aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--drivers/misc/lkdtm.c16
1 files changed, 16 insertions, 0 deletions
diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
index e910b3c5331c..d6ee1aae3e72 100644
--- a/drivers/misc/lkdtm.c
+++ b/drivers/misc/lkdtm.c
@@ -329,7 +329,12 @@ static void execute_location(void *dst)
329{ 329{
330 void (*func)(void) = dst; 330 void (*func)(void) = dst;
331 331
332 pr_info("attempting ok execution at %p\n", do_nothing);
333 do_nothing();
334
332 memcpy(dst, do_nothing, EXEC_SIZE); 335 memcpy(dst, do_nothing, EXEC_SIZE);
336 flush_icache_range((unsigned long)dst, (unsigned long)dst + EXEC_SIZE);
337 pr_info("attempting bad execution at %p\n", func);
333 func(); 338 func();
334} 339}
335 340
@@ -338,8 +343,13 @@ static void execute_user_location(void *dst)
338 /* Intentionally crossing kernel/user memory boundary. */ 343 /* Intentionally crossing kernel/user memory boundary. */
339 void (*func)(void) = dst; 344 void (*func)(void) = dst;
340 345
346 pr_info("attempting ok execution at %p\n", do_nothing);
347 do_nothing();
348
341 if (copy_to_user((void __user *)dst, do_nothing, EXEC_SIZE)) 349 if (copy_to_user((void __user *)dst, do_nothing, EXEC_SIZE))
342 return; 350 return;
351 flush_icache_range((unsigned long)dst, (unsigned long)dst + EXEC_SIZE);
352 pr_info("attempting bad execution at %p\n", func);
343 func(); 353 func();
344} 354}
345 355
@@ -464,8 +474,12 @@ static void lkdtm_do_action(enum ctype which)
464 } 474 }
465 475
466 ptr = (unsigned long *)user_addr; 476 ptr = (unsigned long *)user_addr;
477
478 pr_info("attempting bad read at %p\n", ptr);
467 tmp = *ptr; 479 tmp = *ptr;
468 tmp += 0xc0dec0de; 480 tmp += 0xc0dec0de;
481
482 pr_info("attempting bad write at %p\n", ptr);
469 *ptr = tmp; 483 *ptr = tmp;
470 484
471 vm_munmap(user_addr, PAGE_SIZE); 485 vm_munmap(user_addr, PAGE_SIZE);
@@ -476,6 +490,8 @@ static void lkdtm_do_action(enum ctype which)
476 unsigned long *ptr; 490 unsigned long *ptr;
477 491
478 ptr = (unsigned long *)&rodata; 492 ptr = (unsigned long *)&rodata;
493
494 pr_info("attempting bad write at %p\n", ptr);
479 *ptr ^= 0xabcd1234; 495 *ptr ^= 0xabcd1234;
480 496
481 break; 497 break;