summaryrefslogtreecommitdiffstats
path: root/drivers/misc/lkdtm.c
diff options
context:
space:
mode:
authorKees Cook <keescook@chromium.org>2014-02-09 13:48:48 -0800
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2014-02-14 12:30:20 -0800
commitdc2b9e9069780774c01a06e0ea8dce0c705f1812 (patch)
tree1be055211e27aeddf72cc09c33b5c55daae4db8a /drivers/misc/lkdtm.c
parentaac416fc38cdfd45139a6917eb3f6b77cd00a24f (diff)
downloadlinux-dc2b9e9069780774c01a06e0ea8dce0c705f1812.tar.gz
linux-dc2b9e9069780774c01a06e0ea8dce0c705f1812.tar.bz2
linux-dc2b9e9069780774c01a06e0ea8dce0c705f1812.zip
lkdtm: add "WRITE_KERN" test
Add "WRITE_KERN" crash target to validate that kernel executable memory is not writable. Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/misc/lkdtm.c')
-rw-r--r--drivers/misc/lkdtm.c25
1 files changed, 25 insertions, 0 deletions
diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
index d6ee1aae3e72..d30301149242 100644
--- a/drivers/misc/lkdtm.c
+++ b/drivers/misc/lkdtm.c
@@ -102,6 +102,7 @@ enum ctype {
CT_EXEC_USERSPACE,
CT_ACCESS_USERSPACE,
CT_WRITE_RO,
+ CT_WRITE_KERN,
};
static char* cp_name[] = {
@@ -138,6 +139,7 @@ static char* cp_type[] = {
"EXEC_USERSPACE",
"ACCESS_USERSPACE",
"WRITE_RO",
+ "WRITE_KERN",
};
static struct jprobe lkdtm;
@@ -317,6 +319,13 @@ static void do_nothing(void)
return;
}
+/* Must immediately follow do_nothing for size calculuations to work out. */
+static void do_overwritten(void)
+{
+ pr_info("do_overwritten wasn't overwritten!\n");
+ return;
+}
+
static noinline void corrupt_stack(void)
{
/* Use default char array length that triggers stack protection. */
@@ -496,6 +505,22 @@ static void lkdtm_do_action(enum ctype which)
break;
}
+ case CT_WRITE_KERN: {
+ size_t size;
+ unsigned char *ptr;
+
+ size = (unsigned long)do_overwritten -
+ (unsigned long)do_nothing;
+ ptr = (unsigned char *)do_overwritten;
+
+ pr_info("attempting bad %zu byte write at %p\n", size, ptr);
+ memcpy(ptr, (unsigned char *)do_nothing, size);
+ flush_icache_range((unsigned long)ptr,
+ (unsigned long)(ptr + size));
+
+ do_overwritten();
+ break;
+ }
case CT_NONE:
default:
break;