1/* 2 * Copyright (C) 2012 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17/* 18 * Contributed by: Intel Corporation 19 */ 20 21#include <gtest/gtest.h> 22 23#include <pthread.h> 24#include <stdint.h> 25#include <stdio.h> 26#include <sys/syscall.h> 27#include <unistd.h> 28#include <set> 29 30#if defined(__GLIBC__) 31// glibc doesn't expose gettid(2). 32pid_t gettid() { return syscall(__NR_gettid); } 33#endif // __GLIBC__ 34 35// For x86, bionic and glibc have per-thread stack guard values (all identical). 36#if defined(__i386__) 37static uint32_t GetGuardFromTls() { 38 uint32_t guard; 39 asm ("mov %%gs:0x14, %0": "=d" (guard)); 40 return guard; 41} 42 43struct stack_protector_checker { 44 std::set<pid_t> tids; 45 std::set<uint32_t> guards; 46 47 void Check() { 48 pid_t tid = gettid(); 49 uint32_t guard = GetGuardFromTls(); 50 51 printf("[thread %d] %%gs:0x14 = 0x%08x\n", tid, guard); 52 53 // Duplicate tid. gettid(2) bug? Seeing this would be very upsetting. 54 ASSERT_TRUE(tids.find(tid) == tids.end()); 55 56 // Uninitialized guard. Our bug. Note this is potentially flaky; we _could_ get 57 // four random zero bytes, but it should be vanishingly unlikely. 58 ASSERT_NE(guard, 0U); 59 60 tids.insert(tid); 61 guards.insert(guard); 62 } 63}; 64 65static void* ThreadGuardHelper(void* arg) { 66 stack_protector_checker* checker = reinterpret_cast<stack_protector_checker*>(arg); 67 checker->Check(); 68 return NULL; 69} 70#endif // __i386__ 71 72TEST(stack_protector, same_guard_per_thread) { 73#if defined(__i386__) 74 stack_protector_checker checker; 75 size_t thread_count = 10; 76 for (size_t i = 0; i < thread_count; ++i) { 77 pthread_t t; 78 ASSERT_EQ(0, pthread_create(&t, NULL, ThreadGuardHelper, &checker)); 79 void* result; 80 ASSERT_EQ(0, pthread_join(t, &result)); 81 ASSERT_EQ(NULL, result); 82 } 83 ASSERT_EQ(thread_count, checker.tids.size()); 84 85 // bionic and glibc use the same guard for every thread. 86 ASSERT_EQ(1U, checker.guards.size()); 87#else // __i386__ 88 GTEST_LOG_(INFO) << "This test does nothing.\n"; 89#endif // __i386__ 90} 91 92// For ARM and MIPS, glibc has a global stack check guard value. 93#if defined(__BIONIC__) || defined(__arm__) || defined(__mips__) 94#define TEST_STACK_CHK_GUARD 95 96// Bionic has the global for x86 too, to support binaries that can run on 97// Android releases that didn't implement the TLS guard value. 98extern "C" uintptr_t __stack_chk_guard; 99 100/* 101 * When this function returns, the stack canary will be inconsistent 102 * with the previous value, which will generate a call to __stack_chk_fail(), 103 * eventually resulting in a SIGABRT. 104 * 105 * This must be marked with "__attribute__ ((noinline))", to ensure the 106 * compiler generates the proper stack guards around this function. 107 */ 108__attribute__ ((noinline)) 109static void do_modify_stack_chk_guard() { 110 __stack_chk_guard = 0x12345678; 111} 112#endif 113 114TEST(stack_protector, global_guard) { 115#if defined(TEST_STACK_CHK_GUARD) 116 ASSERT_NE(0, gettid()); 117 ASSERT_NE(0U, __stack_chk_guard); 118#else // TEST_STACK_CHK_GUARD 119 GTEST_LOG_(INFO) << "This test does nothing.\n"; 120#endif // TEST_STACK_CHK_GUARD 121} 122 123TEST(stack_protector_DeathTest, modify_stack_protector) { 124#if defined(TEST_STACK_CHK_GUARD) 125 ::testing::FLAGS_gtest_death_test_style = "threadsafe"; 126 ASSERT_EXIT(do_modify_stack_chk_guard(), testing::KilledBySignal(SIGABRT), ""); 127#else // TEST_STACK_CHK_GUARD 128 GTEST_LOG_(INFO) << "This test does nothing.\n"; 129#endif // TEST_STACK_CHK_GUARD 130} 131