1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * This program test's basic kernel shadow stack support. It enables shadow 4 * stack manual via the arch_prctl(), instead of relying on glibc. It's 5 * Makefile doesn't compile with shadow stack support, so it doesn't rely on 6 * any particular glibc. As a result it can't do any operations that require 7 * special glibc shadow stack support (longjmp(), swapcontext(), etc). Just 8 * stick to the basics and hope the compiler doesn't do anything strange. 9 */ 10 11 #define _GNU_SOURCE 12 13 #include <sys/syscall.h> 14 #include <asm/mman.h> 15 #include <sys/mman.h> 16 #include <sys/stat.h> 17 #include <sys/wait.h> 18 #include <stdio.h> 19 #include <stdlib.h> 20 #include <fcntl.h> 21 #include <unistd.h> 22 #include <string.h> 23 #include <errno.h> 24 #include <stdbool.h> 25 #include <x86intrin.h> 26 #include <asm/prctl.h> 27 #include <sys/prctl.h> 28 #include <stdint.h> 29 #include <signal.h> 30 #include <pthread.h> 31 #include <sys/ioctl.h> 32 #include <linux/userfaultfd.h> 33 #include <setjmp.h> 34 #include <sys/ptrace.h> 35 #include <sys/signal.h> 36 #include <linux/elf.h> 37 #include <linux/perf_event.h> 38 39 /* 40 * Define the ABI defines if needed, so people can run the tests 41 * without building the headers. 42 */ 43 #ifndef __NR_map_shadow_stack 44 #define __NR_map_shadow_stack 453 45 46 #define SHADOW_STACK_SET_TOKEN (1ULL << 0) 47 48 #define ARCH_SHSTK_ENABLE 0x5001 49 #define ARCH_SHSTK_DISABLE 0x5002 50 #define ARCH_SHSTK_LOCK 0x5003 51 #define ARCH_SHSTK_UNLOCK 0x5004 52 #define ARCH_SHSTK_STATUS 0x5005 53 54 #define ARCH_SHSTK_SHSTK (1ULL << 0) 55 #define ARCH_SHSTK_WRSS (1ULL << 1) 56 57 #define NT_X86_SHSTK 0x204 58 #endif 59 60 #define SS_SIZE 0x200000 61 #define PAGE_SIZE 0x1000 62 63 #if (__GNUC__ < 8) || (__GNUC__ == 8 && __GNUC_MINOR__ < 5) 64 int main(int argc, char *argv[]) 65 { 66 printf("[SKIP]\tCompiler does not support CET.\n"); 67 return 0; 68 } 69 #else 70 void write_shstk(unsigned long *addr, unsigned long val) 71 { 72 asm volatile("wrssq %[val], (%[addr])\n" 73 : "=m" (addr) 74 : [addr] "r" (addr), [val] "r" (val)); 75 } 76 77 static inline unsigned long __attribute__((always_inline)) get_ssp(void) 78 { 79 unsigned long ret = 0; 80 81 asm volatile("xor %0, %0; rdsspq %0" : "=r" (ret)); 82 return ret; 83 } 84 85 /* 86 * For use in inline enablement of shadow stack. 87 * 88 * The program can't return from the point where shadow stack gets enabled 89 * because there will be no address on the shadow stack. So it can't use 90 * syscall() for enablement, since it is a function. 91 * 92 * Based on code from nolibc.h. Keep a copy here because this can't pull in all 93 * of nolibc.h. 94 */ 95 #define ARCH_PRCTL(arg1, arg2) \ 96 ({ \ 97 long _ret; \ 98 register long _num asm("eax") = __NR_arch_prctl; \ 99 register long _arg1 asm("rdi") = (long)(arg1); \ 100 register long _arg2 asm("rsi") = (long)(arg2); \ 101 \ 102 asm volatile ( \ 103 "syscall\n" \ 104 : "=a"(_ret) \ 105 : "r"(_arg1), "r"(_arg2), \ 106 "0"(_num) \ 107 : "rcx", "r11", "memory", "cc" \ 108 ); \ 109 _ret; \ 110 }) 111 112 void *create_shstk(void *addr) 113 { 114 return (void *)syscall(__NR_map_shadow_stack, addr, SS_SIZE, SHADOW_STACK_SET_TOKEN); 115 } 116 117 void *create_normal_mem(void *addr) 