1 /*
2 * Copyright (C) 2012 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 /*
18 * Contributed by: Intel Corporation
19 */
20
21 #include <gtest/gtest.h>
22
23 #include <pthread.h>
24 #include <stdint.h>
25 #include <stdio.h>
26 #include <sys/syscall.h>
27 #include <unistd.h>
28 #include <set>
29
30 #if defined(__GLIBC__)
31 // glibc doesn't expose gettid(2).
gettid()32 pid_t gettid() { return syscall(__NR_gettid); }
33 #endif // __GLIBC__
34
35 // For x86, bionic and glibc have per-thread stack guard values (all identical).
36 #if defined(__i386__)
GetGuardFromTls()37 static uint32_t GetGuardFromTls() {
38 uint32_t guard;
39 asm ("mov %%gs:0x14, %0": "=d" (guard));
40 return guard;
41 }
42
43 struct stack_protector_checker {
44 std::set<pid_t> tids;
45 std::set<uint32_t> guards;
46
Checkstack_protector_checker47 void Check() {
48 pid_t tid = gettid();
49 uint32_t guard = GetGuardFromTls();
50
51 printf("[thread %d] %%gs:0x14 = 0x%08x\n", tid, guard);
52
53 // Duplicate tid. gettid(2) bug? Seeing this would be very upsetting.
54 ASSERT_TRUE(tids.find(tid) == tids.end());
55
56 // Uninitialized guard. Our bug. Note this is potentially flaky; we _could_ get
57 // four random zero bytes, but it should be vanishingly unlikely.
58 ASSERT_NE(guard, 0U);
59
60 tids.insert(tid);
61 guards.insert(guard);
62 }
63 };
64
ThreadGuardHelper(void * arg)65 static void* ThreadGuardHelper(void* arg) {
66 stack_protector_checker* checker = reinterpret_cast<stack_protector_checker*>(arg);
67 checker->Check();
68 return NULL;
69 }
70 #endif // __i386__
71
TEST(stack_protector,same_guard_per_thread)72 TEST(stack_protector, same_guard_per_thread) {
73 #if defined(__i386__)
74 stack_protector_checker checker;
75 size_t thread_count = 10;
76 for (size_t i = 0; i < thread_count; ++i) {
77 pthread_t t;
78 ASSERT_EQ(0, pthread_create(&t, NULL, ThreadGuardHelper, &checker));
79 void* result;
80 ASSERT_EQ(0, pthread_join(t, &result));
81 ASSERT_EQ(NULL, result);
82 }
83 ASSERT_EQ(thread_count, checker.tids.size());
84
85 // bionic and glibc use the same guard for every thread.
86 ASSERT_EQ(1U, checker.guards.size());
87 #else // __i386__
88 GTEST_LOG_(INFO) << "This test does nothing.\n";
89 #endif // __i386__
90 }
91
92 // For ARM and MIPS, glibc has a global stack check guard value.
93 #if defined(__BIONIC__) || defined(__arm__) || defined(__mips__)
94 #define TEST_STACK_CHK_GUARD
95
96 // Bionic has the global for x86 too, to support binaries that can run on
97 // Android releases that didn't implement the TLS guard value.
98 extern "C" uintptr_t __stack_chk_guard;
99
100 /*
101 * When this function returns, the stack canary will be inconsistent
102 * with the previous value, which will generate a call to __stack_chk_fail(),
103 * eventually resulting in a SIGABRT.
104 *
105 * This must be marked with "__attribute__ ((noinline))", to ensure the
106 * compiler generates the proper stack guards around this function.
107 */
108 __attribute__ ((noinline))
do_modify_stack_chk_guard()109 static void do_modify_stack_chk_guard() {
110 __stack_chk_guard = 0x12345678;
111 }
112 #endif
113
TEST(stack_protector,global_guard)114 TEST(stack_protector, global_guard) {
115 #if defined(TEST_STACK_CHK_GUARD)
116 ASSERT_NE(0, gettid());
117 ASSERT_NE(0U, __stack_chk_guard);
118 #else // TEST_STACK_CHK_GUARD
119 GTEST_LOG_(INFO) << "This test does nothing.\n";
120 #endif // TEST_STACK_CHK_GUARD
121 }
122
TEST(stack_protector_DeathTest,modify_stack_protector)123 TEST(stack_protector_DeathTest, modify_stack_protector) {
124 #if defined(TEST_STACK_CHK_GUARD)
125 ::testing::FLAGS_gtest_death_test_style = "threadsafe";
126 ASSERT_EXIT(do_modify_stack_chk_guard(), testing::KilledBySignal(SIGABRT), "");
127 #else // TEST_STACK_CHK_GUARD
128 GTEST_LOG_(INFO) << "This test does nothing.\n";
129 #endif // TEST_STACK_CHK_GUARD
130 }
131