[linux.git] / lib / test_kasan.c

/*
 *
 * Copyright (c) 2014 Samsung Electronics Co., Ltd.
 * Author: Andrey Ryabinin <[email protected]>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 */

#define pr_fmt(fmt) "kasan test: %s " fmt, __func__

#include <linux/kernel.h>
#include <linux/mman.h>
#include <linux/mm.h>
#include <linux/printk.h>
#include <linux/slab.h>
#include <linux/string.h>
#include <linux/uaccess.h>
#include <linux/module.h>

/*
 * Note: test functions are marked noinline so that their names appear in
 * reports.
 */

static noinline void __init kmalloc_oob_right(void)
{
	char *ptr;
	size_t size = 123;

	pr_info("out-of-bounds to right\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	ptr[size] = 'x';
	kfree(ptr);
}

static noinline void __init kmalloc_oob_left(void)
{
	char *ptr;
	size_t size = 15;

	pr_info("out-of-bounds to left\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	*ptr = *(ptr - 1);
	kfree(ptr);
}

static noinline void __init kmalloc_node_oob_right(void)
{
	char *ptr;
	size_t size = 4096;

	pr_info("kmalloc_node(): out-of-bounds to right\n");
	ptr = kmalloc_node(size, GFP_KERNEL, 0);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	ptr[size] = 0;
	kfree(ptr);
}

#ifdef CONFIG_SLUB
static noinline void __init kmalloc_pagealloc_oob_right(void)
{
	char *ptr;
	size_t size = KMALLOC_MAX_CACHE_SIZE + 10;

	/* Allocate a chunk that does not fit into a SLUB cache to trigger
	 * the page allocator fallback.
	 */
	pr_info("kmalloc pagealloc allocation: out-of-bounds to right\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	ptr[size] = 0;
	kfree(ptr);
}
#endif

static noinline void __init kmalloc_large_oob_right(void)
{
	char *ptr;
	size_t size = KMALLOC_MAX_CACHE_SIZE - 256;
	/* Allocate a chunk that is large enough, but still fits into a slab
	 * and does not trigger the page allocator fallback in SLUB.
	 */
	pr_info("kmalloc large allocation: out-of-bounds to right\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	ptr[size] = 0;
	kfree(ptr);
}

static noinline void __init kmalloc_oob_krealloc_more(void)
{
	char *ptr1, *ptr2;
	size_t size1 = 17;
	size_t size2 = 19;

	pr_info("out-of-bounds after krealloc more\n");
	ptr1 = kmalloc(size1, GFP_KERNEL);
	ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
	if (!ptr1 || !ptr2) {
		pr_err("Allocation failed\n");
		kfree(ptr1);
		return;
	}

	ptr2[size2] = 'x';
	kfree(ptr2);
}

static noinline void __init kmalloc_oob_krealloc_less(void)
{
	char *ptr1, *ptr2;
	size_t size1 = 17;
	size_t size2 = 15;

	pr_info("out-of-bounds after krealloc less\n");
	ptr1 = kmalloc(size1, GFP_KERNEL);
	ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
	if (!ptr1 || !ptr2) {
		pr_err("Allocation failed\n");
		kfree(ptr1);
		return;
	}
	ptr2[size2] = 'x';
	kfree(ptr2);
}

static noinline void __init kmalloc_oob_16(void)
{
	struct {
		u64 words[2];
	} *ptr1, *ptr2;

	pr_info("kmalloc out-of-bounds for 16-bytes access\n");
	ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL);
	ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
	if (!ptr1 || !ptr2) {
		pr_err("Allocation failed\n");
		kfree(ptr1);
		kfree(ptr2);
		return;
	}
	*ptr1 = *ptr2;
	kfree(ptr1);
	kfree(ptr2);
}

static noinline void __init kmalloc_oob_memset_2(void)
{
	char *ptr;
	size_t size = 8;

	pr_info("out-of-bounds in memset2\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	memset(ptr+7, 0, 2);
	kfree(ptr);
}

static noinline void __init kmalloc_oob_memset_4(void)
{
	char *ptr;
	size_t size = 8;

	pr_info("out-of-bounds in memset4\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	memset(ptr+5, 0, 4);
	kfree(ptr);
}


static noinline void __init kmalloc_oob_memset_8(void)
{
	char *ptr;
	size_t size = 8;

	pr_info("out-of-bounds in memset8\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	memset(ptr+1, 0, 8);
	kfree(ptr);
}

