1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * This is for all the tests related to refcount bugs (e.g. overflow, 4 * underflow, reaching zero untested, etc). 5 */ 6 #include "lkdtm.h" 7 #include <linux/refcount.h> 8 9 static void overflow_check(refcount_t *ref) 10 { 11 switch (refcount_read(ref)) { 12 case REFCOUNT_SATURATED: 13 pr_info("Overflow detected: saturated\n"); 14 break; 15 case REFCOUNT_MAX: 16 pr_warn("Overflow detected: unsafely reset to max\n"); 17 break; 18 default: 19 pr_err("Fail: refcount wrapped to %d\n", refcount_read(ref)); 20 } 21 } 22 23 /* 24 * A refcount_inc() above the maximum value of the refcount implementation, 25 * should at least saturate, and at most also WARN. 26 */ 27 static void lkdtm_REFCOUNT_INC_OVERFLOW(void) 28 { 29 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX - 1); 30 31 pr_info("attempting good refcount_inc() without overflow\n"); 32 refcount_dec(&over); 33 refcount_inc(&over); 34 35 pr_info("attempting bad refcount_inc() overflow\n"); 36 refcount_inc(&over); 37 refcount_inc(&over); 38 39 overflow_check(&over); 40 } 41 42 /* refcount_add() should behave just like refcount_inc() above. */ 43 static void lkdtm_REFCOUNT_ADD_OVERFLOW(void) 44 { 45 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX - 1); 46 47 pr_info("attempting good refcount_add() without overflow\n"); 48 refcount_dec(&over); 49 refcount_dec(&over); 50 refcount_dec(&over); 51 refcount_dec(&over); 52 refcount_add(4, &over); 53 54 pr_info("attempting bad refcount_add() overflow\n"); 55 refcount_add(4, &over); 56 57 overflow_check(&over); 58 } 59 60 /* refcount_inc_not_zero() should behave just like refcount_inc() above. */ 61 static void lkdtm_REFCOUNT_INC_NOT_ZERO_OVERFLOW(void) 62 { 63 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX); 64 65 pr_info("attempting bad refcount_inc_not_zero() overflow\n"); 66 if (!refcount_inc_not_zero(&over)) 67 pr_warn("Weird: refcount_inc_not_zero() reported zero\n"); 68 69 overflow_check(&over); 70 } 71 72 /* refcount_add_not_zero() should behave just like refcount_inc() above. */ 73 static void lkdtm_REFCOUNT_ADD_NOT_ZERO_OVERFLOW(void) 74 { 75 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX); 76 77 pr_info("attempting bad refcount_add_not_zero() overflow\n"); 78 if (!refcount_add_not_zero(6, &over)) 79 pr_warn("Weird: refcount_add_not_zero() reported zero\n"); 80 81 overflow_check(&over); 82 } 83 84 static void check_zero(refcount_t *ref) 85 { 86 switch (refcount_read(ref)) { 87 case REFCOUNT_SATURATED: 88 pr_info("Zero detected: saturated\n"); 89 break; 90 case REFCOUNT_MAX: 91 pr_warn("Zero detected: unsafely reset to max\n"); 92 break; 93 case 0: 94 pr_warn("Still at zero: refcount_inc/add() must not inc-from-0\n"); 95 break; 96 default: 97 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref)); 98 } 99 } 100 101 /* 102 * A refcount_dec(), as opposed to a refcount_dec_and_test(), when it hits 103 * zero it should either saturate (when inc-from-zero isn't protected) 104 * or stay at zero (when inc-from-zero is protected) and should WARN for both. 105 */ 106 static void lkdtm_REFCOUNT_DEC_ZERO(void) 107 { 108 refcount_t zero = REFCOUNT_INIT(2); 109 110 pr_info("attempting good refcount_dec()\n"); 111 refcount_dec(&zero); 112 113 pr_info("attempting bad refcount_dec() to zero\n"); 114 refcount_dec(&zero); 115 116 check_zero(&zero); 117 } 118 119 static void check_negative(refcount_t *ref, int start) 120 { 121 /* 122 * refcount_t refuses to move a refcount at all on an 123 * over-sub, so we have to track our starting position instead of 124 * looking only at zero-pinning. 