1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * This is for all the tests related to refcount bugs (e.g. overflow,
4 * underflow, reaching zero untested, etc).
5 */
6 #include "lkdtm.h"
7 #include <linux/refcount.h>
8
overflow_check(refcount_t * ref)9 static void overflow_check(refcount_t *ref)
10 {
11 switch (refcount_read(ref)) {
12 case REFCOUNT_SATURATED:
13 pr_info("Overflow detected: saturated\n");
14 break;
15 case REFCOUNT_MAX:
16 pr_warn("Overflow detected: unsafely reset to max\n");
17 break;
18 default:
19 pr_err("Fail: refcount wrapped to %d\n", refcount_read(ref));
20 }
21 }
22
23 /*
24 * A refcount_inc() above the maximum value of the refcount implementation,
25 * should at least saturate, and at most also WARN.
26 */
lkdtm_REFCOUNT_INC_OVERFLOW(void)27 static void lkdtm_REFCOUNT_INC_OVERFLOW(void)
28 {
29 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX - 1);
30
31 pr_info("attempting good refcount_inc() without overflow\n");
32 refcount_dec(&over);
33 refcount_inc(&over);
34
35 pr_info("attempting bad refcount_inc() overflow\n");
36 refcount_inc(&over);
37 refcount_inc(&over);
38
39 overflow_check(&over);
40 }
41
42 /* refcount_add() should behave just like refcount_inc() above. */
lkdtm_REFCOUNT_ADD_OVERFLOW(void)43 static void lkdtm_REFCOUNT_ADD_OVERFLOW(void)
44 {
45 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX - 1);
46
47 pr_info("attempting good refcount_add() without overflow\n");
48 refcount_dec(&over);
49 refcount_dec(&over);
50 refcount_dec(&over);
51 refcount_dec(&over);
52 refcount_add(4, &over);
53
54 pr_info("attempting bad refcount_add() overflow\n");
55 refcount_add(4, &over);
56
57 overflow_check(&over);
58 }
59
60 /* refcount_inc_not_zero() should behave just like refcount_inc() above. */
lkdtm_REFCOUNT_INC_NOT_ZERO_OVERFLOW(void)61 static void lkdtm_REFCOUNT_INC_NOT_ZERO_OVERFLOW(void)
62 {
63 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX);
64
65 pr_info("attempting bad refcount_inc_not_zero() overflow\n");
66 if (!refcount_inc_not_zero(&over))
67 pr_warn("Weird: refcount_inc_not_zero() reported zero\n");
68
69 overflow_check(&over);
70 }
71
72 /* refcount_add_not_zero() should behave just like refcount_inc() above. */
lkdtm_REFCOUNT_ADD_NOT_ZERO_OVERFLOW(void)73 static void lkdtm_REFCOUNT_ADD_NOT_ZERO_OVERFLOW(void)
74 {
75 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX);
76
77 pr_info("attempting bad refcount_add_not_zero() overflow\n");
78 if (!refcount_add_not_zero(6, &over))
79 pr_warn("Weird: refcount_add_not_zero() reported zero\n");
80
81 overflow_check(&over);
82 }
83
check_zero(refcount_t * ref)84 static void check_zero(refcount_t *ref)
85 {
86 switch (refcount_read(ref)) {
87 case REFCOUNT_SATURATED:
88 pr_info("Zero detected: saturated\n");
89 break;
90 case REFCOUNT_MAX:
91 pr_warn("Zero detected: unsafely reset to max\n");
92 break;
93 case 0:
94 pr_warn("Still at zero: refcount_inc/add() must not inc-from-0\n");
95 break;
96 default:
97 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
98 }
99 }
100
101 /*
102 * A refcount_dec(), as opposed to a refcount_dec_and_test(), when it hits
103 * zero it should either saturate (when inc-from-zero isn't protected)
104 * or stay at zero (when inc-from-zero is protected) and should WARN for both.
105 */
lkdtm_REFCOUNT_DEC_ZERO(void)106 static void lkdtm_REFCOUNT_DEC_ZERO(void)
107 {
108 refcount_t zero = REFCOUNT_INIT(2);
109
110 pr_info("attempting good refcount_dec()\n");
111 refcount_dec(&zero);
112
113 pr_info("attempting bad refcount_dec() to zero\n");
114 refcount_dec(&zero);
115
116 check_zero(&zero);
117 }
118
check_negative(refcount_t * ref,int start)119 static void check_negative(refcount_t *ref, int start)
120 {
121 /*
122 * refcount_t refuses to move a refcount at all on an
123 * over-sub, so we have to track our starting position instead of
124 * looking only at zero-pinning.
