lkdtm: Add kfence read after free crash type

Add the ability to allocate memory from kfence and trigger a read after
free on that memory to validate that kfence is working properly. This is
used by ChromeOS integration tests to validate that kfence errors can be
collected on user devices and parsed properly.

Cc: Alexander Potapenko <glider@google.com>
Acked-by: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: kasan-dev@googlegroups.com
Signed-off-by: Stephen Boyd <swboyd@chromium.org>
Link: https://lore.kernel.org/r/20231129214413.3156334-1-swboyd@chromium.org
Signed-off-by: Kees Cook <keescook@chromium.org>

diff --git a/drivers/misc/lkdtm/heap.c b/drivers/misc/lkdtm/heap.c
index 0ce4cbf6abdac4fb4b63fcf773555628462a4d00..4f467d3972a6b1f5d3732b63ea863028b90aef6f 100644 (file)
--- a/drivers/misc/lkdtm/heap.c
+++ b/drivers/misc/lkdtm/heap.c
@@ -4,6 +4,7 @@
  * page allocation and slab allocations.
  */
 #include "lkdtm.h"
+#include <linux/kfence.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/sched.h>
@@ -132,6 +133,64 @@ static void lkdtm_READ_AFTER_FREE(void)
        kfree(val);
 }
 
+static void lkdtm_KFENCE_READ_AFTER_FREE(void)
+{
+       int *base, val, saw;
+       unsigned long timeout, resched_after;
+       size_t len = 1024;
+       /*
+        * The slub allocator will use the either the first word or
+        * the middle of the allocation to store the free pointer,
+        * depending on configurations. Store in the second word to
+        * avoid running into the freelist.
+        */
+       size_t offset = sizeof(*base);
+
+       /*
+        * 100x the sample interval should be more than enough to ensure we get
+        * a KFENCE allocation eventually.
+        */
+       timeout = jiffies + msecs_to_jiffies(100 * kfence_sample_interval);
+       /*
+        * Especially for non-preemption kernels, ensure the allocation-gate
+        * timer can catch up: after @resched_after, every failed allocation
+        * attempt yields, to ensure the allocation-gate timer is scheduled.
+        */
+       resched_after = jiffies + msecs_to_jiffies(kfence_sample_interval);
+       do {
+               base = kmalloc(len, GFP_KERNEL);
+               if (!base) {
+                       pr_err("FAIL: Unable to allocate kfence memory!\n");
+                       return;
+               }
+
+               if (is_kfence_address(base)) {
+                       val = 0x12345678;
+                       base[offset] = val;
+                       pr_info("Value in memory before free: %x\n", base[offset]);
+
+                       kfree(base);
+
+                       pr_info("Attempting bad read from freed memory\n");
+                       saw = base[offset];
+                       if (saw != val) {
+                               /* Good! Poisoning happened, so declare a win. */
+                               pr_info("Memory correctly poisoned (%x)\n", saw);
+                       } else {
+                               pr_err("FAIL: Memory was not poisoned!\n");
+                               pr_expected_config_param(CONFIG_INIT_ON_FREE_DEFAULT_ON, "init_on_free");
+                       }
+                       return;
+               }
+
+               kfree(base);
+               if (time_after(jiffies, resched_after))
+                       cond_resched();
+       } while (time_before(jiffies, timeout));
+
+       pr_err("FAIL: kfence memory never allocated!\n");
+}
+
 static void lkdtm_WRITE_BUDDY_AFTER_FREE(void)
 {
        unsigned long p = __get_free_page(GFP_KERNEL);
@@ -327,6 +386,7 @@ static struct crashtype crashtypes[] = {
        CRASHTYPE(VMALLOC_LINEAR_OVERFLOW),
        CRASHTYPE(WRITE_AFTER_FREE),
        CRASHTYPE(READ_AFTER_FREE),
+       CRASHTYPE(KFENCE_READ_AFTER_FREE),
        CRASHTYPE(WRITE_BUDDY_AFTER_FREE),
        CRASHTYPE(READ_BUDDY_AFTER_FREE),
        CRASHTYPE(SLAB_INIT_ON_ALLOC),

diff --git a/include/linux/kfence.h b/include/linux/kfence.h
index 401af475751413187fe047f5a5cb69aae11b0be0..88100cc9cabab45f32c8ee48f6d01dce4337a38e 100644 (file)
--- a/include/linux/kfence.h
+++ b/include/linux/kfence.h
@@ -223,6 +223,8 @@ bool __kfence_obj_info(struct kmem_obj_info *kpp, void *object, struct slab *sla
 
 #else /* CONFIG_KFENCE */
 
+#define kfence_sample_interval (0)
+
 static inline bool is_kfence_address(const void *addr) { return false; }
 static inline void kfence_alloc_pool_and_metadata(void) { }
 static inline void kfence_init(void) { }