifdefs, so when I can I try to avoid them.

Re: [PATCH 6/7] lkdtm: crash on overwriting protected pmalloc var

[Igor Stoppa]

On 06/03/18 19:20, J Freyensee wrote:

> On 2/28/18 12:06 PM, Igor Stoppa wrote:

[...]

>>   void __init lkdtm_perms_init(void);
>>   void lkdtm_WRITE_RO(void);
>>   void lkdtm_WRITE_RO_AFTER_INIT(void);
>> +void lkdtm_WRITE_RO_PMALLOC(void);
> 
> Does this need some sort of #ifdef too?

Not strictly. It's just a function declaration.
As long as it is not used, the linker will not complain.
The #ifdef placed around the use and definition is sufficient, from a
correctness perspective.

But it's a different question if there is any standard in linux about
hiding also the declaration.

I am not very fond of #ifdefs, so when I can I try to avoid them.

>> +pr_info("attempting bad pmalloc write at %p\n", i);
>> +*i = 0;
> 
> OK, now I'm on the right version of this patch series, same comment 
> applies.  I don't get the local *i assignment at the end of the 
> function, but seems harmless.


Because that's the whole point of the function: prove that pmalloc
protection works (see the message in the pr_info one line above).

The function is supposed to do:

* create a pool
* allocate memory from it
* protect it
* try to alter it (and crash)

*i = 0; performs the last step

--
igor

Re: [PATCH 6/7] lkdtm: crash on overwriting protected pmalloc var

[Igor Stoppa]

On 06/03/18 19:20, J Freyensee wrote:

> On 2/28/18 12:06 PM, Igor Stoppa wrote:

[...]

>>   void __init lkdtm_perms_init(void);
>>   void lkdtm_WRITE_RO(void);
>>   void lkdtm_WRITE_RO_AFTER_INIT(void);
>> +void lkdtm_WRITE_RO_PMALLOC(void);
> 
> Does this need some sort of #ifdef too?

Not strictly. It's just a function declaration.
As long as it is not used, the linker will not complain.
The #ifdef placed around the use and definition is sufficient, from a
correctness perspective.

But it's a different question if there is any standard in linux about
hiding also the declaration.

I am not very fond of #ifdefs, so when I can I try to avoid them.

>> +pr_info("attempting bad pmalloc write at %p\n", i);
>> +*i = 0;
> 
> OK, now I'm on the right version of this patch series, same comment 
> applies.  I don't get the local *i assignment at the end of the 
> function, but seems harmless.


Because that's the whole point of the function: prove that pmalloc
protection works (see the message in the pr_info one line above).

The function is supposed to do:

* create a pool
* allocate memory from it
* protect it
* try to alter it (and crash)

*i = 0; performs the last step

--
igor

Re: [PATCH 6/7] lkdtm: crash on overwriting protected pmalloc var

[J Freyensee]

On 2/28/18 12:06 PM, Igor Stoppa wrote:

Verify that pmalloc read-only protection is in place: trying to
overwrite a protected variable will crash the kernel.

Signed-off-by: Igor Stoppa 
---
  drivers/misc/lkdtm.h   |  1 +
  drivers/misc/lkdtm_core.c  |  3 +++
  drivers/misc/lkdtm_perms.c | 28 
  3 files changed, 32 insertions(+)

diff --git a/drivers/misc/lkdtm.h b/drivers/misc/lkdtm.h
index 9e513dcfd809..dcda3ae76ceb 100644
--- a/drivers/misc/lkdtm.h
+++ b/drivers/misc/lkdtm.h
@@ -38,6 +38,7 @@ void lkdtm_READ_BUDDY_AFTER_FREE(void);
  void __init lkdtm_perms_init(void);
  void lkdtm_WRITE_RO(void);
  void lkdtm_WRITE_RO_AFTER_INIT(void);
+void lkdtm_WRITE_RO_PMALLOC(void);


Does this need some sort of #ifdef too?


