From: Cristian Marussi <cristian.marussi@arm.com> To: linux-kselftest@vger.kernel.org, linux-arm-kernel@lists.infradead.org, shuah@kernel.org Cc: andreyknvl@google.com, dave.martin@arm.com, amit.kachhap@arm.com Subject: [PATCH v4 10/11] kselftest: arm64: fake_sigreturn_bad_size Date: Fri, 30 Aug 2019 17:42:47 +0100 [thread overview] Message-ID: <20190830164248.16238-11-cristian.marussi@arm.com> (raw) In-Reply-To: <20190830164248.16238-1-cristian.marussi@arm.com> Add a simple fake_sigreturn testcase which builds a ucontext_t with a badly sized header that causes a overrun in the __reserved area and place it onto the stack. Expects a SIGSEGV on test PASS. Signed-off-by: Cristian Marussi <cristian.marussi@arm.com> --- v3 --> v4 - fix commit - missing include - using new get_starting_head() helper - added test description --- .../testcases/fake_sigreturn_bad_size.c | 77 +++++++++++++++++++ 1 file changed, 77 insertions(+) create mode 100644 tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_bad_size.c diff --git a/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_bad_size.c b/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_bad_size.c new file mode 100644 index 000000000000..b1156afdb691 --- /dev/null +++ b/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_bad_size.c @@ -0,0 +1,77 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (C) 2019 ARM Limited + * + * Place a fake sigframe on the stack including a bad record overflowing + * the __reserved space: on sigreturn Kernel must spot this attempt and + * the test case is expected to be terminated via SEGV. + */ + +#include <signal.h> +#include <ucontext.h> + +#include "test_signals_utils.h" +#include "testcases.h" + +struct fake_sigframe sf; + +#define MIN_SZ_ALIGN 16 + +static int fake_sigreturn_bad_size_run(struct tdescr *td, + siginfo_t *si, ucontext_t *uc) +{ + size_t resv_sz, need_sz, offset; + struct _aarch64_ctx *shead = GET_SF_RESV_HEAD(sf), *head; + + /* just to fill the ucontext_t with something real */ + if (!get_current_context(td, &sf.uc)) + return 1; + + resv_sz = GET_SF_RESV_SIZE(sf); + /* at least HDR_SZ + bad sized esr_context needed */ + need_sz = HDR_SZ + sizeof(struct esr_context); + head = get_starting_head(shead, need_sz, resv_sz, &offset); + if (head) { + /* + * Use an esr_context to build a fake header with a + * size greater then the free __reserved area minus HDR_SZ; + * using ESR_MAGIC here since it is not checked for size nor + * is limited to one instance. + * + * At first inject an additional normal esr_context + */ + head->magic = ESR_MAGIC; + head->size = sizeof(struct esr_context); + /* and terminate properly */ + write_terminator_record(GET_RESV_NEXT_HEAD(head)); + ASSERT_GOOD_CONTEXT(&sf.uc); + + /* + * now mess with fake esr_context size: leaving less space than + * needed while keeping size value 16-aligned + * + * It must trigger a SEGV from Kernel on: + * + * resv_sz - offset < sizeof(*head) + */ + /* at first set the maximum good 16-aligned size */ + head->size = + (resv_sz - offset - need_sz + MIN_SZ_ALIGN) & ~0xfUL; + /* plus a bit more of 16-aligned sized stuff */ + head->size += MIN_SZ_ALIGN; + /* and terminate properly */ + write_terminator_record(GET_RESV_NEXT_HEAD(head)); + ASSERT_BAD_CONTEXT(&sf.uc); + fake_sigreturn(&sf, sizeof(sf), 0); + } + + return 1; +} + +struct tdescr tde = { + .name = "FAKE_SIGRETURN_BAD_SIZE", + .descr = "Triggers a sigreturn with a overrun __reserved area", + .sig_ok = SIGSEGV, + .timeout = 3, + .run = fake_sigreturn_bad_size_run, +}; -- 2.17.1
WARNING: multiple messages have this Message-ID (diff)
From: Cristian Marussi <cristian.marussi@arm.com> To: linux-kselftest@vger.kernel.org, linux-arm-kernel@lists.infradead.org, shuah@kernel.org Cc: amit.kachhap@arm.com, andreyknvl@google.com, dave.martin@arm.com Subject: [PATCH v4 10/11] kselftest: arm64: fake_sigreturn_bad_size Date: Fri, 30 Aug 2019 17:42:47 +0100 [thread overview] Message-ID: <20190830164248.16238-11-cristian.marussi@arm.com> (raw) In-Reply-To: <20190830164248.16238-1-cristian.marussi@arm.com> Add a simple fake_sigreturn testcase which builds a ucontext_t with a badly sized header that causes a overrun in the __reserved area and place it onto the stack. Expects a SIGSEGV on test PASS. Signed-off-by: Cristian Marussi <cristian.marussi@arm.com> --- v3 --> v4 - fix commit - missing include - using new get_starting_head() helper - added test description --- .../testcases/fake_sigreturn_bad_size.c | 77 +++++++++++++++++++ 1 file changed, 77 insertions(+) create mode 100644 tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_bad_size.c diff --git