mirror of
https://github.com/torvalds/linux.git
synced 2024-11-22 12:11:40 +00:00
a2f1154705
Adds a smoke test to ensure that KASAN in Rust is actually detecting a Rust-native UAF. There is significant room to expand this test suite, but this will at least ensure that flags are having the intended effect. The rename from kasan_test.c to kasan_test_c.c is in order to allow the single kasan_test.ko test suite to contain both a .o file produced by the C compiler and one produced by rustc. Signed-off-by: Matthew Maurer <mmaurer@google.com> Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com> Link: https://lore.kernel.org/r/20240820194910.187826-5-mmaurer@google.com [ Applied empty line nit, removed double empty line, applied `rustfmt` and formatted crate comment. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
22 lines
552 B
Rust
22 lines
552 B
Rust
// SPDX-License-Identifier: GPL-2.0
|
|
|
|
//! Helper crate for KASAN testing.
|
|
//!
|
|
//! Provides behavior to check the sanitization of Rust code.
|
|
|
|
use core::ptr::addr_of_mut;
|
|
use kernel::prelude::*;
|
|
|
|
/// Trivial UAF - allocate a big vector, grab a pointer partway through,
|
|
/// drop the vector, and touch it.
|
|
#[no_mangle]
|
|
pub extern "C" fn kasan_test_rust_uaf() -> u8 {
|
|
let mut v: Vec<u8> = Vec::new();
|
|
for _ in 0..4096 {
|
|
v.push(0x42, GFP_KERNEL).unwrap();
|
|
}
|
|
let ptr: *mut u8 = addr_of_mut!(v[2048]);
|
|
drop(v);
|
|
unsafe { *ptr }
|
|
}
|