Loading...
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * This is for all the tests related to refcount bugs (e.g. overflow,
4 * underflow, reaching zero untested, etc).
5 */
6#include "lkdtm.h"
7#include <linux/refcount.h>
8
9static void overflow_check(refcount_t *ref)
10{
11 switch (refcount_read(ref)) {
12 case REFCOUNT_SATURATED:
13 pr_info("Overflow detected: saturated\n");
14 break;
15 case REFCOUNT_MAX:
16 pr_warn("Overflow detected: unsafely reset to max\n");
17 break;
18 default:
19 pr_err("Fail: refcount wrapped to %d\n", refcount_read(ref));
20 }
21}
22
23/*
24 * A refcount_inc() above the maximum value of the refcount implementation,
25 * should at least saturate, and at most also WARN.
26 */
27static void lkdtm_REFCOUNT_INC_OVERFLOW(void)
28{
29 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX - 1);
30
31 pr_info("attempting good refcount_inc() without overflow\n");
32 refcount_dec(&over);
33 refcount_inc(&over);
34
35 pr_info("attempting bad refcount_inc() overflow\n");
36 refcount_inc(&over);
37 refcount_inc(&over);
38
39 overflow_check(&over);
40}
41
42/* refcount_add() should behave just like refcount_inc() above. */
43static void lkdtm_REFCOUNT_ADD_OVERFLOW(void)
44{
45 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX - 1);
46
47 pr_info("attempting good refcount_add() without overflow\n");
48 refcount_dec(&over);
49 refcount_dec(&over);
50 refcount_dec(&over);
51 refcount_dec(&over);
52 refcount_add(4, &over);
53
54 pr_info("attempting bad refcount_add() overflow\n");
55 refcount_add(4, &over);
56
57 overflow_check(&over);
58}
59
60/* refcount_inc_not_zero() should behave just like refcount_inc() above. */
61static void lkdtm_REFCOUNT_INC_NOT_ZERO_OVERFLOW(void)
62{
63 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX);
64
65 pr_info("attempting bad refcount_inc_not_zero() overflow\n");
66 if (!refcount_inc_not_zero(&over))
67 pr_warn("Weird: refcount_inc_not_zero() reported zero\n");
68
69 overflow_check(&over);
70}
71
72/* refcount_add_not_zero() should behave just like refcount_inc() above. */
73static void lkdtm_REFCOUNT_ADD_NOT_ZERO_OVERFLOW(void)
74{
75 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX);
76
77 pr_info("attempting bad refcount_add_not_zero() overflow\n");
78 if (!refcount_add_not_zero(6, &over))
79 pr_warn("Weird: refcount_add_not_zero() reported zero\n");
80
81 overflow_check(&over);
82}
83
84static void check_zero(refcount_t *ref)
85{
86 switch (refcount_read(ref)) {
87 case REFCOUNT_SATURATED:
88 pr_info("Zero detected: saturated\n");
89 break;
90 case REFCOUNT_MAX:
91 pr_warn("Zero detected: unsafely reset to max\n");
92 break;
93 case 0:
94 pr_warn("Still at zero: refcount_inc/add() must not inc-from-0\n");
95 break;
96 default:
97 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
98 }
99}
100
101/*
102 * A refcount_dec(), as opposed to a refcount_dec_and_test(), when it hits
103 * zero it should either saturate (when inc-from-zero isn't protected)
104 * or stay at zero (when inc-from-zero is protected) and should WARN for both.
105 */
106static void lkdtm_REFCOUNT_DEC_ZERO(void)
107{
108 refcount_t zero = REFCOUNT_INIT(2);
109
110 pr_info("attempting good refcount_dec()\n");
111 refcount_dec(&zero);
112
113 pr_info("attempting bad refcount_dec() to zero\n");
114 refcount_dec(&zero);
115
116 check_zero(&zero);
117}
118
119static void check_negative(refcount_t *ref, int start)
120{
121 /*
122 * refcount_t refuses to move a refcount at all on an
123 * over-sub, so we have to track our starting position instead of
124 * looking only at zero-pinning.
