drivers/misc/lkdtm/refcount.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * This is for all the tests related to refcount bugs (e.g. overflow,
   4  * underflow, reaching zero untested, etc).
   5  */
   6 #include "lkdtm.h"
   7 #include <linux/refcount.h>
   8
   9 static void overflow_check(refcount_t *ref)
  10 {
  11         switch (refcount_read(ref)) {
  12         case REFCOUNT_SATURATED:
  13                 pr_info("Overflow detected: saturated\n");
  14                 break;
  15         case REFCOUNT_MAX:
  16                 pr_warn("Overflow detected: unsafely reset to max\n");
  17                 break;
  18         default:
  19                 pr_err("Fail: refcount wrapped to %d\n", refcount_read(ref));
  20         }
  21 }
  22
  23 /*
  24  * A refcount_inc() above the maximum value of the refcount implementation,
  25  * should at least saturate, and at most also WARN.
  26  */
  27 static void lkdtm_REFCOUNT_INC_OVERFLOW(void)
  28 {
  29         refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX - 1);
  30
  31         pr_info("attempting good refcount_inc() without overflow\n");
  32         refcount_dec(&over);
  33         refcount_inc(&over);
  34
  35         pr_info("attempting bad refcount_inc() overflow\n");
  36         refcount_inc(&over);
  37         refcount_inc(&over);
  38
  39         overflow_check(&over);
  40 }
  41
  42 /* refcount_add() should behave just like refcount_inc() above. */
  43 static void lkdtm_REFCOUNT_ADD_OVERFLOW(void)
  44 {
  45         refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX - 1);
  46
  47         pr_info("attempting good refcount_add() without overflow\n");
  48         refcount_dec(&over);
  49         refcount_dec(&over);
  50         refcount_dec(&over);
  51         refcount_dec(&over);
  52         refcount_add(4, &over);
  53
  54         pr_info("attempting bad refcount_add() overflow\n");
  55         refcount_add(4, &over);
  56
  57         overflow_check(&over);
  58 }
  59
  60 /* refcount_inc_not_zero() should behave just like refcount_inc() above. */
  61 static void lkdtm_REFCOUNT_INC_NOT_ZERO_OVERFLOW(void)
  62 {
  63         refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX);
  64
  65         pr_info("attempting bad refcount_inc_not_zero() overflow\n");
  66         if (!refcount_inc_not_zero(&over))
  67                 pr_warn("Weird: refcount_inc_not_zero() reported zero\n");
  68
  69         overflow_check(&over);
  70 }
  71
  72 /* refcount_add_not_zero() should behave just like refcount_inc() above. */
  73 static void lkdtm_REFCOUNT_ADD_NOT_ZERO_OVERFLOW(void)
  74 {
  75         refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX);
  76
  77         pr_info("attempting bad refcount_add_not_zero() overflow\n");
  78         if (!refcount_add_not_zero(6, &over))
  79                 pr_warn("Weird: refcount_add_not_zero() reported zero\n");
  80
  81         overflow_check(&over);
  82 }
  83
  84 static void check_zero(refcount_t *ref)
  85 {
  86         switch (refcount_read(ref)) {
  87         case REFCOUNT_SATURATED:
  88                 pr_info("Zero detected: saturated\n");
  89                 break;
  90         case REFCOUNT_MAX:
  91                 pr_warn("Zero detected: unsafely reset to max\n");
  92                 break;
  93         case 0:
  94                 pr_warn("Still at zero: refcount_inc/add() must not inc-from-0\n");
  95                 break;
  96         default:
  97                 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
  98         }
  99 }
 100
 101 /*
 102  * A refcount_dec(), as opposed to a refcount_dec_and_test(), when it hits
 103  * zero it should either saturate (when inc-from-zero isn't protected)
 104  * or stay at zero (when inc-from-zero is protected) and should WARN for both.
 105  */
 106 static void lkdtm_REFCOUNT_DEC_ZERO(void)
 107 {
 108         refcount_t zero = REFCOUNT_INIT(2);
 109
 110         pr_info("attempting good refcount_dec()\n");
 111         refcount_dec(&zero);
 112
 113         pr_info("attempting bad refcount_dec() to zero\n");
 114         refcount_dec(&zero);
 115
 116         check_zero(&zero);
 117 }
 118
 119 static void check_negative(refcount_t *ref, int start)
 120 {
 121         /*
 122          * refcount_t refuses to move a refcount at all on an
 123          * over-sub, so we have to track our starting position instead of
 124          * looking only at zero-pinning.
