lkdtm: split usercopy tests to separate file
authorKees Cook <keescook@chromium.org>
Sun, 26 Jun 2016 15:46:23 +0000 (08:46 -0700)
committerKees Cook <keescook@chromium.org>
Thu, 7 Jul 2016 18:09:20 +0000 (11:09 -0700)
This splits the USERCOPY_* tests into the new lkdtm_usercopy.c file to
help separate things better for readability.

Signed-off-by: Kees Cook <keescook@chromium.org>
drivers/misc/Makefile
drivers/misc/lkdtm.h
drivers/misc/lkdtm_core.c
drivers/misc/lkdtm_usercopy.c [new file with mode: 0644]

index 7d45ed4a15491ab64aaecb075be9b45b0228bb95..e6b2778731ff3ab56c45ece362de67121ca708f6 100644 (file)
@@ -60,6 +60,7 @@ obj-$(CONFIG_PANEL)             += panel.o
 
 lkdtm-$(CONFIG_LKDTM)          += lkdtm_core.o
 lkdtm-$(CONFIG_LKDTM)          += lkdtm_rodata_objcopy.o
+lkdtm-$(CONFIG_LKDTM)          += lkdtm_usercopy.o
 
 OBJCOPYFLAGS :=
 OBJCOPYFLAGS_lkdtm_rodata_objcopy.o := \
index 9531fa3be4c3af18a4cb6dca21fe5f3b3e9bed78..ef290a2c8816111d8ad5b3639e37cf94f839d104 100644 (file)
@@ -1,6 +1,19 @@
 #ifndef __LKDTM_H
 #define __LKDTM_H
 
+/* lkdtm_rodata.c */
 void lkdtm_rodata_do_nothing(void);
 
+/* lkdtm_usercopy.c */
+void __init lkdtm_usercopy_init(void);
+void __exit lkdtm_usercopy_exit(void);
+void lkdtm_USERCOPY_HEAP_SIZE_TO(void);
+void lkdtm_USERCOPY_HEAP_SIZE_FROM(void);
+void lkdtm_USERCOPY_HEAP_FLAG_TO(void);
+void lkdtm_USERCOPY_HEAP_FLAG_FROM(void);
+void lkdtm_USERCOPY_STACK_FRAME_TO(void);
+void lkdtm_USERCOPY_STACK_FRAME_FROM(void);
+void lkdtm_USERCOPY_STACK_BEYOND(void);
+void lkdtm_USERCOPY_KERNEL(void);
+
 #endif
index 1454d58aa278e3c128b241fdb1e8c2ec3ceb8ff1..74376920ed55fd8e921323be391943cc26e29f24 100644 (file)
@@ -193,10 +193,6 @@ static DEFINE_SPINLOCK(lock_me_up);
 
 static u8 data_area[EXEC_SIZE];
 
-static size_t cache_size = 1024;
-static struct kmem_cache *bad_cache;
-
-static const unsigned char test_text[] = "This is a test.\n";
 static const unsigned long rodata = 0xAA55AA55;
 static unsigned long ro_after_init __ro_after_init = 0x55AA5500;
 
@@ -403,255 +399,6 @@ static void execute_user_location(void *dst)
        func();
 }
 
