1 /*
2  * Copyright (C) 2017 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include <dlfcn.h>
18 #include <sys/stat.h>
19 
20 #include <vector>
21 
22 #include <gtest/gtest.h>
23 
24 #include "gtest_globals.h"
25 #include "utils.h"
26 
27 #if defined(__BIONIC__)
28 #include "private/CFIShadow.h"
29 #endif
30 
31 // Private libdl interface.
32 extern "C" {
33 void __cfi_slowpath(uint64_t CallSiteTypeId, void* Ptr);
34 void __cfi_slowpath_diag(uint64_t CallSiteTypeId, void* Ptr, void* DiagData);
35 size_t __cfi_shadow_size();
36 }
37 
38 // Disables debuggerd stack traces to speed up death tests, make them less
39 // noisy in logcat, and avoid expected deaths from showing up in stability
40 // metrics.
41 // We don't use the usual libbase class because (a) we don't care about most
42 // of the signals it blocks but (b) we do need to block SIGILL, which normal
43 // death tests shouldn't ever hit. (It's possible that a design where a
44 // deathtest always declares its expected signals up front is a better one,
45 // and maybe that's an interesting future direction for libbase.)
46 //
47 // We include SIGSEGV because there's a test that passes heap addresses to
48 // __cfi_slowpath and we only map the executable code shadow as readable.
49 // We don't always get SIGSEGV there though: if the heap allocation happens
50 // to be close enough to an executable mapping that its shadow is in the
51 // same page as the executable shadow, we'll get SIGILL/SIGTRAP.
52 class cfi_test_DeathTest : public testing::Test {
53  protected:
SetUp()54   void SetUp() override {
55     struct sigaction64 action = {.sa_handler = SIG_DFL};
56     sigaction64(SIGILL, &action, &previous_sigill_);
57     sigaction64(SIGSEGV, &action, &previous_sigsegv_);
58     sigaction64(SIGTRAP, &action, &previous_sigtrap_);
59   }
60 
TearDown()61   void TearDown() override {
62     sigaction64(SIGTRAP, &previous_sigtrap_, nullptr);
63     sigaction64(SIGSEGV, &previous_sigsegv_, nullptr);
64     sigaction64(SIGILL, &previous_sigill_, nullptr);
65   }
66 
67  private:
68   struct sigaction64 previous_sigill_;
69   struct sigaction64 previous_sigsegv_;
70   struct sigaction64 previous_sigtrap_;
71 };
72 
f()73 static void f() {}
74 
TEST_F(cfi_test_DeathTest,basic)75 TEST_F(cfi_test_DeathTest, basic) {
76 #if defined(__BIONIC__)
77   void* handle;
78   handle = dlopen("libcfi-test.so", RTLD_NOW | RTLD_LOCAL);
79   ASSERT_TRUE(handle != nullptr) << dlerror();
80 
81   EXPECT_NE(0U, __cfi_shadow_size());
82 
83 #define SYM(type, name) auto name = reinterpret_cast<type>(dlsym(handle, #name))
84   SYM(size_t (*)(), get_count);
85   SYM(uint64_t(*)(), get_last_type_id);
86   SYM(void* (*)(), get_last_address);
87   SYM(void* (*)(), get_last_diag);
88   SYM(void* (*)(), get_global_address);
89   SYM(void (*)(uint64_t, void*, void*), __cfi_check);
90   SYM(char*, bss);
91 #undef SYM
92 
93   size_t c = get_count();
94 
95   // CFI check for code inside the DSO. Can't use just any function address - this is only
96   // guaranteed to work for code addresses above __cfi_check.
97   void* code_ptr = reinterpret_cast<char*>(__cfi_check) + 1234;
98   void* diag_ptr = reinterpret_cast<void*>(5678);
99   __cfi_slowpath_diag(42, code_ptr, diag_ptr);
100   EXPECT_EQ(42U, get_last_type_id());
101   EXPECT_EQ(code_ptr, get_last_address());
102   EXPECT_EQ(diag_ptr, get_last_diag());
103   EXPECT_EQ(++c, get_count());
104 
105   // __cfi_slowpath passes nullptr for the Diag argument.