125 */
126 if (refcount_read(ref) == start) {
127 pr_warn("Still at %d: refcount_inc/add() must not inc-from-0\n",
128 start);
129 return;
130 }
131
132 switch (refcount_read(ref)) {
133 case REFCOUNT_SATURATED:
134 pr_info("Negative detected: saturated\n");
135 break;
136 case REFCOUNT_MAX:
137 pr_warn("Negative detected: unsafely reset to max\n");
138 break;
139 default:
140 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
141 }
142}
143
144/* A refcount_dec() going negative should saturate and may WARN. */
145static void lkdtm_REFCOUNT_DEC_NEGATIVE(void)
146{
147 refcount_t neg = REFCOUNT_INIT(0);
148
149 pr_info("attempting bad refcount_dec() below zero\n");
150 refcount_dec(&neg);
151
152 check_negative(&neg, 0);
153}
154
155/*
156 * A refcount_dec_and_test() should act like refcount_dec() above when
157 * going negative.
158 */
159static void lkdtm_REFCOUNT_DEC_AND_TEST_NEGATIVE(void)
160{
161 refcount_t neg = REFCOUNT_INIT(0);
162
163 pr_info("attempting bad refcount_dec_and_test() below zero\n");
164 if (refcount_dec_and_test(&neg))
165 pr_warn("Weird: refcount_dec_and_test() reported zero\n");
166
167 check_negative(&neg, 0);
168}
169
170/*
171 * A refcount_sub_and_test() should act like refcount_dec_and_test()
172 * above when going negative.
173 */
174static void lkdtm_REFCOUNT_SUB_AND_TEST_NEGATIVE(void)
175{
176 refcount_t neg = REFCOUNT_INIT(3);
177
178 pr_info("attempting bad refcount_sub_and_test() below zero\n");
179 if (refcount_sub_and_test(5, &neg))
180 pr_warn("Weird: refcount_sub_and_test() reported zero\n");
181
182 check_negative(&neg, 3);
183}
184
185static void check_from_zero(refcount_t *ref)
186{
187 switch (refcount_read(ref)) {
188 case 0:
189 pr_info("Zero detected: stayed at zero\n");
190 break;
191 case REFCOUNT_SATURATED:
192 pr_info("Zero detected: saturated\n");
193 break;
194 case REFCOUNT_MAX:
195 pr_warn("Zero detected: unsafely reset to max\n");
196 break;
197 default:
198 pr_info("Fail: zero not detected, incremented to %d\n",
199 refcount_read(ref));
200 }
201}
202
203/*
204 * A refcount_inc() from zero should pin to zero or saturate and may WARN.
205 */
206static void lkdtm_REFCOUNT_INC_ZERO(void)
207{
208 refcount_t zero = REFCOUNT_INIT(0);
209
210 pr_info("attempting safe refcount_inc_not_zero() from zero\n");
211 if (!refcount_inc_not_zero(&zero)) {
212 pr_info("Good: zero detected\n");
213 if (refcount_read(&zero) == 0)
214 pr_info("Correctly stayed at zero\n");
215 else
216 pr_err("Fail: refcount went past zero!\n");
217 } else {
218 pr_err("Fail: Zero not detected!?\n");
219 }
220
221 pr_info("attempting bad refcount_inc() from zero\n");
222 refcount_inc(&zero);
223
224 check_from_zero(&zero);
225}
226
227/*
228 * A refcount_add() should act like refcount_inc() above when starting
229 * at zero.
