168ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov/* 268ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov * Copyright (C) 2017 The Android Open Source Project 368ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov * 468ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov * Licensed under the Apache License, Version 2.0 (the "License"); 568ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov * you may not use this file except in compliance with the License. 668ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov * You may obtain a copy of the License at 768ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov * 868ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov * http://www.apache.org/licenses/LICENSE-2.0 968ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov * 1068ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov * Unless required by applicable law or agreed to in writing, software 1168ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov * distributed under the License is distributed on an "AS IS" BASIS, 1268ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 1368ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov * See the License for the specific language governing permissions and 1468ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov * limitations under the License. 1568ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov */ 1668ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov 17beb3eb1790dffc6e2f57a670aec89364944f66c4Evgenii Stepanov#include <dlfcn.h> 1868ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov#include <gtest/gtest.h> 1968ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov#include <sys/stat.h> 200a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov 210a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov#include "BionicDeathTest.h" 2268ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov#include "gtest_globals.h" 2368ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov#include "utils.h" 240a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov 251dfd76ac2c7f5e993cde7407931bfd01dceca44dEvgenii Stepanov#if defined(__BIONIC__) 261dfd76ac2c7f5e993cde7407931bfd01dceca44dEvgenii Stepanov#include "private/CFIShadow.h" 271dfd76ac2c7f5e993cde7407931bfd01dceca44dEvgenii Stepanov#endif 281dfd76ac2c7f5e993cde7407931bfd01dceca44dEvgenii Stepanov 290a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov// Private libdl interface. 300a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanovextern "C" { 310a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanovvoid __cfi_slowpath(uint64_t CallSiteTypeId, void* Ptr); 320a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanovvoid __cfi_slowpath_diag(uint64_t CallSiteTypeId, void* Ptr, void* DiagData); 3397c16f8dca0694abfcdda34f8e01f5e1e989120fEvgenii Stepanovsize_t __cfi_shadow_size(); 340a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov} 350a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov 360a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanovstatic void f() {} 370a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov 380a3637d3eb2424d8e825ad1825f843450a888406Evgenii StepanovTEST(cfi_test, basic) { 3968ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov#if defined(__BIONIC__) 400a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov void* handle; 410a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov handle = dlopen("libcfi-test.so", RTLD_NOW | RTLD_LOCAL); 420a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov ASSERT_TRUE(handle != nullptr) << dlerror(); 430a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov 4497c16f8dca0694abfcdda34f8e01f5e1e989120fEvgenii Stepanov EXPECT_NE(0U, __cfi_shadow_size()); 4597c16f8dca0694abfcdda34f8e01f5e1e989120fEvgenii Stepanov 460a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov#define SYM(type, name) auto name = reinterpret_cast<type>(dlsym(handle, #name)) 471dfd76ac2c7f5e993cde7407931bfd01dceca44dEvgenii Stepanov SYM(size_t (*)(), get_count); 480a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov SYM(uint64_t(*)(), get_last_type_id); 490a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov SYM(void* (*)(), get_last_address); 500a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov SYM(void* (*)(), get_last_diag); 510a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov SYM(void* (*)(), get_global_address); 520a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov SYM(void (*)(uint64_t, void*, void*), __cfi_check); 531dfd76ac2c7f5e993cde7407931bfd01dceca44dEvgenii Stepanov SYM(char*, bss); 540a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov#undef SYM 550a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov 561dfd76ac2c7f5e993cde7407931bfd01dceca44dEvgenii Stepanov size_t c = get_count(); 570a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov 580a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov // CFI check for code inside the DSO. Can't use just any function address - this is only 590a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov // guaranteed to work for code addresses above __cfi_check. 600a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov void* code_ptr = reinterpret_cast<char*>(__cfi_check) + 1234; 610a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov void* diag_ptr = reinterpret_cast<void*>(5678); 620a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov __cfi_slowpath_diag(42, code_ptr, diag_ptr); 630a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_EQ(42U, get_last_type_id()); 640a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_EQ(code_ptr, get_last_address()); 650a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_EQ(diag_ptr, get_last_diag()); 660a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_EQ(++c, get_count()); 670a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov 680a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov // __cfi_slowpath passes nullptr for the Diag argument. 690a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov __cfi_slowpath(42, code_ptr); 700a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_EQ(42U, get_last_type_id()); 710a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_EQ(code_ptr, get_last_address()); 720a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_EQ(nullptr, get_last_diag()); 730a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_EQ(++c, get_count()); 740a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov 750a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov // CFI check for a data address inside the DSO. 760a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov __cfi_slowpath(43, get_global_address()); 770a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_EQ(43U, get_last_type_id()); 780a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_EQ(get_global_address(), get_last_address()); 790a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_EQ(++c, get_count()); 800a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov 810a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov // CFI check for a function inside _this_ DSO. It either goes to this DSO's __cfi_check, 820a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov // or (if missing) is simply ignored. Any way, it does not affect the test lib's counters. 