drivers/misc/lkdtm/refcount.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * This is for all the tests related to refcount bugs (e.g. overflow,
   4  * underflow, reaching zero untested, etc).
   5  */
   6 #include "lkdtm.h"
   7 #include <linux/refcount.h>
   8
   9 #ifdef CONFIG_REFCOUNT_FULL
  10 #define REFCOUNT_MAX            (UINT_MAX - 1)
  11 #define REFCOUNT_SATURATED      UINT_MAX
  12 #else
  13 #define REFCOUNT_MAX            INT_MAX
  14 #define REFCOUNT_SATURATED      (INT_MIN / 2)
  15 #endif
  16
  17 static void overflow_check(refcount_t *ref)
  18 {
  19         switch (refcount_read(ref)) {
  20         case REFCOUNT_SATURATED:
  21                 pr_info("Overflow detected: saturated\n");
  22                 break;
  23         case REFCOUNT_MAX:
  24                 pr_warn("Overflow detected: unsafely reset to max\n");
  25                 break;
  26         default:
  27                 pr_err("Fail: refcount wrapped to %d\n", refcount_read(ref));
  28         }
  29 }
  30
  31 /*
  32  * A refcount_inc() above the maximum value of the refcount implementation,
  33  * should at least saturate, and at most also WARN.
  34  */
  35 void lkdtm_REFCOUNT_INC_OVERFLOW(void)
  36 {
  37         refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX - 1);
  38
  39         pr_info("attempting good refcount_inc() without overflow\n");
  40         refcount_dec(&over);
  41         refcount_inc(&over);
  42
  43         pr_info("attempting bad refcount_inc() overflow\n");
  44         refcount_inc(&over);
  45         refcount_inc(&over);
  46
  47         overflow_check(&over);
  48 }
  49
  50 /* refcount_add() should behave just like refcount_inc() above. */
  51 void lkdtm_REFCOUNT_ADD_OVERFLOW(void)
  52 {
  53         refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX - 1);
  54
  55         pr_info("attempting good refcount_add() without overflow\n");
  56         refcount_dec(&over);
  57         refcount_dec(&over);
  58         refcount_dec(&over);
  59         refcount_dec(&over);
  60         refcount_add(4, &over);
  61
  62         pr_info("attempting bad refcount_add() overflow\n");
  63         refcount_add(4, &over);
  64
  65         overflow_check(&over);
  66 }
  67
  68 /* refcount_inc_not_zero() should behave just like refcount_inc() above. */
  69 void lkdtm_REFCOUNT_INC_NOT_ZERO_OVERFLOW(void)
  70 {
  71         refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX);
  72
  73         pr_info("attempting bad refcount_inc_not_zero() overflow\n");
  74         if (!refcount_inc_not_zero(&over))
  75                 pr_warn("Weird: refcount_inc_not_zero() reported zero\n");
  76
  77         overflow_check(&over);
  78 }
  79
  80 /* refcount_add_not_zero() should behave just like refcount_inc() above. */
  81 void lkdtm_REFCOUNT_ADD_NOT_ZERO_OVERFLOW(void)
  82 {
  83         refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX);
  84
  85         pr_info("attempting bad refcount_add_not_zero() overflow\n");
  86         if (!refcount_add_not_zero(6, &over))
  87                 pr_warn("Weird: refcount_add_not_zero() reported zero\n");
  88
  89         overflow_check(&over);
  90 }
  91
  92 static void check_zero(refcount_t *ref)
  93 {
  94         switch (refcount_read(ref)) {
  95         case REFCOUNT_SATURATED:
  96                 pr_info("Zero detected: saturated\n");
  97                 break;
  98         case REFCOUNT_MAX:
  99                 pr_warn("Zero detected: unsafely reset to max\n");
 100                 break;
 101         case 0:
 102                 pr_warn("Still at zero: refcount_inc/add() must not inc-from-0\n");
 103                 break;
 104         default:
 105                 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
 106         }
 107 }
 108
 109 /*
 110  * A refcount_dec(), as opposed to a refcount_dec_and_test(), when it hits
 111  * zero it should either saturate (when inc-from-zero isn't protected)
 112  * or stay at zero (when inc-from-zero is protected) and should WARN for both.
 113  */
 114 void lkdtm_REFCOUNT_DEC_ZERO(void)
 115 {
 116         refcount_t zero = REFCOUNT_INIT(2);
 117
 118         pr_info("attempting good refcount_dec()\n");
 119         refcount_dec(&zero);
 120
 121         pr_info("attempting bad refcount_dec() to zero\n");
 122         refcount_dec(&zero);
 123
 124         check_zero(&zero);
 125 }
 126
 127 static void check_negative(refcount_t *ref, int start)
 128 {
 129         /*
 130          * CONFIG_REFCOUNT_FULL refuses to move a refcount at all on an
 131          * over-sub, so we have to track our starting position instead of
 132          * looking only at zero-pinning.