106   __cfi_slowpath(42, code_ptr);
107   EXPECT_EQ(42U, get_last_type_id());
108   EXPECT_EQ(code_ptr, get_last_address());
109   EXPECT_EQ(nullptr, get_last_diag());
110   EXPECT_EQ(++c, get_count());
111 
112   // CFI check for a data address inside the DSO.
113   __cfi_slowpath(43, get_global_address());
114   EXPECT_EQ(43U, get_last_type_id());
115   EXPECT_EQ(get_global_address(), get_last_address());
116   EXPECT_EQ(++c, get_count());
117 
118   // CFI check for a function inside _this_ DSO. It either goes to this DSO's __cfi_check,
119   // or (if missing) is simply ignored. Any way, it does not affect the test lib's counters.
120   __cfi_slowpath(44, reinterpret_cast<void*>(&f));
121   EXPECT_EQ(43U, get_last_type_id());
122   EXPECT_EQ(get_global_address(), get_last_address());
123   EXPECT_EQ(c, get_count());
124 
125   // Check all the addresses.
126   const size_t bss_size = 1024 * 1024;
127   static_assert(bss_size >= kLibraryAlignment * 2, "test range not big enough");
128   for (size_t i = 0; i < bss_size; ++i) {
129     __cfi_slowpath(47, bss + i);
130     EXPECT_EQ(++c, get_count());
131   }
132 
133   // Load the same library again.
134   void* handle2 = dlopen("libcfi-test.so", RTLD_NOW | RTLD_LOCAL);
135   ASSERT_TRUE(handle2 != nullptr) << dlerror();
136   EXPECT_EQ(handle2, handle);
137 
138   // Check that it is still there.
139   __cfi_slowpath(43, get_global_address());
140   EXPECT_EQ(43U, get_last_type_id());
141   EXPECT_EQ(get_global_address(), get_last_address());
142   EXPECT_EQ(++c, get_count());
143 
144   dlclose(handle);
145   dlclose(handle2);
146 #endif
147 }
148 
TEST(cfi_test,invalid)149 TEST(cfi_test, invalid) {
150 #if defined(__BIONIC__)
151   void* handle;
152   handle = dlopen("libcfi-test-bad.so", RTLD_NOW | RTLD_LOCAL);
153   ASSERT_FALSE(handle != nullptr) << dlerror();
154 
155   handle = dlopen("libcfi-test-bad.so", RTLD_NOW | RTLD_LOCAL);
156   ASSERT_FALSE(handle != nullptr) << dlerror();
157 #endif
158 }
159 
160 // cfi_test_helper exports __cfi_check, which triggers CFI initialization at startup.
TEST(cfi_test,early_init)161 TEST(cfi_test, early_init) {
162 #if defined(__BIONIC__)
163   std::string helper = GetTestLibRoot() + "/cfi_test_helper";
164   ExecTestHelper eth;
165   eth.SetArgs({ helper.c_str(), nullptr });
166   eth.Run([&]() { execve(helper.c_str(), eth.GetArgs(), eth.GetEnv()); }, 0, nullptr);
167 #endif
168 }
169 
170 // cfi_test_helper2 depends on a library that exports __cfi_check, which triggers CFI initialization
171 // at startup.
TEST(cfi_test,early_init2)172 TEST(cfi_test, early_init2) {
173 #if defined(__BIONIC__)
174   std::string helper = GetTestLibRoot() + "/cfi_test_helper2";
175   ExecTestHelper eth;
176   eth.SetArgs({ helper.c_str(), nullptr });
177   eth.Run([&]() { execve(helper.c_str(), eth.GetArgs(), eth.GetEnv()); }, 0, nullptr);
178 #endif
179 }
180