-/*
- * Instead of adding -Wno-return-local-addr, just pass the stack address
- * through a function to obfuscate it from the compiler.
- */
-static noinline unsigned char *trick_compiler(unsigned char *stack)
-{
-       return stack + 0;
-}
-
-static noinline unsigned char *do_usercopy_stack_callee(int value)
-{
-       unsigned char buf[32];
-       int i;
-
-       /* Exercise stack to avoid everything living in registers. */
-       for (i = 0; i < sizeof(buf); i++) {
-               buf[i] = value & 0xff;
-       }
-
-       return trick_compiler(buf);
-}
-
-static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
-{
-       unsigned long user_addr;
-       unsigned char good_stack[32];
-       unsigned char *bad_stack;
-       int i;
-
-       /* Exercise stack to avoid everything living in registers. */
-       for (i = 0; i < sizeof(good_stack); i++)
-               good_stack[i] = test_text[i % sizeof(test_text)];
-
-       /* This is a pointer to outside our current stack frame. */
-       if (bad_frame) {
-               bad_stack = do_usercopy_stack_callee((uintptr_t)bad_stack);
-       } else {
-               /* Put start address just inside stack. */
-               bad_stack = task_stack_page(current) + THREAD_SIZE;
-               bad_stack -= sizeof(unsigned long);
-       }
-
-       user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
-                           PROT_READ | PROT_WRITE | PROT_EXEC,
-                           MAP_ANONYMOUS | MAP_PRIVATE, 0);
-       if (user_addr >= TASK_SIZE) {
-               pr_warn("Failed to allocate user memory\n");
-               return;
-       }
-
-       if (to_user) {
-               pr_info("attempting good copy_to_user of local stack\n");
-               if (copy_to_user((void __user *)user_addr, good_stack,
-                                sizeof(good_stack))) {
-                       pr_warn("copy_to_user failed unexpectedly?!\n");
-                       goto free_user;
-               }
-
-               pr_info("attempting bad copy_to_user of distant stack\n");
-               if (copy_to_user((void __user *)user_addr, bad_stack,
-                                sizeof(good_stack))) {
-                       pr_warn("copy_to_user failed, but lacked Oops\n");
-                       goto free_user;
-               }
-       } else {
-               /*
-                * There isn't a safe way to not be protected by usercopy
-                * if we're going to write to another thread's stack.
-                */
-               if (!bad_frame)
-                       goto free_user;
-
-               pr_info("attempting good copy_from_user of local stack\n");
-               if (copy_from_user(good_stack, (void __user *)user_addr,
-                                  sizeof(good_stack))) {
-                       pr_warn("copy_from_user failed unexpectedly?!\n");
-                       goto free_user;
-               }
-
-               pr_info("attempting bad copy_from_user of distant stack\n");
-               if (copy_from_user(bad_stack, (void __user *)user_addr,
-                                  sizeof(good_stack))) {
-                       pr_warn("copy_from_user failed, but lacked Oops\n");
-                       goto free_user;
-               }
-       }
-
-free_user:
-       vm_munmap(user_addr, PAGE_SIZE);
-}
-
-static void do_usercopy_kernel(void)
-{
-       unsigned long user_addr;
-
-       user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
-                           PROT_READ | PROT_WRITE | PROT_EXEC,
-                           MAP_ANONYMOUS | MAP_PRIVATE, 0);
-       if (user_addr >= TASK_SIZE) {
-               pr_warn("Failed to allocate user memory\n");
-               return;
-       }
-
-       pr_info("attempting good copy_to_user from kernel rodata\n");
-       if (copy_to_user((void __user *)user_addr, test_text,
-                        sizeof(test_text))) {
-               pr_warn("copy_to_user failed unexpectedly?!\n");
-               goto free_user;
-       }
-
-       pr_info("attempting bad copy_to_user from kernel text\n");
-       if (copy_to_user((void __user *)user_addr, vm_mmap, PAGE_SIZE)) {
-               pr_warn("copy_to_user failed, but lacked Oops\n");
-               goto free_user;
-       }
-
-free_user:
-       vm_munmap(user_addr, PAGE_SIZE);
-}
-
-static void do_usercopy_heap_size(bool to_user)
-{
-       unsigned long user_addr;
-       unsigned char *one, *two;
-       size_t size = 1024;
-
-       one = kmalloc(size, GFP_KERNEL);
-       two = kmalloc(size, GFP_KERNEL);