  void lkdtm_WRITE_KERN(void);
  void lkdtm_EXEC_DATA(void);
  void lkdtm_EXEC_STACK(void);
diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c
index 2154d1bfd18b..c9fd42bda6ee 100644
--- a/drivers/misc/lkdtm_core.c
+++ b/drivers/misc/lkdtm_core.c
@@ -155,6 +155,9 @@ static const struct crashtype crashtypes[] = {
CRASHTYPE(ACCESS_USERSPACE),
CRASHTYPE(WRITE_RO),
CRASHTYPE(WRITE_RO_AFTER_INIT),
+#ifdef CONFIG_PROTECTABLE_MEMORY
+   CRASHTYPE(WRITE_RO_PMALLOC),
+#endif
CRASHTYPE(WRITE_KERN),
CRASHTYPE(REFCOUNT_INC_OVERFLOW),
CRASHTYPE(REFCOUNT_ADD_OVERFLOW),
diff --git a/drivers/misc/lkdtm_perms.c b/drivers/misc/lkdtm_perms.c
index 53b85c9d16b8..0ac9023fd2b0 100644
--- a/drivers/misc/lkdtm_perms.c
+++ b/drivers/misc/lkdtm_perms.c
@@ -9,6 +9,7 @@
  #include 
  #include 
  #include 
+#include 
  #include 
  
  /* Whether or not to fill the target memory area with do_nothing(). */

@@ -104,6 +105,33 @@ void lkdtm_WRITE_RO_AFTER_INIT(void)
*ptr ^= 0xabcd1234;
  }
  
+#ifdef CONFIG_PROTECTABLE_MEMORY

+void lkdtm_WRITE_RO_PMALLOC(void)
+{
+   struct gen_pool *pool;
+   int *i;
+
+   pool = pmalloc_create_pool("pool", 0);
+   if (unlikely(!pool)) {
+   pr_info("Failed preparing pool for pmalloc test.");
+   return;
+   }
+
+   i = (int *)pmalloc(pool, sizeof(int), GFP_KERNEL);
+   if (unlikely(!i)) {
+   pr_info("Failed allocating memory for pmalloc test.");
+   pmalloc_destroy_pool(pool);
+   return;
+   }
+
+   *i = INT_MAX;
+   pmalloc_protect_pool(pool);
+
+   pr_info("attempting bad pmalloc write at %p\n", i);
+   *i = 0;


OK, now I'm on the right version of this patch series, same comment 
applies.  I don't get the local *i assignment at the end of the 
function, but seems harmless.


Except the two minor comments, otherwise,
Reviewed-by: Jay Freyensee 


+}
+#endif
+
  void lkdtm_WRITE_KERN(void)
  {
size_t size;

Re: [PATCH 6/7] lkdtm: crash on overwriting protected pmalloc var

[J Freyensee]

On 2/28/18 12:06 PM, Igor Stoppa wrote:

Verify that pmalloc read-only protection is in place: trying to
overwrite a protected variable will crash the kernel.

Signed-off-by: Igor Stoppa 
---
  drivers/misc/lkdtm.h   |  1 +
  drivers/misc/lkdtm_core.c  |  3 +++
  drivers/misc/lkdtm_perms.c | 28 
  3 files changed, 32 insertions(+)

diff --git a/drivers/misc/lkdtm.h b/drivers/misc/lkdtm.h
index 9e513dcfd809..dcda3ae76ceb 100644
--- a/drivers/misc/lkdtm.h
+++ b/drivers/misc/lkdtm.h
@@ -38,6 +38,7 @@ void lkdtm_READ_BUDDY_AFTER_FREE(void);
  void __init lkdtm_perms_init(void);
  void lkdtm_WRITE_RO(void);
  void lkdtm_WRITE_RO_AFTER_INIT(void);
+void lkdtm_WRITE_RO_PMALLOC(void);


Does this need some sort of #ifdef too?


