1 /*
2 * Copyright (C) 2017 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <dlfcn.h>
18 #include <sys/stat.h>
19
20 #include <vector>
21
22 #include <gtest/gtest.h>
23
24 #include "gtest_globals.h"
25 #include "utils.h"
26
27 #if defined(__BIONIC__)
28 #include "private/CFIShadow.h"
29 #endif
30
31 // Private libdl interface.
32 extern "C" {
33 void __cfi_slowpath(uint64_t CallSiteTypeId, void* Ptr);
34 void __cfi_slowpath_diag(uint64_t CallSiteTypeId, void* Ptr, void* DiagData);
35 size_t __cfi_shadow_size();
36 }
37
38 // Disables debuggerd stack traces to speed up death tests, make them less
39 // noisy in logcat, and avoid expected deaths from showing up in stability
40 // metrics.
41 // We don't use the usual libbase class because (a) we don't care about most
42 // of the signals it blocks but (b) we do need to block SIGILL, which normal
43 // death tests shouldn't ever hit. (It's possible that a design where a
44 // deathtest always declares its expected signals up front is a better one,
45 // and maybe that's an interesting future direction for libbase.)
46 //
47 // We include SIGSEGV because there's a test that passes heap addresses to
48 // __cfi_slowpath and we only map the executable code shadow as readable.
49 // We don't always get SIGSEGV there though: if the heap allocation happens
50 // to be close enough to an executable mapping that its shadow is in the
51 // same page as the executable shadow, we'll get SIGILL/SIGTRAP.
52 class cfi_test_DeathTest : public testing::Test {
53 protected:
SetUp()54 void SetUp() override {
55 struct sigaction64 action = {.sa_handler = SIG_DFL};
56 sigaction64(SIGILL, &action, &previous_sigill_);
57 sigaction64(SIGSEGV, &action, &previous_sigsegv_);
58 sigaction64(SIGTRAP, &action, &previous_sigtrap_);
59 }
60
TearDown()61 void TearDown() override {
62 sigaction64(SIGTRAP, &previous_sigtrap_, nullptr);
63 sigaction64(SIGSEGV, &previous_sigsegv_, nullptr);
64 sigaction64(SIGILL, &previous_sigill_, nullptr);
65 }
66
67 private:
68 struct sigaction64 previous_sigill_;
69 struct sigaction64 previous_sigsegv_;
70 struct sigaction64 previous_sigtrap_;
71 };
72
KilledByCfi(int status)73 static bool KilledByCfi(int status) {
74 return WIFSIGNALED(status) &&
75 (WTERMSIG(status) == SIGTRAP || WTERMSIG(status) == SIGILL || WTERMSIG(status) == SIGSEGV);
76 }
77
f()78 static void f() {}
79
test_cfi_slowpath_with_alloc()80 static void test_cfi_slowpath_with_alloc() {
81 std::vector<void*> allocs;
82 for (size_t i = 0; i < 1000; i++) {
83 allocs.push_back(malloc(4096));
84 __cfi_slowpath(46, allocs.back());
85 }
86 }
87
TEST_F(cfi_test_DeathTest,basic)88 TEST_F(cfi_test_DeathTest, basic) {
89 #if defined(__BIONIC__)
90 void* handle;
91 handle = dlopen("libcfi-test.so", RTLD_NOW | RTLD_LOCAL);
92 ASSERT_TRUE(handle != nullptr) << dlerror();
93
94 EXPECT_NE(0U, __cfi_shadow_size());
95
96 #define SYM(type, name) auto name = reinterpret_cast<type>(dlsym(handle, #name))
97 SYM(size_t (*)(), get_count);
98 SYM(uint64_t(*)(), get_last_type_id);
99 SYM(void* (*)(), get_last_address);
100 SYM(void* (*)(), get_last_diag);
101 SYM(void* (*)(), get_global_address);
102 SYM(void (*)(uint64_t, void*, void*), __cfi_check);
103 SYM(char*, bss);
104 #undef SYM
105
106 size_t c = get_count();
107
108 // CFI check for code inside the DSO. Can't use just any function address - this is only
109 // guaranteed to work for code addresses above __cfi_check.
110 void* code_ptr = reinterpret_cast<char*>(__cfi_check) + 1234;
111 void* diag_ptr = reinterpret_cast<void*>(5678);
112 __cfi_slowpath_diag(42, code_ptr, diag_ptr);
113 EXPECT_EQ(42U, get_last_type_id());
114 EXPECT_EQ(code_ptr, get_last_address());
115 EXPECT_EQ(diag_ptr, get_last_diag());
116 EXPECT_EQ(++c, get_count());
117
118 // __cfi_slowpath passes nullptr for the Diag argument.