118 { 119 return mmap(addr, SS_SIZE, PROT_READ | PROT_WRITE, 120 MAP_PRIVATE | MAP_ANONYMOUS, 0, 0); 121 } 122 123 void free_shstk(void *shstk) 124 { 125 munmap(shstk, SS_SIZE); 126 } 127 128 int reset_shstk(void *shstk) 129 { 130 return madvise(shstk, SS_SIZE, MADV_DONTNEED); 131 } 132 133 void try_shstk(unsigned long new_ssp) 134 { 135 unsigned long ssp; 136 137 printf("[INFO]\tnew_ssp = %lx, *new_ssp = %lx\n", 138 new_ssp, *((unsigned long *)new_ssp)); 139 140 ssp = get_ssp(); 141 printf("[INFO]\tchanging ssp from %lx to %lx\n", ssp, new_ssp); 142 143 asm volatile("rstorssp (%0)\n":: "r" (new_ssp)); 144 asm volatile("saveprevssp"); 145 printf("[INFO]\tssp is now %lx\n", get_ssp()); 146 147 /* Switch back to original shadow stack */ 148 ssp -= 8; 149 asm volatile("rstorssp (%0)\n":: "r" (ssp)); 150 asm volatile("saveprevssp"); 151 } 152 153 int test_shstk_pivot(void) 154 { 155 void *shstk = create_shstk(0); 156 157 if (shstk == MAP_FAILED) { 158 printf("[FAIL]\tError creating shadow stack: %d\n", errno); 159 return 1; 160 } 161 try_shstk((unsigned long)shstk + SS_SIZE - 8); 162 free_shstk(shstk); 163 164 printf("[OK]\tShadow stack pivot\n"); 165 return 0; 166 } 167 168 int test_shstk_faults(void) 169 { 170 unsigned long *shstk = create_shstk(0); 171 172 /* Read shadow stack, test if it's zero to not get read optimized out */ 173 if (*shstk != 0) 174 goto err; 175 176 /* Wrss memory that was already read. */ 177 write_shstk(shstk, 1); 178 if (*shstk != 1) 179 goto err; 180 181 /* Page out memory, so we can wrss it again. */ 182 if (reset_shstk((void *)shstk)) 183 goto err; 184 185 write_shstk(shstk, 1); 186 if (*shstk != 1) 187 goto err; 188 189 printf("[OK]\tShadow stack faults\n"); 190 return 0; 191 192 err: 193 return 1; 194 } 195 196 unsigned long saved_ssp; 197 unsigned long saved_ssp_val; 198 volatile bool segv_triggered; 199 200 void __attribute__((noinline)) violate_ss(void) 201 { 202 saved_ssp = get_ssp(); 203 saved_ssp_val = *(unsigned long *)saved_ssp; 204 205 /* Corrupt shadow stack */ 206 printf("[INFO]\tCorrupting shadow stack\n"); 207 write_shstk((void *)saved_ssp, 0); 208 } 209 210 void segv_handler(int signum, siginfo_t *si, void *uc) 211 { 212 printf("[INFO]\tGenerated shadow stack violation successfully\n"); 213 214 segv_triggered = true; 215 216 /* Fix shadow stack */ 217 write_shstk((void *)saved_ssp, saved_ssp_val); 218 } 219 220 int test_shstk_violation(void) 221 { 222 struct sigaction sa = {}; 223 224 sa.sa_sigaction = segv_handler; 225 sa.sa_flags = SA_SIGINFO; 226 if (sigaction(SIGSEGV, &sa, NULL)) 227 return 1; 228 229 segv_triggered = false; 230 231 /* Make sure segv_triggered is set before violate_ss() */ 232 asm volatile("" : : : "memory"); 233 234 violate_ss(); 235 236 signal(SIGSEGV, SIG_DFL); 237 238 printf("[OK]\tShadow stack violation test\n"); 239 240 return !segv_triggered; 241 } 242 243 /* Gup test state */ 244 #define MAGIC_VAL 0x12345678 245 bool is_shstk_access; 246 void *shstk_ptr; 247 int fd; 248 249 void reset_test_shstk(void *addr) 250 { 251 if (shstk_ptr) 252 free_shstk(shstk_ptr); 253 shstk_ptr = create_shstk(addr); 254 } 255 256 void test_access_fix_handler(int signum, siginfo_t *si, void *uc) 257 { 258 printf("[INFO]\tViolation from %s\n", is_shstk_access ? "shstk access" : "normal