static noinline void __init kmalloc_oob_memset_16(void)
{
	char *ptr;
	size_t size = 16;

	pr_info("out-of-bounds in memset16\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	memset(ptr+1, 0, 16);
	kfree(ptr);
}

static noinline void __init kmalloc_oob_in_memset(void)
{
	char *ptr;
	size_t size = 666;

	pr_info("out-of-bounds in memset\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	memset(ptr, 0, size+5);
	kfree(ptr);
}

static noinline void __init kmalloc_uaf(void)
{
	char *ptr;
	size_t size = 10;

	pr_info("use-after-free\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	kfree(ptr);
	*(ptr + 8) = 'x';
}

static noinline void __init kmalloc_uaf_memset(void)
{
	char *ptr;
	size_t size = 33;

	pr_info("use-after-free in memset\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}

	kfree(ptr);
	memset(ptr, 0, size);
}

static noinline void __init kmalloc_uaf2(void)
{
	char *ptr1, *ptr2;
	size_t size = 43;

	pr_info("use-after-free after another kmalloc\n");
	ptr1 = kmalloc(size, GFP_KERNEL);
	if (!ptr1) {
		pr_err("Allocation failed\n");
		return;
	}

	kfree(ptr1);
	ptr2 = kmalloc(size, GFP_KERNEL);
	if (!ptr2) {
		pr_err("Allocation failed\n");
		return;
	}

	ptr1[40] = 'x';
	if (ptr1 == ptr2)
		pr_err("Could not detect use-after-free: ptr1 == ptr2\n");
	kfree(ptr2);
}

static noinline void __init kmem_cache_oob(void)
{
	char *p;
	size_t size = 200;
	struct kmem_cache *cache = kmem_cache_create("test_cache",
						size, 0,
						0, NULL);
	if (!cache) {
		pr_err("Cache allocation failed\n");
		return;
	}
	pr_info("out-of-bounds in kmem_cache_alloc\n");
	p = kmem_cache_alloc(cache, GFP_KERNEL);
	if (!p) {
		pr_err("Allocation failed\n");
		kmem_cache_destroy(cache);
		return;
	}

	*p = p[size];
	kmem_cache_free(cache, p);
	kmem_cache_destroy(cache);
}

static char global_array[10];

static noinline void __init kasan_global_oob(void)
{
	volatile int i = 3;
	char *p = &global_array[ARRAY_SIZE(global_array) + i];

	pr_info("out-of-bounds global variable\n");
	*(volatile char *)p;
}

static noinline void __init kasan_stack_oob(void)
{
	char stack_array[10];
	volatile int i = 0;
	char *p = &stack_array[ARRAY_SIZE(stack_array) + i];

	pr_info("out-of-bounds on stack\n");
	*(volatile char *)p;
}

static noinline void __init ksize_unpoisons_memory(void)
{
	char *ptr;
	size_t size = 123, real_size = size;

	pr_info("ksize() unpoisons the whole allocated chunk\n");
	ptr = kmalloc(size, GFP_KERNEL);
	if (!ptr) {
		pr_err("Allocation failed\n");
		return;
	}
	real_size = ksize(ptr);
	/* This access doesn't trigger an error. */
	ptr[size] = 'x';
	/* This one does. */
	ptr[real_size] = 'y';
	kfree(ptr);
}

static noinline void __init copy_user_test(void)
{
	char *kmem;
	char __user *usermem;
	size_t size = 10;
	int unused;

	kmem = kmalloc(size, GFP_KERNEL);
	if (!kmem)
		return;

	usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE,
			    PROT_READ | PROT_WRITE | PROT_EXEC,
			    MAP_ANONYMOUS | MAP_PRIVATE, 0);
	if (IS_ERR(usermem)) {
		pr_err("Failed to allocate user memory\n");
		kfree(kmem);
		return;
	}

	pr_info("out-of-bounds in copy_from_user()\n");
	unused = copy_from_user(kmem, usermem, size + 1);

	pr_info("out-of-bounds in copy_to_user()\n");
	unused = copy_to_user(usermem, kmem, size + 1);

	pr_info("out-of-bounds in __copy_from_user()\n");
	unused = __copy_from_user(kmem, usermem, size + 1);

	pr_info("out-of-bounds in __copy_to_user()\n");
	unused = __copy_to_user(usermem, kmem, size + 1);

	pr_info("out-of-bounds in __copy_from_user_inatomic()\n");
	unused = __copy_from_user_inatomic(kmem, usermem, size + 1);

