lkdtm: add test for atomic_t underflow/overflow
dmesg output of running this LKDTM test with PaX: [187095.475573] lkdtm: No crash points registered, enable through debugfs [187118.020257] lkdtm: Performing direct entry WRAP_ATOMIC [187118.030045] lkdtm: attempting atomic underflow [187118.030929] PAX: refcount overflow detected in: bash:1790, uid/euid: 0/0 [187118.071667] PAX: refcount overflow occured at: lkdtm_do_action+0x19e/0x400 [lkdtm] [187118.081423] CPU: 3 PID: 1790 Comm: bash Not tainted 4.2.6-pax-refcount-split+ #2 [187118.083403] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [187118.102596] task: ffff8800da8de040 ti: ffff8800da8e4000 task.ti: ffff8800da8e4000 [187118.111321] RIP: 0010:[<ffffffffc00fc2fe>] [<ffffffffc00fc2fe>] lkdtm_do_action+0x19e/0x400 [lkdtm] ... [187118.128074] lkdtm: attempting atomic overflow [187118.128080] PAX: refcount overflow detected in: bash:1790, uid/euid: 0/0 [187118.128082] PAX: refcount overflow occured at: lkdtm_do_action+0x1b6/0x400 [lkdtm] [187118.128085] CPU: 3 PID: 1790 Comm: bash Not tainted 4.2.6-pax-refcount-split+ #2 [187118.128086] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [187118.128088] task: ffff8800da8de040 ti: ffff8800da8e4000 task.ti: ffff8800da8e4000 [187118.128092] RIP: 0010:[<ffffffffc00fc316>] [<ffffffffc00fc316>] lkdtm_do_action+0x1b6/0x400 [lkdtm] Signed-off-by: David Windsor <dave@progbits.org> [cleaned up whitespacing, keescook] Signed-off-by: Kees Cook <keescook@chromium.org>
This commit is contained in:
parent
920d451f9c
commit
5fd9e48084
|
@ -107,6 +107,7 @@ enum ctype {
|
||||||
CT_ACCESS_USERSPACE,
|
CT_ACCESS_USERSPACE,
|
||||||
CT_WRITE_RO,
|
CT_WRITE_RO,
|
||||||
CT_WRITE_KERN,
|
CT_WRITE_KERN,
|
||||||
|
CT_WRAP_ATOMIC
|
||||||
};
|
};
|
||||||
|
|
||||||
static char* cp_name[] = {
|
static char* cp_name[] = {
|
||||||
|
@ -147,6 +148,7 @@ static char* cp_type[] = {
|
||||||
"ACCESS_USERSPACE",
|
"ACCESS_USERSPACE",
|
||||||
"WRITE_RO",
|
"WRITE_RO",
|
||||||
"WRITE_KERN",
|
"WRITE_KERN",
|
||||||
|
"WRAP_ATOMIC"
|
||||||
};
|
};
|
||||||
|
|
||||||
static struct jprobe lkdtm;
|
static struct jprobe lkdtm;
|
||||||
|
@ -620,6 +622,17 @@ static void lkdtm_do_action(enum ctype which)
|
||||||
do_overwritten();
|
do_overwritten();
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
case CT_WRAP_ATOMIC: {
|
||||||
|
atomic_t under = ATOMIC_INIT(INT_MIN);
|
||||||
|
atomic_t over = ATOMIC_INIT(INT_MAX);
|
||||||
|
|
||||||
|
pr_info("attempting atomic underflow\n");
|
||||||
|
atomic_dec(&under);
|
||||||
|
pr_info("attempting atomic overflow\n");
|
||||||
|
atomic_inc(&over);
|
||||||
|
|
||||||
|
return;
|
||||||
|
}
|
||||||
case CT_NONE:
|
case CT_NONE:
|
||||||
default:
|
default:
|
||||||
break;
|
break;
|
||||||
|
|
Loading…
Reference in New Issue