write"); 259 260 segv_triggered = true; 261 262 /* Fix shadow stack */ 263 if (is_shstk_access) { 264 reset_test_shstk(shstk_ptr); 265 return; 266 } 267 268 free_shstk(shstk_ptr); 269 create_normal_mem(shstk_ptr); 270 } 271 272 bool test_shstk_access(void *ptr) 273 { 274 is_shstk_access = true; 275 segv_triggered = false; 276 write_shstk(ptr, MAGIC_VAL); 277 278 asm volatile("" : : : "memory"); 279 280 return segv_triggered; 281 } 282 283 bool test_write_access(void *ptr) 284 { 285 is_shstk_access = false; 286 segv_triggered = false; 287 *(unsigned long *)ptr = MAGIC_VAL; 288 289 asm volatile("" : : : "memory"); 290 291 return segv_triggered; 292 } 293 294 bool gup_write(void *ptr) 295 { 296 unsigned long val; 297 298 lseek(fd, (unsigned long)ptr, SEEK_SET); 299 if (write(fd, &val, sizeof(val)) < 0) 300 return 1; 301 302 return 0; 303 } 304 305 bool gup_read(void *ptr) 306 { 307 unsigned long val; 308 309 lseek(fd, (unsigned long)ptr, SEEK_SET); 310 if (read(fd, &val, sizeof(val)) < 0) 311 return 1; 312 313 return 0; 314 } 315 316 int test_gup(void) 317 { 318 struct sigaction sa = {}; 319 int status; 320 pid_t pid; 321 322 sa.sa_sigaction = test_access_fix_handler; 323 sa.sa_flags = SA_SIGINFO; 324 if (sigaction(SIGSEGV, &sa, NULL)) 325 return 1; 326 327 segv_triggered = false; 328 329 fd = open("/proc/self/mem", O_RDWR); 330 if (fd == -1) 331 return 1; 332 333 reset_test_shstk(0); 334 if (gup_read(shstk_ptr)) 335 return 1; 336 if (test_shstk_access(shstk_ptr)) 337 return 1; 338 printf("[INFO]\tGup read -> shstk access success\n"); 339 340 reset_test_shstk(0); 341 if (gup_write(shstk_ptr)) 342 return 1; 343 if (test_shstk_access(shstk_ptr)) 344 return 1; 345 printf("[INFO]\tGup write -> shstk access success\n"); 346 347 reset_test_shstk(0); 348 if (gup_read(shstk_ptr)) 349 return 1; 350 if (!test_write_access(shstk_ptr)) 351 return 1; 352 printf("[INFO]\tGup read -> write access success\n"); 353 354 reset_test_shstk(0); 355 if (gup_write(shstk_ptr)) 356 return 1; 357 if (!test_write_access(shstk_ptr)) 358 return 1; 359 printf("[INFO]\tGup write -> write access success\n"); 360 361 close(fd); 362 363 /* COW/gup test */ 364 reset_test_shstk(0); 365 pid = fork(); 366 if (!pid) { 367 fd = open("/proc/self/mem", O_RDWR); 368 if (fd == -1) 369 exit(1); 370 371 if (gup_write(shstk_ptr)) { 372 close(fd); 373 exit(1); 374 } 375 close(fd); 376 exit(0); 377 } 378 waitpid(pid, &status, 0); 379 if (WEXITSTATUS(status)) { 380 printf("[FAIL]\tWrite in child failed\n"); 381 return 1; 382 } 383 if (*(unsigned long *)shstk_ptr == MAGIC_VAL) { 384 printf("[FAIL]\tWrite in child wrote through to shared memory\n"); 385 return 1; 386 } 387 388 printf("[INFO]\tCow gup write -> write access success\n"); 389 390 free_shstk(shstk_ptr); 391 392 signal(SIGSEGV, SIG_DFL); 393 394 printf("[OK]\tShadow gup test\n"); 395 396 return 0; 397 } 398 399 int test_mprotect(void) 400 { 401 struct sigaction sa = {}; 402 403 sa.sa_sigaction = test_access_fix_handler; 404 sa.sa_flags = SA_SIGINFO; 405 if (sigaction(SIGSEGV, &sa, NULL)) 406 return 1; 407 408 segv_triggered = false; 409 410 /* mprotect a shadow stack as read only */ 411 reset_test_shstk(0); 412 if (mprotect(shstk_ptr, SS_SIZE, PROT_READ) < 0) { 413 printf("[FAIL]\tmprotect(PROT_READ) failed\n"); 414 