a/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_bad_size.c b/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_bad_size.c new file mode 100644 index 000000000000..b1156afdb691 --- /dev/null +++ b/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_bad_size.c @@ -0,0 +1,77 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (C) 2019 ARM Limited + * + * Place a fake sigframe on the stack including a bad record overflowing + * the __reserved space: on sigreturn Kernel must spot this attempt and + * the test case is expected to be terminated via SEGV. + */ + +#include <signal.h> +#include <ucontext.h> + +#include "test_signals_utils.h" +#include "testcases.h" + +struct fake_sigframe sf; + +#define MIN_SZ_ALIGN 16 + +static int fake_sigreturn_bad_size_run(struct tdescr *td, + siginfo_t *si, ucontext_t *uc) +{ + size_t resv_sz, need_sz, offset; + struct _aarch64_ctx *shead = GET_SF_RESV_HEAD(sf), *head; + + /* just to fill the ucontext_t with something real */ + if (!get_current_context(td, &sf.uc)) + return 1; + + resv_sz = GET_SF_RESV_SIZE(sf); + /* at least HDR_SZ + bad sized esr_context needed */ + need_sz = HDR_SZ + sizeof(struct esr_context); + head = get_starting_head(shead, need_sz, resv_sz, &offset); + if (head) { + /* + * Use an esr_context to build a fake header with a + * size greater then the free __reserved area minus HDR_SZ; + * using ESR_MAGIC here since it is not checked for size nor + * is limited to one instance. + * + * At first inject an additional normal esr_context + */ + head->magic = ESR_MAGIC; + head->size = sizeof(struct esr_context); + /* and terminate properly */ + write_terminator_record(GET_RESV_NEXT_HEAD(head)); + ASSERT_GOOD_CONTEXT(&sf.uc); + + /* + * now mess with fake esr_context size: leaving less space than + * needed while keeping size value 16-aligned + * + * It must trigger a SEGV from Kernel on: + * + * resv_sz - offset < sizeof(*head) + */ + /* at first set the maximum good 16-aligned size */ + head->size = + (resv_sz - offset - need_sz + MIN_SZ_ALIGN) & ~0xfUL; + /* plus a bit more of 16-aligned sized stuff */ + head->size += MIN_SZ_ALIGN; + /* and terminate properly */ + write_terminator_record(GET_RESV_NEXT_HEAD(head)); + ASSERT_BAD_CONTEXT(&sf.uc); + fake_sigreturn(&sf, sizeof(sf), 0); + } + + return 1; +} + +struct tdescr tde = { + .name = "FAKE_SIGRETURN_BAD_SIZE", + .descr = "Triggers a sigreturn with a overrun __reserved area", + .sig_ok = SIGSEGV, + .timeout = 3, + .run = fake_sigreturn_bad_size_run, +}; -- 2.17.1 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2019-08-30 16:43 UTC|newest] Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-08-30 16:42 [PATCH v4 00/11] Add arm64/signal initial kselftest support Cristian Marussi 2019-08-30 16:42 ` Cristian Marussi 2019-08-30 16:42 ` [PATCH v4 01/11] kselftest: arm64: add skeleton Makefile Cristian Marussi 2019-08-30 16:42 ` Cristian Marussi 2019-08-30 16:42 ` [PATCH v4 02/11] kselftest: arm64: add common utils and one testcase Cristian Marussi 2019-08-30 16:42 ` Cristian Marussi 2019-08-30 16:42 ` [PATCH v4 03/11] kselftest: arm64: mangle_pstate_invalid_daif_bits Cristian Marussi 2019-08-30 16:42 ` Cristian Marussi 2019-08-30 16:42 ` [PATCH v4 04/11] kselftest: arm64: mangle_pstate_invalid_mode_el[123][ht] Cristian Marussi 2019-08-30 16:42 ` Cristian Marussi 2019-08-30 16:42 ` [PATCH v4 05/11] kselftest: arm64: mangle_pstate_ssbs_regs Cristian Marussi 2019-08-30 16:42 ` Cristian Marussi 2019-08-30 16:42 ` [PATCH v4 06/11] kselftest: arm64: fake_sigreturn_bad_magic Cristian Marussi 2019-08-30 16:42 ` Cristian Marussi 2019-08-30 16:42 ` [PATCH v4 07/11] kselftest: arm64: fake_sigreturn_bad_size_for_magic0 Cristian Marussi 2019-08-30 16:42 ` Cristian Marussi 2019-08-30 16:42 ` [PATCH v4 08/11] kselftest: arm64: fake_sigreturn_missing_fpsimd Cristian Marussi 2019-08-30 16:42 ` Cristian Marussi 2019-08-30 16:42 ` [PATCH v4 09/11] kselftest: arm64: fake_sigreturn_duplicated_fpsimd Cristian Marussi 2019-08-30 16:42 ` Cristian Marussi 2019-08-30 16:42 ` Cristian Marussi [this message] 2019-08-30 16:42 ` [PATCH v4 10/11] kselftest: arm64: fake_sigreturn_bad_size Cristian Marussi 2019-08-30 16:42 ` [PATCH v4 11/11] kselftest: arm64: fake_sigreturn_misaligned_sp Cristian Marussi 2019-08-30 16:42 ` Cristian Marussi
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190830164248.16238-11-cristian.marussi@arm.com \ --to=cristian.marussi@arm.com \ --cc=amit.kachhap@arm.com \ --cc=andreyknvl@google.com \ --cc=dave.martin@arm.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kselftest@vger.kernel.org \ --cc=shuah@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.