230 */
231static void lkdtm_REFCOUNT_ADD_ZERO(void)
232{
233 refcount_t zero = REFCOUNT_INIT(0);
234
235 pr_info("attempting safe refcount_add_not_zero() from zero\n");
236 if (!refcount_add_not_zero(3, &zero)) {
237 pr_info("Good: zero detected\n");
238 if (refcount_read(&zero) == 0)
239 pr_info("Correctly stayed at zero\n");
240 else
241 pr_err("Fail: refcount went past zero\n");
242 } else {
243 pr_err("Fail: Zero not detected!?\n");
244 }
245
246 pr_info("attempting bad refcount_add() from zero\n");
247 refcount_add(3, &zero);
248
249 check_from_zero(&zero);
250}
251
252static void check_saturated(refcount_t *ref)
253{
254 switch (refcount_read(ref)) {
255 case REFCOUNT_SATURATED:
256 pr_info("Saturation detected: still saturated\n");
257 break;
258 case REFCOUNT_MAX:
259 pr_warn("Saturation detected: unsafely reset to max\n");
260 break;
261 default:
262 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
263 }
264}
265
266/*
267 * A refcount_inc() from a saturated value should at most warn about
268 * being saturated already.
269 */
270static void lkdtm_REFCOUNT_INC_SATURATED(void)
271{
272 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
273
274 pr_info("attempting bad refcount_inc() from saturated\n");
275 refcount_inc(&sat);
276
277 check_saturated(&sat);
278}
279
280/* Should act like refcount_inc() above from saturated. */
281static void lkdtm_REFCOUNT_DEC_SATURATED(void)
282{
283 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
284
285 pr_info("attempting bad refcount_dec() from saturated\n");
286 refcount_dec(&sat);
287
288 check_saturated(&sat);
289}
290
291/* Should act like refcount_inc() above from saturated. */
292static void lkdtm_REFCOUNT_ADD_SATURATED(void)
293{
294 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
295
296 pr_info("attempting bad refcount_dec() from saturated\n");
297 refcount_add(8, &sat);
298
299 check_saturated(&sat);
300}
301
302/* Should act like refcount_inc() above from saturated. */
303static void lkdtm_REFCOUNT_INC_NOT_ZERO_SATURATED(void)
304{
305 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
306
307 pr_info("attempting bad refcount_inc_not_zero() from saturated\n");
308 if (!refcount_inc_not_zero(&sat))
309 pr_warn("Weird: refcount_inc_not_zero() reported zero\n");
310
311 check_saturated(&sat);
312}
313
314/* Should act like refcount_inc() above from saturated. */
315static void lkdtm_REFCOUNT_ADD_NOT_ZERO_SATURATED(void)
316{
317 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
318
319 pr_info("attempting bad refcount_add_not_zero() from saturated\n");
320 if (!refcount_add_not_zero(7, &sat))
321 pr_warn("Weird: refcount_add_not_zero() reported zero\n");
322
323 check_saturated(&sat);
324}
325
326/* Should act like refcount_inc() above from saturated. */
327static void lkdtm_REFCOUNT_DEC_AND_TEST_SATURATED(void)
328{
329 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
330
331 pr_info("attempting bad refcount_dec_and_test() from saturated\n");
332 if (refcount_dec_and_test(&sat))
333 pr_warn("Weird: refcount_dec_and_test() reported zero\n");
334
335 check_saturated(&sat);
336}
337
338/* Should act like refcount_inc() above from saturated. */
339static void lkdtm_REFCOUNT_SUB_AND_TEST_SATURATED(void)
340{
341 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