return 1; 415 } 416 417 /* try to wrss it and fail */ 418 if (!test_shstk_access(shstk_ptr)) { 419 printf("[FAIL]\tShadow stack access to read-only memory succeeded\n"); 420 return 1; 421 } 422 423 /* 424 * The shadow stack was reset above to resolve the fault, make the new one 425 * read-only. 426 */ 427 if (mprotect(shstk_ptr, SS_SIZE, PROT_READ) < 0) { 428 printf("[FAIL]\tmprotect(PROT_READ) failed\n"); 429 return 1; 430 } 431 432 /* then back to writable */ 433 if (mprotect(shstk_ptr, SS_SIZE, PROT_WRITE | PROT_READ) < 0) { 434 printf("[FAIL]\tmprotect(PROT_WRITE) failed\n"); 435 return 1; 436 } 437 438 /* then wrss to it and succeed */ 439 if (test_shstk_access(shstk_ptr)) { 440 printf("[FAIL]\tShadow stack access to mprotect() writable memory failed\n"); 441 return 1; 442 } 443 444 free_shstk(shstk_ptr); 445 446 signal(SIGSEGV, SIG_DFL); 447 448 printf("[OK]\tmprotect() test\n"); 449 450 return 0; 451 } 452 453 char zero[4096]; 454 455 static void *uffd_thread(void *arg) 456 { 457 struct uffdio_copy req; 458 int uffd = *(int *)arg; 459 struct uffd_msg msg; 460 int ret; 461 462 while (1) { 463 ret = read(uffd, &msg, sizeof(msg)); 464 if (ret > 0) 465 break; 466 else if (errno == EAGAIN) 467 continue; 468 return (void *)1; 469 } 470 471 req.dst = msg.arg.pagefault.address; 472 req.src = (__u64)zero; 473 req.len = 4096; 474 req.mode = 0; 475 476 if (ioctl(uffd, UFFDIO_COPY, &req)) 477 return (void *)1; 478 479 return (void *)0; 480 } 481 482 int test_userfaultfd(void) 483 { 484 struct uffdio_register uffdio_register; 485 struct uffdio_api uffdio_api; 486 struct sigaction sa = {}; 487 pthread_t thread; 488 void *res; 489 int uffd; 490 491 sa.sa_sigaction = test_access_fix_handler; 492 sa.sa_flags = SA_SIGINFO; 493 if (sigaction(SIGSEGV, &sa, NULL)) 494 return 1; 495 496 uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK); 497 if (uffd < 0) { 498 printf("[SKIP]\tUserfaultfd unavailable.\n"); 499 return 0; 500 } 501 502 reset_test_shstk(0); 503 504 uffdio_api.api = UFFD_API; 505 uffdio_api.features = 0; 506 if (ioctl(uffd, UFFDIO_API, &uffdio_api)) 507 goto err; 508 509 uffdio_register.range.start = (__u64)shstk_ptr; 510 uffdio_register.range.len = 4096; 511 uffdio_register.mode = UFFDIO_REGISTER_MODE_MISSING; 512 if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register)) 513 goto err; 514 515 if (pthread_create(&thread, NULL, &uffd_thread, &uffd)) 516 goto err; 517 518 reset_shstk(shstk_ptr); 519 test_shstk_access(shstk_ptr); 520 521 if (pthread_join(thread, &res)) 522 goto err; 523 524 if (test_shstk_access(shstk_ptr)) 525 goto err; 526 527 free_shstk(shstk_ptr); 528 529 signal(SIGSEGV, SIG_DFL); 530 531 if (!res) 532 printf("[OK]\tUserfaultfd test\n"); 533 return !!res; 534 err: 535 free_shstk(shstk_ptr); 536 close(uffd); 537 signal(SIGSEGV, SIG_DFL); 538 return 1; 539 } 540 541 /* Simple linked list for keeping track of mappings in test_guard_gap() */ 542 struct node { 543 struct node *next; 544 void *mapping; 545 }; 546 547 /* 548 * This tests whether mmap will place other mappings in a shadow stack's guard 549 * gap. The steps are: 550 * 1. Finds an empty place by mapping and unmapping something. 