1 // SPDX-License-Identifier: GPL-2.0
4  * bad alignment, bad loops, bad locking, bad scheduling, deep stacks, and
42  * - function marked noinline
43  * - stack variables are marked volatile
44  * - stack variables are written (memset()) and read (buf[..] passed as arg)
45  * - function may have external effects (memzero_explicit())
46  * - no tail recursion possible
57 		ret = recursive_loop((int)buf[remaining % sizeof(buf)] - 1);  in recursive_loop()
127 /* Same as above but will only get a canary with -fstack-protector-strong */
153 	pr_info("Stack offset: %d\n", (int)(stack_addr - (uintptr_t)&magic));  in lkdtm_REPORT_STACK()
171 		if (*canary == current->stack_canary)  in __lkdtm_REPORT_STACK_CANARY()
205 		pr_warn("ERROR: saw pid %d again -- please use a new pid\n", pid);  in __lkdtm_REPORT_STACK_CANARY()
276 volatile unsigned int huge = INT_MAX - 2;
308 /* Intentionally using old-style flex array definition of 1 byte. */
337 	/* For both, touch all bytes in the actual member size. */  in lkdtm_ARRAY_BOUNDS()
338 	for (i = 0; i < sizeof(checked->data); i++)  in lkdtm_ARRAY_BOUNDS()
339 		checked->data[i] = 'A';  in lkdtm_ARRAY_BOUNDS()
341 	 * For the uninstrumented flex array member, also touch 1 byte  in lkdtm_ARRAY_BOUNDS()
344 	for (i = 0; i < sizeof(not_checked->data) + 1; i++)  in lkdtm_ARRAY_BOUNDS()
345 		not_checked->data[i] = 'A';  in lkdtm_ARRAY_BOUNDS()
348 	for (i = 0; i < sizeof(checked->data) + 1; i++)  in lkdtm_ARRAY_BOUNDS()
349 		checked->data[i] = 'B';  in lkdtm_ARRAY_BOUNDS()
376 	 *	test_head.next->prev = &good.node  in lkdtm_CORRUPT_LIST_ADD()
431 	const unsigned char *ptr = stack - 1;  in lkdtm_STACK_GUARD_PAGE_LEADING()
484 	 * To test the post-write pinning verification we need to call  in lkdtm_UNSET_SMEP()
517 	pr_err("XFAIL: this test is x86_64-only\n");  in lkdtm_UNSET_SMEP()
530 		.type = 3,	/* expand-up, writable, accessed data */  in lkdtm_DOUBLE_FAULT()
532 		.d = 1,		/* 32-bit */  in lkdtm_DOUBLE_FAULT()
542 	 * Put our zero-limit segment in SS and then trigger a fault.  The  in lkdtm_DOUBLE_FAULT()
543 	 * 4-byte access to (%esp) will fault with #SS, and the attempt to  in lkdtm_DOUBLE_FAULT()
547 	 * would also double-fault, resulting in the NMI or MCE being lost.  in lkdtm_DOUBLE_FAULT()
554 	pr_err("XFAIL: this test is ia32-only\n");  in lkdtm_DOUBLE_FAULT()
594 	pr_err("XFAIL: this test is arm64-only\n");  in lkdtm_CORRUPT_PAC()