 125          */
 126         if (refcount_read(ref) == start) {
 127                 pr_warn("Still at %d: refcount_inc/add() must not inc-from-0\n",
 128                         start);
 129                 return;
 130         }
 131
 132         switch (refcount_read(ref)) {
 133         case REFCOUNT_SATURATED:
 134                 pr_info("Negative detected: saturated\n");
 135                 break;
 136         case REFCOUNT_MAX:
 137                 pr_warn("Negative detected: unsafely reset to max\n");
 138                 break;
 139         default:
 140                 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
 141         }
 142 }
 143
 144 /* A refcount_dec() going negative should saturate and may WARN. */
 145 static void lkdtm_REFCOUNT_DEC_NEGATIVE(void)
 146 {
 147         refcount_t neg = REFCOUNT_INIT(0);
 148
 149         pr_info("attempting bad refcount_dec() below zero\n");
 150         refcount_dec(&neg);
 151
 152         check_negative(&neg, 0);
 153 }
 154
 155 /*
 156  * A refcount_dec_and_test() should act like refcount_dec() above when
 157  * going negative.
 158  */
 159 static void lkdtm_REFCOUNT_DEC_AND_TEST_NEGATIVE(void)
 160 {
 161         refcount_t neg = REFCOUNT_INIT(0);
 162
 163         pr_info("attempting bad refcount_dec_and_test() below zero\n");
 164         if (refcount_dec_and_test(&neg))
 165                 pr_warn("Weird: refcount_dec_and_test() reported zero\n");
 166
 167         check_negative(&neg, 0);
 168 }
 169
 170 /*
 171  * A refcount_sub_and_test() should act like refcount_dec_and_test()
 172  * above when going negative.
 173  */
 174 static void lkdtm_REFCOUNT_SUB_AND_TEST_NEGATIVE(void)
 175 {
 176         refcount_t neg = REFCOUNT_INIT(3);
 177
 178         pr_info("attempting bad refcount_sub_and_test() below zero\n");
 179         if (refcount_sub_and_test(5, &neg))
 180                 pr_warn("Weird: refcount_sub_and_test() reported zero\n");
 181
 182         check_negative(&neg, 3);
 183 }
 184
 185 /*
 186  * A refcount_sub_and_test() by zero when the counter is at zero should act like
 187  * refcount_sub_and_test() above when going negative.
 188  */
 189 static void lkdtm_REFCOUNT_SUB_AND_TEST_ZERO(void)
 190 {
 191         refcount_t neg = REFCOUNT_INIT(0);
 192
 193         pr_info("attempting bad refcount_sub_and_test() at zero\n");
 194         if (refcount_sub_and_test(0, &neg))
 195                 pr_warn("Weird: refcount_sub_and_test() reported zero\n");
 196
 197         check_negative(&neg, 0);
 198 }
 199
 200 static void check_from_zero(refcount_t *ref)
 201 {
 202         switch (refcount_read(ref)) {
 203         case 0:
 204                 pr_info("Zero detected: stayed at zero\n");
 205                 break;
 206         case REFCOUNT_SATURATED:
 207                 pr_info("Zero detected: saturated\n");
 208                 break;
 209         case REFCOUNT_MAX:
 210                 pr_warn("Zero detected: unsafely reset to max\n");
 211                 break;
 212         default:
 213                 pr_info("Fail: zero not detected, incremented to %d\n",
 214                         refcount_read(ref));
 215         }
 216 }
 217
 218 /*
 219  * A refcount_inc() from zero should pin to zero or saturate and may WARN.
