mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 13:55:32 +00:00
6cb6982f42
This test is specific for arm64. When in-kernel Pointer Authentication config is enabled, the return address stored in the stack is signed. This feature helps in ROP kind of attack. If any parameters used to generate the pac (<key, sp, lr>) is modified then this will fail in the authentication stage and will lead to abort. This test changes the input parameter APIA kernel keys to cause abort. The pac computed from the new key can be same as last due to hash collision so this is retried for few times as there is no reliable way to compare the pacs. Even though this test may fail even after retries but this may cause authentication failure at a later stage in earlier function returns. This test can be invoked as, echo CORRUPT_PAC > /sys/kernel/debug/provoke-crash/DIRECT or as below if inserted as a module, insmod lkdtm.ko cpoint_name=DIRECT cpoint_type=CORRUPT_PAC cpoint_count=1 [ 13.118166] lkdtm: Performing direct entry CORRUPT_PAC [ 13.118298] lkdtm: Clearing PAC from the return address [ 13.118466] Unable to handle kernel paging request at virtual address bfff8000108648ec [ 13.118626] Mem abort info: [ 13.118666] ESR = 0x86000004 [ 13.118866] EC = 0x21: IABT (current EL), IL = 32 bits [ 13.118966] SET = 0, FnV = 0 [ 13.119117] EA = 0, S1PTW = 0 Signed-off-by: Amit Daniel Kachhap <amit.kachhap@arm.com> Acked-by: Catalin Marinas <catalin.marinas@arm.com> Cc: Kees Cook <keescook@chromium.org> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
106 lines
3.2 KiB
C
106 lines
3.2 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef __LKDTM_H
|
|
#define __LKDTM_H
|
|
|
|
#define pr_fmt(fmt) "lkdtm: " fmt
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
/* lkdtm_bugs.c */
|
|
void __init lkdtm_bugs_init(int *recur_param);
|
|
void lkdtm_PANIC(void);
|
|
void lkdtm_BUG(void);
|
|
void lkdtm_WARNING(void);
|
|
void lkdtm_WARNING_MESSAGE(void);
|
|
void lkdtm_EXCEPTION(void);
|
|
void lkdtm_LOOP(void);
|
|
void lkdtm_EXHAUST_STACK(void);
|
|
void lkdtm_CORRUPT_STACK(void);
|
|
void lkdtm_CORRUPT_STACK_STRONG(void);
|
|
void lkdtm_UNALIGNED_LOAD_STORE_WRITE(void);
|
|
void lkdtm_SOFTLOCKUP(void);
|
|
void lkdtm_HARDLOCKUP(void);
|
|
void lkdtm_SPINLOCKUP(void);
|
|
void lkdtm_HUNG_TASK(void);
|
|
void lkdtm_CORRUPT_LIST_ADD(void);
|
|
void lkdtm_CORRUPT_LIST_DEL(void);
|
|
void lkdtm_CORRUPT_USER_DS(void);
|
|
void lkdtm_STACK_GUARD_PAGE_LEADING(void);
|
|
void lkdtm_STACK_GUARD_PAGE_TRAILING(void);
|
|
void lkdtm_UNSET_SMEP(void);
|
|
#ifdef CONFIG_X86_32
|
|
void lkdtm_DOUBLE_FAULT(void);