342
343 pr_info("attempting bad refcount_sub_and_test() from saturated\n");
344 if (refcount_sub_and_test(8, &sat))
345 pr_warn("Weird: refcount_sub_and_test() reported zero\n");
346
347 check_saturated(&sat);
348}
349
350/* Used to time the existing atomic_t when used for reference counting */
351static void lkdtm_ATOMIC_TIMING(void)
352{
353 unsigned int i;
354 atomic_t count = ATOMIC_INIT(1);
355
356 for (i = 0; i < INT_MAX - 1; i++)
357 atomic_inc(&count);
358
359 for (i = INT_MAX; i > 0; i--)
360 if (atomic_dec_and_test(&count))
361 break;
362
363 if (i != 1)
364 pr_err("atomic timing: out of sync up/down cycle: %u\n", i - 1);
365 else
366 pr_info("atomic timing: done\n");
367}
368
369/*
370 * This can be compared to ATOMIC_TIMING when implementing fast refcount
371 * protections. Looking at the number of CPU cycles tells the real story
372 * about performance. For example:
373 * cd /sys/kernel/debug/provoke-crash
374 * perf stat -B -- cat <(echo REFCOUNT_TIMING) > DIRECT
375 */
376static void lkdtm_REFCOUNT_TIMING(void)
377{
378 unsigned int i;
379 refcount_t count = REFCOUNT_INIT(1);
380
381 for (i = 0; i < INT_MAX - 1; i++)
382 refcount_inc(&count);
383
384 for (i = INT_MAX; i > 0; i--)
385 if (refcount_dec_and_test(&count))
386 break;
387
388 if (i != 1)
389 pr_err("refcount: out of sync up/down cycle: %u\n", i - 1);
390 else
391 pr_info("refcount timing: done\n");
392}
393
394static struct crashtype crashtypes[] = {
395 CRASHTYPE(REFCOUNT_INC_OVERFLOW),
396 CRASHTYPE(REFCOUNT_ADD_OVERFLOW),
397 CRASHTYPE(REFCOUNT_INC_NOT_ZERO_OVERFLOW),
398 CRASHTYPE(REFCOUNT_ADD_NOT_ZERO_OVERFLOW),
399 CRASHTYPE(REFCOUNT_DEC_ZERO),
400 CRASHTYPE(REFCOUNT_DEC_NEGATIVE),
401 CRASHTYPE(REFCOUNT_DEC_AND_TEST_NEGATIVE),
402 CRASHTYPE(REFCOUNT_SUB_AND_TEST_NEGATIVE),
403 CRASHTYPE(REFCOUNT_INC_ZERO),
404 CRASHTYPE(REFCOUNT_ADD_ZERO),
405 CRASHTYPE(REFCOUNT_INC_SATURATED),
406 CRASHTYPE(REFCOUNT_DEC_SATURATED),
407 CRASHTYPE(REFCOUNT_ADD_SATURATED),
408 CRASHTYPE(REFCOUNT_INC_NOT_ZERO_SATURATED),
409 CRASHTYPE(REFCOUNT_ADD_NOT_ZERO_SATURATED),
410 CRASHTYPE(REFCOUNT_DEC_AND_TEST_SATURATED),
411 CRASHTYPE(REFCOUNT_SUB_AND_TEST_SATURATED),
412 CRASHTYPE(ATOMIC_TIMING),
413 CRASHTYPE(REFCOUNT_TIMING),
414};
415
416struct crashtype_category refcount_crashtypes = {
417 .crashtypes = crashtypes,
418 .len = ARRAY_SIZE(crashtypes),
419};
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * This is for all the tests related to refcount bugs (e.g. overflow,
4 * underflow, reaching zero untested, etc).
5 */
6#include "lkdtm.h"
7#include <linux/refcount.h>
8
9#ifdef CONFIG_REFCOUNT_FULL
10#define REFCOUNT_MAX (UINT_MAX - 1)
11#define REFCOUNT_SATURATED UINT_MAX
12#else
13#define REFCOUNT_MAX INT_MAX
14#define REFCOUNT_SATURATED (INT_MIN / 2)
15#endif
16
17static void overflow_check(refcount_t *ref)
18{
19 switch (refcount_read(ref)) {
20 case REFCOUNT_SATURATED:
21 pr_info("Overflow detected: saturated\n");
22 break;
23 case REFCOUNT_MAX:
24 pr_warn("Overflow detected: unsafely reset to max\n");
25 break;
26 default:
27 pr_err("Fail: refcount wrapped to %d\n", refcount_read(ref));
28 }
29}
30
31/*
32 * A refcount_inc() above the maximum value of the refcount implementation,
33 * should at least saturate, and at most also WARN.