 133          */
 134         if (refcount_read(ref) == start) {
 135                 pr_warn("Still at %d: refcount_inc/add() must not inc-from-0\n",
 136                         start);
 137                 return;
 138         }
 139
 140         switch (refcount_read(ref)) {
 141         case REFCOUNT_SATURATED:
 142                 pr_info("Negative detected: saturated\n");
 143                 break;
 144         case REFCOUNT_MAX:
 145                 pr_warn("Negative detected: unsafely reset to max\n");
 146                 break;
 147         default:
 148                 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
 149         }
 150 }
 151
 152 /* A refcount_dec() going negative should saturate and may WARN. */
 153 void lkdtm_REFCOUNT_DEC_NEGATIVE(void)
 154 {
 155         refcount_t neg = REFCOUNT_INIT(0);
 156
 157         pr_info("attempting bad refcount_dec() below zero\n");
 158         refcount_dec(&neg);
 159
 160         check_negative(&neg, 0);
 161 }
 162
 163 /*
 164  * A refcount_dec_and_test() should act like refcount_dec() above when
 165  * going negative.
 166  */
 167 void lkdtm_REFCOUNT_DEC_AND_TEST_NEGATIVE(void)
 168 {
 169         refcount_t neg = REFCOUNT_INIT(0);
 170
 171         pr_info("attempting bad refcount_dec_and_test() below zero\n");
 172         if (refcount_dec_and_test(&neg))
 173                 pr_warn("Weird: refcount_dec_and_test() reported zero\n");
 174
 175         check_negative(&neg, 0);
 176 }
 177
 178 /*
 179  * A refcount_sub_and_test() should act like refcount_dec_and_test()
 180  * above when going negative.
 181  */
 182 void lkdtm_REFCOUNT_SUB_AND_TEST_NEGATIVE(void)
 183 {
 184         refcount_t neg = REFCOUNT_INIT(3);
 185
 186         pr_info("attempting bad refcount_sub_and_test() below zero\n");
 187         if (refcount_sub_and_test(5, &neg))
 188                 pr_warn("Weird: refcount_sub_and_test() reported zero\n");
 189
 190         check_negative(&neg, 3);
 191 }
 192
 193 static void check_from_zero(refcount_t *ref)
 194 {
 195         switch (refcount_read(ref)) {
 196         case 0:
 197                 pr_info("Zero detected: stayed at zero\n");
 198                 break;
 199         case REFCOUNT_SATURATED:
 200                 pr_info("Zero detected: saturated\n");
 201                 break;
 202         case REFCOUNT_MAX:
 203                 pr_warn("Zero detected: unsafely reset to max\n");
 204                 break;
 205         default:
 206                 pr_info("Fail: zero not detected, incremented to %d\n",
 207                         refcount_read(ref));
 208         }
 209 }
 210
 211 /*
 212  * A refcount_inc() from zero should pin to zero or saturate and may WARN.
 213  * Only CONFIG_REFCOUNT_FULL provides this protection currently.
 214  */
 215 void lkdtm_REFCOUNT_INC_ZERO(void)
 216 {
 217         refcount_t zero = REFCOUNT_INIT(0);
 218
 219         pr_info("attempting safe refcount_inc_not_zero() from zero\n");
 220         if (!refcount_inc_not_zero(&zero)) {
 221                 pr_info("Good: zero detected\n");
 222                 if (refcount_read(&zero) == 0)
 223                         pr_info("Correctly stayed at zero\n");
 224                 else
 225                         pr_err("Fail: refcount went past zero!\n");
 226         } else {
 227                 pr_err("Fail: Zero not detected!?\n");
 228         }
 229
 230         pr_info("attempting bad refcount_inc() from zero\n");
 231         refcount_inc(&zero);
 232
 233         check_from_zero(&zero);
 234 }
 235
 236 /*
 237  * A refcount_add() should act like refcount_inc() above when starting
 238  * at zero.
 239  */
 240 void lkdtm_REFCOUNT_ADD_ZERO(void)
 241 {
 242         refcount_t zero = REFCOUNT_INIT(0);
 243
 244         pr_info("attempting safe refcount_add_not_zero() from zero\n");
 245         if (!refcount_add_not_zero(3, &zero)) {
 246                 pr_info("Good: zero detected\n");
 247                 if (refcount_read(&zero) == 0)
 248                         pr_info("Correctly stayed at zero\n");
 249                 else
 250                         pr_err("Fail: refcount went past zero\n");
 251         } else {
 252                 pr_err("Fail: Zero not detected!?\n");
 253         }
 254
 255         pr_info("attempting bad refcount_add() from zero\n");
 256         refcount_add(3, &zero);
 257
 258         check_from_zero(&zero);
 259 }
 260
 261 static void check_saturated(refcount_t *ref)
 262 {
 263         switch (refcount_read(ref)) {
 264         case REFCOUNT_SATURATED:
 265                 pr_info("Saturation detected: still saturated\n");
 266                 break;
 267         case REFCOUNT_MAX:
 268                 pr_warn("Saturation detected: unsafely reset to max\n");
 269                 break;
 270         default:
 271                 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
 272         }
 273 }
 274
 275 /*
 276  * A refcount_inc() from a saturated value should at most warn about
 277  * being saturated already.
