1 /* 2 * Copyright (C) 2017 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #include <dlfcn.h> 18 #include <gtest/gtest.h> 19 #include <sys/stat.h> 20 21 #include "BionicDeathTest.h" 22 #include "gtest_globals.h" 23 #include "utils.h" 24 25 #if defined(__BIONIC__) 26 #include "private/CFIShadow.h" 27 #endif 28 29 // Private libdl interface. 30 extern "C" { 31 void __cfi_slowpath(uint64_t CallSiteTypeId, void* Ptr); 32 void __cfi_slowpath_diag(uint64_t CallSiteTypeId, void* Ptr, void* DiagData); 33 size_t __cfi_shadow_size(); 34 } 35 36 static void f() {} 37 38 TEST(cfi_test, basic) { 39 #if defined(__BIONIC__) 40 void* handle; 41 handle = dlopen("libcfi-test.so", RTLD_NOW | RTLD_LOCAL); 42 ASSERT_TRUE(handle != nullptr) << dlerror(); 43 44 EXPECT_NE(0U, __cfi_shadow_size()); 45 46 #define SYM(type, name) auto name = reinterpret_cast<type>(dlsym(handle, #name)) 47 SYM(size_t (*)(), get_count); 48 SYM(uint64_t(*)(), get_last_type_id); 49 SYM(void* (*)(), get_last_address); 50 SYM(void* (*)(), get_last_diag); 51 SYM(void* (*)(), get_global_address); 52 SYM(void (*)(uint64_t, void*, void*), __cfi_check); 53 SYM(char*, bss); 54 #undef SYM 55 56 size_t c = get_count(); 57 58 // CFI check for code inside the DSO. Can't use just any function address - this is only 59 // guaranteed to work for code addresses above __cfi_check. 60 void* code_ptr = reinterpret_cast<char*>(__cfi_check) + 1234; 61 void* diag_ptr = reinterpret_cast<void*>(5678); 62 __cfi_slowpath_diag(42, code_ptr, diag_ptr); 63 EXPECT_EQ(42U, get_last_type_id()); 64 EXPECT_EQ(code_ptr, get_last_address()); 65 EXPECT_EQ(diag_ptr, get_last_diag()); 66 EXPECT_EQ(++c, get_count()); 67 68 // __cfi_slowpath passes nullptr for the Diag argument. 69 __cfi_slowpath(42, code_ptr); 70 EXPECT_EQ(42U, get_last_type_id()); 71 EXPECT_EQ(code_ptr, get_last_address()); 72 EXPECT_EQ(nullptr, get_last_diag()); 73 EXPECT_EQ(++c, get_count()); 74 75 // CFI check for a data address inside the DSO. 76 __cfi_slowpath(43, get_global_address()); 77 EXPECT_EQ(43U, get_last_type_id()); 78 EXPECT_EQ(get_global_address(), get_last_address()); 79 EXPECT_EQ(++c, get_count()); 80 81 // CFI check for a function inside _this_ DSO. It either goes to this DSO's __cfi_check, 82 // or (if missing) is simply ignored. Any way, it does not affect the test lib's counters. 83 __cfi_slowpath(44, reinterpret_cast<void*>(&f)); 84 EXPECT_EQ(43U, get_last_type_id()); 85 EXPECT_EQ(get_global_address(), get_last_address()); 86 EXPECT_EQ(c, get_count()); 87 88 // CFI check for a stack address. This is always invalid and gets the process killed. 89 EXPECT_DEATH(__cfi_slowpath(45, reinterpret_cast<void*>(&c)), ""); 90 91 // CFI check for a heap address. This is always invalid and gets the process killed. 92 void* p = malloc(4096); 93 EXPECT_DEATH(__cfi_slowpath(46, p), ""); 94 free(p); 95 96 // Check all the addresses. 97 const size_t bss_size = 1024 * 1024; 98 static_assert(bss_size >= kLibraryAlignment * 2, "test range not big enough"); 99 for (size_t i = 0; i < bss_size; ++i) { 100 __cfi_slowpath(47, bss + i); 101 EXPECT_EQ(++c, get_count()); 102 } 103 104 // Load the same library again. 105 void* handle2 = dlopen("libcfi-test.so", RTLD_NOW | RTLD_LOCAL); 106 ASSERT_TRUE(handle2 != nullptr) << dlerror(); 107 EXPECT_EQ(handle2, handle); 108 109 // Check that it is still there. 110 __cfi_slowpath(43, get_global_address()); 111 EXPECT_EQ(43U, get_last_type_id()); 112 EXPECT_EQ(get_global_address(), get_last_address()); 113 EXPECT_EQ(++c, get_count()); 114 115 dlclose(handle); 116 dlclose(handle2); 117 118 // CFI check for a function inside the unloaded DSO. This is always invalid and gets the process 119 // killed. 120 EXPECT_DEATH(__cfi_slowpath(45, reinterpret_cast<void*>(code_ptr)), ""); 121 #endif 122 } 123 124 TEST(cfi_test, invalid) { 125 #if defined(__BIONIC__) 126 void* handle; 127 handle = dlopen("libcfi-test-bad.so", RTLD_NOW | RTLD_LOCAL); 128 ASSERT_FALSE(handle != nullptr) << dlerror(); 129 130 handle = dlopen("libcfi-test-bad.so", RTLD_NOW | RTLD_LOCAL); 131 ASSERT_FALSE(handle != nullptr) << dlerror(); 132 #endif 133 } 134 135 // cfi_test_helper exports __cfi_check, which triggers CFI initialization at startup. 136 TEST(cfi_test, early_init) { 137 #if defined(__BIONIC__) 138 std::string helper = get_testlib_root() + "/cfi_test_helper/cfi_test_helper"; 139 chmod(helper.c_str(), 0755); // TODO: "x" lost in CTS, b/34945607 140 ExecTestHelper eth; 141 eth.SetArgs({ helper.c_str(), nullptr }); 142 eth.Run([&]() { execve(helper.c_str(), eth.GetArgs(), eth.GetEnv()); }, 0, nullptr); 143 #endif 144 } 145 146 // cfi_test_helper2 depends on a library that exports __cfi_check, which triggers CFI initialization 147 // at startup. 148 TEST(cfi_test, early_init2) { 149 #if defined(__BIONIC__) 150 std::string helper = get_testlib_root() + "/cfi_test_helper2/cfi_test_helper2"; 151 chmod(helper.c_str(), 0755); // TODO: "x" lost in CTS, b/34945607 152 ExecTestHelper eth; 153 eth.SetArgs({ helper.c_str(), nullptr }); 154 eth.Run([&]() { execve(helper.c_str(), eth.GetArgs(), eth.GetEnv()); }, 0, nullptr); 155 #endif 156 } 157