34 */
35void lkdtm_REFCOUNT_INC_OVERFLOW(void)
36{
37 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX - 1);
38
39 pr_info("attempting good refcount_inc() without overflow\n");
40 refcount_dec(&over);
41 refcount_inc(&over);
42
43 pr_info("attempting bad refcount_inc() overflow\n");
44 refcount_inc(&over);
45 refcount_inc(&over);
46
47 overflow_check(&over);
48}
49
50/* refcount_add() should behave just like refcount_inc() above. */
51void lkdtm_REFCOUNT_ADD_OVERFLOW(void)
52{
53 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX - 1);
54
55 pr_info("attempting good refcount_add() without overflow\n");
56 refcount_dec(&over);
57 refcount_dec(&over);
58 refcount_dec(&over);
59 refcount_dec(&over);
60 refcount_add(4, &over);
61
62 pr_info("attempting bad refcount_add() overflow\n");
63 refcount_add(4, &over);
64
65 overflow_check(&over);
66}
67
68/* refcount_inc_not_zero() should behave just like refcount_inc() above. */
69void lkdtm_REFCOUNT_INC_NOT_ZERO_OVERFLOW(void)
70{
71 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX);
72
73 pr_info("attempting bad refcount_inc_not_zero() overflow\n");
74 if (!refcount_inc_not_zero(&over))
75 pr_warn("Weird: refcount_inc_not_zero() reported zero\n");
76
77 overflow_check(&over);
78}
79
80/* refcount_add_not_zero() should behave just like refcount_inc() above. */
81void lkdtm_REFCOUNT_ADD_NOT_ZERO_OVERFLOW(void)
82{
83 refcount_t over = REFCOUNT_INIT(REFCOUNT_MAX);
84
85 pr_info("attempting bad refcount_add_not_zero() overflow\n");
86 if (!refcount_add_not_zero(6, &over))
87 pr_warn("Weird: refcount_add_not_zero() reported zero\n");
88
89 overflow_check(&over);
90}
91
92static void check_zero(refcount_t *ref)
93{
94 switch (refcount_read(ref)) {
95 case REFCOUNT_SATURATED:
96 pr_info("Zero detected: saturated\n");
97 break;
98 case REFCOUNT_MAX:
99 pr_warn("Zero detected: unsafely reset to max\n");
100 break;
101 case 0:
102 pr_warn("Still at zero: refcount_inc/add() must not inc-from-0\n");
103 break;
104 default:
105 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
106 }
107}
108
109/*
110 * A refcount_dec(), as opposed to a refcount_dec_and_test(), when it hits
111 * zero it should either saturate (when inc-from-zero isn't protected)
112 * or stay at zero (when inc-from-zero is protected) and should WARN for both.
113 */
114void lkdtm_REFCOUNT_DEC_ZERO(void)
115{
116 refcount_t zero = REFCOUNT_INIT(2);
117
118 pr_info("attempting good refcount_dec()\n");
119 refcount_dec(&zero);
120
121 pr_info("attempting bad refcount_dec() to zero\n");
122 refcount_dec(&zero);
123
124 check_zero(&zero);
125}
126
127static void check_negative(refcount_t *ref, int start)
128{
129 /*
130 * CONFIG_REFCOUNT_FULL refuses to move a refcount at all on an
131 * over-sub, so we have to track our starting position instead of
132 * looking only at zero-pinning.
133 */
134 if (refcount_read(ref) == start) {
135 pr_warn("Still at %d: refcount_inc/add() must not inc-from-0\n",
136 start);
137 return;
138 }
139
140 switch (refcount_read(ref)) {
141 case REFCOUNT_SATURATED:
142 pr_info("Negative detected: saturated\n");
143 break;
144 case REFCOUNT_MAX:
145 pr_warn("Negative detected: unsafely reset to max\n");
146 break;
147 default:
148 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
149 }
150}
151
152/* A refcount_dec() going negative should saturate and may WARN. */
153void lkdtm_REFCOUNT_DEC_NEGATIVE(void)
154{
155 refcount_t neg = REFCOUNT_INIT(0);
156
157 pr_info("attempting bad refcount_dec() below zero\n");
158 refcount_dec(&neg);
159
160 check_negative(&neg, 0);
161}
162
163/*
164 * A refcount_dec_and_test() should act like refcount_dec() above when
165 * going negative.