  void lkdtm_WRITE_KERN(void);
  void lkdtm_EXEC_DATA(void);
  void lkdtm_EXEC_STACK(void);
diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c
index 2154d1bfd18b..c9fd42bda6ee 100644
--- a/drivers/misc/lkdtm_core.c
+++ b/drivers/misc/lkdtm_core.c
@@ -155,6 +155,9 @@ static const struct crashtype crashtypes[] = {
CRASHTYPE(ACCESS_USERSPACE),
CRASHTYPE(WRITE_RO),
CRASHTYPE(WRITE_RO_AFTER_INIT),
+#ifdef CONFIG_PROTECTABLE_MEMORY
+   CRASHTYPE(WRITE_RO_PMALLOC),
+#endif
CRASHTYPE(WRITE_KERN),
CRASHTYPE(REFCOUNT_INC_OVERFLOW),
CRASHTYPE(REFCOUNT_ADD_OVERFLOW),
diff --git a/drivers/misc/lkdtm_perms.c b/drivers/misc/lkdtm_perms.c
index 53b85c9d16b8..0ac9023fd2b0 100644
--- a/drivers/misc/lkdtm_perms.c
+++ b/drivers/misc/lkdtm_perms.c
@@ -9,6 +9,7 @@
  #include 
  #include 
  #include 
+#include 
  #include 
  
  /* Whether or not to fill the target memory area with do_nothing(). */

@@ -104,6 +105,33 @@ void lkdtm_WRITE_RO_AFTER_INIT(void)
*ptr ^= 0xabcd1234;
  }
  
+#ifdef CONFIG_PROTECTABLE_MEMORY

+void lkdtm_WRITE_RO_PMALLOC(void)
+{
+   struct gen_pool *pool;
+   int *i;
+
+   pool = pmalloc_create_pool("pool", 0);
+   if (unlikely(!pool)) {
+   pr_info("Failed preparing pool for pmalloc test.");
+   return;
+   }
+
+   i = (int *)pmalloc(pool, sizeof(int), GFP_KERNEL);
+   if (unlikely(!i)) {
+   pr_info("Failed allocating memory for pmalloc test.");
+   pmalloc_destroy_pool(pool);
+   return;
+   }
+
+   *i = INT_MAX;
+   pmalloc_protect_pool(pool);
+
+   pr_info("attempting bad pmalloc write at %p\n", i);
+   *i = 0;


OK, now I'm on the right version of this patch series, same comment 
applies.  I don't get the local *i assignment at the end of the 
function, but seems harmless.


Except the two minor comments, otherwise,
Reviewed-by: Jay Freyensee 


+}
+#endif
+
  void lkdtm_WRITE_KERN(void)
  {
size_t size;

Re: [PATCH 6/7] lkdtm: crash on overwriting protected pmalloc var

[J Freyensee]

On 3/6/18 9:05 AM, J Freyensee wrote:



  +#ifdef CONFIG_PROTECTABLE_MEMORY
+void lkdtm_WRITE_RO_PMALLOC(void)
+{
+    struct gen_pool *pool;
+    int *i;
+
+    pool = pmalloc_create_pool("pool", 0);
+    if (unlikely(!pool)) {
+    pr_info("Failed preparing pool for pmalloc test.");
+    return;
+    }
+
+    i = (int *)pmalloc(pool, sizeof(int), GFP_KERNEL);
+    if (unlikely(!i)) {
+    pr_info("Failed allocating memory for pmalloc test.");
+    pmalloc_destroy_pool(pool);
+    return;
+    }
+
+    *i = INT_MAX;
+    pmalloc_protect_pool(pool);
+
+    pr_info("attempting bad pmalloc write at %p\n", i);
+    *i = 0;




Opps, disregard this, this is the last series of this patch series, not 
the most recent one :-(.




Seems harmless, but I don't get why *i local variable needs to be set 
to 0 at the end of this function.



