436 lines · c
1// SPDX-License-Identifier: GPL-2.02/*3 * This is for all the tests related to refcount bugs (e.g. overflow,4 * underflow, reaching zero untested, etc).5 */6#include "lkdtm.h"7#include <linux/refcount.h>8 9static void overflow_check(refcount_t *ref)10{11 switch (refcount_read(ref)) {12 case REFCOUNT_SATURATED:13 pr_info("Overflow detected: saturated\n");14 break;15 case REFCOUNT_MAX:16 pr_warn("Overflow detected: unsafely reset to max\n");17 break;18 default:19 pr_err("Fail: refcount wrapped to %d\n", refcount_read(ref));20 }21}22 23/*24 * A refcount_inc() above the maximum value of the refcount implementation,25 * should at least saturate, and at most also WARN.26 */27static void lkdtm_REFCOUNT_INC_OVERFLOW(void)28{29 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX - 1);30 31 pr_info("attempting good refcount_inc() without overflow\n");32 refcount_dec(&over);33 refcount_inc(&over);34 35 pr_info("attempting bad refcount_inc() overflow\n");36 refcount_inc(&over);37 refcount_inc(&over);38 39 overflow_check(&over);40}41 42/* refcount_add() should behave just like refcount_inc() above. */43static void lkdtm_REFCOUNT_ADD_OVERFLOW(void)44{45 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX - 1);46 47 pr_info("attempting good refcount_add() without overflow\n");48 refcount_dec(&over);49 refcount_dec(&over);50 refcount_dec(&over);51 refcount_dec(&over);52 refcount_add(4, &over);53 54 pr_info("attempting bad refcount_add() overflow\n");55 refcount_add(4, &over);56 57 overflow_check(&over);58}59 60/* refcount_inc_not_zero() should behave just like refcount_inc() above. */61static void lkdtm_REFCOUNT_INC_NOT_ZERO_OVERFLOW(void)62{63 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX);64 65 pr_info("attempting bad refcount_inc_not_zero() overflow\n");66 if (!refcount_inc_not_zero(&over))67 pr_warn("Weird: refcount_inc_not_zero() reported zero\n");68 69 overflow_check(&over);70}71 72/* refcount_add_not_zero() should behave just like refcount_inc() above. */73static void lkdtm_REFCOUNT_ADD_NOT_ZERO_OVERFLOW(void)74{75 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX);76 77 pr_info("attempting bad refcount_add_not_zero() overflow\n");78 if (!refcount_add_not_zero(6, &over))79 pr_warn("Weird: refcount_add_not_zero() reported zero\n");80 81 overflow_check(&over);82}83 84static void check_zero(refcount_t *ref)85{86 switch (refcount_read(ref)) {87 case REFCOUNT_SATURATED:88 pr_info("Zero detected: saturated\n");89 break;90 case REFCOUNT_MAX:91 pr_warn("Zero detected: unsafely reset to max\n");92 break;93 case 0:94 pr_warn("Still at zero: refcount_inc/add() must not inc-from-0\n");95 break;96 default:97 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));98 }99}100 101/*102 * A refcount_dec(), as opposed to a refcount_dec_and_test(), when it hits103 * zero it should either saturate (when inc-from-zero isn't protected)104 * or stay at zero (when inc-from-zero is protected) and should WARN for both.105 */106static void lkdtm_REFCOUNT_DEC_ZERO(void)107{108 refcount_t zero = REFCOUNT_INIT(2);109 110 pr_info("attempting good refcount_dec()\n");111 refcount_dec(&zero);112 113 pr_info("attempting bad refcount_dec() to zero\n");114 refcount_dec(&zero);115 116 check_zero(&zero);117}118 119static void check_negative(refcount_t *ref, int start)120{121 /*122 * refcount_t refuses to move a refcount at all on an123 * over-sub, so we have to track our starting position instead of124 * looking only at zero-pinning.125 */126 if (refcount_read(ref) == start) {127 pr_warn("Still at %d: refcount_inc/add() must not inc-from-0\n",128 start);129 return;130 }131 132 switch (refcount_read(ref)) {133 case REFCOUNT_SATURATED:134 pr_info("Negative detected: saturated\n");135 break;136 case REFCOUNT_MAX:137 pr_warn("Negative detected: unsafely reset to max\n");138 break;139 default:140 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));141 }142}143 144/* A refcount_dec() going negative should saturate and may WARN. */145static void lkdtm_REFCOUNT_DEC_NEGATIVE(void)146{147 refcount_t neg = REFCOUNT_INIT(0);148 