1 /*
2 * Copyright (C) 2017 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <dlfcn.h>
18 #include <gtest/gtest.h>
19 #include <sys/stat.h>
20
21 #include <vector>
22
23 #include "BionicDeathTest.h"
24 #include "gtest_globals.h"
25 #include "utils.h"
26
27 #if defined(__BIONIC__)
28 #include "private/CFIShadow.h"
29 #endif
30
31 // Private libdl interface.
32 extern "C" {
33 void __cfi_slowpath(uint64_t CallSiteTypeId, void* Ptr);
34 void __cfi_slowpath_diag(uint64_t CallSiteTypeId, void* Ptr, void* DiagData);
35 size_t __cfi_shadow_size();
36 }
37
f()38 static void f() {}
39
test_cfi_slowpath_with_alloc()40 static void test_cfi_slowpath_with_alloc() {
41 std::vector<void*> allocs;
42 for (size_t i = 0; i < 1000; i++) {
43 allocs.push_back(malloc(4096));
44 __cfi_slowpath(46, allocs.back());
45 }
46 }
47
TEST(cfi_test,basic)48 TEST(cfi_test, basic) {
49 #if defined(__BIONIC__)
50 void* handle;
51 handle = dlopen("libcfi-test.so", RTLD_NOW | RTLD_LOCAL);
52 ASSERT_TRUE(handle != nullptr) << dlerror();
53
54 EXPECT_NE(0U, __cfi_shadow_size());
55
56 #define SYM(type, name) auto name = reinterpret_cast<type>(dlsym(handle, #name))
57 SYM(size_t (*)(), get_count);
58 SYM(uint64_t(*)(), get_last_type_id);
59 SYM(void* (*)(), get_last_address);
60 SYM(void* (*)(), get_last_diag);
61 SYM(void* (*)(), get_global_address);
62 SYM(void (*)(uint64_t, void*, void*), __cfi_check);
63 SYM(char*, bss);
64 #undef SYM
65
66 size_t c = get_count();
67
68 // CFI check for code inside the DSO. Can't use just any function address - this is only
69 // guaranteed to work for code addresses above __cfi_check.
70 void* code_ptr = reinterpret_cast<char*>(__cfi_check) + 1234;
71 void* diag_ptr = reinterpret_cast<void*>(5678);
72 __cfi_slowpath_diag(42, code_ptr, diag_ptr);
73 EXPECT_EQ(42U, get_last_type_id());
74 EXPECT_EQ(code_ptr, get_last_address());
75 EXPECT_EQ(diag_ptr, get_last_diag());
76 EXPECT_EQ(++c, get_count());
77
78 // __cfi_slowpath passes nullptr for the Diag argument.
79 __cfi_slowpath(42, code_ptr);
80 EXPECT_EQ(42U, get_last_type_id());
81 EXPECT_EQ(code_ptr, get_last_address());
82 EXPECT_EQ(nullptr, get_last_diag());
83 EXPECT_EQ(++c, get_count());
84
85 // CFI check for a data address inside the DSO.
86 __cfi_slowpath(43, get_global_address());
87 EXPECT_EQ(43U, get_last_type_id());
88 EXPECT_EQ(get_global_address(), get_last_address());
89 EXPECT_EQ(++c, get_count());
90
91 // CFI check for a function inside _this_ DSO. It either goes to this DSO's __cfi_check,
92 // or (if missing) is simply ignored. Any way, it does not affect the test lib's counters.
93 __cfi_slowpath(44, reinterpret_cast<void*>(&f));
94 EXPECT_EQ(43U, get_last_type_id());
95 EXPECT_EQ(get_global_address(), get_last_address());
96 EXPECT_EQ(c, get_count());
97
98 // CFI check for a stack address. This is always invalid and gets the process killed.
99 EXPECT_DEATH(__cfi_slowpath(45, reinterpret_cast<void*>(&c)), "");
100
101 // CFI check for a heap address.
102 // It's possible that this allocation could wind up in the same CFI granule as
103 // an unchecked library, which means the below might not crash. To force a
104 // crash keep allocating up to a max until there is a crash.
105 EXPECT_DEATH(test_cfi_slowpath_with_alloc(), "");
106
107 // Check all the addresses.
108 const size_t bss_size = 1024 * 1024;
109 static_assert(bss_size >= kLibraryAlignment * 2, "test range not big enough");
110 for (size_t i = 0; i < bss_size; ++i) {
111 __cfi_slowpath(47, bss + i);
112 EXPECT_EQ(++c, get_count());
113 }
114
115 // Load the same library again.
116 void* handle2 = dlopen("libcfi-test.so", RTLD_NOW | RTLD_LOCAL);
117 ASSERT_TRUE(handle2 != nullptr) << dlerror();
118 EXPECT_EQ(handle2, handle);
119
120 // Check that it is still there.
121 __cfi_slowpath(43, get_global_address());
122 EXPECT_EQ(43U, get_last_type_id());
123 EXPECT_EQ(get_global_address(), get_last_address());
124 EXPECT_EQ(++c, get_count());
125
126 dlclose(handle);
127 dlclose(handle2);
128
129 // CFI check for a function inside the unloaded DSO. This is always invalid and gets the process
130 // killed.
131 EXPECT_DEATH(__cfi_slowpath(45, reinterpret_cast<void*>(code_ptr)), "");
132 #endif
133 }
134
TEST(cfi_test,invalid)135 TEST(cfi_test, invalid) {
136 #if defined(__BIONIC__)
137 void* handle;
138 handle = dlopen("libcfi-test-bad.so", RTLD_NOW | RTLD_LOCAL);
139 ASSERT_FALSE(handle != nullptr) << dlerror();
140
141 handle = dlopen("libcfi-test-bad.so", RTLD_NOW | RTLD_LOCAL);
142 ASSERT_FALSE(handle != nullptr) << dlerror();
143 #endif
144 }
145
146 // cfi_test_helper exports __cfi_check, which triggers CFI initialization at startup.
TEST(cfi_test,early_init)147 TEST(cfi_test, early_init) {
148 #if defined(__BIONIC__)
149 std::string helper = GetTestlibRoot() + "/cfi_test_helper/cfi_test_helper";
150 chmod(helper.c_str(), 0755); // TODO: "x" lost in CTS, b/34945607
151 ExecTestHelper eth;
152 eth.SetArgs({ helper.c_str(), nullptr });
153 eth.Run([&]() { execve(helper.c_str(), eth.GetArgs(), eth.GetEnv()); }, 0, nullptr);
154 #endif
155 }
156
157 // cfi_test_helper2 depends on a library that exports __cfi_check, which triggers CFI initialization
158 // at startup.
TEST(cfi_test,early_init2)159 TEST(cfi_test, early_init2) {
160 #if defined(__BIONIC__)
161 std::string helper = GetTestlibRoot() + "/cfi_test_helper2/cfi_test_helper2";
162 chmod(helper.c_str(), 0755); // TODO: "x" lost in CTS, b/34945607
163 ExecTestHelper eth;
164 eth.SetArgs({ helper.c_str(), nullptr });
165 eth.Run([&]() { execve(helper.c_str(), eth.GetArgs(), eth.GetEnv()); }, 0, nullptr);
166 #endif
167 }
168