1 /* 2 * syscall_arg_fault.c - tests faults 32-bit fast syscall stack args 3 * Copyright (c) 2015 Andrew Lutomirski 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms and conditions of the GNU General Public License, 7 * version 2, as published by the Free Software Foundation. 8 * 9 * This program is distributed in the hope it will be useful, but 10 * WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 * General Public License for more details. 13 */ 14 15 #define _GNU_SOURCE 16 17 #include <stdlib.h> 18 #include <stdio.h> 19 #include <string.h> 20 #include <sys/signal.h> 21 #include <sys/ucontext.h> 22 #include <err.h> 23 #include <setjmp.h> 24 #include <errno.h> 25 26 /* Our sigaltstack scratch space. */ 27 static unsigned char altstack_data[SIGSTKSZ]; 28 29 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), 30 int flags) 31 { 32 struct sigaction sa; 33 memset(&sa, 0, sizeof(sa)); 34 sa.sa_sigaction = handler; 35 sa.sa_flags = SA_SIGINFO | flags; 36 sigemptyset(&sa.sa_mask); 37 if (sigaction(sig, &sa, 0)) 38 err(1, "sigaction"); 39 } 40 41 static volatile sig_atomic_t sig_traps; 42 static sigjmp_buf jmpbuf; 43 44 static volatile sig_atomic_t n_errs; 45 46 static void sigsegv_or_sigbus(int sig, siginfo_t *info, void *ctx_void) 47 { 48 ucontext_t *ctx = (ucontext_t*)ctx_void; 49 50 if (ctx->uc_mcontext.gregs[REG_EAX] != -EFAULT) { 51 printf("[FAIL]\tAX had the wrong value: 0x%x\n", 52 ctx->uc_mcontext.gregs[REG_EAX]); 53 n_errs++; 54 } else { 55 printf("[OK]\tSeems okay\n"); 56 } 57 58 siglongjmp(jmpbuf, 1); 59 } 60 61 static void sigill(int sig, siginfo_t *info, void *ctx_void) 62 { 63 printf("[SKIP]\tIllegal instruction\n"); 64 siglongjmp(jmpbuf, 1); 65 } 66 67 int main() 68 { 69 stack_t stack = { 70 .ss_sp = altstack_data, 71 .ss_size = SIGSTKSZ, 72 }; 73 if (sigaltstack(&stack, NULL) != 0) 74 err(1, "sigaltstack"); 75 76 sethandler(SIGSEGV, sigsegv_or_sigbus, SA_ONSTACK); 77 /* 78 * The actual exception can vary. On Atom CPUs, we get #SS 79 * instead of #PF when the vDSO fails to access the stack when 80 * ESP is too close to 2^32, and #SS causes SIGBUS. 81 */ 82 sethandler(SIGBUS, sigsegv_or_sigbus, SA_ONSTACK); 83 sethandler(SIGILL, sigill, SA_ONSTACK); 84 85 /* 86 * Exercise another nasty special case. The 32-bit SYSCALL 87 * and SYSENTER instructions (even in compat mode) each 88 * clobber one register. A Linux system call has a syscall 89 * number and six arguments, and the user stack pointer 90 * needs to live in some register on return. That means 91 * that we need eight registers, but SYSCALL and SYSENTER 92 * only preserve seven registers. As a result, one argument 93 * ends up on the stack. The stack is user memory, which 94 * means that the kernel can fail to read it. 95 * 96 * The 32-bit fast system calls don't have a defined ABI: 97 * we're supposed to invoke them through the vDSO. So we'll 98 * fudge it: we set all regs to invalid pointer values and 99 * invoke the entry instruction. The return will fail no 100 * matter what, and we completely lose our program state, 101 * but we can fix it up with a signal handler. 102 */ 103 104 printf("[RUN]\tSYSENTER with invalid state\n"); 105 if (sigsetjmp(jmpbuf, 1) == 0) { 106 asm volatile ( 107 "movl $-1, %%eax\n\t" 108 "movl $-1, %%ebx\n\t" 109 "movl $-1, %%ecx\n\t" 110 "movl $-1, %%edx\n\t" 111 "movl $-1, %%esi\n\t" 112 "movl $-1, %%edi\n\t" 113 "movl $-1, %%ebp\n\t" 114 "movl $-1, %%esp\n\t" 115 "sysenter" 116 : : : "memory", "flags"); 117 } 118 119 printf("[RUN]\tSYSCALL with invalid state\n"); 120 if (sigsetjmp(jmpbuf, 1) == 0) { 121 asm volatile ( 122 "movl $-1, %%eax\n\t" 123 "movl $-1, %%ebx\n\t" 124 "movl $-1, %%ecx\n\t" 125 "movl $-1, %%edx\n\t" 126 "movl $-1, %%esi\n\t" 127 "movl $-1, %%edi\n\t" 128 "movl $-1, %%ebp\n\t" 129 "movl $-1, %%esp\n\t" 130 "syscall\n\t" 131 "pushl $0" /* make sure we segfault cleanly */ 132 : : : "memory", "flags"); 133 } 134 135 return 0; 136 } 137