149 pr_info("attempting bad refcount_dec() below zero\n");150 refcount_dec(&neg);151 152 check_negative(&neg, 0);153}154 155/*156 * A refcount_dec_and_test() should act like refcount_dec() above when157 * going negative.158 */159static void lkdtm_REFCOUNT_DEC_AND_TEST_NEGATIVE(void)160{161 refcount_t neg = REFCOUNT_INIT(0);162 163 pr_info("attempting bad refcount_dec_and_test() below zero\n");164 if (refcount_dec_and_test(&neg))165 pr_warn("Weird: refcount_dec_and_test() reported zero\n");166 167 check_negative(&neg, 0);168}169 170/*171 * A refcount_sub_and_test() should act like refcount_dec_and_test()172 * above when going negative.173 */174static void lkdtm_REFCOUNT_SUB_AND_TEST_NEGATIVE(void)175{176 refcount_t neg = REFCOUNT_INIT(3);177 178 pr_info("attempting bad refcount_sub_and_test() below zero\n");179 if (refcount_sub_and_test(5, &neg))180 pr_warn("Weird: refcount_sub_and_test() reported zero\n");181 182 check_negative(&neg, 3);183}184 185/*186 * A refcount_sub_and_test() by zero when the counter is at zero should act like187 * refcount_sub_and_test() above when going negative.188 */189static void lkdtm_REFCOUNT_SUB_AND_TEST_ZERO(void)190{191 refcount_t neg = REFCOUNT_INIT(0);192 193 pr_info("attempting bad refcount_sub_and_test() at zero\n");194 if (refcount_sub_and_test(0, &neg))195 pr_warn("Weird: refcount_sub_and_test() reported zero\n");196 197 check_negative(&neg, 0);198}199 200static void check_from_zero(refcount_t *ref)201{202 switch (refcount_read(ref)) {203 case 0:204 pr_info("Zero detected: stayed at zero\n");205 break;206 case REFCOUNT_SATURATED:207 pr_info("Zero detected: saturated\n");208 break;209 case REFCOUNT_MAX:210 pr_warn("Zero detected: unsafely reset to max\n");211 break;212 default:213 pr_info("Fail: zero not detected, incremented to %d\n",214 refcount_read(ref));215 }216}217 218/*219 * A refcount_inc() from zero should pin to zero or saturate and may WARN.220 */221static void lkdtm_REFCOUNT_INC_ZERO(void)222{223 refcount_t zero = REFCOUNT_INIT(0);224 225 pr_info("attempting safe refcount_inc_not_zero() from zero\n");226 if (!refcount_inc_not_zero(&zero)) {227 pr_info("Good: zero detected\n");228 if (refcount_read(&zero) == 0)229 pr_info("Correctly stayed at zero\n");230 else231 pr_err("Fail: refcount went past zero!\n");232 } else {233 pr_err("Fail: Zero not detected!?\n");234 }235 236 pr_info("attempting bad refcount_inc() from zero\n");237 refcount_inc(&zero);238 239 check_from_zero(&zero);240}241 242/*243 * A refcount_add() should act like refcount_inc() above when starting244 * at zero.245 */246static void lkdtm_REFCOUNT_ADD_ZERO(void)247{248 refcount_t zero = REFCOUNT_INIT(0);249 250 pr_info("attempting safe refcount_add_not_zero() from zero\n");251 if (!refcount_add_not_zero(3, &zero)) {252 pr_info("Good: zero detected\n");253 if (refcount_read(&zero) == 0)254 pr_info("Correctly stayed at zero\n");255 else256 pr_err("Fail: refcount went past zero\n");257 } else {258 pr_err("Fail: Zero not detected!?\n");259 }260 261 pr_info("attempting bad refcount_add() from zero\n");262 refcount_add(3, &zero);263 264 check_from_zero(&zero);265}266 267static void check_saturated(refcount_t *ref)268{269 switch (refcount_read(ref)) {270 case REFCOUNT_SATURATED:271 pr_info("Saturation detected: still saturated\n");272 break;273 case REFCOUNT_MAX:274 pr_warn("Saturation detected: unsafely reset to max\n");275 break;276 default:277 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));278 }279}280 281/*282 * A refcount_inc() from a saturated value should at most warn about283 * being saturated already.284 */285static void lkdtm_REFCOUNT_INC_SATURATED(void)286{287 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);288 289 pr_info("attempting bad refcount_inc() from saturated\n");290 refcount_inc(&sat);291 292 check_saturated(&sat);293}294 295/* Should act like refcount_inc() above from saturated. */296static void lkdtm_REFCOUNT_DEC_SATURATED(void)297{298 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);299 300 pr_info("attempting bad refcount_dec() from