 220  */
 221 static void lkdtm_REFCOUNT_INC_ZERO(void)
 222 {
 223         refcount_t zero = REFCOUNT_INIT(0);
 224
 225         pr_info("attempting safe refcount_inc_not_zero() from zero\n");
 226         if (!refcount_inc_not_zero(&zero)) {
 227                 pr_info("Good: zero detected\n");
 228                 if (refcount_read(&zero) == 0)
 229                         pr_info("Correctly stayed at zero\n");
 230                 else
 231                         pr_err("Fail: refcount went past zero!\n");
 232         } else {
 233                 pr_err("Fail: Zero not detected!?\n");
 234         }
 235
 236         pr_info("attempting bad refcount_inc() from zero\n");
 237         refcount_inc(&zero);
 238
 239         check_from_zero(&zero);
 240 }
 241
 242 /*
 243  * A refcount_add() should act like refcount_inc() above when starting
 244  * at zero.
 245  */
 246 static void lkdtm_REFCOUNT_ADD_ZERO(void)
 247 {
 248         refcount_t zero = REFCOUNT_INIT(0);
 249
 250         pr_info("attempting safe refcount_add_not_zero() from zero\n");
 251         if (!refcount_add_not_zero(3, &zero)) {
 252                 pr_info("Good: zero detected\n");
 253                 if (refcount_read(&zero) == 0)
 254                         pr_info("Correctly stayed at zero\n");
 255                 else
 256                         pr_err("Fail: refcount went past zero\n");
 257         } else {
 258                 pr_err("Fail: Zero not detected!?\n");
 259         }
 260
 261         pr_info("attempting bad refcount_add() from zero\n");
 262         refcount_add(3, &zero);
 263
 264         check_from_zero(&zero);
 265 }
 266
 267 static void check_saturated(refcount_t *ref)
 268 {
 269         switch (refcount_read(ref)) {
 270         case REFCOUNT_SATURATED:
 271                 pr_info("Saturation detected: still saturated\n");
 272                 break;
 273         case REFCOUNT_MAX:
 274                 pr_warn("Saturation detected: unsafely reset to max\n");
 275                 break;
 276         default:
 277                 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
 278         }
 279 }
 280
 281 /*
 282  * A refcount_inc() from a saturated value should at most warn about
 283  * being saturated already.
 284  */
 285 static void lkdtm_REFCOUNT_INC_SATURATED(void)
 286 {
 287         refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
 288
 289         pr_info("attempting bad refcount_inc() from saturated\n");
 290         refcount_inc(&sat);
 291
 292         check_saturated(&sat);
 293 }
 294
 295 /* Should act like refcount_inc() above from saturated. */
 296 static void lkdtm_REFCOUNT_DEC_SATURATED(void)
 297 {
 298         refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
 299
 300         pr_info("attempting bad refcount_dec() from saturated\n");
 301         refcount_dec(&sat);
 302
 303         check_saturated(&sat);
 304 }
 305
 306 /* Should act like refcount_inc() above from saturated. */
 307 static void lkdtm_REFCOUNT_ADD_SATURATED(void)
 308 {
 309         refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
 310
 311         pr_info("attempting bad refcount_dec() from saturated\n");
 312         refcount_add(8, &sat);
 313
 314         check_saturated(&sat);
 315 }
 316
 317 /* Should act like refcount_inc() above from saturated. */
 318 static void lkdtm_REFCOUNT_INC_NOT_ZERO_SATURATED(void)
 319 {
 320         refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
 321
 322         pr_info("attempting bad refcount_inc_not_zero() from saturated\n");
 323         if (!refcount_inc_not_zero(&sat))
 324                 pr_warn("Weird: refcount_inc_not_zero() reported zero\n");
 325
 326         check_saturated(&sat);
 327 }
 328
 329 /* Should act like refcount_inc() above from saturated. */
 330 static void lkdtm_REFCOUNT_ADD_NOT_ZERO_SATURATED(void)
 331 {
 332         refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
