1 /*
2 * Copyright (C) 2012 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 /*
18 * Contributed by: Intel Corporation
19 */
20
21 #include <gtest/gtest.h>
22
23 #include <pthread.h>
24 #include <stdint.h>
25 #include <stdio.h>
26 #include <unistd.h>
27 #include <set>
28
29 #include <android-base/silent_death_test.h>
30
31 #include "platform/bionic/mte.h"
32 #include "private/bionic_tls.h"
33
34 extern "C" pid_t gettid(); // glibc defines this but doesn't declare it anywhere.
35
36 #if defined(__BIONIC__)
37 extern uintptr_t __stack_chk_guard;
38 #endif
39
40 struct stack_protector_checker {
41 std::set<pid_t> tids;
42 std::set<void*> guards;
43
Checkstack_protector_checker44 void Check() {
45 pid_t tid = gettid();
46 void* guard = __get_tls()[TLS_SLOT_STACK_GUARD];
47
48 printf("[thread %d] TLS stack guard = %p\n", tid, guard);
49
50 // Duplicate tid. gettid(2) bug? Seeing this would be very upsetting.
51 ASSERT_TRUE(tids.find(tid) == tids.end());
52
53 // Uninitialized guard. Our bug. Note this is potentially flaky; we _could_
54 // get four random zero bytes, but it should be vanishingly unlikely.
55 ASSERT_NE(guard, nullptr);
56
57 #if defined(__BIONIC__)
58 // bionic always has the global too.
59 ASSERT_EQ(__stack_chk_guard, reinterpret_cast<uintptr_t>(guard));
60 #endif
61
62 tids.insert(tid);
63 guards.insert(guard);
64 }
65 };
66
TEST(stack_protector,same_guard_per_thread)67 TEST(stack_protector, same_guard_per_thread) {
68 // Everyone has the TLS slot set, even if their stack protector
69 // implementation doesn't yet use it.
70 stack_protector_checker checker;
71
72 // Check the main thread.
73 ASSERT_EQ(getpid(), gettid()); // We are the main thread, right?
74 checker.Check();
75
76 size_t thread_count = 9;
77 for (size_t i = 1; i < thread_count; ++i) {
78 pthread_t t;
79 ASSERT_EQ(0, pthread_create(&t, nullptr, [](void* arg) -> void* {
80 stack_protector_checker* checker = reinterpret_cast<stack_protector_checker*>(arg);
81 checker->Check();
82 return nullptr;
83 }, &checker));
84 void* result;
85 ASSERT_EQ(0, pthread_join(t, &result));
86 ASSERT_EQ(nullptr, result);
87 }
88 ASSERT_EQ(thread_count, checker.tids.size());
89
90 // Both bionic and glibc use the same guard for every thread.
91 ASSERT_EQ(1U, checker.guards.size());
92 }
93
TEST(stack_protector,global_guard)94 TEST(stack_protector, global_guard) {
95 #if defined(__BIONIC__)
96 // Bionic always has a global, even if it's using TLS.
97 ASSERT_NE(0, gettid());
98 ASSERT_NE(0U, __stack_chk_guard);
99 #else
100 GTEST_SKIP() << "glibc doesn't have a global __stack_chk_guard";
101 #endif
102 }
103
104 // Make sure that a stack variable (`*p`) is tagged under MTE, by forcing the
105 // stack safety analysis to fail.
106 int z;
escape_stack_safety_analysis(int * p)107 __attribute__((noinline)) void escape_stack_safety_analysis(int* p) {
108 *p = z;
109 }
110
stack_mte_enabled()111 bool stack_mte_enabled() {
112 if (!mte_supported()) return false;
113 int stack_variable;
114 escape_stack_safety_analysis(&stack_variable);
115 #if defined(__aarch64__)
116 return reinterpret_cast<uintptr_t>(&stack_variable) & (0xfull << 56);
117 #else // !defined(__aarch64__)
118 return false;
119 #endif // defined(__aarch64__)
120 }
121
hwasan_enabled()122 bool hwasan_enabled() {
123 #if __has_feature(hwaddress_sanitizer)
124 return true;
125 #else
126 return false;
127 #endif // __has_feature(hwaddress_sanitizer)
128 }
129
130 using stack_protector_DeathTest = SilentDeathTest;
131
TEST_F(stack_protector_DeathTest,modify_stack_protector)132 TEST_F(stack_protector_DeathTest, modify_stack_protector) {
133 // In another file to prevent inlining, which removes stack protection.
134 extern void modify_stack_protector_test();
135
136 if (stack_mte_enabled()) {
137 GTEST_SKIP() << "Stack MTE is enabled, stack protector is not available";
138 } else if (hwasan_enabled()) {
139 GTEST_SKIP() << "HWASan is enabled, stack protector is not testable";
140 } else {
141 ASSERT_EXIT(modify_stack_protector_test(), testing::KilledBySignal(SIGABRT),
142 "stack corruption detected");
143 }
144 }
145