drivers/misc/lkdtm/heap.c

Source file repositories/reference/linux-study-clean/drivers/misc/lkdtm/heap.c

File Facts

System
Linux kernel
Corpus path
drivers/misc/lkdtm/heap.c
Extension
.c
Size
9840 bytes
Lines
392
Domain
Driver Families
Bucket
drivers/misc
Inferred role
Driver Families: implementation source
Status
source implementation candidate

Why This File Exists

Repeatable hardware-adapter layer. Deep compatibility for every driver is out of scope; this atlas records patterns, probe lifecycles, bus glue, IRQ/DMA usage, and links back to core abstractions.

Dependency Surface

Detected Declarations

Annotated Snippet

if (!base) {
			pr_err("FAIL: Unable to allocate kfence memory!\n");
			return;
		}

		if (is_kfence_address(base)) {
			val = 0x12345678;
			base[offset] = val;
			pr_info("Value in memory before free: %x\n", base[offset]);

			kfree(base);

			pr_info("Attempting bad read from freed memory\n");
			saw = base[offset];
			if (saw != val) {
				/* Good! Poisoning happened, so declare a win. */
				pr_info("Memory correctly poisoned (%x)\n", saw);
			} else {
				pr_err("FAIL: Memory was not poisoned!\n");
				pr_expected_config_param(CONFIG_INIT_ON_FREE_DEFAULT_ON, "init_on_free");
			}
			return;
		}

		kfree(base);
		if (time_after(jiffies, resched_after))
			cond_resched();
	} while (time_before(jiffies, timeout));

	pr_err("FAIL: kfence memory never allocated!\n");
}

static void lkdtm_WRITE_BUDDY_AFTER_FREE(void)
{
	unsigned long p = __get_free_page(GFP_KERNEL);
	if (!p) {
		pr_info("Unable to allocate free page\n");
		return;
	}

	pr_info("Writing to the buddy page before free\n");
	memset((void *)p, 0x3, PAGE_SIZE);
	free_page(p);
	schedule();
	pr_info("Attempting bad write to the buddy page after free\n");
	memset((void *)p, 0x78, PAGE_SIZE);
	/* Attempt to notice the overwrite. */
	p = __get_free_page(GFP_KERNEL);
	free_page(p);
	schedule();
}

static void lkdtm_READ_BUDDY_AFTER_FREE(void)
{
	unsigned long p = __get_free_page(GFP_KERNEL);
	int saw, *val;
	int *base;

	if (!p) {
		pr_info("Unable to allocate free page\n");
		return;
	}

	val = kmalloc(1024, GFP_KERNEL);
	if (!val) {
		pr_info("Unable to allocate val memory.\n");
		free_page(p);
		return;
	}

	base = (int *)p;

	*val = 0x12345678;
	base[0] = *val;
	pr_info("Value in memory before free: %x\n", base[0]);
	free_page(p);
	pr_info("Attempting to read from freed memory\n");
	saw = base[0];
	if (saw != *val) {
		/* Good! Poisoning happened, so declare a win. */
		pr_info("Memory correctly poisoned (%x)\n", saw);
	} else {
		pr_err("FAIL: Buddy page was not poisoned!\n");
		pr_expected_config_param(CONFIG_INIT_ON_FREE_DEFAULT_ON, "init_on_free");
	}

	kfree(val);
}

static void lkdtm_SLAB_INIT_ON_ALLOC(void)

Annotation

Implementation Notes