125 */ 126 if (refcount_read(ref) == start) { 127 pr_warn("Still at %d: refcount_inc/add() must not inc-from-0\n", 128 start); 129 return; 130 } 131 132 switch (refcount_read(ref)) { 133 case REFCOUNT_SATURATED: 134 pr_info("Negative detected: saturated\n"); 135 break; 136 case REFCOUNT_MAX: 137 pr_warn("Negative detected: unsafely reset to max\n"); 138 break; 139 default: 140 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref)); 141 } 142 } 143 144 /* A refcount_dec() going negative should saturate and may WARN. */ 145 static void lkdtm_REFCOUNT_DEC_NEGATIVE(void) 146 { 147 refcount_t neg = REFCOUNT_INIT(0); 148 149 pr_info("attempting bad refcount_dec() below zero\n"); 150 refcount_dec(&neg); 151 152 check_negative(&neg, 0); 153 } 154 155 /* 156 * A refcount_dec_and_test() should act like refcount_dec() above when 157 * going negative. 158 */ 159 static void lkdtm_REFCOUNT_DEC_AND_TEST_NEGATIVE(void) 160 { 161 refcount_t neg = REFCOUNT_INIT(0); 162 163 pr_info("attempting bad refcount_dec_and_test() below zero\n"); 164 if (refcount_dec_and_test(&neg)) 165 pr_warn("Weird: refcount_dec_and_test() reported zero\n"); 166 167 check_negative(&neg, 0); 168 } 169 170 /* 171 * A refcount_sub_and_test() should act like refcount_dec_and_test() 172 * above when going negative. 173 */ 174 static void lkdtm_REFCOUNT_SUB_AND_TEST_NEGATIVE(void) 175 { 176 refcount_t neg = REFCOUNT_INIT(3); 177 178 pr_info("attempting bad refcount_sub_and_test() below zero\n"); 179 if (refcount_sub_and_test(5, &neg)) 180 pr_warn("Weird: refcount_sub_and_test() reported zero\n"); 181 182 check_negative(&neg, 3); 183 } 184 185 /* 186 * A refcount_sub_and_test() by zero when the counter is at zero should act like 187 * refcount_sub_and_test() above when going negative. 188 */ 189 static void lkdtm_REFCOUNT_SUB_AND_TEST_ZERO(void) 190 { 191 refcount_t neg = REFCOUNT_INIT(0); 192 193 pr_info("attempting bad refcount_sub_and_test() at zero\n"); 194 if (refcount_sub_and_test(0, &neg)) 195 pr_warn("Weird: refcount_sub_and_test() reported zero\n"); 196 197 check_negative(&neg, 0); 198 } 199 200 static void check_from_zero(refcount_t *ref) 201 { 202 switch (refcount_read(ref)) { 203 case 0: 204 pr_info("Zero detected: stayed at zero\n"); 205 break; 206 case REFCOUNT_SATURATED: 207 pr_info("Zero detected: saturated\n"); 208 break; 209 case REFCOUNT_MAX: 210 pr_warn("Zero detected: unsafely reset to max\n"); 211 break; 212 default: 213 pr_info("Fail: zero not detected, incremented to %d\n", 214 refcount_read(ref)); 215 } 216 } 217 218 /* 219 * A refcount_inc() from zero should pin to zero or saturate and may WARN. 220 */ 221 static void lkdtm_REFCOUNT_INC_ZERO(void) 222 { 223 refcount_t zero = REFCOUNT_INIT(0); 224 225 pr_info("attempting safe refcount_inc_not_zero() from zero\n"); 226 if (!refcount_inc_not_zero(&zero)) { 227 pr_info("Good: zero detected\n"); 228 if (refcount_read(&zero) == 0) 229 pr_info("Correctly stayed at zero\n"); 230 else 231 pr_err("Fail: refcount went past zero!