-       if (!one || !two) {
-               pr_warn("Failed to allocate kernel memory\n");
-               goto free_kernel;
-       }
-
-       user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
-                           PROT_READ | PROT_WRITE | PROT_EXEC,
-                           MAP_ANONYMOUS | MAP_PRIVATE, 0);
-       if (user_addr >= TASK_SIZE) {
-               pr_warn("Failed to allocate user memory\n");
-               goto free_kernel;
-       }
-
-       memset(one, 'A', size);
-       memset(two, 'B', size);
-
-       if (to_user) {
-               pr_info("attempting good copy_to_user of correct size\n");
-               if (copy_to_user((void __user *)user_addr, one, size)) {
-                       pr_warn("copy_to_user failed unexpectedly?!\n");
-                       goto free_user;
-               }
-
-               pr_info("attempting bad copy_to_user of too large size\n");
-               if (copy_to_user((void __user *)user_addr, one, 2 * size)) {
-                       pr_warn("copy_to_user failed, but lacked Oops\n");
-                       goto free_user;
-               }
-       } else {
-               pr_info("attempting good copy_from_user of correct size\n");
-               if (copy_from_user(one, (void __user *)user_addr, size)) {
-                       pr_warn("copy_from_user failed unexpectedly?!\n");
-                       goto free_user;
-               }
-
-               pr_info("attempting bad copy_from_user of too large size\n");
-               if (copy_from_user(one, (void __user *)user_addr, 2 * size)) {
-                       pr_warn("copy_from_user failed, but lacked Oops\n");
-                       goto free_user;
-               }
-       }
-
-free_user:
-       vm_munmap(user_addr, PAGE_SIZE);
-free_kernel:
-       kfree(one);
-       kfree(two);
-}
-
-static void do_usercopy_heap_flag(bool to_user)
-{
-       unsigned long user_addr;
-       unsigned char *good_buf = NULL;
-       unsigned char *bad_buf = NULL;
-
-       /* Make sure cache was prepared. */
-       if (!bad_cache) {
-               pr_warn("Failed to allocate kernel cache\n");
-               return;
-       }
-
-       /*
-        * Allocate one buffer from each cache (kmalloc will have the
-        * SLAB_USERCOPY flag already, but "bad_cache" won't).
-        */
-       good_buf = kmalloc(cache_size, GFP_KERNEL);
-       bad_buf = kmem_cache_alloc(bad_cache, GFP_KERNEL);
-       if (!good_buf || !bad_buf) {
-               pr_warn("Failed to allocate buffers from caches\n");
-               goto free_alloc;
-       }
-
-       /* Allocate user memory we'll poke at. */
-       user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
-                           PROT_READ | PROT_WRITE | PROT_EXEC,
-                           MAP_ANONYMOUS | MAP_PRIVATE, 0);
-       if (user_addr >= TASK_SIZE) {
-               pr_warn("Failed to allocate user memory\n");
-               goto free_alloc;
-       }
-
-       memset(good_buf, 'A', cache_size);
-       memset(bad_buf, 'B', cache_size);
-
-       if (to_user) {
-               pr_info("attempting good copy_to_user with SLAB_USERCOPY\n");
-               if (copy_to_user((void __user *)user_addr, good_buf,
-                                cache_size)) {
-                       pr_warn("copy_to_user failed unexpectedly?!\n");
-                       goto free_user;
-               }
-
-               pr_info("attempting bad copy_to_user w/o SLAB_USERCOPY\n");
-               if (copy_to_user((void __user *)user_addr, bad_buf,
-                                cache_size)) {
-                       pr_warn("copy_to_user failed, but lacked Oops\n");
-                       goto free_user;
-               }
-       } else {
-               pr_info("attempting good copy_from_user with SLAB_USERCOPY\n");
-               if (copy_from_user(good_buf, (void __user *)user_addr,
-                                  cache_size)) {
-                       pr_warn("copy_from_user failed unexpectedly?!\n");
-                       goto free_user;
-               }
-
-               pr_info("attempting bad copy_from_user w/o SLAB_USERCOPY\n");
-               if (copy_from_user(bad_buf, (void __user *)user_addr,
-                                  cache_size)) {
-                       pr_warn("copy_from_user failed, but lacked Oops\n");
-                       goto free_user;
-               }
-       }
-
-free_user:
-       vm_munmap(user_addr, PAGE_SIZE);
-free_alloc:
-       if (bad_buf)
-               kmem_cache_free(bad_cache, bad_buf);
-       kfree(good_buf);
-}
 
