1 /* 2 * Check decoding of process_vm_readv/process_vm_writev syscall. 3 * 4 * Copyright (c) 2016 Eugene Syromyatnikov <evgsyr (at) gmail.com> 5 * Copyright (c) 2016-2017 The strace developers. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. The name of the author may not be used to endorse or promote products 17 * derived from this software without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31 #include <inttypes.h> 32 #include <stdio.h> 33 #include <unistd.h> 34 #include <sys/uio.h> 35 36 #if OP_WR 37 # define in_iovec rmt_iovec 38 # define out_iovec lcl_iovec 39 # define in_iov rmt_iov 40 # define out_iov lcl_iov 41 #else 42 # define in_iovec lcl_iovec 43 # define out_iovec rmt_iovec 44 # define in_iov lcl_iov 45 # define out_iov rmt_iov 46 #endif 47 48 typedef void (*iov_print_fn)(const struct iovec *, const void *, long); 49 50 enum { MAX_SEGM_COUNT = 2, MAX_STR_LEN = 5 }; 51 52 struct print_iov_arg { 53 uint32_t count; 54 uint32_t valid :1, 55 string :1, 56 addr_term:1, 57 check_rc :1; 58 uint32_t str_segms; 59 uint8_t str_base[MAX_SEGM_COUNT]; 60 uint8_t str_size[MAX_SEGM_COUNT]; 61 }; 62 63 static void 64 print_iov(const struct iovec *iov, const void *arg_ptr, long rc) 65 { 66 const struct print_iov_arg *arg = arg_ptr; 67 uint32_t i; 68 uint32_t num_segm = 0; 69 uint64_t segm_offs = 0; 70 71 if (!arg || !arg->valid) { 72 if (iov) 73 printf("%p", iov); 74 else 75 printf("NULL"); 76 77 return; 78 } 79 80 printf("["); 81 82 for (i = 0; i < arg->count; i++) { 83 if (i) 84 printf(", "); 85 86 if (i >= MAX_STR_LEN) { 87 printf("..."); 88 break; 89 } 90 91 printf("{iov_base="); 92 if (arg->string && (!arg->check_rc || (rc != -1))) { 93 uint64_t str_left = iov[i].iov_len; 94 uint64_t pr_count = 0; 95 96 printf("\""); 97 98 while (str_left--) { 99 static const char oct_str[] = "01234567"; 100 uint8_t c = arg->str_base[num_segm] + segm_offs; 101 102 if ((num_segm >= arg->str_segms) || 103 (num_segm >= MAX_SEGM_COUNT)) 104 error_msg_and_fail("print_iov: segment " 105 "count overrun"); 106 107 if (pr_count++ < MAX_STR_LEN) 108 printf("\\%.1s%.1s%d", 109 (c >> 6) ? 110 oct_str + (c >> 6) : "", 111 (c >> 3) ? 112 oct_str + ((c >> 3) & 7) : "", 113 c & 7); 114 115 segm_offs++; 116 117 if (segm_offs >= arg->str_size[num_segm]) { 118 num_segm++; 119 segm_offs = 0; 120 } 121 } 122 123 printf("\""); 124 125 if (pr_count > MAX_STR_LEN) 126 printf("..."); 127 } else { 128 if (iov[i].iov_base) 129 printf("%p", iov[i].iov_base); 130 else 131 printf("NULL"); 132 } 133 134 printf(", iov_len=%zu}", iov[i].iov_len); 135 } 136 137 if (arg->addr_term) 138 