	pr_info("out-of-bounds in __copy_to_user_inatomic()\n");
	unused = __copy_to_user_inatomic(usermem, kmem, size + 1);

	pr_info("out-of-bounds in strncpy_from_user()\n");
	unused = strncpy_from_user(kmem, usermem, size + 1);

	vm_munmap((unsigned long)usermem, PAGE_SIZE);
	kfree(kmem);
}

static noinline void __init use_after_scope_test(void)
{
	volatile char *volatile p;

	pr_info("use-after-scope on int\n");
	{
		int local = 0;

		p = (char *)&local;
	}
	p[0] = 1;
	p[3] = 1;

	pr_info("use-after-scope on array\n");
	{
		char local[1024] = {0};

		p = local;
	}
	p[0] = 1;
	p[1023] = 1;
}

static int __init kmalloc_tests_init(void)
{
	kmalloc_oob_right();
	kmalloc_oob_left();
	kmalloc_node_oob_right();
#ifdef CONFIG_SLUB
	kmalloc_pagealloc_oob_right();
#endif
	kmalloc_large_oob_right();
	kmalloc_oob_krealloc_more();
	kmalloc_oob_krealloc_less();
	kmalloc_oob_16();
	kmalloc_oob_in_memset();
	kmalloc_oob_memset_2();
	kmalloc_oob_memset_4();
	kmalloc_oob_memset_8();
	kmalloc_oob_memset_16();
	kmalloc_uaf();
	kmalloc_uaf_memset();
	kmalloc_uaf2();
	kmem_cache_oob();
	kasan_stack_oob();
	kasan_global_oob();
	ksize_unpoisons_memory();
	copy_user_test();
	use_after_scope_test();
	return -EAGAIN;
}