 static void lkdtm_do_action(enum ctype which)
 {
@@ -964,28 +711,28 @@ static void lkdtm_do_action(enum ctype which)
                return;
        }
        case CT_USERCOPY_HEAP_SIZE_TO:
-               do_usercopy_heap_size(true);
+               lkdtm_USERCOPY_HEAP_SIZE_TO();
                break;
        case CT_USERCOPY_HEAP_SIZE_FROM:
-               do_usercopy_heap_size(false);
+               lkdtm_USERCOPY_HEAP_SIZE_FROM();
                break;
        case CT_USERCOPY_HEAP_FLAG_TO:
-               do_usercopy_heap_flag(true);
+               lkdtm_USERCOPY_HEAP_FLAG_TO();
                break;
        case CT_USERCOPY_HEAP_FLAG_FROM:
-               do_usercopy_heap_flag(false);
+               lkdtm_USERCOPY_HEAP_FLAG_FROM();
                break;
        case CT_USERCOPY_STACK_FRAME_TO:
-               do_usercopy_stack(true, true);
+               lkdtm_USERCOPY_STACK_FRAME_TO();
                break;
        case CT_USERCOPY_STACK_FRAME_FROM:
-               do_usercopy_stack(false, true);
+               lkdtm_USERCOPY_STACK_FRAME_FROM();
                break;
        case CT_USERCOPY_STACK_BEYOND:
-               do_usercopy_stack(true, false);
+               lkdtm_USERCOPY_STACK_BEYOND();
                break;
        case CT_USERCOPY_KERNEL:
-               do_usercopy_kernel();
+               lkdtm_USERCOPY_KERNEL();
                break;
        case CT_NONE:
        default:
@@ -1276,13 +1023,12 @@ static int __init lkdtm_module_init(void)
        int n_debugfs_entries = 1; /* Assume only the direct entry */
        int i;
 