551 * 2. Map a shadow stack in the middle of the known empty area. 552 * 3. Map a bunch of PAGE_SIZE mappings. These will use the search down 553 * direction, filling any gaps until it encounters the shadow stack's 554 * guard gap. 555 * 4. When a mapping lands below the shadow stack from step 2, then all 556 * of the above gaps are filled. The search down algorithm will have 557 * looked at the shadow stack gaps. 558 * 5. See if it landed in the gap. 559 */ 560 int test_guard_gap_other_gaps(void) 561 { 562 void *free_area, *shstk, *test_map = (void *)0xFFFFFFFFFFFFFFFF; 563 struct node *head = NULL, *cur; 564 565 free_area = mmap(0, SS_SIZE * 3, PROT_READ | PROT_WRITE, 566 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); 567 munmap(free_area, SS_SIZE * 3); 568 569 shstk = create_shstk(free_area + SS_SIZE); 570 if (shstk == MAP_FAILED) 571 return 1; 572 573 while (test_map > shstk) { 574 test_map = mmap(0, PAGE_SIZE, PROT_READ | PROT_WRITE, 575 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); 576 if (test_map == MAP_FAILED) 577 return 1; 578 cur = malloc(sizeof(*cur)); 579 cur->mapping = test_map; 580 581 cur->next = head; 582 head = cur; 583 } 584 585 while (head) { 586 cur = head; 587 head = cur->next; 588 munmap(cur->mapping, PAGE_SIZE); 589 free(cur); 590 } 591 592 free_shstk(shstk); 593 594 if (shstk - test_map - PAGE_SIZE != PAGE_SIZE) 595 return 1; 596 597 printf("[OK]\tGuard gap test, other mapping's gaps\n"); 598 599 return 0; 600 } 601 602 /* Tests respecting the guard gap of the mapping getting placed */ 603 int test_guard_gap_new_mappings_gaps(void) 604 { 605 void *free_area, *shstk_start, *test_map = (void *)0xFFFFFFFFFFFFFFFF; 606 struct node *head = NULL, *cur; 607 int ret = 0; 608 609 free_area = mmap(0, PAGE_SIZE * 4, PROT_READ | PROT_WRITE, 610 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); 611 munmap(free_area, PAGE_SIZE * 4); 612 613 /* Test letting map_shadow_stack find a free space */ 614 shstk_start = mmap(free_area, PAGE_SIZE, PROT_READ | PROT_WRITE, 615 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); 616 if (shstk_start == MAP_FAILED || shstk_start != free_area) 617 return 1; 618 619 while (test_map > shstk_start) { 620 test_map = (void *)syscall(__NR_map_shadow_stack, 0, PAGE_SIZE, 0); 621 if (test_map == MAP_FAILED) { 622 printf("[INFO]\tmap_shadow_stack MAP_FAILED\n"); 623 ret = 1; 624 break; 625 } 626 627 cur = malloc(sizeof(*cur)); 628 cur->mapping = test_map; 629 630 cur->next = head; 631 head = cur; 632 633 if (test_map == free_area + PAGE_SIZE) { 634 printf("[INFO]\tNew mapping has other mapping in guard gap!\n"); 635 ret = 1; 636 break; 637 } 638 } 639 640 while (head) { 641 cur = head; 642 head = cur->next; 643 munmap(cur->mapping, PAGE_SIZE); 644 free(cur); 645 } 646 647 munmap(shstk_start, PAGE_SIZE); 648 649 if (!ret) 650 printf("[OK]\tGuard gap test, placement mapping's gaps\n"); 651 652 return ret; 653 } 654 655 /* 656 * Too complicated to pull it out of the 32 bit header, but also get the 657 * 64 bit one needed above. Just define a copy here. 658 */ 659 #define __NR_compat_sigaction 67 660 661 /* 662 * Call 32 bit signal handler to get 32 bit signals ABI. Make sure 663 * to push the registers that will get clobbered. 