166 */
167void lkdtm_REFCOUNT_DEC_AND_TEST_NEGATIVE(void)
168{
169 refcount_t neg = REFCOUNT_INIT(0);
170
171 pr_info("attempting bad refcount_dec_and_test() below zero\n");
172 if (refcount_dec_and_test(&neg))
173 pr_warn("Weird: refcount_dec_and_test() reported zero\n");
174
175 check_negative(&neg, 0);
176}
177
178/*
179 * A refcount_sub_and_test() should act like refcount_dec_and_test()
180 * above when going negative.
181 */
182void lkdtm_REFCOUNT_SUB_AND_TEST_NEGATIVE(void)
183{
184 refcount_t neg = REFCOUNT_INIT(3);
185
186 pr_info("attempting bad refcount_sub_and_test() below zero\n");
187 if (refcount_sub_and_test(5, &neg))
188 pr_warn("Weird: refcount_sub_and_test() reported zero\n");
189
190 check_negative(&neg, 3);
191}
192
193static void check_from_zero(refcount_t *ref)
194{
195 switch (refcount_read(ref)) {
196 case 0:
197 pr_info("Zero detected: stayed at zero\n");
198 break;
199 case REFCOUNT_SATURATED:
200 pr_info("Zero detected: saturated\n");
201 break;
202 case REFCOUNT_MAX:
203 pr_warn("Zero detected: unsafely reset to max\n");
204 break;
205 default:
206 pr_info("Fail: zero not detected, incremented to %d\n",
207 refcount_read(ref));
208 }
209}
210
211/*
212 * A refcount_inc() from zero should pin to zero or saturate and may WARN.
213 * Only CONFIG_REFCOUNT_FULL provides this protection currently.
214 */
215void lkdtm_REFCOUNT_INC_ZERO(void)
216{
217 refcount_t zero = REFCOUNT_INIT(0);
218
219 pr_info("attempting safe refcount_inc_not_zero() from zero\n");
220 if (!refcount_inc_not_zero(&zero)) {
221 pr_info("Good: zero detected\n");
222 if (refcount_read(&zero) == 0)
223 pr_info("Correctly stayed at zero\n");
224 else
225 pr_err("Fail: refcount went past zero!\n");
226 } else {
227 pr_err("Fail: Zero not detected!?\n");
228 }
229
230 pr_info("attempting bad refcount_inc() from zero\n");
231 refcount_inc(&zero);
232
233 check_from_zero(&zero);
234}
235
236/*
237 * A refcount_add() should act like refcount_inc() above when starting
238 * at zero.
239 */
240void lkdtm_REFCOUNT_ADD_ZERO(void)
241{
242 refcount_t zero = REFCOUNT_INIT(0);
243
244 pr_info("attempting safe refcount_add_not_zero() from zero\n");
245 if (!refcount_add_not_zero(3, &zero)) {
246 pr_info("Good: zero detected\n");
247 if (refcount_read(&zero) == 0)
248 pr_info("Correctly stayed at zero\n");
249 else
250 pr_err("Fail: refcount went past zero\n");
251 } else {
252 pr_err("Fail: Zero not detected!?\n");
253 }
254
255 pr_info("attempting bad refcount_add() from zero\n");
256 refcount_add(3, &zero);
257
258 check_from_zero(&zero);
259}
260
261static void check_saturated(refcount_t *ref)
262{
263 switch (refcount_read(ref)) {
264 case REFCOUNT_SATURATED:
265 pr_info("Saturation detected: still saturated\n");
266 break;
267 case REFCOUNT_MAX:
268 pr_warn("Saturation detected: unsafely reset to max\n");
269 break;
270 default:
271 pr_err("Fail: refcount went crazy: %d\n", refcount_read(ref));
272 }
273}
274
275/*
276 * A refcount_inc() from a saturated value should at most warn about
277 * being saturated already.
