lkdtm: Add Control Flow Integrity test

This adds a simple test for forward CFI (indirect function calls) with
function prototype granularity (as implemented by Clang's CFI).

Signed-off-by: Kees Cook <keescook@chromium.org>

diff --git a/drivers/misc/lkdtm/Makefile b/drivers/misc/lkdtm/Makefile
index fb10eafe9bde74324bcb4b008c906dd9175151e8..c70b3822013f48a35c6341d7879fdf04102cdc45 100644 (file)
--- a/drivers/misc/lkdtm/Makefile
+++ b/drivers/misc/lkdtm/Makefile
@@ -9,6 +9,7 @@ lkdtm-$(CONFIG_LKDTM)           += refcount.o
 lkdtm-$(CONFIG_LKDTM)          += rodata_objcopy.o
 lkdtm-$(CONFIG_LKDTM)          += usercopy.o
 lkdtm-$(CONFIG_LKDTM)          += stackleak.o
+lkdtm-$(CONFIG_LKDTM)          += cfi.o
 
 KASAN_SANITIZE_stackleak.o     := n
 KCOV_INSTRUMENT_rodata.o       := n

diff --git a/drivers/misc/lkdtm/cfi.c b/drivers/misc/lkdtm/cfi.c
new file mode 100644 (file)
index 0000000..e73ebdb
--- /dev/null
+++ b/drivers/misc/lkdtm/cfi.c
@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * This is for all the tests relating directly to Control Flow Integrity.
+ */
+#include "lkdtm.h"
+
+static int called_count;
+
+/* Function taking one argument, without a return value. */
+static noinline void lkdtm_increment_void(int *counter)
+{
+       (*counter)++;
+}
+
+/* Function taking one argument, returning int. */
+static noinline int lkdtm_increment_int(int *counter)
+{
+       (*counter)++;
+
+       return *counter;
+}
+/*
+ * This tries to call an indirect function with a mismatched prototype.
+ */
+void lkdtm_CFI_FORWARD_PROTO(void)
+{
+       /*
+        * Matches lkdtm_increment_void()'s prototype, but not
+        * lkdtm_increment_int()'s prototype.
+        */
+       void (*func)(int *);
+
+       pr_info("Calling matched prototype ...\n");
+       func = lkdtm_increment_void;
+       func(&called_count);
+
+       pr_info("Calling mismatched prototype ...\n");
+       func = (void *)lkdtm_increment_int;
+       func(&called_count);
+
+       pr_info("Fail: survived mismatched prototype function call!\n");
+}

diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c
index 66ae6b2a6950caa0a86d55f398cd43170651991e..42136196681eb38ffb003432e0d15a882f771f64 100644 (file)
--- a/drivers/misc/lkdtm/core.c
+++ b/drivers/misc/lkdtm/core.c
@@ -169,6 +169,7 @@ static const struct crashtype crashtypes[] = {
        CRASHTYPE(USERCOPY_KERNEL),
        CRASHTYPE(USERCOPY_KERNEL_DS),
        CRASHTYPE(STACKLEAK_ERASING),
+       CRASHTYPE(CFI_FORWARD_PROTO),
 };
 
 

diff --git a/drivers/misc/lkdtm/lkdtm.h b/drivers/misc/lkdtm/lkdtm.h
index 6a284a87a037c80f60f354314fa4cba3049ef995..8a25afbdf95491609def49f2b6e31e8c045ebb1d 100644 (file)
--- a/drivers/misc/lkdtm/lkdtm.h
+++ b/drivers/misc/lkdtm/lkdtm.h
@@ -95,4 +95,7 @@ void lkdtm_USERCOPY_KERNEL_DS(void);
 /* lkdtm_stackleak.c */
 void lkdtm_STACKLEAK_ERASING(void);
 
+/* cfi.c */
+void lkdtm_CFI_FORWARD_PROTO(void);
+
 #endif