1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Copyright (C) 2019 ARM Limited
4 *
5 * Place a fake sigframe on the stack including a bad record overflowing
6 * the __reserved space: on sigreturn Kernel must spot this attempt and
7 * the test case is expected to be terminated via SEGV.
8 */
9
10 #include <signal.h>
11 #include <ucontext.h>
12
13 #include "test_signals_utils.h"
14 #include "testcases.h"
15
16 struct fake_sigframe sf;
17
18 #define MIN_SZ_ALIGN 16
19
fake_sigreturn_bad_size_run(struct tdescr * td,siginfo_t * si,ucontext_t * uc)20 static int fake_sigreturn_bad_size_run(struct tdescr *td,
21 siginfo_t *si, ucontext_t *uc)
22 {
23 size_t resv_sz, need_sz, offset;
24 struct _aarch64_ctx *shead = GET_SF_RESV_HEAD(sf), *head;
25
26 /* just to fill the ucontext_t with something real */
27 if (!get_current_context(td, &sf.uc, sizeof(sf.uc)))
28 return 1;
29
30 resv_sz = GET_SF_RESV_SIZE(sf);
31 /* at least HDR_SZ + bad sized esr_context needed */
32 need_sz = sizeof(struct esr_context) + HDR_SZ;
33 head = get_starting_head(shead, need_sz, resv_sz, &offset);
34 if (!head)
35 return 0;
36
37 /*
38 * Use an esr_context to build a fake header with a
39 * size greater then the free __reserved area minus HDR_SZ;
40 * using ESR_MAGIC here since it is not checked for size nor
41 * is limited to one instance.
42 *
43 * At first inject an additional normal esr_context
44 */
45 head->magic = ESR_MAGIC;
46 head->size = sizeof(struct esr_context);
47 /* and terminate properly */
48 write_terminator_record(GET_RESV_NEXT_HEAD(head));
49 ASSERT_GOOD_CONTEXT(&sf.uc);
50
51 /*
52 * now mess with fake esr_context size: leaving less space than
53 * needed while keeping size value 16-aligned
54 *
55 * It must trigger a SEGV from Kernel on:
56 *
57 * resv_sz - offset < sizeof(*head)
58 */
59 /* at first set the maximum good 16-aligned size */
60 head->size = (resv_sz - offset - need_sz + MIN_SZ_ALIGN) & ~0xfUL;
61 /* plus a bit more of 16-aligned sized stuff */
62 head->size += MIN_SZ_ALIGN;
63 /* and terminate properly */
64 write_terminator_record(GET_RESV_NEXT_HEAD(head));
65 ASSERT_BAD_CONTEXT(&sf.uc);
66 fake_sigreturn(&sf, sizeof(sf), 0);
67
68 return 1;
69 }
70
71 struct tdescr tde = {
72 .name = "FAKE_SIGRETURN_BAD_SIZE",
73 .descr = "Triggers a sigreturn with a overrun __reserved area",
74 .sig_ok = SIGSEGV,
75 .timeout = 3,
76 .run = fake_sigreturn_bad_size_run,
77 };
78