278 */
279void lkdtm_REFCOUNT_INC_SATURATED(void)
280{
281 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
282
283 pr_info("attempting bad refcount_inc() from saturated\n");
284 refcount_inc(&sat);
285
286 check_saturated(&sat);
287}
288
289/* Should act like refcount_inc() above from saturated. */
290void lkdtm_REFCOUNT_DEC_SATURATED(void)
291{
292 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
293
294 pr_info("attempting bad refcount_dec() from saturated\n");
295 refcount_dec(&sat);
296
297 check_saturated(&sat);
298}
299
300/* Should act like refcount_inc() above from saturated. */
301void lkdtm_REFCOUNT_ADD_SATURATED(void)
302{
303 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
304
305 pr_info("attempting bad refcount_dec() from saturated\n");
306 refcount_add(8, &sat);
307
308 check_saturated(&sat);
309}
310
311/* Should act like refcount_inc() above from saturated. */
312void lkdtm_REFCOUNT_INC_NOT_ZERO_SATURATED(void)
313{
314 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
315
316 pr_info("attempting bad refcount_inc_not_zero() from saturated\n");
317 if (!refcount_inc_not_zero(&sat))
318 pr_warn("Weird: refcount_inc_not_zero() reported zero\n");
319
320 check_saturated(&sat);
321}
322
323/* Should act like refcount_inc() above from saturated. */
324void lkdtm_REFCOUNT_ADD_NOT_ZERO_SATURATED(void)
325{
326 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
327
328 pr_info("attempting bad refcount_add_not_zero() from saturated\n");
329 if (!refcount_add_not_zero(7, &sat))
330 pr_warn("Weird: refcount_add_not_zero() reported zero\n");
331
332 check_saturated(&sat);
333}
334
335/* Should act like refcount_inc() above from saturated. */
336void lkdtm_REFCOUNT_DEC_AND_TEST_SATURATED(void)
337{
338 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
339
340 pr_info("attempting bad refcount_dec_and_test() from saturated\n");
341 if (refcount_dec_and_test(&sat))
342 pr_warn("Weird: refcount_dec_and_test() reported zero\n");
343
344 check_saturated(&sat);
345}
346
347/* Should act like refcount_inc() above from saturated. */
348void lkdtm_REFCOUNT_SUB_AND_TEST_SATURATED(void)
349{
350 refcount_t sat = REFCOUNT_INIT(REFCOUNT_SATURATED);
351
352 pr_info("attempting bad refcount_sub_and_test() from saturated\n");
353 if (refcount_sub_and_test(8, &sat))
354 pr_warn("Weird: refcount_sub_and_test() reported zero\n");
355
356 check_saturated(&sat);
357}
358
359/* Used to time the existing atomic_t when used for reference counting */
360void lkdtm_ATOMIC_TIMING(void)
361{
362 unsigned int i;
363 atomic_t count = ATOMIC_INIT(1);
364
365 for (i = 0; i < INT_MAX - 1; i++)
366 atomic_inc(&count);
367
368 for (i = INT_MAX; i > 0; i--)
369 if (atomic_dec_and_test(&count))
370 break;
371
372 if (i != 1)
373 pr_err("atomic timing: out of sync up/down cycle: %u\n", i - 1);
374 else
375 pr_info("atomic timing: done\n");
376}
377
378/*
379 * This can be compared to ATOMIC_TIMING when implementing fast refcount
380 * protections. Looking at the number of CPU cycles tells the real story
381 * about performance. For example:
382 * cd /sys/kernel/debug/provoke-crash
383 * perf stat -B -- cat <(echo REFCOUNT_TIMING) > DIRECT
384 */
385void lkdtm_REFCOUNT_TIMING(void)
386{
387 unsigned int i;
388 refcount_t count = REFCOUNT_INIT(1);
389
390 for (i = 0; i < INT_MAX - 1; i++)
391 refcount_inc(&count);
392
393 for (i = INT_MAX; i > 0; i--)
394 if (refcount_dec_and_test(&count))
395 break;
396
397 if (i != 1)
398 pr_err("refcount: out of sync up/down cycle: %u\n", i - 1);
399 else
400 pr_info("refcount timing: done\n");
401}