1 /*
2 * syscall_arg_fault.c - tests faults 32-bit fast syscall stack args
3 * Copyright (c) 2015 Andrew Lutomirski
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms and conditions of the GNU General Public License,
7 * version 2, as published by the Free Software Foundation.
8 *
9 * This program is distributed in the hope it will be useful, but
10 * WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * General Public License for more details.
13 */
14
15 #define _GNU_SOURCE
16
17 #include <stdlib.h>
18 #include <stdio.h>
19 #include <string.h>
20 #include <sys/signal.h>
21 #include <sys/ucontext.h>
22 #include <err.h>
23 #include <setjmp.h>
24 #include <errno.h>
25
26 /* Our sigaltstack scratch space. */
27 static unsigned char altstack_data[SIGSTKSZ];
28
sethandler(int sig,void (* handler)(int,siginfo_t *,void *),int flags)29 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
30 int flags)
31 {
32 struct sigaction sa;
33 memset(&sa, 0, sizeof(sa));
34 sa.sa_sigaction = handler;
35 sa.sa_flags = SA_SIGINFO | flags;
36 sigemptyset(&sa.sa_mask);
37 if (sigaction(sig, &sa, 0))
38 err(1, "sigaction");
39 }
40
41 static volatile sig_atomic_t sig_traps;
42 static sigjmp_buf jmpbuf;
43
44 static volatile sig_atomic_t n_errs;
45
sigsegv_or_sigbus(int sig,siginfo_t * info,void * ctx_void)46 static void sigsegv_or_sigbus(int sig, siginfo_t *info, void *ctx_void)
47 {
48 ucontext_t *ctx = (ucontext_t*)ctx_void;
49
50 if (ctx->uc_mcontext.gregs[REG_EAX] != -EFAULT) {
51 printf("[FAIL]\tAX had the wrong value: 0x%x\n",
52 ctx->uc_mcontext.gregs[REG_EAX]);
53 n_errs++;
54 } else {
55 printf("[OK]\tSeems okay\n");
56 }
57
58 siglongjmp(jmpbuf, 1);
59 }
60
sigill(int sig,siginfo_t * info,void * ctx_void)61 static void sigill(int sig, siginfo_t *info, void *ctx_void)
62 {
63 printf("[SKIP]\tIllegal instruction\n");
64 siglongjmp(jmpbuf, 1);
65 }
66
main()67 int main()
68 {
69 stack_t stack = {
70 .ss_sp = altstack_data,
71 .ss_size = SIGSTKSZ,
72 };
73 if (sigaltstack(&stack, NULL) != 0)
74 err(1, "sigaltstack");
75
76 sethandler(SIGSEGV, sigsegv_or_sigbus, SA_ONSTACK);
77 /*
78 * The actual exception can vary. On Atom CPUs, we get #SS
79 * instead of #PF when the vDSO fails to access the stack when
80 * ESP is too close to 2^32, and #SS causes SIGBUS.
81 */
82 sethandler(SIGBUS, sigsegv_or_sigbus, SA_ONSTACK);
83 sethandler(SIGILL, sigill, SA_ONSTACK);
84
85 /*
86 * Exercise another nasty special case. The 32-bit SYSCALL
87 * and SYSENTER instructions (even in compat mode) each
88 * clobber one register. A Linux system call has a syscall
89 * number and six arguments, and the user stack pointer
90 * needs to live in some register on return. That means
91 * that we need eight registers, but SYSCALL and SYSENTER
92 * only preserve seven registers. As a result, one argument
93 * ends up on the stack. The stack is user memory, which
94 * means that the kernel can fail to read it.
95 *
96 * The 32-bit fast system calls don't have a defined ABI:
97 * we're supposed to invoke them through the vDSO. So we'll
98 * fudge it: we set all regs to invalid pointer values and
99 * invoke the entry instruction. The return will fail no
100 * matter what, and we completely lose our program state,
101 * but we can fix it up with a signal handler.
102 */
103
104 printf("[RUN]\tSYSENTER with invalid state\n");
105 if (sigsetjmp(jmpbuf, 1) == 0) {
106 asm volatile (
107 "movl $-1, %%eax\n\t"
108 "movl $-1, %%ebx\n\t"
109 "movl $-1, %%ecx\n\t"
110 "movl $-1, %%edx\n\t"
111 "movl $-1, %%esi\n\t"
112 "movl $-1, %%edi\n\t"
113 "movl $-1, %%ebp\n\t"
114 "movl $-1, %%esp\n\t"
115 "sysenter"
116 : : : "memory", "flags");
117 }
118
119 printf("[RUN]\tSYSCALL with invalid state\n");
120 if (sigsetjmp(jmpbuf, 1) == 0) {
121 asm volatile (
122 "movl $-1, %%eax\n\t"
123 "movl $-1, %%ebx\n\t"
124 "movl $-1, %%ecx\n\t"
125 "movl $-1, %%edx\n\t"
126 "movl $-1, %%esi\n\t"
127 "movl $-1, %%edi\n\t"
128 "movl $-1, %%ebp\n\t"
129 "movl $-1, %%esp\n\t"
130 "syscall\n\t"
131 "pushl $0" /* make sure we segfault cleanly */
132 : : : "memory", "flags");
133 }
134
135 return 0;
136 }
137