830a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov __cfi_slowpath(44, reinterpret_cast<void*>(&f)); 840a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_EQ(43U, get_last_type_id()); 850a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_EQ(get_global_address(), get_last_address()); 860a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_EQ(c, get_count()); 870a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov 880a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov // CFI check for a stack address. This is always invalid and gets the process killed. 890a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_DEATH(__cfi_slowpath(45, reinterpret_cast<void*>(&c)), ""); 900a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov 910a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov // CFI check for a heap address. This is always invalid and gets the process killed. 920a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov void* p = malloc(4096); 930a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_DEATH(__cfi_slowpath(46, p), ""); 940a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov free(p); 950a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov 961dfd76ac2c7f5e993cde7407931bfd01dceca44dEvgenii Stepanov // Check all the addresses. 971dfd76ac2c7f5e993cde7407931bfd01dceca44dEvgenii Stepanov const size_t bss_size = 1024 * 1024; 981dfd76ac2c7f5e993cde7407931bfd01dceca44dEvgenii Stepanov static_assert(bss_size >= kLibraryAlignment * 2, "test range not big enough"); 991dfd76ac2c7f5e993cde7407931bfd01dceca44dEvgenii Stepanov for (size_t i = 0; i < bss_size; ++i) { 1001dfd76ac2c7f5e993cde7407931bfd01dceca44dEvgenii Stepanov __cfi_slowpath(47, bss + i); 1011dfd76ac2c7f5e993cde7407931bfd01dceca44dEvgenii Stepanov EXPECT_EQ(++c, get_count()); 1021dfd76ac2c7f5e993cde7407931bfd01dceca44dEvgenii Stepanov } 1031dfd76ac2c7f5e993cde7407931bfd01dceca44dEvgenii Stepanov 1040a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov // Load the same library again. 1050a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov void* handle2 = dlopen("libcfi-test.so", RTLD_NOW | RTLD_LOCAL); 1060a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov ASSERT_TRUE(handle2 != nullptr) << dlerror(); 1070a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_EQ(handle2, handle); 1080a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov 1090a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov // Check that it is still there. 1100a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov __cfi_slowpath(43, get_global_address()); 1110a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_EQ(43U, get_last_type_id()); 1120a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_EQ(get_global_address(), get_last_address()); 1130a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_EQ(++c, get_count()); 1140a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov 1150a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov dlclose(handle); 1160a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov dlclose(handle2); 1170a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov 1180a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov // CFI check for a function inside the unloaded DSO. This is always invalid and gets the process 1190a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov // killed. 1200a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov EXPECT_DEATH(__cfi_slowpath(45, reinterpret_cast<void*>(code_ptr)), ""); 12168ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov#endif 1220a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov} 1230a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov 1240a3637d3eb2424d8e825ad1825f843450a888406Evgenii StepanovTEST(cfi_test, invalid) { 12568ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov#if defined(__BIONIC__) 1260a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov void* handle; 1270a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov handle = dlopen("libcfi-test-bad.so", RTLD_NOW | RTLD_LOCAL); 1280a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov ASSERT_FALSE(handle != nullptr) << dlerror(); 1290a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov 1300a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov handle = dlopen("libcfi-test-bad.so", RTLD_NOW | RTLD_LOCAL); 1310a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov ASSERT_FALSE(handle != nullptr) << dlerror(); 13268ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov#endif 13368ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov} 13468ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov 13568ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov// cfi_test_helper exports __cfi_check, which triggers CFI initialization at startup. 13668ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii StepanovTEST(cfi_test, early_init) { 13768ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov#if defined(__BIONIC__) 13868ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov std::string helper = get_testlib_root() + "/cfi_test_helper/cfi_test_helper"; 13968ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov chmod(helper.c_str(), 0755); // TODO: "x" lost in CTS, b/34945607 14068ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov ExecTestHelper eth; 14168ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov eth.SetArgs({ helper.c_str(), nullptr }); 14268ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov eth.Run([&]() { execve(helper.c_str(), eth.GetArgs(), eth.GetEnv()); }, 0, nullptr); 14368ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov#endif 14468ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov} 14568ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov 14668ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov// cfi_test_helper2 depends on a library that exports __cfi_check, which triggers CFI initialization 14768ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov// at startup. 14868ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii StepanovTEST(cfi_test, early_init2) { 14968ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov#if defined(__BIONIC__) 15068ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov std::string helper = get_testlib_root() + "/cfi_test_helper2/cfi_test_helper2"; 15168ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov chmod(helper.c_str(), 0755); // TODO: "x" lost in CTS, b/34945607 15268ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov ExecTestHelper eth; 15368ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov eth.SetArgs({ helper.c_str(), nullptr }); 15468ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov eth.Run([&]() { execve(helper.c_str(), eth.GetArgs(), eth.GetEnv()); }, 0, nullptr); 15568ecec1965dcec08c7df3f0224d69604c683cd6cEvgenii Stepanov#endif 1560a3637d3eb2424d8e825ad1825f843450a888406Evgenii Stepanov} 157