drivers/misc/lkdtm/usercopy.c
Source file repositories/reference/linux-study-clean/drivers/misc/lkdtm/usercopy.c
File Facts
- System
- Linux kernel
- Corpus path
drivers/misc/lkdtm/usercopy.c- Extension
.c- Size
- 12327 bytes
- Lines
- 458
- Domain
- Driver Families
- Bucket
- drivers/misc
- Inferred role
- Driver Families: implementation source
- Status
- source implementation candidate
Why This File Exists
Repeatable hardware-adapter layer. Deep compatibility for every driver is out of scope; this atlas records patterns, probe lifecycles, bus glue, IRQ/DMA usage, and links back to core abstractions.
- Repeatable hardware-adapter layer. Deep compatibility for every driver is out of scope; this atlas records patterns, probe lifecycles, bus glue, IRQ/DMA usage, and links back to core abstractions.
- Touches user memory; correctness depends on fault-safe copying and privilege boundary handling.
- Allocates kernel memory; connect allocation flags and lifetime to context constraints.
- Defines or uses C structs; map object ownership, embedded links, reference counts, and lock ownership.
Dependency Surface
lkdtm.hlinux/slab.hlinux/highmem.hlinux/vmalloc.hlinux/sched/task_stack.hlinux/mman.hlinux/uaccess.hasm/cacheflush.h
Detected Declarations
function do_usercopy_stackfunction do_usercopy_slab_sizefunction do_usercopy_slab_whitelistfunction lkdtm_USERCOPY_SLAB_SIZE_TOfunction lkdtm_USERCOPY_SLAB_SIZE_FROMfunction lkdtm_USERCOPY_SLAB_WHITELIST_TOfunction lkdtm_USERCOPY_SLAB_WHITELIST_FROMfunction lkdtm_USERCOPY_STACK_FRAME_TOfunction lkdtm_USERCOPY_STACK_FRAME_FROMfunction lkdtm_USERCOPY_STACK_BEYONDfunction lkdtm_USERCOPY_KERNELfunction copy_from_userfunction lkdtm_USERCOPY_VMALLOCfunction lkdtm_USERCOPY_FOLIOfunction lkdtm_usercopy_initfunction lkdtm_usercopy_exit
Annotated Snippet
if (copy_to_user(test_user_addr, test_kern_addr, size / 2)) {
pr_warn("copy_to_user failed unexpectedly?!\n");
goto free_user;
}
pr_info("attempting bad copy_to_user of too large size\n");
if (copy_to_user(test_user_addr, test_kern_addr, size)) {
pr_warn("copy_to_user failed, but lacked Oops\n");
goto free_user;
}
} else {
pr_info("attempting good copy_from_user of correct size\n");
if (copy_from_user(test_kern_addr, test_user_addr, size / 2)) {
pr_warn("copy_from_user failed unexpectedly?!\n");
goto free_user;
}
pr_info("attempting bad copy_from_user of too large size\n");
if (copy_from_user(test_kern_addr, test_user_addr, size)) {
pr_warn("copy_from_user failed, but lacked Oops\n");
goto free_user;
}
}
pr_err("FAIL: bad usercopy not detected!\n");
pr_expected_config_param(CONFIG_HARDENED_USERCOPY, "hardened_usercopy");
free_user:
vm_munmap(user_addr, PAGE_SIZE);
free_kernel:
kfree(one);
kfree(two);
}
/*
* This checks for the specific whitelist window within an object. If this
* test passes, then do_usercopy_slab_size() tests will pass too.
*/
static void do_usercopy_slab_whitelist(bool to_user)
{
unsigned long user_alloc;
unsigned char *buf = NULL;
unsigned char __user *user_addr;
size_t offset, size;
/* Make sure cache was prepared. */
if (!whitelist_cache) {
pr_warn("Failed to allocate kernel cache\n");
return;
}
/*
* Allocate a buffer with a whitelisted window in the buffer.
*/
buf = kmem_cache_alloc(whitelist_cache, GFP_KERNEL);
if (!buf) {
pr_warn("Failed to allocate buffer from whitelist cache\n");
goto free_alloc;
}
/* Allocate user memory we'll poke at. */
user_alloc = vm_mmap(NULL, 0, PAGE_SIZE,
PROT_READ | PROT_WRITE | PROT_EXEC,
MAP_ANONYMOUS | MAP_PRIVATE, 0);
if (user_alloc >= TASK_SIZE) {
pr_warn("Failed to allocate user memory\n");
goto free_alloc;
}
user_addr = (void __user *)user_alloc;
memset(buf, 'B', cache_size);
/* Whitelisted window in buffer, from kmem_cache_create_usercopy. */
offset = (cache_size / 4) + unconst;
size = (cache_size / 16) + unconst;
if (to_user) {
pr_info("attempting good copy_to_user inside whitelist\n");
if (copy_to_user(user_addr, buf + offset, size)) {
pr_warn("copy_to_user failed unexpectedly?!\n");
goto free_user;
}
pr_info("attempting bad copy_to_user outside whitelist\n");
if (copy_to_user(user_addr, buf + offset - 1, size)) {
pr_warn("copy_to_user failed, but lacked Oops\n");
goto free_user;
}
} else {
pr_info("attempting good copy_from_user inside whitelist\n");
if (copy_from_user(buf + offset, user_addr, size)) {
Annotation
- Immediate include surface: `lkdtm.h`, `linux/slab.h`, `linux/highmem.h`, `linux/vmalloc.h`, `linux/sched/task_stack.h`, `linux/mman.h`, `linux/uaccess.h`, `asm/cacheflush.h`.
- Detected declarations: `function do_usercopy_stack`, `function do_usercopy_slab_size`, `function do_usercopy_slab_whitelist`, `function lkdtm_USERCOPY_SLAB_SIZE_TO`, `function lkdtm_USERCOPY_SLAB_SIZE_FROM`, `function lkdtm_USERCOPY_SLAB_WHITELIST_TO`, `function lkdtm_USERCOPY_SLAB_WHITELIST_FROM`, `function lkdtm_USERCOPY_STACK_FRAME_TO`, `function lkdtm_USERCOPY_STACK_FRAME_FROM`, `function lkdtm_USERCOPY_STACK_BEYOND`.
- Atlas domain: Driver Families / drivers/misc.
- Implementation status: source implementation candidate.
- This snippet crosses the user/kernel memory boundary; validate fault handling and access checks before translating the pattern.
Implementation Notes
- This generated page is the file-by-file coverage layer; curated subsystem chapters should link here when they synthesize a multi-file control flow.
- Core OS pages should be promoted from atlas-only to deep-reviewed when they explain data structures, invariants, locking, lifecycle, and C implementation snippets.
- Driver-family pages are intentionally pattern-oriented unless they are part of the selected PCIe/NVMe representative device path.