module_init(kmalloc_tests_init);
MODULE_LICENSE("GPL");
Commit	Line	Data
3f15801c AR	1	/*
	2	*
	3	* Copyright (c) 2014 Samsung Electronics Co., Ltd.
	4	* Author: Andrey Ryabinin <[email protected]>
	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License version 2 as
	8	* published by the Free Software Foundation.
	9	*
	10	*/
	11
	12	#define pr_fmt(fmt) "kasan test: %s " fmt, __func__
	13
	14	#include <linux/kernel.h>
eae08dca AR	15	#include <linux/mman.h>
eae08dca AR	16	#include <linux/mm.h>
3f15801c AR	17	#include <linux/printk.h>
	18	#include <linux/slab.h>
	19	#include <linux/string.h>
eae08dca	20	#include <linux/uaccess.h>
3f15801c AR	21	#include <linux/module.h>
3f15801c AR	22
828347f8 DV	23	/*
	24	* Note: test functions are marked noinline so that their names appear in
	25	* reports.
	26	*/
	27
3f15801c AR	28	static noinline void __init kmalloc_oob_right(void)
	29	{
	30	char *ptr;
	31	size_t size = 123;
	32
	33	pr_info("out-of-bounds to right\n");
	34	ptr = kmalloc(size, GFP_KERNEL);
	35	if (!ptr) {
	36	pr_err("Allocation failed\n");
	37	return;
	38	}
	39
	40	ptr[size] = 'x';
	41	kfree(ptr);
	42	}
	43
	44	static noinline void __init kmalloc_oob_left(void)
	45	{
	46	char *ptr;
	47	size_t size = 15;
	48
	49	pr_info("out-of-bounds to left\n");
	50	ptr = kmalloc(size, GFP_KERNEL);
	51	if (!ptr) {
	52	pr_err("Allocation failed\n");
	53	return;
	54	}
	55
	56	ptr = (ptr - 1);
	57	kfree(ptr);
	58	}
	59
	60	static noinline void __init kmalloc_node_oob_right(void)
	61	{
	62	char *ptr;
	63	size_t size = 4096;
	64
	65	pr_info("kmalloc_node(): out-of-bounds to right\n");
	66	ptr = kmalloc_node(size, GFP_KERNEL, 0);
	67	if (!ptr) {
	68	pr_err("Allocation failed\n");
	69	return;
	70	}
	71
	72	ptr[size] = 0;
	73	kfree(ptr);
	74	}
	75
e6e8379c AP	76	#ifdef CONFIG_SLUB
e6e8379c AP	77	static noinline void __init kmalloc_pagealloc_oob_right(void)
3f15801c AR	78	{
	79	char *ptr;
	80	size_t size = KMALLOC_MAX_CACHE_SIZE + 10;
	81
e6e8379c AP	82	/* Allocate a chunk that does not fit into a SLUB cache to trigger
	83	* the page allocator fallback.
	84	*/
	85	pr_info("kmalloc pagealloc allocation: out-of-bounds to right\n");
	86	ptr = kmalloc(size, GFP_KERNEL);
	87	if (!ptr) {
	88	pr_err("Allocation failed\n");
	89	return;
	90	}
	91
	92	ptr[size] = 0;
	93	kfree(ptr);
	94	}
	95	#endif
	96
	97	static noinline void __init kmalloc_large_oob_right(void)
	98	{
	99	char *ptr;
	100	size_t size = KMALLOC_MAX_CACHE_SIZE - 256;
	101	/* Allocate a chunk that is large enough, but still fits into a slab
	102	* and does not trigger the page allocator fallback in SLUB.
	103	*/
3f15801c AR	104	pr_info("kmalloc large allocation: out-of-bounds to right\n");
	105	ptr = kmalloc(size, GFP_KERNEL);
	106	if (!ptr) {
	107	pr_err("Allocation failed\n");
	108	return;
	109	}
	110
	111	ptr[size] = 0;
	112	kfree(ptr);
	113	}
	114
	115	static noinline void __init kmalloc_oob_krealloc_more(void)
	116	{
	117	char ptr1, ptr2;
	118	size_t size1 = 17;
	119	size_t size2 = 19;
	120
	121	pr_info("out-of-bounds after krealloc more\n");
	122	ptr1 = kmalloc(size1, GFP_KERNEL);
	123	ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
	124	if (!ptr1 \|\| !ptr2) {
	125	pr_err("Allocation failed\n");
	126	kfree(ptr1);
	127	return;
	128	}
	129
	130	ptr2[size2] = 'x';
	131	kfree(ptr2);
	132	}
	133
	134	static noinline void __init kmalloc_oob_krealloc_less(void)
	135	{
	136	char ptr1, ptr2;
	137	size_t size1 = 17;
	138	size_t size2 = 15;
	139
	140	pr_info("out-of-bounds after krealloc less\n");
	141	ptr1 = kmalloc(size1, GFP_KERNEL);
	142	ptr2 = krealloc(ptr1, size2, GFP_KERNEL);
	143	if (!ptr1 \|\| !ptr2) {
	144	pr_err("Allocation failed\n");
	145	kfree(ptr1);
	146	return;
	147	}
6b4a35fc	148	ptr2[size2] = 'x';
3f15801c AR	149	kfree(ptr2);
	150	}
	151
	152	static noinline void __init kmalloc_oob_16(void)