119 __cfi_slowpath(42, code_ptr);
120 EXPECT_EQ(42U, get_last_type_id());
121 EXPECT_EQ(code_ptr, get_last_address());
122 EXPECT_EQ(nullptr, get_last_diag());
123 EXPECT_EQ(++c, get_count());
124
125 // CFI check for a data address inside the DSO.
126 __cfi_slowpath(43, get_global_address());
127 EXPECT_EQ(43U, get_last_type_id());
128 EXPECT_EQ(get_global_address(), get_last_address());
129 EXPECT_EQ(++c, get_count());
130
131 // CFI check for a function inside _this_ DSO. It either goes to this DSO's __cfi_check,
132 // or (if missing) is simply ignored. Any way, it does not affect the test lib's counters.
133 __cfi_slowpath(44, reinterpret_cast<void*>(&f));
134 EXPECT_EQ(43U, get_last_type_id());
135 EXPECT_EQ(get_global_address(), get_last_address());
136 EXPECT_EQ(c, get_count());
137
138 // CFI check for a heap address.
139 // It's possible that this allocation could wind up in the same CFI granule as
140 // an unchecked library, which means the below might not crash. To force a
141 // crash keep allocating up to a max until there is a crash.
142 EXPECT_EXIT(test_cfi_slowpath_with_alloc(), KilledByCfi, "");
143
144 // Check all the addresses.
145 const size_t bss_size = 1024 * 1024;
146 static_assert(bss_size >= kLibraryAlignment * 2, "test range not big enough");
147 for (size_t i = 0; i < bss_size; ++i) {
148 __cfi_slowpath(47, bss + i);
149 EXPECT_EQ(++c, get_count());
150 }
151
152 // Load the same library again.
153 void* handle2 = dlopen("libcfi-test.so", RTLD_NOW | RTLD_LOCAL);
154 ASSERT_TRUE(handle2 != nullptr) << dlerror();
155 EXPECT_EQ(handle2, handle);
156
157 // Check that it is still there.
158 __cfi_slowpath(43, get_global_address());
159 EXPECT_EQ(43U, get_last_type_id());
160 EXPECT_EQ(get_global_address(), get_last_address());
161 EXPECT_EQ(++c, get_count());
162
163 dlclose(handle);
164 dlclose(handle2);
165
166 // CFI check for a function inside the unloaded DSO. This is always invalid and gets the process
167 // killed.
168 EXPECT_EXIT(__cfi_slowpath(45, reinterpret_cast<void*>(code_ptr)), KilledByCfi, "");
169 #endif
170 }
171
TEST(cfi_test,invalid)172 TEST(cfi_test, invalid) {
173 #if defined(__BIONIC__)
174 void* handle;
175 handle = dlopen("libcfi-test-bad.so", RTLD_NOW | RTLD_LOCAL);
176 ASSERT_FALSE(handle != nullptr) << dlerror();
177
178 handle = dlopen("libcfi-test-bad.so", RTLD_NOW | RTLD_LOCAL);
179 ASSERT_FALSE(handle != nullptr) << dlerror();
180 #endif
181 }
182
183 // cfi_test_helper exports __cfi_check, which triggers CFI initialization at startup.
TEST(cfi_test,early_init)184 TEST(cfi_test, early_init) {
185 #if defined(__BIONIC__)
186 std::string helper = GetTestlibRoot() + "/cfi_test_helper";
187 chmod(helper.c_str(), 0755); // TODO: "x" lost in CTS, b/34945607
188 ExecTestHelper eth;
189 eth.SetArgs({ helper.c_str(), nullptr });
190 eth.Run([&]() { execve(helper.c_str(), eth.GetArgs(), eth.GetEnv()); }, 0, nullptr);
191 #endif
192 }
193
194 // cfi_test_helper2 depends on a library that exports __cfi_check, which triggers CFI initialization
195 // at startup.
TEST(cfi_test,early_init2)196 TEST(cfi_test, early_init2) {
197 #if defined(__BIONIC__)
198 std::string helper = GetTestlibRoot() + "/cfi_test_helper2";
199 chmod(helper.c_str(), 0755); // TODO: "x" lost in CTS, b/34945607
200 ExecTestHelper eth;
201 eth.SetArgs({ helper.c_str(), nullptr });
202 eth.Run([&]() { execve(helper.c_str(), eth.GetArgs(), eth.GetEnv()); }, 0, nullptr);
203 #endif
204 }
205