diff mbox series

[04/13] kselftest: arm64: mangle_pc_invalid

Message ID 20190613111335.7645-5-cristian.marussi@arm.com
State New
Headers show
Series Add arm64/signal initial kselftest support | expand

Commit Message

Cristian Marussi June 13, 2019, 11:13 a.m. UTC
Added a simple mangle testcase which messes with the ucontext_t
from within the sig_handler, trying to badly modify the PC to point
toward Kernel land.
Expects SIGSEGV on test PASS.

Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
---
 .../arm64/signal/testcases/.gitignore         |  1 +
 .../signal/testcases/mangle_pc_invalid.c      | 24 +++++++++++++++++++
 2 files changed, 25 insertions(+)
 create mode 100644 tools/testing/selftests/arm64/signal/testcases/mangle_pc_invalid.c

Comments

Dave Martin June 21, 2019, 10:35 a.m. UTC | #1
On Thu, Jun 13, 2019 at 12:13:26PM +0100, Cristian Marussi wrote:
> Added a simple mangle testcase which messes with the ucontext_t
> from within the sig_handler, trying to badly modify the PC to point
> toward Kernel land.
> Expects SIGSEGV on test PASS.
> 
> Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
> ---
>  .../arm64/signal/testcases/.gitignore         |  1 +
>  .../signal/testcases/mangle_pc_invalid.c      | 24 +++++++++++++++++++
>  2 files changed, 25 insertions(+)
>  create mode 100644 tools/testing/selftests/arm64/signal/testcases/mangle_pc_invalid.c
> 
> diff --git a/tools/testing/selftests/arm64/signal/testcases/.gitignore b/tools/testing/selftests/arm64/signal/testcases/.gitignore
> index 7f7414d241f2..a87fb0f0d2cf 100644
> --- a/tools/testing/selftests/arm64/signal/testcases/.gitignore
> +++ b/tools/testing/selftests/arm64/signal/testcases/.gitignore
> @@ -1 +1,2 @@
>  mangle_sp_misaligned
> +mangle_pc_invalid
> diff --git a/tools/testing/selftests/arm64/signal/testcases/mangle_pc_invalid.c b/tools/testing/selftests/arm64/signal/testcases/mangle_pc_invalid.c
> new file mode 100644
> index 000000000000..0024032528bc
> --- /dev/null
> +++ b/tools/testing/selftests/arm64/signal/testcases/mangle_pc_invalid.c
> @@ -0,0 +1,24 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +/* Copyright (C) 2019 ARM Limited */
> +
> +#include "test_signals_utils.h"
> +#include "testcases.h"
> +
> +static int mangle_invalid_pc_run(struct tdescr *td, siginfo_t *si,
> +				 ucontext_t *uc)
> +{
> +	ASSERT_GOOD_CONTEXT(uc);
> +
> +	uc->uc_mcontext.pc = 0xffffffffcccccccc;

Similarly to the previous test, I don't think this is testing the
sigreturn behaviour: the kernel just restores the bogus PC value and
returns to userspace.  We then rely on the architecture to generate a
prefetch abort when trying to fetch from the bogus PC.

Am I missing anything?

Could we have a test that points SP to kernel memory and the calls
sigreturn: there is a real behaviour to test there: we must not be able
to trick the kernel into interpreting kernel memory as a signal frame.

[...]

Cheers
--Dave
diff mbox series

Patch

diff --git a/tools/testing/selftests/arm64/signal/testcases/.gitignore b/tools/testing/selftests/arm64/signal/testcases/.gitignore
index 7f7414d241f2..a87fb0f0d2cf 100644
--- a/tools/testing/selftests/arm64/signal/testcases/.gitignore
+++ b/tools/testing/selftests/arm64/signal/testcases/.gitignore
@@ -1 +1,2 @@ 
 mangle_sp_misaligned
+mangle_pc_invalid
diff --git a/tools/testing/selftests/arm64/signal/testcases/mangle_pc_invalid.c b/tools/testing/selftests/arm64/signal/testcases/mangle_pc_invalid.c
new file mode 100644
index 000000000000..0024032528bc
--- /dev/null
+++ b/tools/testing/selftests/arm64/signal/testcases/mangle_pc_invalid.c
@@ -0,0 +1,24 @@ 
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Copyright (C) 2019 ARM Limited */
+
+#include "test_signals_utils.h"
+#include "testcases.h"
+
+static int mangle_invalid_pc_run(struct tdescr *td, siginfo_t *si,
+				 ucontext_t *uc)
+{
+	ASSERT_GOOD_CONTEXT(uc);
+
+	uc->uc_mcontext.pc = 0xffffffffcccccccc;
+
+	return 1;
+}
+
+struct tdescr tde = {
+		.sanity_disabled = true,
+		.name = "MANGLE_PC_INVALID",
+		.descr = "Mangling uc_mcontext with INVALID PC",
+		.sig_trig = SIGUSR1,
+		.sig_ok = SIGSEGV,
+		.run = mangle_invalid_pc_run,
+};