1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * sigreturn.c - tests that x86 avoids Intel SYSRET pitfalls 4 * Copyright (c) 2014-2016 Andrew Lutomirski 5 */ 6 7 #define _GNU_SOURCE 8 9 #include <stdlib.h> 10 #include <unistd.h> 11 #include <stdio.h> 12 #include <string.h> 13 #include <inttypes.h> 14 #include <sys/signal.h> 15 #include <sys/ucontext.h> 16 #include <sys/syscall.h> 17 #include <err.h> 18 #include <stddef.h> 19 #include <stdbool.h> 20 #include <setjmp.h> 21 #include <sys/user.h> 22 #include <sys/mman.h> 23 #include <assert.h> 24 25 26 asm ( 27 ".pushsection \".text\", \"ax\"\n\t" 28 ".balign 4096\n\t" 29 "test_page: .globl test_page\n\t" 30 ".fill 4094,1,0xcc\n\t" 31 "test_syscall_insn:\n\t" 32 "syscall\n\t" 33 ".ifne . - test_page - 4096\n\t" 34 ".error \"test page is not one page long\"\n\t" 35 ".endif\n\t" 36 ".popsection" 37 ); 38 39 extern const char test_page[]; 40 static void const *current_test_page_addr = test_page; 41 42 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), 43 int flags) 44 { 45 struct sigaction sa; 46 memset(&sa, 0, sizeof(sa)); 47 sa.sa_sigaction = handler; 48 sa.sa_flags = SA_SIGINFO | flags; 49 sigemptyset(&sa.sa_mask); 50 if (sigaction(sig, &sa, 0)) 51 err(1, "sigaction"); 52 } 53 54 static void clearhandler(int sig) 55 { 56 struct sigaction sa; 57 memset(&sa, 0, sizeof(sa)); 58 sa.sa_handler = SIG_DFL; 59 sigemptyset(&sa.sa_mask); 60 if (sigaction(sig, &sa, 0)) 61 err(1, "sigaction"); 62 } 63 64 /* State used by our signal handlers. */ 65 static gregset_t initial_regs; 66 67 static volatile unsigned long rip; 68 69 static void sigsegv_for_sigreturn_test(int sig, siginfo_t *info, void *ctx_void) 70 { 71 ucontext_t *ctx = (ucontext_t*)ctx_void; 72 73 if (rip != ctx->uc_mcontext.gregs[REG_RIP]) { 74 printf("[FAIL]\tRequested RIP=0x%lx but got RIP=0x%lx\n", 75 rip, (unsigned long)ctx->uc_mcontext.gregs[REG_RIP]); 76 fflush(stdout); 77 _exit(1); 78 } 79 80 memcpy(&ctx->uc_mcontext.gregs, &initial_regs, sizeof(gregset_t)); 81 82 printf("[OK]\tGot SIGSEGV at RIP=0x%lx\n", rip); 83 } 84 85 static void sigusr1(int sig, siginfo_t *info, void *ctx_void) 86 { 87 ucontext_t *ctx = (ucontext_t*)ctx_void; 88 89 memcpy(&initial_regs, &ctx->uc_mcontext.gregs, sizeof(gregset_t)); 90 91 /* Set IP and CX to match so that SYSRET can happen. */ 92 ctx->uc_mcontext.gregs[REG_RIP] = rip; 93 ctx->uc_mcontext.gregs[REG_RCX] = rip; 94 95 /* R11 and EFLAGS should already match. */ 96 assert(ctx->uc_mcontext.gregs[REG_EFL] == 97 ctx->uc_mcontext.gregs[REG_R11]); 98 99 sethandler(SIGSEGV, sigsegv_for_sigreturn_test, SA_RESETHAND); 100 101 return; 102 } 103 104 static void test_sigreturn_to(unsigned long ip) 105 { 106 rip = ip; 107 printf("[RUN]\tsigreturn to 0x%lx\n", ip); 108 raise(SIGUSR1); 109 } 110 111 static jmp_buf jmpbuf; 112 113 static void sigsegv_for_fallthrough(int sig, siginfo_t *info, void *ctx_void) 114 { 115 ucontext_t *ctx = (ucontext_t*)ctx_void; 116 117 if (rip != ctx->uc_mcontext.gregs[REG_RIP]) { 118 printf("[FAIL]\tExpected SIGSEGV at 0x%lx but got RIP=0x%lx\n", 119 rip, (unsigned long)ctx->uc_mcontext.gregs[REG_RIP]); 120 fflush(stdout); 121 _exit(1); 122 } 123 124 siglongjmp(jmpbuf, 1); 125 } 126 127 static void test_syscall_fallthrough_to(unsigned long ip) 128 { 129 void *new_address = (void *)(ip - 4096); 130 void *ret; 131 132 printf("[RUN]\tTrying a SYSCALL that falls through to 0x%lx\n", ip); 133 134 ret = mremap((void *)current_test_page_addr, 4096, 4096, 135 MREMAP_MAYMOVE | MREMAP_FIXED, new_address); 136 if (ret == MAP_FAILED) { 137 if (ip <= (1UL << 47) - PAGE_SIZE) { 138 err(1, "mremap to %p", new_address); 139 } else { 140 printf("[OK]\tmremap to %p failed\n", new_address); 141 return; 142 } 143 } 144 145 if (ret != new_address) 146 errx(1, "mremap malfunctioned: asked for %p but got %p\n", 147 new_address, ret); 148 149 current_test_page_addr = new_address; 150 rip = ip; 151 152 if (sigsetjmp(jmpbuf, 1) == 0) { 153 asm volatile ("call *%[syscall_insn]" :: "a" (SYS_getpid), 154 [syscall_insn] "rm" (ip - 2)); 155 errx(1, "[FAIL]\tSyscall trampoline returned"); 156 } 157 158 printf("[OK]\tWe survived\n"); 159 } 160 161 int main() 162 { 163 /* 164 * When the kernel returns from a slow-path syscall, it will 165 * detect whether SYSRET is appropriate. If it incorrectly 166 * thinks that SYSRET is appropriate when RIP is noncanonical, 167 * it'll crash on Intel CPUs. 168 */ 169 sethandler(SIGUSR1, sigusr1, 0); 170 for (int i = 47; i < 64; i++) 171 test_sigreturn_to(1UL<<i); 172 173 clearhandler(SIGUSR1); 174 175 sethandler(SIGSEGV, sigsegv_for_fallthrough, 0); 176 177 /* One extra test to check that we didn't screw up the mremap logic. */ 178 test_syscall_fallthrough_to((1UL << 47) - 2*PAGE_SIZE); 179 180 /* These are the interesting cases. */ 181 for (int i = 47; i < 64; i++) { 182 test_syscall_fallthrough_to((1UL<<i) - PAGE_SIZE); 183 test_syscall_fallthrough_to(1UL<<i); 184 } 185 186 return 0; 187 } 188