 278  */
 279 void lkdtm_REFCOUNT_INC_SATURATED(void)
 280 {
 281         refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
 282
 283         pr_info("attempting bad refcount_inc() from saturated\n");
 284         refcount_inc(&sat);
 285
 286         check_saturated(&sat);
 287 }
 288
 289 /* Should act like refcount_inc() above from saturated. */
 290 void lkdtm_REFCOUNT_DEC_SATURATED(void)
 291 {
 292         refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
 293
 294         pr_info("attempting bad refcount_dec() from saturated\n");
 295         refcount_dec(&sat);
 296
 297         check_saturated(&sat);
 298 }
 299
 300 /* Should act like refcount_inc() above from saturated. */
 301 void lkdtm_REFCOUNT_ADD_SATURATED(void)
 302 {
 303         refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
 304
 305         pr_info("attempting bad refcount_dec() from saturated\n");
 306         refcount_add(8, &sat);
 307
 308         check_saturated(&sat);
 309 }
 310
 311 /* Should act like refcount_inc() above from saturated. */
 312 void lkdtm_REFCOUNT_INC_NOT_ZERO_SATURATED(void)
 313 {
 314         refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
 315
 316         pr_info("attempting bad refcount_inc_not_zero() from saturated\n");
 317         if (!refcount_inc_not_zero(&sat))
 318                 pr_warn("Weird: refcount_inc_not_zero() reported zero\n");
 319
 320         check_saturated(&sat);
 321 }
 322
 323 /* Should act like refcount_inc() above from saturated. */
 324 void lkdtm_REFCOUNT_ADD_NOT_ZERO_SATURATED(void)
 325 {
 326         refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
 327
 328         pr_info("attempting bad refcount_add_not_zero() from saturated\n");
 329         if (!refcount_add_not_zero(7, &sat))
 330                 pr_warn("Weird: refcount_add_not_zero() reported zero\n");
 331
 332         check_saturated(&sat);
 333 }
 334
 335 /* Should act like refcount_inc() above from saturated. */
 336 void lkdtm_REFCOUNT_DEC_AND_TEST_SATURATED(void)
 337 {
 338         refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
 339
 340         pr_info("attempting bad refcount_dec_and_test() from saturated\n");
 341         if (refcount_dec_and_test(&sat))
 342                 pr_warn("Weird: refcount_dec_and_test() reported zero\n");
 343
 344         check_saturated(&sat);
 345 }
 346
 347 /* Should act like refcount_inc() above from saturated. */
 348 void lkdtm_REFCOUNT_SUB_AND_TEST_SATURATED(void)
 349 {
 350         refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
 351
 352         pr_info("attempting bad refcount_sub_and_test() from saturated\n");
 353         if (refcount_sub_and_test(8, &sat))
 354                 pr_warn("Weird: refcount_sub_and_test() reported zero\n");
 355
 356         check_saturated(&sat);
 357 }
 358
 359 /* Used to time the existing atomic_t when used for reference counting */
 360 void lkdtm_ATOMIC_TIMING(void)
 361 {
 362         unsigned int i;
 363         atomic_t count = ATOMIC_INIT(1);
 364
 365         for (i = 0; i < INT_MAX - 1; i++)
 366                 atomic_inc(&count);
 367
 368         for (i = INT_MAX; i > 0; i--)
 369                 if (atomic_dec_and_test(&count))
 370                         break;
 371
 372         if (i != 1)
 373                 pr_err("atomic timing: out of sync up/down cycle: %u\n", i - 1);
 374         else
 375                 pr_info("atomic timing: done\n");
 376 }
 377
 378 /*
 379  * This can be compared to ATOMIC_TIMING when implementing fast refcount
 380  * protections. Looking at the number of CPU cycles tells the real story
 381  * about performance. For example:
 382  *    cd /sys/kernel/debug/provoke-crash
 383  *    perf stat -B -- cat <(echo REFCOUNT_TIMING) > DIRECT
 384  */
 385 void lkdtm_REFCOUNT_TIMING(void)
 386 {
 387         unsigned int i;
 388         refcount_t count = REFCOUNT_INIT(1);
 389
 390         for (i = 0; i < INT_MAX - 1; i++)
 391                 refcount_inc(&count);
 392
 393         for (i = INT_MAX; i > 0; i--)
 394                 if (refcount_dec_and_test(&count))
 395                         break;
 396
 397         if (i != 1)
 398                 pr_err("refcount: out of sync up/down cycle: %u\n", i - 1);
 399         else
 400                 pr_info("refcount timing: done\n");
 401 }