	153	{
	154	struct {
	155	u64 words[2];
	156	} ptr1, ptr2;
	157
	158	pr_info("kmalloc out-of-bounds for 16-bytes access\n");
	159	ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL);
	160	ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
	161	if (!ptr1 \|\| !ptr2) {
	162	pr_err("Allocation failed\n");
	163	kfree(ptr1);
	164	kfree(ptr2);
	165	return;
	166	}
	167	ptr1 = ptr2;
	168	kfree(ptr1);
	169	kfree(ptr2);
	170	}
	171
f523e737 WL	172	static noinline void __init kmalloc_oob_memset_2(void)
	173	{
	174	char *ptr;
	175	size_t size = 8;
	176
	177	pr_info("out-of-bounds in memset2\n");
	178	ptr = kmalloc(size, GFP_KERNEL);
	179	if (!ptr) {
	180	pr_err("Allocation failed\n");
	181	return;
	182	}
	183
	184	memset(ptr+7, 0, 2);
	185	kfree(ptr);
	186	}
	187
	188	static noinline void __init kmalloc_oob_memset_4(void)
	189	{
	190	char *ptr;
	191	size_t size = 8;
	192
	193	pr_info("out-of-bounds in memset4\n");
	194	ptr = kmalloc(size, GFP_KERNEL);
	195	if (!ptr) {
	196	pr_err("Allocation failed\n");
	197	return;
	198	}
	199
	200	memset(ptr+5, 0, 4);
	201	kfree(ptr);
	202	}
	203
	204
	205	static noinline void __init kmalloc_oob_memset_8(void)
	206	{
	207	char *ptr;
	208	size_t size = 8;
	209
	210	pr_info("out-of-bounds in memset8\n");
	211	ptr = kmalloc(size, GFP_KERNEL);
	212	if (!ptr) {
	213	pr_err("Allocation failed\n");
	214	return;
	215	}
	216
	217	memset(ptr+1, 0, 8);
	218	kfree(ptr);
	219	}
	220
	221	static noinline void __init kmalloc_oob_memset_16(void)
	222	{
	223	char *ptr;
	224	size_t size = 16;
	225
	226	pr_info("out-of-bounds in memset16\n");
	227	ptr = kmalloc(size, GFP_KERNEL);
	228	if (!ptr) {
	229	pr_err("Allocation failed\n");
	230	return;
	231	}
	232
	233	memset(ptr+1, 0, 16);
	234	kfree(ptr);
	235	}
236
3f15801c AR	237	static noinline void __init kmalloc_oob_in_memset(void)
	238	{
	239	char *ptr;
	240	size_t size = 666;
	241
	242	pr_info("out-of-bounds in memset\n");
	243	ptr = kmalloc(size, GFP_KERNEL);
	244	if (!ptr) {
	245	pr_err("Allocation failed\n");
	246	return;
	247	}
	248
	249	memset(ptr, 0, size+5);
	250	kfree(ptr);
	251	}
	252
	253	static noinline void __init kmalloc_uaf(void)
	254	{
	255	char *ptr;
	256	size_t size = 10;
	257
	258	pr_info("use-after-free\n");
	259	ptr = kmalloc(size, GFP_KERNEL);
	260	if (!ptr) {
	261	pr_err("Allocation failed\n");
	262	return;
	263	}
	264
	265	kfree(ptr);
	266	*(ptr + 8) = 'x';
	267	}
	268
	269	static noinline void __init kmalloc_uaf_memset(void)
	270	{
	271	char *ptr;
	272	size_t size = 33;
	273
	274	pr_info("use-after-free in memset\n");
	275	ptr = kmalloc(size, GFP_KERNEL);
	276	if (!ptr) {
	277	pr_err("Allocation failed\n");
	278	return;
	279	}
	280
	281	kfree(ptr);
	282	memset(ptr, 0, size);
	283	}
	284
	285	static noinline void __init kmalloc_uaf2(void)
	286	{
	287	char ptr1, ptr2;
	288	size_t size = 43;
	289
	290	pr_info("use-after-free after another kmalloc\n");
	291	ptr1 = kmalloc(size, GFP_KERNEL);
	292	if (!ptr1) {
	293	pr_err("Allocation failed\n");
	294	return;
	295	}
	296
	297	kfree(ptr1);
	298	ptr2 = kmalloc(size, GFP_KERNEL);
	299	if (!ptr2) {
	300	pr_err("Allocation failed\n");
301	return;
302	}
303
304	ptr1[40] = 'x';
9dcadd38 AP	305	if (ptr1 == ptr2)
9dcadd38 AP	306	pr_err("Could not detect use-after-free: ptr1 == ptr2\n");
3f15801c AR	307	kfree(ptr2);
	308	}
	309
	310	static noinline void __init kmem_cache_oob(void)
	311	{
	312	char *p;
	313	size_t size = 200;
	314	struct kmem_cache *cache = kmem_cache_create("test_cache",
	315	size, 0,
	316	0, NULL);
	317	if (!cache) {
	318	pr_err("Cache allocation failed\n");
	319	return;
	320	}
	321	pr_info("out-of-bounds in kmem_cache_alloc\n");
	322	p = kmem_cache_alloc(cache, GFP_KERNEL);
	323	if (!p) {
	324	pr_err("Allocation failed\n");
	325	kmem_cache_destroy(cache);
	326	return;
	327	}
	328
	329	*p = p[size];
