1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Corrupt the XSTATE header in a signal frame
4 *
5 * Based on analysis and a test case from Thomas Gleixner.
6 */
7
8 #define _GNU_SOURCE
9
10 #include <stdlib.h>
11 #include <stdio.h>
12 #include <string.h>
13 #include <sched.h>
14 #include <signal.h>
15 #include <err.h>
16 #include <unistd.h>
17 #include <stdint.h>
18 #include <sys/wait.h>
19
__cpuid(unsigned int * eax,unsigned int * ebx,unsigned int * ecx,unsigned int * edx)20 static inline void __cpuid(unsigned int *eax, unsigned int *ebx,
21 unsigned int *ecx, unsigned int *edx)
22 {
23 asm volatile(
24 "cpuid;"
25 : "=a" (*eax),
26 "=b" (*ebx),
27 "=c" (*ecx),
28 "=d" (*edx)
29 : "0" (*eax), "2" (*ecx));
30 }
31
xsave_enabled(void)32 static inline int xsave_enabled(void)
33 {
34 unsigned int eax, ebx, ecx, edx;
35
36 eax = 0x1;
37 ecx = 0x0;
38 __cpuid(&eax, &ebx, &ecx, &edx);
39
40 /* Is CR4.OSXSAVE enabled ? */
41 return ecx & (1U << 27);
42 }
43
sethandler(int sig,void (* handler)(int,siginfo_t *,void *),int flags)44 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
45 int flags)
46 {
47 struct sigaction sa;
48
49 memset(&sa, 0, sizeof(sa));
50 sa.sa_sigaction = handler;
51 sa.sa_flags = SA_SIGINFO | flags;
52 sigemptyset(&sa.sa_mask);
53 if (sigaction(sig, &sa, 0))
54 err(1, "sigaction");
55 }
56
sigusr1(int sig,siginfo_t * info,void * uc_void)57 static void sigusr1(int sig, siginfo_t *info, void *uc_void)
58 {
59 ucontext_t *uc = uc_void;
60 uint8_t *fpstate = (uint8_t *)uc->uc_mcontext.fpregs;
61 uint64_t *xfeatures = (uint64_t *)(fpstate + 512);
62
63 printf("\tWreck XSTATE header\n");
64 /* Wreck the first reserved bytes in the header */
65 *(xfeatures + 2) = 0xfffffff;
66 }
67
sigsegv(int sig,siginfo_t * info,void * uc_void)68 static void sigsegv(int sig, siginfo_t *info, void *uc_void)
69 {
70 printf("\tGot SIGSEGV\n");
71 }
72
main(void)73 int main(void)
74 {
75 cpu_set_t set;
76
77 sethandler(SIGUSR1, sigusr1, 0);
78 sethandler(SIGSEGV, sigsegv, 0);
79
80 if (!xsave_enabled()) {
81 printf("[SKIP] CR4.OSXSAVE disabled.\n");
82 return 0;
83 }
84
85 CPU_ZERO(&set);
86 CPU_SET(0, &set);
87
88 /*
89 * Enforce that the child runs on the same CPU
90 * which in turn forces a schedule.
91 */
92 sched_setaffinity(getpid(), sizeof(set), &set);
93
94 printf("[RUN]\tSend ourselves a signal\n");
95 raise(SIGUSR1);
96
97 printf("[OK]\tBack from the signal. Now schedule.\n");
98 pid_t child = fork();
99 if (child < 0)
100 err(1, "fork");
101 if (child == 0)
102 return 0;
103 if (child)
104 waitpid(child, NULL, 0);
105 printf("[OK]\tBack in the main thread.\n");
106
107 /*
108 * We could try to confirm that extended state is still preserved
109 * when we schedule. For now, the only indication of failure is
110 * a warning in the kernel logs.
111 */
112
113 return 0;
114 }
115