Otherwise,

Reviewed-by: Jay Freyensee 

Re: [PATCH 6/7] lkdtm: crash on overwriting protected pmalloc var

[J Freyensee]

On 3/6/18 9:05 AM, J Freyensee wrote:



  +#ifdef CONFIG_PROTECTABLE_MEMORY
+void lkdtm_WRITE_RO_PMALLOC(void)
+{
+    struct gen_pool *pool;
+    int *i;
+
+    pool = pmalloc_create_pool("pool", 0);
+    if (unlikely(!pool)) {
+    pr_info("Failed preparing pool for pmalloc test.");
+    return;
+    }
+
+    i = (int *)pmalloc(pool, sizeof(int), GFP_KERNEL);
+    if (unlikely(!i)) {
+    pr_info("Failed allocating memory for pmalloc test.");
+    pmalloc_destroy_pool(pool);
+    return;
+    }
+
+    *i = INT_MAX;
+    pmalloc_protect_pool(pool);
+
+    pr_info("attempting bad pmalloc write at %p\n", i);
+    *i = 0;




Opps, disregard this, this is the last series of this patch series, not 
the most recent one :-(.




Seems harmless, but I don't get why *i local variable needs to be set 
to 0 at the end of this function.



Otherwise,

Reviewed-by: Jay Freyensee 

Re: [PATCH 6/7] lkdtm: crash on overwriting protected pmalloc var

[J Freyensee]

  
+#ifdef CONFIG_PROTECTABLE_MEMORY

+void lkdtm_WRITE_RO_PMALLOC(void)
+{
+   struct gen_pool *pool;
+   int *i;
+
+   pool = pmalloc_create_pool("pool", 0);
+   if (unlikely(!pool)) {
+   pr_info("Failed preparing pool for pmalloc test.");
+   return;
+   }
+
+   i = (int *)pmalloc(pool, sizeof(int), GFP_KERNEL);
+   if (unlikely(!i)) {
+   pr_info("Failed allocating memory for pmalloc test.");
+   pmalloc_destroy_pool(pool);
+   return;
+   }
+
+   *i = INT_MAX;
+   pmalloc_protect_pool(pool);
+
+   pr_info("attempting bad pmalloc write at %p\n", i);
+   *i = 0;


Seems harmless, but I don't get why *i local variable needs to be set to 
0 at the end of this function.



Otherwise,

Reviewed-by: Jay Freyensee 

Re: [PATCH 6/7] lkdtm: crash on overwriting protected pmalloc var

[J Freyensee]

  
+#ifdef CONFIG_PROTECTABLE_MEMORY

+void lkdtm_WRITE_RO_PMALLOC(void)
+{
+   struct gen_pool *pool;
+   int *i;
+
+   pool = pmalloc_create_pool("pool", 0);
+   if (unlikely(!pool)) {
+   pr_info("Failed preparing pool for pmalloc test.");
+   return;
+   }
+
+   i = (int *)pmalloc(pool, sizeof(int), GFP_KERNEL);
+   if (unlikely(!i)) {
+   pr_info("Failed allocating memory for pmalloc test.");
+   pmalloc_destroy_pool(pool);
+   return;
+   }
+
+   *i = INT_MAX;
+   pmalloc_protect_pool(pool);
+
+   pr_info("attempting bad pmalloc write at %p\n", i);
+   *i = 0;


Seems harmless, but I don't get why *i local variable needs to be set to 
0 at the end of this function.



Otherwise,

Reviewed-by: Jay Freyensee 

[PATCH 6/7] lkdtm: crash on overwriting protected pmalloc var

[Igor Stoppa]

Verify that pmalloc read-only protection is in place: trying to
overwrite a protected variable will crash the kernel.