saturated\n");301 refcount_dec(&sat);302 303 check_saturated(&sat);304}305 306/* Should act like refcount_inc() above from saturated. */307static void lkdtm_REFCOUNT_ADD_SATURATED(void)308{309 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);310 311 pr_info("attempting bad refcount_dec() from saturated\n");312 refcount_add(8, &sat);313 314 check_saturated(&sat);315}316 317/* Should act like refcount_inc() above from saturated. */318static void lkdtm_REFCOUNT_INC_NOT_ZERO_SATURATED(void)319{320 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);321 322 pr_info("attempting bad refcount_inc_not_zero() from saturated\n");323 if (!refcount_inc_not_zero(&sat))324 pr_warn("Weird: refcount_inc_not_zero() reported zero\n");325 326 check_saturated(&sat);327}328 329/* Should act like refcount_inc() above from saturated. */330static void lkdtm_REFCOUNT_ADD_NOT_ZERO_SATURATED(void)331{332 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);333 334 pr_info("attempting bad refcount_add_not_zero() from saturated\n");335 if (!refcount_add_not_zero(7, &sat))336 pr_warn("Weird: refcount_add_not_zero() reported zero\n");337 338 check_saturated(&sat);339}340 341/* Should act like refcount_inc() above from saturated. */342static void lkdtm_REFCOUNT_DEC_AND_TEST_SATURATED(void)343{344 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);345 346 pr_info("attempting bad refcount_dec_and_test() from saturated\n");347 if (refcount_dec_and_test(&sat))348 pr_warn("Weird: refcount_dec_and_test() reported zero\n");349 350 check_saturated(&sat);351}352 353/* Should act like refcount_inc() above from saturated. */354static void lkdtm_REFCOUNT_SUB_AND_TEST_SATURATED(void)355{356 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);357 358 pr_info("attempting bad refcount_sub_and_test() from saturated\n");359 if (refcount_sub_and_test(8, &sat))360 pr_warn("Weird: refcount_sub_and_test() reported zero\n");361 362 check_saturated(&sat);363}364 365/* Used to time the existing atomic_t when used for reference counting */366static void lkdtm_ATOMIC_TIMING(void)367{368 unsigned int i;369 atomic_t count = ATOMIC_INIT(1);370 371 for (i = 0; i < INT_MAX - 1; i++)372 atomic_inc(&count);373 374 for (i = INT_MAX; i > 0; i--)375 if (atomic_dec_and_test(&count))376 break;377 378 if (i != 1)379 pr_err("atomic timing: out of sync up/down cycle: %u\n", i - 1);380 else381 pr_info("atomic timing: done\n");382}383 384/*385 * This can be compared to ATOMIC_TIMING when implementing fast refcount386 * protections. Looking at the number of CPU cycles tells the real story387 * about performance. For example:388 * cd /sys/kernel/debug/provoke-crash389 * perf stat -B -- cat <(echo REFCOUNT_TIMING) > DIRECT390 */391static void lkdtm_REFCOUNT_TIMING(void)392{393 unsigned int i;394 refcount_t count = REFCOUNT_INIT(1);395 396 for (i = 0; i < INT_MAX - 1; i++)397 refcount_inc(&count);398 399 for (i = INT_MAX; i > 0; i--)400 if (refcount_dec_and_test(&count))401 break;402 403 if (i != 1)404 pr_err("refcount: out of sync up/down cycle: %u\n", i - 1);405 else406 pr_info("refcount timing: done\n");407}408 409static struct crashtype crashtypes[] = {410 CRASHTYPE(REFCOUNT_INC_OVERFLOW),411 CRASHTYPE(REFCOUNT_ADD_OVERFLOW),412 CRASHTYPE(REFCOUNT_INC_NOT_ZERO_OVERFLOW),413 CRASHTYPE(REFCOUNT_ADD_NOT_ZERO_OVERFLOW),414 CRASHTYPE(REFCOUNT_DEC_ZERO),415 CRASHTYPE(REFCOUNT_DEC_NEGATIVE),416 CRASHTYPE(REFCOUNT_DEC_AND_TEST_NEGATIVE),417 CRASHTYPE(REFCOUNT_SUB_AND_TEST_NEGATIVE),418 CRASHTYPE(REFCOUNT_SUB_AND_TEST_ZERO),419 CRASHTYPE(REFCOUNT_INC_ZERO),420 CRASHTYPE(REFCOUNT_ADD_ZERO),421 CRASHTYPE(REFCOUNT_INC_SATURATED),422 CRASHTYPE(REFCOUNT_DEC_SATURATED),423 CRASHTYPE(REFCOUNT_ADD_SATURATED),424 CRASHTYPE(REFCOUNT_INC_NOT_ZERO_SATURATED),425 CRASHTYPE(REFCOUNT_ADD_NOT_ZERO_SATURATED),426 CRASHTYPE(REFCOUNT_DEC_AND_TEST_SATURATED),427 CRASHTYPE(REFCOUNT_SUB_AND_TEST_SATURATED),428 CRASHTYPE(ATOMIC_TIMING),429 CRASHTYPE(REFCOUNT_TIMING),430};431 432struct crashtype_category refcount_crashtypes = {433 .crashtypes = crashtypes,434 .len = ARRAY_SIZE(crashtypes),435};436