+       /* Handle test-specific initialization. */
+       lkdtm_usercopy_init();
+
        /* Make sure we can write to __ro_after_init values during __init */
        ro_after_init |= 0xAA;
 
-       /* Prepare cache that lacks SLAB_USERCOPY flag. */
-       bad_cache = kmem_cache_create("lkdtm-no-usercopy", cache_size, 0,
-                                     0, NULL);
-
        /* Register debugfs interface */
        lkdtm_debugfs_root = debugfs_create_dir("provoke-crash", NULL);
        if (!lkdtm_debugfs_root) {
@@ -1334,7 +1080,8 @@ static void __exit lkdtm_module_exit(void)
 {
        debugfs_remove_recursive(lkdtm_debugfs_root);
 
-       kmem_cache_destroy(bad_cache);
+       /* Handle test-specific clean-up. */
+       lkdtm_usercopy_exit();
 
        unregister_jprobe(&lkdtm);
        pr_info("Crash point unregistered\n");
diff --git a/drivers/misc/lkdtm_usercopy.c b/drivers/misc/lkdtm_usercopy.c
new file mode 100644 (file)
index 0000000..9c748e8
--- /dev/null
@@ -0,0 +1,315 @@
+/*
+ * This is for all the tests related to copy_to_user() and copy_from_user()
+ * hardening.
+ */
+#define pr_fmt(fmt) "lkdtm: " fmt
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/mman.h>
+#include <linux/uaccess.h>
+#include <asm/cacheflush.h>
+
+static size_t cache_size = 1024;
+static struct kmem_cache *bad_cache;
+
+static const unsigned char test_text[] = "This is a test.\n";
+
+/*
+ * Instead of adding -Wno-return-local-addr, just pass the stack address
+ * through a function to obfuscate it from the compiler.
+ */
+static noinline unsigned char *trick_compiler(unsigned char *stack)
+{
+       return stack + 0;
+}
+
+static noinline unsigned char *do_usercopy_stack_callee(int value)
+{
+       unsigned char buf[32];
+       int i;
+
+       /* Exercise stack to avoid everything living in registers. */
+       for (i = 0; i < sizeof(buf); i++) {
+               buf[i] = value & 0xff;
+       }
+
+       return trick_compiler(buf);
+}
+
+static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
+{
+       unsigned long user_addr;
+       unsigned char good_stack[32];
+       unsigned char *bad_stack;
+       int i;
+
+       /* Exercise stack to avoid everything living in registers. */
+       for (i = 0; i < sizeof(good_stack); i++)
+               good_stack[i] = test_text[i % sizeof(test_text)];
+
+       /* This is a pointer to outside our current stack frame. */
+       if (bad_frame) {
+               bad_stack = do_usercopy_stack_callee((uintptr_t)bad_stack);
+       } else {
+               /* Put start address just inside stack. */
+               bad_stack = task_stack_page(current) + THREAD_SIZE;
+               bad_stack -= sizeof(unsigned long);
+       }
+
+       user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
+                           PROT_READ | PROT_WRITE | PROT_EXEC,
+                           MAP_ANONYMOUS | MAP_PRIVATE, 0);
+       if (user_addr >= TASK_SIZE) {
+               pr_warn("Failed to allocate user memory\n");
+               return;
+       }
+
+       if (to_user) {
+               pr_info("attempting good copy_to_user of local stack\n");
+               if (copy_to_user((void __user *)user_addr, good_stack,
+                                sizeof(good_stack))) {
+                       pr_warn("copy_to_user failed unexpectedly?!\n");
+                       goto free_user;
+               }
+
+               pr_info("attempting bad copy_to_user of distant stack\n");
+               if (copy_to_user((void __user *)user_addr, bad_stack,
+                                sizeof(good_stack))) {
+                       pr_warn("copy_to_user failed, but lacked Oops\n");
+                       goto free_user;
+               }
+       } else {
+               /*
+                * There isn't a safe way to not be protected by usercopy
+                * if we're going to write to another thread's stack.
+                */
+               if (!bad_frame)
+                       goto free_user;
+
+               pr_info("attempting good copy_from_user of local stack\n");
+               if (copy_from_user(good_stack, (void __user *)user_addr,
+                                  sizeof(good_stack))) {
+                       pr_warn("copy_from_user failed unexpectedly?!\n");
+                       goto free_user;
+               }
+
+               pr_info("attempting bad copy_from_user of distant stack\n");
+               if (copy_from_user(bad_stack, (void __user *)user_addr,
+                                  sizeof(good_stack))) {
+                       pr_warn("copy_from_user failed, but lacked Oops\n");
+                       goto free_user;
+               }
+       }
+
+free_user:
+       vm_munmap(user_addr, PAGE_SIZE);
+}
+
+static void do_usercopy_heap_size(bool to_user)
+{
+       unsigned long user_addr;
+       unsigned char *one, *two;
+       const size_t size = 1024;
+
+       one = kmalloc(size, GFP_KERNEL);
+       two = kmalloc(size, GFP_KERNEL);
+       if (!one || !two) {
+               pr_warn("Failed to allocate kernel memory\n");
+               goto free_kernel;
+       }
+
+       user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
+                           PROT_READ | PROT_WRITE | PROT_EXEC,
+                           MAP_ANONYMOUS | MAP_PRIVATE, 0);
+       if (user_addr >= TASK_SIZE) {
+               pr_warn("Failed to allocate user memory\n");
+               goto free_kernel;
+       }
+
+       memset(one, 'A', size);
+       memset(two, 'B', size);
+
+       if (to_user) {
+               pr_info("attempting good copy_to_user of correct size\n");
+               if (copy_to_user((void __user *)user_addr, one, size)) {
+                       pr_warn("copy_to_user failed unexpectedly?!\n");