125 */
126 if (refcount_read(ref) == start) {
127 pr_warn("Still at %d: refcount_inc/add() must not inc-from-0\n",
128 start);
129 return;
130 }
131
132 switch (refcount_read(ref)) {
133 case REFCOUNT_SATURATED:
134 pr_info("Negative detected: saturated\n");
135 break;
136 case REFCOUNT_MAX:
137 pr_warn("Negative detected: unsafely reset to max\n");
138 break;
139 default:
140 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
141 }
142 }
143
144 /* A refcount_dec() going negative should saturate and may WARN. */
lkdtm_REFCOUNT_DEC_NEGATIVE(void)145 static void lkdtm_REFCOUNT_DEC_NEGATIVE(void)
146 {
147 refcount_t neg = REFCOUNT_INIT(0);
148
149 pr_info("attempting bad refcount_dec() below zero\n");
150 refcount_dec(&neg);
151
152 check_negative(&neg, 0);
153 }
154
155 /*
156 * A refcount_dec_and_test() should act like refcount_dec() above when
157 * going negative.
158 */
lkdtm_REFCOUNT_DEC_AND_TEST_NEGATIVE(void)159 static void lkdtm_REFCOUNT_DEC_AND_TEST_NEGATIVE(void)
160 {
161 refcount_t neg = REFCOUNT_INIT(0);
162
163 pr_info("attempting bad refcount_dec_and_test() below zero\n");
164 if (refcount_dec_and_test(&neg))
165 pr_warn("Weird: refcount_dec_and_test() reported zero\n");
166
167 check_negative(&neg, 0);
168 }
169
170 /*
171 * A refcount_sub_and_test() should act like refcount_dec_and_test()
172 * above when going negative.
173 */
lkdtm_REFCOUNT_SUB_AND_TEST_NEGATIVE(void)174 static void lkdtm_REFCOUNT_SUB_AND_TEST_NEGATIVE(void)
175 {
176 refcount_t neg = REFCOUNT_INIT(3);
177
178 pr_info("attempting bad refcount_sub_and_test() below zero\n");
179 if (refcount_sub_and_test(5, &neg))
180 pr_warn("Weird: refcount_sub_and_test() reported zero\n");
181
182 check_negative(&neg, 3);
183 }
184
185 /*
186 * A refcount_sub_and_test() by zero when the counter is at zero should act like
187 * refcount_sub_and_test() above when going negative.
188 */
lkdtm_REFCOUNT_SUB_AND_TEST_ZERO(void)189 static void lkdtm_REFCOUNT_SUB_AND_TEST_ZERO(void)
190 {
191 refcount_t neg = REFCOUNT_INIT(0);
192
193 pr_info("attempting bad refcount_sub_and_test() at zero\n");
194 if (refcount_sub_and_test(0, &neg))
195 pr_warn("Weird: refcount_sub_and_test() reported zero\n");
196
197 check_negative(&neg, 0);
198 }
199
check_from_zero(refcount_t * ref)200 static void check_from_zero(refcount_t *ref)
201 {
202 switch (refcount_read(ref)) {
203 case 0:
204 pr_info("Zero detected: stayed at zero\n");
205 break;
206 case REFCOUNT_SATURATED:
207 pr_info("Zero detected: saturated\n");
208 break;
209 case REFCOUNT_MAX:
210 pr_warn("Zero detected: unsafely reset to max\n");
211 break;
212 default:
213 pr_info("Fail: zero not detected, incremented to %d\n",
214 refcount_read(ref));
215 }
216 }
217
218 /*
219 * A refcount_inc() from zero should pin to zero or saturate and may WARN.