Signed-off-by: Igor Stoppa 
---
 drivers/misc/lkdtm.h   |  1 +
 drivers/misc/lkdtm_core.c  |  3 +++
 drivers/misc/lkdtm_perms.c | 28 
 3 files changed, 32 insertions(+)

diff --git a/drivers/misc/lkdtm.h b/drivers/misc/lkdtm.h
index 9e513dcfd809..dcda3ae76ceb 100644
--- a/drivers/misc/lkdtm.h
+++ b/drivers/misc/lkdtm.h
@@ -38,6 +38,7 @@ void lkdtm_READ_BUDDY_AFTER_FREE(void);
 void __init lkdtm_perms_init(void);
 void lkdtm_WRITE_RO(void);
 void lkdtm_WRITE_RO_AFTER_INIT(void);
+void lkdtm_WRITE_RO_PMALLOC(void);
 void lkdtm_WRITE_KERN(void);
 void lkdtm_EXEC_DATA(void);
 void lkdtm_EXEC_STACK(void);
diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c
index 2154d1bfd18b..c9fd42bda6ee 100644
--- a/drivers/misc/lkdtm_core.c
+++ b/drivers/misc/lkdtm_core.c
@@ -155,6 +155,9 @@ static const struct crashtype crashtypes[] = {
CRASHTYPE(ACCESS_USERSPACE),
CRASHTYPE(WRITE_RO),
CRASHTYPE(WRITE_RO_AFTER_INIT),
+#ifdef CONFIG_PROTECTABLE_MEMORY
+   CRASHTYPE(WRITE_RO_PMALLOC),
+#endif
CRASHTYPE(WRITE_KERN),
CRASHTYPE(REFCOUNT_INC_OVERFLOW),
CRASHTYPE(REFCOUNT_ADD_OVERFLOW),
diff --git a/drivers/misc/lkdtm_perms.c b/drivers/misc/lkdtm_perms.c
index 53b85c9d16b8..0ac9023fd2b0 100644
--- a/drivers/misc/lkdtm_perms.c
+++ b/drivers/misc/lkdtm_perms.c
@@ -9,6 +9,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 
 /* Whether or not to fill the target memory area with do_nothing(). */
@@ -104,6 +105,33 @@ void lkdtm_WRITE_RO_AFTER_INIT(void)
*ptr ^= 0xabcd1234;
 }
 
+#ifdef CONFIG_PROTECTABLE_MEMORY
+void lkdtm_WRITE_RO_PMALLOC(void)
+{
+   struct gen_pool *pool;
+   int *i;
+
+   pool = pmalloc_create_pool("pool", 0);
+   if (unlikely(!pool)) {
+   pr_info("Failed preparing pool for pmalloc test.");
+   return;
+   }
+
+   i = (int *)pmalloc(pool, sizeof(int), GFP_KERNEL);
+   if (unlikely(!i)) {
+   pr_info("Failed allocating memory for pmalloc test.");
+   pmalloc_destroy_pool(pool);
+   return;
+   }
+
+   *i = INT_MAX;
+   pmalloc_protect_pool(pool);
+
+   pr_info("attempting bad pmalloc write at %p\n", i);
+   *i = 0;
+}
+#endif
+
 void lkdtm_WRITE_KERN(void)
 {
size_t size;
-- 
2.14.1

[PATCH 6/7] lkdtm: crash on overwriting protected pmalloc var

[Igor Stoppa]

Verify that pmalloc read-only protection is in place: trying to
overwrite a protected variable will crash the kernel.

Signed-off-by: Igor Stoppa 
---
 drivers/misc/lkdtm.h   |  1 +
 drivers/misc/lkdtm_core.c  |  3 +++
 drivers/misc/lkdtm_perms.c | 28 
 3 files changed, 32 insertions(+)