	330	kmem_cache_free(cache, p);
	331	kmem_cache_destroy(cache);
	332	}
	333
	334	static char global_array[10];
	335
	336	static noinline void __init kasan_global_oob(void)
	337	{
	338	volatile int i = 3;
	339	char *p = &global_array[ARRAY_SIZE(global_array) + i];
	340
	341	pr_info("out-of-bounds global variable\n");
	342	(volatile char )p;
	343	}
	344
	345	static noinline void __init kasan_stack_oob(void)
	346	{
	347	char stack_array[10];
	348	volatile int i = 0;
	349	char *p = &stack_array[ARRAY_SIZE(stack_array) + i];
	350
	351	pr_info("out-of-bounds on stack\n");
	352	(volatile char )p;
	353	}
	354
96fe805f AP	355	static noinline void __init ksize_unpoisons_memory(void)
	356	{
	357	char *ptr;
	358	size_t size = 123, real_size = size;
	359
	360	pr_info("ksize() unpoisons the whole allocated chunk\n");
	361	ptr = kmalloc(size, GFP_KERNEL);
	362	if (!ptr) {
	363	pr_err("Allocation failed\n");
	364	return;
	365	}
	366	real_size = ksize(ptr);
	367	/* This access doesn't trigger an error. */
	368	ptr[size] = 'x';
	369	/* This one does. */
	370	ptr[real_size] = 'y';
	371	kfree(ptr);
	372	}
	373
eae08dca AR	374	static noinline void __init copy_user_test(void)
	375	{
	376	char *kmem;
	377	char __user *usermem;
	378	size_t size = 10;
	379	int unused;
	380
	381	kmem = kmalloc(size, GFP_KERNEL);
	382	if (!kmem)
	383	return;
	384
	385	usermem = (char __user *)vm_mmap(NULL, 0, PAGE_SIZE,
	386	PROT_READ \| PROT_WRITE \| PROT_EXEC,
	387	MAP_ANONYMOUS \| MAP_PRIVATE, 0);
	388	if (IS_ERR(usermem)) {
	389	pr_err("Failed to allocate user memory\n");
	390	kfree(kmem);
	391	return;
	392	}
	393
	394	pr_info("out-of-bounds in copy_from_user()\n");
	395	unused = copy_from_user(kmem, usermem, size + 1);
	396
	397	pr_info("out-of-bounds in copy_to_user()\n");
	398	unused = copy_to_user(usermem, kmem, size + 1);
	399
	400	pr_info("out-of-bounds in __copy_from_user()\n");
	401	unused = __copy_from_user(kmem, usermem, size + 1);
	402
	403	pr_info("out-of-bounds in __copy_to_user()\n");
	404	unused = __copy_to_user(usermem, kmem, size + 1);
	405
	406	pr_info("out-of-bounds in __copy_from_user_inatomic()\n");
	407	unused = __copy_from_user_inatomic(kmem, usermem, size + 1);
	408
	409	pr_info("out-of-bounds in __copy_to_user_inatomic()\n");
	410	unused = __copy_to_user_inatomic(usermem, kmem, size + 1);
	411
	412	pr_info("out-of-bounds in strncpy_from_user()\n");
	413	unused = strncpy_from_user(kmem, usermem, size + 1);
	414
	415	vm_munmap((unsigned long)usermem, PAGE_SIZE);
	416	kfree(kmem);
	417	}
	418
828347f8 DV	419	static noinline void __init use_after_scope_test(void)
	420	{
	421	volatile char *volatile p;
	422
	423	pr_info("use-after-scope on int\n");
	424	{
	425	int local = 0;
	426
	427	p = (char *)&local;
	428	}
	429	p[0] = 1;
	430	p[3] = 1;
	431
	432	pr_info("use-after-scope on array\n");
	433	{
	434	char local[1024] = {0};
	435
	436	p = local;
	437	}
	438	p[0] = 1;
	439	p[1023] = 1;
	440	}
	441
3f15801c AR	442	static int __init kmalloc_tests_init(void)
	443	{
	444	kmalloc_oob_right();
	445	kmalloc_oob_left();
	446	kmalloc_node_oob_right();
e6e8379c AP	447	#ifdef CONFIG_SLUB
	448	kmalloc_pagealloc_oob_right();
	449	#endif
9789d8e0	450	kmalloc_large_oob_right();
3f15801c AR	451	kmalloc_oob_krealloc_more();
	452	kmalloc_oob_krealloc_less();
	453	kmalloc_oob_16();
	454	kmalloc_oob_in_memset();
f523e737 WL	455	kmalloc_oob_memset_2();
	456	kmalloc_oob_memset_4();
	457	kmalloc_oob_memset_8();
	458	kmalloc_oob_memset_16();
3f15801c AR	459	kmalloc_uaf();
	460	kmalloc_uaf_memset();
	461	kmalloc_uaf2();
	462	kmem_cache_oob();
	463	kasan_stack_oob();
	464	kasan_global_oob();
96fe805f	465	ksize_unpoisons_memory();
eae08dca	466	copy_user_test();
828347f8	467	use_after_scope_test();
3f15801c AR	468	return -EAGAIN;
	469	}
	470
	471	module_init(kmalloc_tests_init);
	472	MODULE_LICENSE("GPL");