 333
 334         pr_info("attempting bad refcount_add_not_zero() from saturated\n");
 335         if (!refcount_add_not_zero(7, &sat))
 336                 pr_warn("Weird: refcount_add_not_zero() reported zero\n");
 337
 338         check_saturated(&sat);
 339 }
 340
 341 /* Should act like refcount_inc() above from saturated. */
 342 static void lkdtm_REFCOUNT_DEC_AND_TEST_SATURATED(void)
 343 {
 344         refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
 345
 346         pr_info("attempting bad refcount_dec_and_test() from saturated\n");
 347         if (refcount_dec_and_test(&sat))
 348                 pr_warn("Weird: refcount_dec_and_test() reported zero\n");
 349
 350         check_saturated(&sat);
 351 }
 352
 353 /* Should act like refcount_inc() above from saturated. */
 354 static void lkdtm_REFCOUNT_SUB_AND_TEST_SATURATED(void)
 355 {
 356         refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
 357
 358         pr_info("attempting bad refcount_sub_and_test() from saturated\n");
 359         if (refcount_sub_and_test(8, &sat))
 360                 pr_warn("Weird: refcount_sub_and_test() reported zero\n");
 361
 362         check_saturated(&sat);
 363 }
 364
 365 /* Used to time the existing atomic_t when used for reference counting */
 366 static void lkdtm_ATOMIC_TIMING(void)
 367 {
 368         unsigned int i;
 369         atomic_t count = ATOMIC_INIT(1);
 370
 371         for (i = 0; i < INT_MAX - 1; i++)
 372                 atomic_inc(&count);
 373
 374         for (i = INT_MAX; i > 0; i--)
 375                 if (atomic_dec_and_test(&count))
 376                         break;
 377
 378         if (i != 1)
 379                 pr_err("atomic timing: out of sync up/down cycle: %u\n", i - 1);
 380         else
 381                 pr_info("atomic timing: done\n");
 382 }
 383
 384 /*
 385  * This can be compared to ATOMIC_TIMING when implementing fast refcount
 386  * protections. Looking at the number of CPU cycles tells the real story
 387  * about performance. For example:
 388  *    cd /sys/kernel/debug/provoke-crash
 389  *    perf stat -B -- cat <(echo REFCOUNT_TIMING) > DIRECT
 390  */
 391 static void lkdtm_REFCOUNT_TIMING(void)
 392 {
 393         unsigned int i;
 394         refcount_t count = REFCOUNT_INIT(1);
 395
 396         for (i = 0; i < INT_MAX - 1; i++)
 397                 refcount_inc(&count);
 398
 399         for (i = INT_MAX; i > 0; i--)
 400                 if (refcount_dec_and_test(&count))
 401                         break;
 402
 403         if (i != 1)
 404                 pr_err("refcount: out of sync up/down cycle: %u\n", i - 1);
 405         else
 406                 pr_info("refcount timing: done\n");
 407 }
 408
 409 static struct crashtype crashtypes[] = {
 410         CRASHTYPE(REFCOUNT_INC_OVERFLOW),
 411         CRASHTYPE(REFCOUNT_ADD_OVERFLOW),
 412         CRASHTYPE(REFCOUNT_INC_NOT_ZERO_OVERFLOW),
 413         CRASHTYPE(REFCOUNT_ADD_NOT_ZERO_OVERFLOW),
 414         CRASHTYPE(REFCOUNT_DEC_ZERO),
 415         CRASHTYPE(REFCOUNT_DEC_NEGATIVE),
 416         CRASHTYPE(REFCOUNT_DEC_AND_TEST_NEGATIVE),
 417         CRASHTYPE(REFCOUNT_SUB_AND_TEST_NEGATIVE),
 418         CRASHTYPE(REFCOUNT_SUB_AND_TEST_ZERO),
 419         CRASHTYPE(REFCOUNT_INC_ZERO),
 420         CRASHTYPE(REFCOUNT_ADD_ZERO),
 421         CRASHTYPE(REFCOUNT_INC_SATURATED),
 422         CRASHTYPE(REFCOUNT_DEC_SATURATED),
 423         CRASHTYPE(REFCOUNT_ADD_SATURATED),
 424         CRASHTYPE(REFCOUNT_INC_NOT_ZERO_SATURATED),
 425         CRASHTYPE(REFCOUNT_ADD_NOT_ZERO_SATURATED),
 426         CRASHTYPE(REFCOUNT_DEC_AND_TEST_SATURATED),
 427         CRASHTYPE(REFCOUNT_SUB_AND_TEST_SATURATED),
 428         CRASHTYPE(ATOMIC_TIMING),
 429         CRASHTYPE(REFCOUNT_TIMING),
 430 };
 431
 432 struct crashtype_category refcount_crashtypes = {
 433         .crashtypes = crashtypes,
 434         .len        = ARRAY_SIZE(crashtypes),
 435 };