220 */
lkdtm_REFCOUNT_INC_ZERO(void)221 static void lkdtm_REFCOUNT_INC_ZERO(void)
222 {
223 refcount_t zero = REFCOUNT_INIT(0);
224
225 pr_info("attempting safe refcount_inc_not_zero() from zero\n");
226 if (!refcount_inc_not_zero(&zero)) {
227 pr_info("Good: zero detected\n");
228 if (refcount_read(&zero) == 0)
229 pr_info("Correctly stayed at zero\n");
230 else
231 pr_err("Fail: refcount went past zero!\n");
232 } else {
233 pr_err("Fail: Zero not detected!?\n");
234 }
235
236 pr_info("attempting bad refcount_inc() from zero\n");
237 refcount_inc(&zero);
238
239 check_from_zero(&zero);
240 }
241
242 /*
243 * A refcount_add() should act like refcount_inc() above when starting
244 * at zero.
245 */
lkdtm_REFCOUNT_ADD_ZERO(void)246 static void lkdtm_REFCOUNT_ADD_ZERO(void)
247 {
248 refcount_t zero = REFCOUNT_INIT(0);
249
250 pr_info("attempting safe refcount_add_not_zero() from zero\n");
251 if (!refcount_add_not_zero(3, &zero)) {
252 pr_info("Good: zero detected\n");
253 if (refcount_read(&zero) == 0)
254 pr_info("Correctly stayed at zero\n");
255 else
256 pr_err("Fail: refcount went past zero\n");
257 } else {
258 pr_err("Fail: Zero not detected!?\n");
259 }
260
261 pr_info("attempting bad refcount_add() from zero\n");
262 refcount_add(3, &zero);
263
264 check_from_zero(&zero);
265 }
266
check_saturated(refcount_t * ref)267 static void check_saturated(refcount_t *ref)
268 {
269 switch (refcount_read(ref)) {
270 case REFCOUNT_SATURATED:
271 pr_info("Saturation detected: still saturated\n");
272 break;
273 case REFCOUNT_MAX:
274 pr_warn("Saturation detected: unsafely reset to max\n");
275 break;
276 default:
277 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
278 }
279 }
280
281 /*
282 * A refcount_inc() from a saturated value should at most warn about
283 * being saturated already.
284 */
lkdtm_REFCOUNT_INC_SATURATED(void)285 static void lkdtm_REFCOUNT_INC_SATURATED(void)
286 {
287 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
288
289 pr_info("attempting bad refcount_inc() from saturated\n");
290 refcount_inc(&sat);
291
292 check_saturated(&sat);
293 }
294
295 /* Should act like refcount_inc() above from saturated. */
lkdtm_REFCOUNT_DEC_SATURATED(void)296 static void lkdtm_REFCOUNT_DEC_SATURATED(void)
297 {
298 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
299
300 pr_info("attempting bad refcount_dec() from saturated\n");
301 refcount_dec(&sat);
302
303 check_saturated(&sat);
304 }
305
306 /* Should act like refcount_inc() above from saturated. */
lkdtm_REFCOUNT_ADD_SATURATED(void)307 static void lkdtm_REFCOUNT_ADD_SATURATED(void)
308 {
309 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
310
311 pr_info("attempting bad refcount_dec() from saturated\n");
312 refcount_add(8, &sat);
313
314 check_saturated(&sat);
315 }
316
317 /* Should act like refcount_inc() above from saturated. */
lkdtm_REFCOUNT_INC_NOT_ZERO_SATURATED(void)318 static void lkdtm_REFCOUNT_INC_NOT_ZERO_SATURATED(void)
319 {
320 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
321
322 pr_info("attempting bad refcount_inc_not_zero() from saturated\n");
323 if (!refcount_inc_not_zero(&sat))
324 pr_warn("Weird: refcount_inc_not_zero() reported zero\n");
325
326 check_saturated(&sat);
327 }
328
329 /* Should act like refcount_inc() above from saturated. */
lkdtm_REFCOUNT_ADD_NOT_ZERO_SATURATED(void)330 static void lkdtm_REFCOUNT_ADD_NOT_ZERO_SATURATED(void)
331 {
