write in 30M

hc

2024-02-20 ea08eeccae9297f7aabd2ef7f0c2517ac4549acc

 kernel/drivers/misc/lkdtm/perms.c
..
..
@@ -57,6 +57,7 @@
57
57
 	}
58
58
 	pr_info("attempting bad execution at %px\n", func);
59
59
 	func();
60
+	pr_err("FAIL: func returned\n");
60
61
 }
61
62
 
62
63
 static void execute_user_location(void *dst)
..
..
@@ -75,20 +76,22 @@
75
76
 		return;
76
77
 	pr_info("attempting bad execution at %px\n", func);
77
78
 	func();
79
+	pr_err("FAIL: func returned\n");
78
80
 }
79
81
 
80
82
 void lkdtm_WRITE_RO(void)
81
83
 {
82
-	/* Explicitly cast away "const" for the test. */
83
-	unsigned long *ptr = (unsigned long *)&rodata;
84
+	/* Explicitly cast away "const" for the test and make volatile. */
85
+	volatile unsigned long *ptr = (unsigned long *)&rodata;
84
86
 
85
87
 	pr_info("attempting bad rodata write at %px\n", ptr);
86
88
 	*ptr ^= 0xabcd1234;
89
+	pr_err("FAIL: survived bad write\n");
87
90
 }
88
91
 
89
92
 void lkdtm_WRITE_RO_AFTER_INIT(void)
90
93
 {
91
-	unsigned long *ptr = &ro_after_init;
94
+	volatile unsigned long *ptr = &ro_after_init;
92
95
 
93
96
 	/*
94
97
 	 * Verify we were written to during init. Since an Oops
..
..
@@ -102,19 +105,21 @@
102
105
 
103
106
 	pr_info("attempting bad ro_after_init write at %px\n", ptr);
104
107
 	*ptr ^= 0xabcd1234;
108
+	pr_err("FAIL: survived bad write\n");
105
109
 }
106
110
 
107
111
 void lkdtm_WRITE_KERN(void)
108
112
 {
109
113
 	size_t size;
110
-	unsigned char *ptr;
114
+	volatile unsigned char *ptr;
111
115
 
112
116
 	size = (unsigned long)do_overwritten - (unsigned long)do_nothing;
113
117
 	ptr = (unsigned char *)do_overwritten;
114
118
 
115
119
 	pr_info("attempting bad %zu byte write at %px\n", size, ptr);
116
-	memcpy(ptr, (unsigned char *)do_nothing, size);
120
+	memcpy((void *)ptr, (unsigned char *)do_nothing, size);
117
121
 	flush_icache_range((unsigned long)ptr, (unsigned long)(ptr + size));
122
+	pr_err("FAIL: survived bad write\n");
118
123
 
119
124
 	do_overwritten();
120
125
 }
..
..
@@ -193,9 +198,11 @@
193
198
 	pr_info("attempting bad read at %px\n", ptr);
194
199
 	tmp = *ptr;
195
200
 	tmp += 0xc0dec0de;
201
+	pr_err("FAIL: survived bad read\n");
196
202
 
197
203
 	pr_info("attempting bad write at %px\n", ptr);
198
204
 	*ptr = tmp;
205
+	pr_err("FAIL: survived bad write\n");
199
206
 
200
207
 	vm_munmap(user_addr, PAGE_SIZE);
201
208
 }
..
..
@@ -203,19 +210,20 @@
203
210
 void lkdtm_ACCESS_NULL(void)
204
211
 {
205
212
 	unsigned long tmp;
206
-	unsigned long *ptr = (unsigned long *)NULL;
213
+	volatile unsigned long *ptr = (unsigned long *)NULL;
207
214
 
208
215
 	pr_info("attempting bad read at %px\n", ptr);
209
216
 	tmp = *ptr;
210
217
 	tmp += 0xc0dec0de;
218
+	pr_err("FAIL: survived bad read\n");
211
219
 
212
220
 	pr_info("attempting bad write at %px\n", ptr);
213
221
 	*ptr = tmp;
222
+	pr_err("FAIL: survived bad write\n");
214
223
 }
215
224
 
216
225
 void __init lkdtm_perms_init(void)
217
226
 {
218
227
 	/* Make sure we can write to __ro_after_init values during __init */
219
228
 	ro_after_init |= 0xAA;
220
-
221
229
 }