stack_protector_test.cpp revision 9df70403d95f5cfe6824e38a9a6c35f9b9bbc76a 
1/*
2 * Copyright (C) 2012 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17/*
18 * Contributed by: Intel Corporation
19 */
20
21#include <gtest/gtest.h>
22#include "BionicDeathTest.h"
23
24#include <pthread.h>
25#include <stdint.h>
26#include <stdio.h>
27#include <sys/syscall.h>
28#include <unistd.h>
29#include <set>
30
31#if defined(__GLIBC__)
32// glibc doesn't expose gettid(2).
33pid_t gettid() { return syscall(__NR_gettid); }
34#endif // __GLIBC__
35
36// For x86, bionic and glibc have per-thread stack guard values (all identical).
37#if defined(__i386__)
38static uint32_t GetGuardFromTls() {
39  uint32_t guard;
40  asm ("mov %%gs:0x14, %0": "=d" (guard));
41  return guard;
42}
43
44struct stack_protector_checker {
45  std::set<pid_t> tids;
46  std::set<uint32_t> guards;
47
48  void Check() {
49    pid_t tid = gettid();
50    uint32_t guard = GetGuardFromTls();
51
52    printf("[thread %d] %%gs:0x14 = 0x%08x\n", tid, guard);
53
54    // Duplicate tid. gettid(2) bug? Seeing this would be very upsetting.
55    ASSERT_TRUE(tids.find(tid) == tids.end());
56
57    // Uninitialized guard. Our bug. Note this is potentially flaky; we _could_ get
58    // four random zero bytes, but it should be vanishingly unlikely.
59    ASSERT_NE(guard, 0U);
60
61    tids.insert(tid);
62    guards.insert(guard);
63  }
64};
65
66static void* ThreadGuardHelper(void* arg) {
67  stack_protector_checker* checker = reinterpret_cast<stack_protector_checker*>(arg);
68  checker->Check();
69  return NULL;
70}
71#endif // __i386__
72
73TEST(stack_protector, same_guard_per_thread) {
74#if defined(__i386__)
75  stack_protector_checker checker;
76  size_t thread_count = 10;
77  for (size_t i = 0; i < thread_count; ++i) {
78    pthread_t t;
79    ASSERT_EQ(0, pthread_create(&t, NULL, ThreadGuardHelper, &checker));
80    void* result;
81    ASSERT_EQ(0, pthread_join(t, &result));
82    ASSERT_EQ(NULL, result);
83  }
84  ASSERT_EQ(thread_count, checker.tids.size());
85
86  // bionic and glibc use the same guard for every thread.
87  ASSERT_EQ(1U, checker.guards.size());
88#else // __i386__
89  GTEST_LOG_(INFO) << "This test does nothing.\n";
90#endif // __i386__
91}
92
93// For ARM and MIPS, glibc has a global stack check guard value.
94#if defined(__BIONIC__) || defined(__arm__) || defined(__mips__)
95#define TEST_STACK_CHK_GUARD
96
97// Bionic has the global for x86 too, to support binaries that can run on
98// Android releases that didn't implement the TLS guard value.
99extern "C" uintptr_t __stack_chk_guard;
100
101/*
102 * When this function returns, the stack canary will be inconsistent
103 * with the previous value, which will generate a call to __stack_chk_fail(),
104 * eventually resulting in a SIGABRT.
105 *
106 * This must be marked with "__attribute__ ((noinline))", to ensure the
107 * compiler generates the proper stack guards around this function.
108 */
109__attribute__ ((noinline))
110static void do_modify_stack_chk_guard() {
111  __stack_chk_guard = 0x12345678;
112}
113#endif
114
115TEST(stack_protector, global_guard) {
116#if defined(TEST_STACK_CHK_GUARD)
117  ASSERT_NE(0, gettid());
118  ASSERT_NE(0U, __stack_chk_guard);
119#else // TEST_STACK_CHK_GUARD
120  GTEST_LOG_(INFO) << "This test does nothing.\n";
121#endif // TEST_STACK_CHK_GUARD
122}
123
124class stack_protector_DeathTest : public BionicDeathTest {};
125
126TEST_F(stack_protector_DeathTest, modify_stack_protector) {
127#if defined(TEST_STACK_CHK_GUARD)
128  ASSERT_EXIT(do_modify_stack_chk_guard(), testing::KilledBySignal(SIGABRT), "");
129#else // TEST_STACK_CHK_GUARD
130  GTEST_LOG_(INFO) << "This test does nothing.\n";
131#endif // TEST_STACK_CHK_GUARD
132}
133