\n"); 232 } else { 233 pr_err("Fail: Zero not detected!?\n"); 234 } 235 236 pr_info("attempting bad refcount_inc() from zero\n"); 237 refcount_inc(&zero); 238 239 check_from_zero(&zero); 240 } 241 242 /* 243 * A refcount_add() should act like refcount_inc() above when starting 244 * at zero. 245 */ 246 static void lkdtm_REFCOUNT_ADD_ZERO(void) 247 { 248 refcount_t zero = REFCOUNT_INIT(0); 249 250 pr_info("attempting safe refcount_add_not_zero() from zero\n"); 251 if (!refcount_add_not_zero(3, &zero)) { 252 pr_info("Good: zero detected\n"); 253 if (refcount_read(&zero) == 0) 254 pr_info("Correctly stayed at zero\n"); 255 else 256 pr_err("Fail: refcount went past zero\n"); 257 } else { 258 pr_err("Fail: Zero not detected!?\n"); 259 } 260 261 pr_info("attempting bad refcount_add() from zero\n"); 262 refcount_add(3, &zero); 263 264 check_from_zero(&zero); 265 } 266 267 static void check_saturated(refcount_t *ref) 268 { 269 switch (refcount_read(ref)) { 270 case REFCOUNT_SATURATED: 271 pr_info("Saturation detected: still saturated\n"); 272 break; 273 case REFCOUNT_MAX: 274 pr_warn("Saturation detected: unsafely reset to max\n"); 275 break; 276 default: 277 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref)); 278 } 279 } 280 281 /* 282 * A refcount_inc() from a saturated value should at most warn about 283 * being saturated already. 284 */ 285 static void lkdtm_REFCOUNT_INC_SATURATED(void) 286 { 287 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED); 288 289 pr_info("attempting bad refcount_inc() from saturated\n"); 290 refcount_inc(&sat); 291 292 check_saturated(&sat); 293 } 294 295 /* Should act like refcount_inc() above from saturated. */ 296 static void lkdtm_REFCOUNT_DEC_SATURATED(void) 297 { 298 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED); 299 300 pr_info("attempting bad refcount_dec() from saturated\n"); 301 refcount_dec(&sat); 302 303 check_saturated(&sat); 304 } 305 306 /* Should act like refcount_inc() above from saturated. */ 307 static void lkdtm_REFCOUNT_ADD_SATURATED(void) 308 { 309 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED); 310 311 pr_info("attempting bad refcount_dec() from saturated\n"); 312 refcount_add(8, &sat); 313 314 check_saturated(&sat); 315 } 316 317 /* Should act like refcount_inc() above from saturated. */ 318 static void lkdtm_REFCOUNT_INC_NOT_ZERO_SATURATED(void) 319 { 320 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED); 321 322 pr_info("attempting bad refcount_inc_not_zero() from saturated\n"); 323 if (!refcount_inc_not_zero(&sat)) 324 pr_warn("Weird: refcount_inc_not_zero() reported zero\n"); 325 326 check_saturated(&sat); 327 } 328 329 /* Should act like refcount_inc() above from saturated. */ 330 static void lkdtm_REFCOUNT_ADD_NOT_ZERO_SATURATED(void) 331 { 332 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED); 333 334 pr_info("attempting bad refcount_add_not_zero() from