|
|
#endif
|
|
void lkdtm_CORRUPT_PAC(void);
|
|
|
|
/* lkdtm_heap.c */
|
|
void __init lkdtm_heap_init(void);
|
|
void __exit lkdtm_heap_exit(void);
|
|
void lkdtm_OVERWRITE_ALLOCATION(void);
|
|
void lkdtm_WRITE_AFTER_FREE(void);
|
|
void lkdtm_READ_AFTER_FREE(void);
|
|
void lkdtm_WRITE_BUDDY_AFTER_FREE(void);
|
|
void lkdtm_READ_BUDDY_AFTER_FREE(void);
|
|
void lkdtm_SLAB_FREE_DOUBLE(void);
|
|
void lkdtm_SLAB_FREE_CROSS(void);
|
|
void lkdtm_SLAB_FREE_PAGE(void);
|
|
|
|
/* lkdtm_perms.c */
|
|
void __init lkdtm_perms_init(void);
|
|
void lkdtm_WRITE_RO(void);
|
|
void lkdtm_WRITE_RO_AFTER_INIT(void);
|
|
void lkdtm_WRITE_KERN(void);
|
|
void lkdtm_EXEC_DATA(void);
|
|
void lkdtm_EXEC_STACK(void);
|
|
void lkdtm_EXEC_KMALLOC(void);
|
|
void lkdtm_EXEC_VMALLOC(void);
|
|
void lkdtm_EXEC_RODATA(void);
|
|
void lkdtm_EXEC_USERSPACE(void);
|
|
void lkdtm_EXEC_NULL(void);
|
|
void lkdtm_ACCESS_USERSPACE(void);
|
|
void lkdtm_ACCESS_NULL(void);
|
|
|
|
/* lkdtm_refcount.c */
|
|
void lkdtm_REFCOUNT_INC_OVERFLOW(void);
|
|
void lkdtm_REFCOUNT_ADD_OVERFLOW(void);
|
|
void lkdtm_REFCOUNT_INC_NOT_ZERO_OVERFLOW(void);
|
|
void lkdtm_REFCOUNT_ADD_NOT_ZERO_OVERFLOW(void);
|
|
void lkdtm_REFCOUNT_DEC_ZERO(void);
|
|
void lkdtm_REFCOUNT_DEC_NEGATIVE(void);
|
|
void lkdtm_REFCOUNT_DEC_AND_TEST_NEGATIVE(void);
|
|
void lkdtm_REFCOUNT_SUB_AND_TEST_NEGATIVE(void);
|
|
void lkdtm_REFCOUNT_INC_ZERO(void);
|
|
void lkdtm_REFCOUNT_ADD_ZERO(void);
|
|
void lkdtm_REFCOUNT_INC_SATURATED(void);
|
|
void lkdtm_REFCOUNT_DEC_SATURATED(void);
|
|
void lkdtm_REFCOUNT_ADD_SATURATED(void);
|
|
void lkdtm_REFCOUNT_INC_NOT_ZERO_SATURATED(void);
|
|
void lkdtm_REFCOUNT_ADD_NOT_ZERO_SATURATED(void);
|
|
void lkdtm_REFCOUNT_DEC_AND_TEST_SATURATED(void);
|
|
void lkdtm_REFCOUNT_SUB_AND_TEST_SATURATED(void);
|
|
void lkdtm_REFCOUNT_TIMING(void);
|
|
void lkdtm_ATOMIC_TIMING(void);
|
|
|
|
/* lkdtm_rodata.c */
|
|
void lkdtm_rodata_do_nothing(void);
|
|
|
|
/* lkdtm_usercopy.c */
|
|
void __init lkdtm_usercopy_init(void);
|
|
void __exit lkdtm_usercopy_exit(void);
|
|
void lkdtm_USERCOPY_HEAP_SIZE_TO(void);
|
|
void lkdtm_USERCOPY_HEAP_SIZE_FROM(void);
|
|
void lkdtm_USERCOPY_HEAP_WHITELIST_TO(void);
|
|
void lkdtm_USERCOPY_HEAP_WHITELIST_FROM(void);
|
|
void lkdtm_USERCOPY_STACK_FRAME_TO(void);
|
|
void lkdtm_USERCOPY_STACK_FRAME_FROM(void);
|
|
void lkdtm_USERCOPY_STACK_BEYOND(void);
|
|
void lkdtm_USERCOPY_KERNEL(void);
|
|
void lkdtm_USERCOPY_KERNEL_DS(void);
|
|
|
|
/* lkdtm_stackleak.c */
|
|
void lkdtm_STACKLEAK_ERASING(void);
|
|
|
|
/* cfi.c */
|
|
void lkdtm_CFI_FORWARD_PROTO(void);
|
|
|
|
#endif
|