+                       goto free_user;
+               }
+
+               pr_info("attempting bad copy_to_user of too large size\n");
+               if (copy_to_user((void __user *)user_addr, one, 2 * size)) {
+                       pr_warn("copy_to_user failed, but lacked Oops\n");
+                       goto free_user;
+               }
+       } else {
+               pr_info("attempting good copy_from_user of correct size\n");
+               if (copy_from_user(one, (void __user *)user_addr, size)) {
+                       pr_warn("copy_from_user failed unexpectedly?!\n");
+                       goto free_user;
+               }
+
+               pr_info("attempting bad copy_from_user of too large size\n");
+               if (copy_from_user(one, (void __user *)user_addr, 2 * size)) {
+                       pr_warn("copy_from_user failed, but lacked Oops\n");
+                       goto free_user;
+               }
+       }
+
+free_user:
+       vm_munmap(user_addr, PAGE_SIZE);
+free_kernel:
+       kfree(one);
+       kfree(two);
+}
+
+static void do_usercopy_heap_flag(bool to_user)
+{
+       unsigned long user_addr;
+       unsigned char *good_buf = NULL;
+       unsigned char *bad_buf = NULL;
+
+       /* Make sure cache was prepared. */
+       if (!bad_cache) {
+               pr_warn("Failed to allocate kernel cache\n");
+               return;
+       }
+
+       /*
+        * Allocate one buffer from each cache (kmalloc will have the
+        * SLAB_USERCOPY flag already, but "bad_cache" won't).
+        */
+       good_buf = kmalloc(cache_size, GFP_KERNEL);
+       bad_buf = kmem_cache_alloc(bad_cache, GFP_KERNEL);
+       if (!good_buf || !bad_buf) {
+               pr_warn("Failed to allocate buffers from caches\n");
+               goto free_alloc;
+       }
+
+       /* Allocate user memory we'll poke at. */
+       user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
+                           PROT_READ | PROT_WRITE | PROT_EXEC,
+                           MAP_ANONYMOUS | MAP_PRIVATE, 0);
+       if (user_addr >= TASK_SIZE) {
+               pr_warn("Failed to allocate user memory\n");
+               goto free_alloc;
+       }
+
+       memset(good_buf, 'A', cache_size);
+       memset(bad_buf, 'B', cache_size);
+
+       if (to_user) {
+               pr_info("attempting good copy_to_user with SLAB_USERCOPY\n");
+               if (copy_to_user((void __user *)user_addr, good_buf,
+                                cache_size)) {
+                       pr_warn("copy_to_user failed unexpectedly?!\n");
+                       goto free_user;
+               }
+
+               pr_info("attempting bad copy_to_user w/o SLAB_USERCOPY\n");
+               if (copy_to_user((void __user *)user_addr, bad_buf,
+                                cache_size)) {
+                       pr_warn("copy_to_user failed, but lacked Oops\n");
+                       goto free_user;
+               }
+       } else {
+               pr_info("attempting good copy_from_user with SLAB_USERCOPY\n");
+               if (copy_from_user(good_buf, (void __user *)user_addr,
+                                  cache_size)) {
+                       pr_warn("copy_from_user failed unexpectedly?!\n");
+                       goto free_user;
+               }
+
+               pr_info("attempting bad copy_from_user w/o SLAB_USERCOPY\n");
+               if (copy_from_user(bad_buf, (void __user *)user_addr,
+                                  cache_size)) {
+                       pr_warn("copy_from_user failed, but lacked Oops\n");
+                       goto free_user;
+               }
+       }
+
+free_user:
+       vm_munmap(user_addr, PAGE_SIZE);
+free_alloc:
+       if (bad_buf)
+               kmem_cache_free(bad_cache, bad_buf);
+       kfree(good_buf);
+}
+
+/* Callable tests. */
+void lkdtm_USERCOPY_HEAP_SIZE_TO(void)
+{
+       do_usercopy_heap_size(true);
+}
+
+void lkdtm_USERCOPY_HEAP_SIZE_FROM(void)
+{
+       do_usercopy_heap_size(false);
+}
+
+void lkdtm_USERCOPY_HEAP_FLAG_TO(void)
+{
+       do_usercopy_heap_flag(true);
+}
+
+void lkdtm_USERCOPY_HEAP_FLAG_FROM(void)
+{
+       do_usercopy_heap_flag(false);
+}
+
+void lkdtm_USERCOPY_STACK_FRAME_TO(void)
+{
+       do_usercopy_stack(true, true);
+}
+
+void lkdtm_USERCOPY_STACK_FRAME_FROM(void)
+{
+       do_usercopy_stack(false, true);
+}
+
+void lkdtm_USERCOPY_STACK_BEYOND(void)
+{
+       do_usercopy_stack(true, false);
+}
+
+void lkdtm_USERCOPY_KERNEL(void)
+{
+       unsigned long user_addr;
+
+       user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
+                           PROT_READ | PROT_WRITE | PROT_EXEC,
+                           MAP_ANONYMOUS | MAP_PRIVATE, 0);
+       if (user_addr >= TASK_SIZE) {
+               pr_warn("Failed to allocate user memory\n");
+               return;
+       }
+
+       pr_info("attempting good copy_to_user from kernel rodata\n");
+       if (copy_to_user((void __user *)user_addr, test_text,
+                        sizeof(test_text))) {
+               pr_warn("copy_to_user failed unexpectedly?!\n");
+               goto free_user;
+       }
+
+       pr_info("attempting bad copy_to_user from kernel text\n");
+       if (copy_to_user((void __user *)user_addr, vm_mmap, PAGE_SIZE)) {
+               pr_warn("copy_to_user failed, but lacked Oops\n");
+               goto free_user;
+       }
+
+free_user:
+       vm_munmap(user_addr, PAGE_SIZE);
+}
+
+void __init lkdtm_usercopy_init(void)
+{
+       /* Prepare cache that lacks SLAB_USERCOPY flag. */
+       bad_cache = kmem_cache_create("lkdtm-no-usercopy", cache_size, 0,
+                                     0, NULL);
+}
+
+void __exit lkdtm_usercopy_exit(void)
+{
+       kmem_cache_destroy(bad_cache);
+}