linux-kernel - [RFC 05/19] ktf: Implementation of ktf support for overriding function entry and return.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 13 Aug 2019 08:09:20 +0200
From:   Knut Omang <knut.omang@...cle.com>
To:     linux-kselftest@...r.kernel.org, linux-kernel@...r.kernel.org
Cc:     linux-doc@...r.kernel.org, linux-kbuild@...r.kernel.org,
        Shuah Khan <shuah@...nel.org>,
        Jonathan Corbet <corbet@....net>,
        Masahiro Yamada <yamada.masahiro@...ionext.com>,
        Michal Marek <michal.lkml@...kovi.net>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Shreyans Devendra Doshi <0xinfosect0r@...il.com>,
        Alan Maguire <alan.maguire@...cle.com>,
        Brendan Higgins <brendanhiggins@...gle.com>,
        Kevin Hilman <khilman@...libre.com>,
        Hidenori Yamaji <hidenori.yamaji@...y.com>,
        Frank Rowand <frowand.list@...il.com>,
        Timothy Bird <Tim.Bird@...y.com>,
        Luis Chamberlain <mcgrof@...nel.org>,
        "Theodore Ts'o" <tytso@....edu>, Daniel Vetter <daniel@...ll.ch>,
        Stephen Boyd <sboyd@...nel.org>,
        Knut Omang <knut.omang@...cle.com>
Subject: [RFC 05/19] ktf: Implementation of ktf support for overriding function entry and return.

From: Alan Maguire <alan.maguire@...cle.com>

This is a very powerful and yet simple way to verify or modify
behaviour of kernel calls. It uses the same technique as the error
injection framework in kernel/fail_function.c to to override function
entry and return. In addition to error injection, this is very useful
to for instance verify that a particular API actually ends up being
called, and in the right way, as an effect of a test.

ktf_override.c:  support for overriding function entry.
ktf_override.h:  Function override support interface for KTF.

Signed-off-by: Alan Maguire <alan.maguire@...cle.com>
Signed-off-by: Knut Omang <knut.omang@...cle.com>
---
 tools/testing/selftests/ktf/kernel/ktf_override.c | 45 ++++++++++++++++-
 tools/testing/selftests/ktf/kernel/ktf_override.h | 15 +++++-
 2 files changed, 60 insertions(+)
 create mode 100644 tools/testing/selftests/ktf/kernel/ktf_override.c
 create mode 100644 tools/testing/selftests/ktf/kernel/ktf_override.h

diff --git a/tools/testing/selftests/ktf/kernel/ktf_override.c b/tools/testing/selftests/ktf/kernel/ktf_override.c
new file mode 100644
index 0000000..7f046c8
--- /dev/null
+++ b/tools/testing/selftests/ktf/kernel/ktf_override.c
@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
+ *    Author: Alan Maguire <alan.maguire@...cle.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0
+ *
+ * ktf_override.c: support for overriding function entry.
+ */
+#include <linux/kprobes.h>
+#include <linux/ptrace.h>
+#include "ktf.h"
+#include "ktf_override.h"
+
+asmlinkage void ktf_just_return_func(void);
+
+asm(
+	".type ktf_just_return_func, @function\n"
+	".globl ktf_just_return_func\n"
+	"ktf_just_return_func:\n"
+	"	ret\n"
+	".size ktf_just_return_func, .-ktf_just_return_func\n"
+);
+
+void ktf_post_handler(struct kprobe *kp, struct pt_regs *regs,
+		      unsigned long flags)
+{
+	/*
+	 * A dummy post handler is required to prohibit optimizing, because
+	 * jump optimization does not support execution path overriding.
+	 */
+}
+EXPORT_SYMBOL(ktf_post_handler);
+
+void ktf_override_function_with_return(struct pt_regs *regs)
+{
+	KTF_SET_INSTRUCTION_POINTER(regs, (unsigned long)&ktf_just_return_func);
+}
+EXPORT_SYMBOL(ktf_override_function_with_return);
+NOKPROBE_SYMBOL(ktf_override_function_with_return);
+
+int ktf_register_override(struct kprobe *kp)
+{
+	return register_kprobe(kp);
+}
+EXPORT_SYMBOL(ktf_register_override);
diff --git a/tools/testing/selftests/ktf/kernel/ktf_override.h b/tools/testing/selftests/ktf/kernel/ktf_override.h
new file mode 100644
index 0000000..8a9cf39
--- /dev/null
+++ b/tools/testing/selftests/ktf/kernel/ktf_override.h
@@ -0,0 +1,15 @@
+/*
+ * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
+ *    Author: Alan Maguire <alan.maguire@...cle.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0
+ *
+ * ktf_override.h: Function override support interface for KTF.
+ */
+#include <linux/kprobes.h>
+#include "ktf.h"
+
+void ktf_post_handler(struct kprobe *kp, struct pt_regs *regs,
+		      unsigned long flags);
+void ktf_override_function_with_return(struct pt_regs *regs);
+int ktf_register_override(struct kprobe *kp);
-- 
git-series 0.9.1