332 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
333
334 pr_info("attempting bad refcount_add_not_zero() from saturated\n");
335 if (!refcount_add_not_zero(7, &sat))
336 pr_warn("Weird: refcount_add_not_zero() reported zero\n");
337
338 check_saturated(&sat);
339 }
340
341 /* Should act like refcount_inc() above from saturated. */
lkdtm_REFCOUNT_DEC_AND_TEST_SATURATED(void)342 static void lkdtm_REFCOUNT_DEC_AND_TEST_SATURATED(void)
343 {
344 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
345
346 pr_info("attempting bad refcount_dec_and_test() from saturated\n");
347 if (refcount_dec_and_test(&sat))
348 pr_warn("Weird: refcount_dec_and_test() reported zero\n");
349
350 check_saturated(&sat);
351 }
352
353 /* Should act like refcount_inc() above from saturated. */
lkdtm_REFCOUNT_SUB_AND_TEST_SATURATED(void)354 static void lkdtm_REFCOUNT_SUB_AND_TEST_SATURATED(void)
355 {
356 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
357
358 pr_info("attempting bad refcount_sub_and_test() from saturated\n");
359 if (refcount_sub_and_test(8, &sat))
360 pr_warn("Weird: refcount_sub_and_test() reported zero\n");
361
362 check_saturated(&sat);
363 }
364
365 /* Used to time the existing atomic_t when used for reference counting */
lkdtm_ATOMIC_TIMING(void)366 static void lkdtm_ATOMIC_TIMING(void)
367 {
368 unsigned int i;
369 atomic_t count = ATOMIC_INIT(1);
370
371 for (i = 0; i < INT_MAX - 1; i++)
372 atomic_inc(&count);
373
374 for (i = INT_MAX; i > 0; i--)
375 if (atomic_dec_and_test(&count))
376 break;
377
378 if (i != 1)
379 pr_err("atomic timing: out of sync up/down cycle: %u\n", i - 1);
380 else
381 pr_info("atomic timing: done\n");
382 }
383
384 /*
385 * This can be compared to ATOMIC_TIMING when implementing fast refcount
386 * protections. Looking at the number of CPU cycles tells the real story
387 * about performance. For example:
388 * cd /sys/kernel/debug/provoke-crash
389 * perf stat -B -- cat <(echo REFCOUNT_TIMING) > DIRECT
390 */
lkdtm_REFCOUNT_TIMING(void)391 static void lkdtm_REFCOUNT_TIMING(void)
392 {
393 unsigned int i;
394 refcount_t count = REFCOUNT_INIT(1);
395
396 for (i = 0; i < INT_MAX - 1; i++)
397 refcount_inc(&count);
398
399 for (i = INT_MAX; i > 0; i--)
400 if (refcount_dec_and_test(&count))
401 break;
402
403 if (i != 1)
404 pr_err("refcount: out of sync up/down cycle: %u\n", i - 1);
405 else
406 pr_info("refcount timing: done\n");
407 }
408
409 static struct crashtype crashtypes[] = {
410 CRASHTYPE(REFCOUNT_INC_OVERFLOW),
411 CRASHTYPE(REFCOUNT_ADD_OVERFLOW),
412 CRASHTYPE(REFCOUNT_INC_NOT_ZERO_OVERFLOW),
413 CRASHTYPE(REFCOUNT_ADD_NOT_ZERO_OVERFLOW),
414 CRASHTYPE(REFCOUNT_DEC_ZERO),
415 CRASHTYPE(REFCOUNT_DEC_NEGATIVE),
416 CRASHTYPE(REFCOUNT_DEC_AND_TEST_NEGATIVE),
417 CRASHTYPE(REFCOUNT_SUB_AND_TEST_NEGATIVE),
418 CRASHTYPE(REFCOUNT_SUB_AND_TEST_ZERO),
419 CRASHTYPE(REFCOUNT_INC_ZERO),
420 CRASHTYPE(REFCOUNT_ADD_ZERO),
421 CRASHTYPE(REFCOUNT_INC_SATURATED),
422 CRASHTYPE(REFCOUNT_DEC_SATURATED),
423 CRASHTYPE(REFCOUNT_ADD_SATURATED),
424 CRASHTYPE(REFCOUNT_INC_NOT_ZERO_SATURATED),
425 CRASHTYPE(REFCOUNT_ADD_NOT_ZERO_SATURATED),
426 CRASHTYPE(REFCOUNT_DEC_AND_TEST_SATURATED),
427 CRASHTYPE(REFCOUNT_SUB_AND_TEST_SATURATED),
428 CRASHTYPE(ATOMIC_TIMING),
429 CRASHTYPE(REFCOUNT_TIMING),
430 };
431
432 struct crashtype_category refcount_crashtypes = {
433 .crashtypes = crashtypes,
434 .len = ARRAY_SIZE(crashtypes),
435 };
436