Hi
On 6/21/19 11:35 AM, Dave Martin wrote:
On Thu, Jun 13, 2019 at 12:13:25PM +0100, Cristian Marussi wrote:
Added a simple mangle testcase which messes with the ucontext_t from within the sig_handler, trying to badly modify and misalign the SP. Expects SIGBUS on test PASS.
Signed-off-by: Cristian Marussi cristian.marussi@arm.com
.../arm64/signal/testcases/.gitignore | 1 + .../signal/testcases/mangle_sp_misaligned.c | 24 +++++++++++++++++++ 2 files changed, 25 insertions(+) create mode 100644 tools/testing/selftests/arm64/signal/testcases/.gitignore create mode 100644 tools/testing/selftests/arm64/signal/testcases/mangle_sp_misaligned.c
diff --git a/tools/testing/selftests/arm64/signal/testcases/.gitignore b/tools/testing/selftests/arm64/signal/testcases/.gitignore new file mode 100644 index 000000000000..7f7414d241f2 --- /dev/null +++ b/tools/testing/selftests/arm64/signal/testcases/.gitignore @@ -0,0 +1 @@ +mangle_sp_misaligned diff --git a/tools/testing/selftests/arm64/signal/testcases/mangle_sp_misaligned.c b/tools/testing/selftests/arm64/signal/testcases/mangle_sp_misaligned.c new file mode 100644 index 000000000000..41bd27312e54 --- /dev/null +++ b/tools/testing/selftests/arm64/signal/testcases/mangle_sp_misaligned.c @@ -0,0 +1,24 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* Copyright (C) 2019 ARM Limited */
+#include "test_signals_utils.h" +#include "testcases.h"
+static int mangle_misaligned_sp_run(struct tdescr *td, siginfo_t *si,
ucontext_t *uc)+{
- ASSERT_GOOD_CONTEXT(uc);
- uc->uc_mcontext.sp += 3;
What are we testing here?
It is archietcturally permitted (if unusual) to have a misaligned sp in userspace.
So are we just getting a SIGBUS after the sigreturn, when the thread tries to dereference sp? If so, we aren't really testing anything about sigreturn here -- I don't see any check in the kernel when restoring sp in sigreturn.
Even if there were no SIGBUS, the thread stack is now corrupt (due to wrong sp), so the interrupted code is unlikely to continue running successfully.
Am I missing something?
The initial (flawed) attempt was to test the check in arm64 rt_sigreturn kernel code:
if (regs->sp & 15) goto badframe;
BUT in fact such initial check happens at the start of rt_sigreturn syscall well before the regs are restored from the uc context in the sigframe which I mangled
i.e. restore_sigframe() -->> __get_user_error(regs->sp...)
==>> uc.uc_mcontext.sp --> regs->sp
happens AFTER the above regs->sp alignment check.
So the check is performed on the effective SP value at the time of kernel entry of sigreturn NOT on the uc.uc_mcontext.sp MANGLED value, so this is not really a sigreturn related test at this point. (and hence the SIGBUS instead of the SEGV).
So an option could be as you proposed in another similarly flawed test to mangle uc.uc_mcontext.sp to point to something unreasonable and in Kernel space (at least virtually)
I'll give it a try.
Cristian
[...]
Cheers ---Dave