diff --git a/drivers/misc/lkdtm.h b/drivers/misc/lkdtm.h
index 9e513dcfd809..dcda3ae76ceb 100644
--- a/drivers/misc/lkdtm.h
+++ b/drivers/misc/lkdtm.h
@@ -38,6 +38,7 @@ void lkdtm_READ_BUDDY_AFTER_FREE(void);
 void __init lkdtm_perms_init(void);
 void lkdtm_WRITE_RO(void);
 void lkdtm_WRITE_RO_AFTER_INIT(void);
+void lkdtm_WRITE_RO_PMALLOC(void);
 void lkdtm_WRITE_KERN(void);
 void lkdtm_EXEC_DATA(void);
 void lkdtm_EXEC_STACK(void);
diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c
index 2154d1bfd18b..c9fd42bda6ee 100644
--- a/drivers/misc/lkdtm_core.c
+++ b/drivers/misc/lkdtm_core.c
@@ -155,6 +155,9 @@ static const struct crashtype crashtypes[] = {
CRASHTYPE(ACCESS_USERSPACE),
CRASHTYPE(WRITE_RO),
CRASHTYPE(WRITE_RO_AFTER_INIT),
+#ifdef CONFIG_PROTECTABLE_MEMORY
+   CRASHTYPE(WRITE_RO_PMALLOC),
+#endif
CRASHTYPE(WRITE_KERN),
CRASHTYPE(REFCOUNT_INC_OVERFLOW),
CRASHTYPE(REFCOUNT_ADD_OVERFLOW),
diff --git a/drivers/misc/lkdtm_perms.c b/drivers/misc/lkdtm_perms.c
index 53b85c9d16b8..0ac9023fd2b0 100644
--- a/drivers/misc/lkdtm_perms.c
+++ b/drivers/misc/lkdtm_perms.c
@@ -9,6 +9,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 
 /* Whether or not to fill the target memory area with do_nothing(). */
@@ -104,6 +105,33 @@ void lkdtm_WRITE_RO_AFTER_INIT(void)
*ptr ^= 0xabcd1234;
 }
 
+#ifdef CONFIG_PROTECTABLE_MEMORY
+void lkdtm_WRITE_RO_PMALLOC(void)
+{
+   struct gen_pool *pool;
+   int *i;
+
+   pool = pmalloc_create_pool("pool", 0);
+   if (unlikely(!pool)) {
+   pr_info("Failed preparing pool for pmalloc test.");
+   return;
+   }
+
+   i = (int *)pmalloc(pool, sizeof(int), GFP_KERNEL);
+   if (unlikely(!i)) {
+   pr_info("Failed allocating memory for pmalloc test.");
+   pmalloc_destroy_pool(pool);
+   return;
+   }
+
+   *i = INT_MAX;
+   pmalloc_protect_pool(pool);
+
+   pr_info("attempting bad pmalloc write at %p\n", i);
+   *i = 0;
+}
+#endif
+
 void lkdtm_WRITE_KERN(void)
 {
size_t size;
-- 
2.14.1

Re: [PATCH 6/7] lkdtm: crash on overwriting protected pmalloc var

[kbuild test robot]

Hi Igor,

Thank you for the patch! Yet something to improve:

[auto build test ERROR on linus/master]
[also build test ERROR on v4.16-rc2]
[cannot apply to next-20180223]
[if your patch is applied to the wrong git tree, please drop us a note to help 
improve the system]

url:
https://github.com/0day-ci/linux/commits/Igor-Stoppa/genalloc-track-beginning-of-allocations/20180225-081601
config: x86_64-rhel (attached as .config)
compiler: gcc-7 (Debian 7.3.0-1) 7.3.0
reproduce:
# save the attached .config to linux build tree
make ARCH=x86_64 

All errors (new ones prefixed by >>):

>> ERROR: "pmalloc" [drivers/misc/lkdtm.ko] undefined!
>> ERROR: "pmalloc_create_pool" [drivers/misc/lkdtm.ko] undefined!
>> ERROR: "pmalloc_destroy_pool" [drivers/misc/lkdtm.ko] undefined!
>> ERROR: "pmalloc_protect_pool" [drivers/misc/lkdtm.ko] undefined!