saturated\n"); 335 if (!refcount_add_not_zero(7, &sat)) 336 pr_warn("Weird: refcount_add_not_zero() reported zero\n"); 337 338 check_saturated(&sat); 339 } 340 341 /* Should act like refcount_inc() above from saturated. */ 342 static void lkdtm_REFCOUNT_DEC_AND_TEST_SATURATED(void) 343 { 344 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED); 345 346 pr_info("attempting bad refcount_dec_and_test() from saturated\n"); 347 if (refcount_dec_and_test(&sat)) 348 pr_warn("Weird: refcount_dec_and_test() reported zero\n"); 349 350 check_saturated(&sat); 351 } 352 353 /* Should act like refcount_inc() above from saturated. */ 354 static void lkdtm_REFCOUNT_SUB_AND_TEST_SATURATED(void) 355 { 356 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED); 357 358 pr_info("attempting bad refcount_sub_and_test() from saturated\n"); 359 if (refcount_sub_and_test(8, &sat)) 360 pr_warn("Weird: refcount_sub_and_test() reported zero\n"); 361 362 check_saturated(&sat); 363 } 364 365 /* Used to time the existing atomic_t when used for reference counting */ 366 static void lkdtm_ATOMIC_TIMING(void) 367 { 368 unsigned int i; 369 atomic_t count = ATOMIC_INIT(1); 370 371 for (i = 0; i < INT_MAX - 1; i++) 372 atomic_inc(&count); 373 374 for (i = INT_MAX; i > 0; i--) 375 if (atomic_dec_and_test(&count)) 376 break; 377 378 if (i != 1) 379 pr_err("atomic timing: out of sync up/down cycle: %u\n", i - 1); 380 else 381 pr_info("atomic timing: done\n"); 382 } 383 384 /* 385 * This can be compared to ATOMIC_TIMING when implementing fast refcount 386 * protections. Looking at the number of CPU cycles tells the real story 387 * about performance. For example: 388 * cd /sys/kernel/debug/provoke-crash 389 * perf stat -B -- cat <(echo REFCOUNT_TIMING) > DIRECT 390 */ 391 static void lkdtm_REFCOUNT_TIMING(void) 392 { 393 unsigned int i; 394 refcount_t count = REFCOUNT_INIT(1); 395 396 for (i = 0; i < INT_MAX - 1; i++) 397 refcount_inc(&count); 398 399 for (i = INT_MAX; i > 0; i--) 400 if (refcount_dec_and_test(&count)) 401 break; 402 403 if (i != 1) 404 pr_err("refcount: out of sync up/down cycle: %u\n", i - 1); 405 else 406 pr_info("refcount timing: done\n"); 407 } 408 409 static struct crashtype crashtypes[] = { 410 CRASHTYPE(REFCOUNT_INC_OVERFLOW), 411 CRASHTYPE(REFCOUNT_ADD_OVERFLOW), 412 CRASHTYPE(REFCOUNT_INC_NOT_ZERO_OVERFLOW), 413 CRASHTYPE(REFCOUNT_ADD_NOT_ZERO_OVERFLOW), 414 CRASHTYPE(REFCOUNT_DEC_ZERO), 415 CRASHTYPE(REFCOUNT_DEC_NEGATIVE), 416 CRASHTYPE(REFCOUNT_DEC_AND_TEST_NEGATIVE), 417 CRASHTYPE(REFCOUNT_SUB_AND_TEST_NEGATIVE), 418 CRASHTYPE(REFCOUNT_SUB_AND_TEST_ZERO), 419 CRASHTYPE(REFCOUNT_INC_ZERO), 420 CRASHTYPE(REFCOUNT_ADD_ZERO), 421 CRASHTYPE(REFCOUNT_INC_SATURATED), 422 CRASHTYPE(REFCOUNT_DEC_SATURATED), 423 CRASHTYPE(REFCOUNT_ADD_SATURATED), 424 CRASHTYPE(REFCOUNT_INC_NOT_ZERO_SATURATED), 425 CRASHTYPE(REFCOUNT_ADD_NOT_ZERO_SATURATED), 426 CRASHTYPE(REFCOUNT_DEC_AND_TEST_SATURATED), 427 CRASHTYPE(REFCOUNT_SUB_AND_TEST_SATURATED), 428 CRASHTYPE(ATOMIC_TIMING), 429 CRASHTYPE(REFCOUNT_TIMING), 430 }; 431 432 struct crashtype_category refcount_crashtypes = { 433 .crashtypes = crashtypes, 434 .len = ARRAY_SIZE(crashtypes), 435 }; 436