1 // SPDX-License-Identifier: GPL-2.0
4  * bad alignment, bad loops, bad locking, bad scheduling, deep stacks, and
44  * - function marked noinline
45  * - stack variables are marked volatile
46  * - stack variables are written (memset()) and read (buf[..] passed as arg)
47  * - function may have external effects (memzero_explicit())
48  * - no tail recursion possible
59 		ret = recursive_loop((int)buf[remaining % sizeof(buf)] - 1);  in recursive_loop()
154 /* Same as above but will only get a canary with -fstack-protector-strong */
180 	pr_info("Stack offset: %d\n", (int)(stack_addr - (uintptr_t)&magic));  in lkdtm_REPORT_STACK()
198 		if (*canary == current->stack_canary)  in __lkdtm_REPORT_STACK_CANARY()
232 		pr_warn("ERROR: saw pid %d again -- please use a new pid\n", pid);  in __lkdtm_REPORT_STACK_CANARY()
333 static volatile unsigned int huge = INT_MAX - 2;
394 	/* For both, touch all bytes in the actual member size. */  in lkdtm_ARRAY_BOUNDS()
395 	for (i = 0; i < sizeof(checked->data); i++)  in lkdtm_ARRAY_BOUNDS()
396 		checked->data[i] = 'A';  in lkdtm_ARRAY_BOUNDS()
398 	 * For the uninstrumented flex array member, also touch 1 byte  in lkdtm_ARRAY_BOUNDS()
402 		not_checked->data[i] = 'A';  in lkdtm_ARRAY_BOUNDS()
405 	for (i = 0; i < sizeof(checked->data) + 1; i++)  in lkdtm_ARRAY_BOUNDS()
406 		checked->data[i] = 'B';  in lkdtm_ARRAY_BOUNDS()
435 	inst->count = fam_count;  in lkdtm_FAM_BOUNDS()
437 	inst->array[1] = fam_count;  in lkdtm_FAM_BOUNDS()
438 	ignored = inst->array[1];  in lkdtm_FAM_BOUNDS()
441 	inst->array[fam_count] = fam_count;  in lkdtm_FAM_BOUNDS()
442 	ignored = inst->array[fam_count];  in lkdtm_FAM_BOUNDS()
473 	 *	test_head.next->prev = &good.node  in lkdtm_CORRUPT_LIST_ADD()
528 	const unsigned char *ptr = stack - 1;  in lkdtm_STACK_GUARD_PAGE_LEADING()
581 	 * To test the post-write pinning verification we need to call  in lkdtm_UNSET_SMEP()
615 	pr_err("XFAIL: this test is x86_64-only\n");  in lkdtm_UNSET_SMEP()
628 		.type = 3,	/* expand-up, writable, accessed data */  in lkdtm_DOUBLE_FAULT()
630 		.d = 1,		/* 32-bit */  in lkdtm_DOUBLE_FAULT()
640 	 * Put our zero-limit segment in SS and then trigger a fault.  The  in lkdtm_DOUBLE_FAULT()
641 	 * 4-byte access to (%esp) will fault with #SS, and the attempt to  in lkdtm_DOUBLE_FAULT()
645 	 * would also double-fault, resulting in the NMI or MCE being lost.  in lkdtm_DOUBLE_FAULT()
652 	pr_err("XFAIL: this test is ia32-only\n");  in lkdtm_DOUBLE_FAULT()
692 	pr_err("XFAIL: this test is arm64-only\n");  in lkdtm_CORRUPT_PAC()