---
0-DAY kernel test infrastructureOpen Source Technology Center
https://lists.01.org/pipermail/kbuild-all   Intel Corporation


.config.gz
Description: application/gzip

Re: [PATCH 6/7] lkdtm: crash on overwriting protected pmalloc var

[kbuild test robot]

Hi Igor,

Thank you for the patch! Yet something to improve:

[auto build test ERROR on linus/master]
[also build test ERROR on v4.16-rc2]
[cannot apply to next-20180223]
[if your patch is applied to the wrong git tree, please drop us a note to help 
improve the system]

url:
https://github.com/0day-ci/linux/commits/Igor-Stoppa/genalloc-track-beginning-of-allocations/20180225-081601
config: x86_64-rhel (attached as .config)
compiler: gcc-7 (Debian 7.3.0-1) 7.3.0
reproduce:
# save the attached .config to linux build tree
make ARCH=x86_64 

All errors (new ones prefixed by >>):

>> ERROR: "pmalloc" [drivers/misc/lkdtm.ko] undefined!
>> ERROR: "pmalloc_create_pool" [drivers/misc/lkdtm.ko] undefined!
>> ERROR: "pmalloc_destroy_pool" [drivers/misc/lkdtm.ko] undefined!
>> ERROR: "pmalloc_protect_pool" [drivers/misc/lkdtm.ko] undefined!

---
0-DAY kernel test infrastructureOpen Source Technology Center
https://lists.01.org/pipermail/kbuild-all   Intel Corporation


.config.gz
Description: application/gzip

[PATCH 6/7] lkdtm: crash on overwriting protected pmalloc var

[Igor Stoppa]

Verify that pmalloc read-only protection is in place: trying to
overwrite a protected variable will crash the kernel.

Signed-off-by: Igor Stoppa 
---
 drivers/misc/lkdtm.h   |  1 +
 drivers/misc/lkdtm_core.c  |  3 +++
 drivers/misc/lkdtm_perms.c | 28 
 3 files changed, 32 insertions(+)

diff --git a/drivers/misc/lkdtm.h b/drivers/misc/lkdtm.h
index 9e513dcfd809..dcda3ae76ceb 100644
--- a/drivers/misc/lkdtm.h
+++ b/drivers/misc/lkdtm.h
@@ -38,6 +38,7 @@ void lkdtm_READ_BUDDY_AFTER_FREE(void);
 void __init lkdtm_perms_init(void);
 void lkdtm_WRITE_RO(void);
 void lkdtm_WRITE_RO_AFTER_INIT(void);
+void lkdtm_WRITE_RO_PMALLOC(void);
 void lkdtm_WRITE_KERN(void);
 void lkdtm_EXEC_DATA(void);
 void lkdtm_EXEC_STACK(void);
diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c
index 2154d1bfd18b..c9fd42bda6ee 100644
--- a/drivers/misc/lkdtm_core.c
+++ b/drivers/misc/lkdtm_core.c
@@ -155,6 +155,9 @@ static const struct crashtype crashtypes[] = {
CRASHTYPE(ACCESS_USERSPACE),
CRASHTYPE(WRITE_RO),
CRASHTYPE(WRITE_RO_AFTER_INIT),
+#ifdef CONFIG_PROTECTABLE_MEMORY
+   CRASHTYPE(WRITE_RO_PMALLOC),
+#endif
CRASHTYPE(WRITE_KERN),
CRASHTYPE(REFCOUNT_INC_OVERFLOW),
CRASHTYPE(REFCOUNT_ADD_OVERFLOW),
diff --git a/drivers/misc/lkdtm_perms.c b/drivers/misc/lkdtm_perms.c
index 53b85c9d16b8..0ac9023fd2b0 100644
--- a/drivers/misc/lkdtm_perms.c
+++ b/drivers/misc/lkdtm_perms.c
@@ -9,6 +9,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 
 /* Whether or not to fill the target memory area with do_nothing(). */
@@ -104,6 +105,33 @@ void lkdtm_WRITE_RO_AFTER_INIT(void)
*ptr ^= 0xabcd1234;
 }
 