printf(", %p", iov + arg->count); 139 140 printf("]"); 141 } 142 143 static void 144 do_call(kernel_ulong_t pid, 145 kernel_ulong_t local_iov, const char *local_arg, 146 kernel_ulong_t liovcnt, 147 kernel_ulong_t remote_iov, const char *remote_arg, 148 kernel_ulong_t riovcnt, 149 kernel_ulong_t flags, iov_print_fn pr_iov) 150 { 151 long rc; 152 const char *errstr; 153 154 rc = syscall(OP_NR, pid, local_iov, liovcnt, remote_iov, riovcnt, 155 flags); 156 errstr = sprintrc(rc); 157 158 printf("%s(%d, ", OP_STR, (int) pid); 159 160 if (pr_iov) 161 pr_iov((const struct iovec *) (uintptr_t) local_iov, local_arg, 162 rc); 163 else 164 printf("%s", local_arg); 165 166 printf(", %lu, ", (unsigned long) liovcnt); 167 168 if (pr_iov) 169 pr_iov((const struct iovec *) (uintptr_t) remote_iov, 170 remote_arg, rc); 171 else 172 printf("%s", remote_arg); 173 174 printf(", %lu, %lu) = %s\n", (unsigned long) riovcnt, 175 (unsigned long) flags, errstr); 176 } 177 178 kernel_ulong_t 179 ptr_cast(void *ptr) 180 { 181 return (kernel_ulong_t) (uintptr_t) ptr; 182 } 183 184 int 185 main(void) 186 { 187 enum { 188 SIZE_11 = 2, 189 SIZE_12 = 3, 190 SIZE_13 = 4, 191 SIZE_1 = SIZE_11 + SIZE_12 + SIZE_13, 192 SIZE_21 = 5, 193 SIZE_22 = 6, 194 SIZE_23 = 7, 195 SIZE_2 = SIZE_21 + SIZE_22 + SIZE_23, 196 }; 197 198 enum { 199 SEGM1_BASE = 0x80, 200 SEGM2_BASE = 0xA0, 201 }; 202 203 static const kernel_ulong_t bogus_pid = 204 (kernel_ulong_t) 0xbadfaceddeadca57ULL; 205 static const kernel_ulong_t bogus_iovcnt1 = 206 (kernel_ulong_t) 0xdec0ded1defaced2ULL; 207 static const kernel_ulong_t bogus_iovcnt2 = 208 (kernel_ulong_t) 0xdec0ded3defaced4ULL; 209 static const kernel_ulong_t bogus_flags = 210 (kernel_ulong_t) 0xdeadc0deda7adeadULL; 211 212 pid_t my_pid = getpid(); 213 char *data1_out = tail_alloc(SIZE_1); 214 char *data2_out = tail_alloc(SIZE_2); 215 char *data1_in = tail_alloc(SIZE_2); 216 char *data2_in = tail_alloc(SIZE_1); 217 218 struct iovec bogus_iovec[] = { 219 { data1_out + SIZE_1, (size_t) 0xdeadfaceca57beefULL }, 220 { data1_in + SIZE_2, (size_t) 0xbadc0dedda7adeadULL }, 221 { data2_out + SIZE_2, (size_t) 0xf157facedec0ded1ULL }, 222 { data2_in + SIZE_1, (size_t) 0xdefaced2bea7be57ULL }, 223 }; 224 225 struct iovec out_iovec[] = { 226 { data1_out, SIZE_11 }, 227 { data1_out + SIZE_11, SIZE_12 }, 228 { data1_out + SIZE_11 + SIZE_12, SIZE_13 }, 229 { data2_out, SIZE_21 }, 230 { data2_out + SIZE_21, SIZE_22 }, 231 { data2_out + SIZE_21 + SIZE_22, SIZE_23 }, 232 }; 233 struct iovec in_iovec[] = { 234 { data1_in, SIZE_23 }, 235 { data1_in + SIZE_23, SIZE_22 }, 236 { data1_in + SIZE_23 + SIZE_22, SIZE_21 }, 237 { data2_in, SIZE_13 }, 238 { data2_in + SIZE_13, SIZE_12 }, 239 { data2_in + SIZE_13 + SIZE_12, SIZE_11 }, 240 }; 241 242 struct iovec *bogus_iov = tail_memdup(bogus_iovec, sizeof(bogus_iovec)); 243 struct iovec *lcl_iov = tail_memdup(lcl_iovec, sizeof(lcl_iovec)); 244 struct iovec *rmt_iov = tail_memdup(rmt_iovec, sizeof(rmt_iovec)); 245 246 struct print_iov_arg bogus_arg = { ARRAY_SIZE(bogus_iovec), 1 }; 247 struct print_iov_arg lcl_arg = { ARRAY_SIZE(lcl_iovec), 1, 1, 0, 0, 248 2, {SEGM1_BASE, SEGM2_BASE}, {SIZE_1, SIZE_2} }; 249 struct print_iov_arg rmt_arg = { ARRAY_SIZE(rmt_iovec), 1 }; 250 251 struct print_iov_arg bogus_arg_cut = { 252 ARRAY_SIZE(bogus_iovec) - 2, 1, 0, 1 253 }; 254 struct print_iov_arg lcl_arg_cut = { 255 ARRAY_SIZE(lcl_iovec) - 2, 1, 1, 1, 0, 2, 256 { SEGM1_BASE + SIZE_11 + SIZE_12, SEGM2_BASE }, 257 {SIZE_13, SIZE_2} 258 }; 259 struct print_iov_arg rmt_arg_cut = { ARRAY_SIZE(rmt_iovec) - 2, 1 }; 260 261 262 fill_memory_ex(data1_out, SIZE_1, SEGM1_BASE, SIZE_1); 263 fill_memory_ex(data2_out, SIZE_2, SEGM2_BASE, SIZE_2); 264 265 266 do_call(bogus_pid, (kernel_ulong_t) (uintptr_t) ARG_STR(NULL), 267 bogus_iovcnt1, (kernel_ulong_t) (uintptr_t) ARG_STR(NULL), 268 bogus_iovcnt2, bogus_flags, NULL); 269 270 do_call(my_pid, ptr_cast(bogus_iov + ARRAY_SIZE(bogus_iovec)), 271 "[]", 0, ptr_cast(in_iov + ARRAY_SIZE(in_iovec)), "[]", 272 0, 0, NULL); 273 do_call(my_pid, ptr_cast(bogus_iov + ARRAY_SIZE(bogus_iovec)), NULL, 274 bogus_iovcnt1, ptr_cast(in_iov + ARRAY_SIZE(in_iovec)), NULL, 275 bogus_iovcnt2, 0, print_iov); 276 277 do_call(my_pid, ptr_cast(bogus_iov), (char *) &bogus_arg, 278 ARRAY_SIZE(bogus_iovec), ptr_cast(rmt_iov + 2), 279 (char *) &rmt_arg_cut, ARRAY_SIZE(rmt_iovec) - 2, 0, print_iov); 280 281 #if !OP_WR 282 lcl_arg.check_rc = 1; 283 lcl_arg_cut.check_rc = 1; 284 #endif 285 286 do_call(my_pid, ptr_cast(lcl_iov + 2), (char *) &lcl_arg_cut, 287 ARRAY_SIZE(lcl_iovec) - 1, ptr_cast(bogus_iov + 2), 288 (char *) &bogus_arg_cut, ARRAY_SIZE(bogus_iovec) - 1, 0, 289 print_iov); 290 291 lcl_arg_cut.addr_term = 0; 292 293 rmt_arg_cut.addr_term = 1; 294 rmt_arg_cut.count = 5; 295 296 do_call(my_pid, ptr_cast(lcl_iov + 2), (char *) &lcl_arg_cut, 297 ARRAY_SIZE(lcl_iovec) - 2, ptr_cast(rmt_iov + 1), 298 (char *) &rmt_arg_cut, ARRAY_SIZE(rmt_iovec), 0, print_iov); 299 300 /* Correct call */ 301 do_call(my_pid, ptr_cast(lcl_iov), (char *) &lcl_arg, 302 ARRAY_SIZE(lcl_iovec), ptr_cast(rmt_iov), (char *) &rmt_arg, 303 ARRAY_SIZE(rmt_iovec), 0, print_iov); 304 305 puts("+++ exited with 0 +++"); 306 307 return 0; 308 } 309