+#ifdef CONFIG_PROTECTABLE_MEMORY
+void lkdtm_WRITE_RO_PMALLOC(void)
+{
+   struct gen_pool *pool;
+   int *i;
+
+   pool = pmalloc_create_pool("pool", 0);
+   if (unlikely(!pool)) {
+   pr_info("Failed preparing pool for pmalloc test.");
+   return;
+   }
+
+   i = (int *)pmalloc(pool, sizeof(int), GFP_KERNEL);
+   if (unlikely(!i)) {
+   pr_info("Failed allocating memory for pmalloc test.");
+   pmalloc_destroy_pool(pool);
+   return;
+   }
+
+   *i = INT_MAX;
+   pmalloc_protect_pool(pool);
+
+   pr_info("attempting bad pmalloc write at %p\n", i);
+   *i = 0;
+}
+#endif
+
 void lkdtm_WRITE_KERN(void)
 {
size_t size;
-- 
2.14.1

[PATCH 6/7] lkdtm: crash on overwriting protected pmalloc var

[Igor Stoppa]

Verify that pmalloc read-only protection is in place: trying to
overwrite a protected variable will crash the kernel.

Signed-off-by: Igor Stoppa 
---
 drivers/misc/lkdtm.h   |  1 +
 drivers/misc/lkdtm_core.c  |  3 +++
 drivers/misc/lkdtm_perms.c | 28 
 3 files changed, 32 insertions(+)

diff --git a/drivers/misc/lkdtm.h b/drivers/misc/lkdtm.h
index 9e513dcfd809..dcda3ae76ceb 100644
--- a/drivers/misc/lkdtm.h
+++ b/drivers/misc/lkdtm.h
@@ -38,6 +38,7 @@ void lkdtm_READ_BUDDY_AFTER_FREE(void);
 void __init lkdtm_perms_init(void);
 void lkdtm_WRITE_RO(void);
 void lkdtm_WRITE_RO_AFTER_INIT(void);
+void lkdtm_WRITE_RO_PMALLOC(void);
 void lkdtm_WRITE_KERN(void);
 void lkdtm_EXEC_DATA(void);
 void lkdtm_EXEC_STACK(void);
diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c
index 2154d1bfd18b..c9fd42bda6ee 100644
--- a/drivers/misc/lkdtm_core.c
+++ b/drivers/misc/lkdtm_core.c
@@ -155,6 +155,9 @@ static const struct crashtype crashtypes[] = {
CRASHTYPE(ACCESS_USERSPACE),
CRASHTYPE(WRITE_RO),
CRASHTYPE(WRITE_RO_AFTER_INIT),
+#ifdef CONFIG_PROTECTABLE_MEMORY
+   CRASHTYPE(WRITE_RO_PMALLOC),
+#endif
CRASHTYPE(WRITE_KERN),
CRASHTYPE(REFCOUNT_INC_OVERFLOW),
CRASHTYPE(REFCOUNT_ADD_OVERFLOW),
diff --git a/drivers/misc/lkdtm_perms.c b/drivers/misc/lkdtm_perms.c
index 53b85c9d16b8..0ac9023fd2b0 100644
--- a/drivers/misc/lkdtm_perms.c
+++ b/drivers/misc/lkdtm_perms.c
@@ -9,6 +9,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 
 /* Whether or not to fill the target memory area with do_nothing(). */
@@ -104,6 +105,33 @@ void lkdtm_WRITE_RO_AFTER_INIT(void)
*ptr ^= 0xabcd1234;
 }
 
+#ifdef CONFIG_PROTECTABLE_MEMORY
+void lkdtm_WRITE_RO_PMALLOC(void)
+{
+   struct gen_pool *pool;
+   int *i;
+
+   pool = pmalloc_create_pool("pool", 0);
+   if (unlikely(!pool)) {
+   pr_info("Failed preparing pool for pmalloc test.");
+   return;
+   }
+
+   i = (int *)pmalloc(pool, sizeof(int), GFP_KERNEL);
+   if (unlikely(!i)) {
+   pr_info("Failed allocating memory for pmalloc test.");
+   pmalloc_destroy_pool(pool);
+   return;
+   }
+
+   *i = INT_MAX;
+   pmalloc_protect_pool(pool);
+
+   pr_info("attempting bad pmalloc write at %p\n", i);
+   *i = 0;
+}
+#endif
+
 void lkdtm_WRITE_KERN(void)
 {
size_t size;
-- 
2.14.1