664 */ 665 int sigaction32(int signum, const struct sigaction *restrict act, 666 struct sigaction *restrict oldact) 667 { 668 register long syscall_reg asm("eax") = __NR_compat_sigaction; 669 register long signum_reg asm("ebx") = signum; 670 register long act_reg asm("ecx") = (long)act; 671 register long oldact_reg asm("edx") = (long)oldact; 672 int ret = 0; 673 674 asm volatile ("int $0x80;" 675 : "=a"(ret), "=m"(oldact) 676 : "r"(syscall_reg), "r"(signum_reg), "r"(act_reg), 677 "r"(oldact_reg) 678 : "r8", "r9", "r10", "r11" 679 ); 680 681 return ret; 682 } 683 684 sigjmp_buf jmp_buffer; 685 686 void segv_gp_handler(int signum, siginfo_t *si, void *uc) 687 { 688 segv_triggered = true; 689 690 /* 691 * To work with old glibc, this can't rely on siglongjmp working with 692 * shadow stack enabled, so disable shadow stack before siglongjmp(). 693 */ 694 ARCH_PRCTL(ARCH_SHSTK_DISABLE, ARCH_SHSTK_SHSTK); 695 siglongjmp(jmp_buffer, -1); 696 } 697 698 /* 699 * Transition to 32 bit mode and check that a #GP triggers a segfault. 700 */ 701 int test_32bit(void) 702 { 703 struct sigaction sa = {}; 704 struct sigaction *sa32; 705 706 /* Create sigaction in 32 bit address range */ 707 sa32 = mmap(0, 4096, PROT_READ | PROT_WRITE, 708 MAP_32BIT | MAP_PRIVATE | MAP_ANONYMOUS, 0, 0); 709 sa32->sa_flags = SA_SIGINFO; 710 711 sa.sa_sigaction = segv_gp_handler; 712 sa.sa_flags = SA_SIGINFO; 713 if (sigaction(SIGSEGV, &sa, NULL)) 714 return 1; 715 716 717 segv_triggered = false; 718 719 /* Make sure segv_triggered is set before triggering the #GP */ 720 asm volatile("" : : : "memory"); 721 722 /* 723 * Set handler to somewhere in 32 bit address space 724 */ 725 sa32->sa_handler = (void *)sa32; 726 if (sigaction32(SIGUSR1, sa32, NULL)) 727 return 1; 728 729 if (!sigsetjmp(jmp_buffer, 1)) 730 raise(SIGUSR1); 731 732 if (segv_triggered) 733 printf("[OK]\t32 bit test\n"); 734 735 return !segv_triggered; 736 } 737 738 static int parse_uint_from_file(const char *file, const char *fmt) 739 { 740 int err, ret; 741 FILE *f; 742 743 f = fopen(file, "re"); 744 if (!f) { 745 err = -errno; 746 printf("failed to open '%s': %d\n", file, err); 747 return err; 748 } 749 err = fscanf(f, fmt, &ret); 750 if (err != 1) { 751 err = err == EOF ? -EIO : -errno; 752 printf("failed to parse '%s': %d\n", file, err); 753 fclose(f); 754 return err; 755 } 756 fclose(f); 757 return ret; 758 } 759 760 static int determine_uprobe_perf_type(void) 761 { 762 const char *file = "/sys/bus/event_source/devices/uprobe/type"; 763 764 return parse_uint_from_file(file, "%d\n"); 765 } 766 767 static int determine_uprobe_retprobe_bit(void) 768 { 769 const char *file = "/sys/bus/event_source/devices/uprobe/format/retprobe"; 770 771 return parse_uint_from_file(file, "config:%d\n"); 772 } 773 774 static ssize_t get_uprobe_offset(const void *addr) 775 { 776 size_t start, end, base; 777 char buf[256]; 778 bool found = false; 779 FILE *f; 780 781 f = fopen("/proc/self/maps", "r"); 782 if (!f) 783 return -errno; 784 785 while (fscanf(f, "%zx-%zx %s %zx %*[^\n]\n", &start, &end, buf, &base) == 4) { 786 if (buf[2] == 'x' && (uintptr_t)addr >= start && (uintptr_t)addr < end) { 787 found = true; 788 break; 789 } 790 } 791 792 fclose(f); 793 794 if (!found) 795 return -ESRCH; 796 797 return (uintptr_t)addr - start + base; 798 } 799 800 static __attribute__((noinline)) void uretprobe_trigger(void) 801 { 802 asm volatile (""); 803 } 804 805 /* 806 * This test setups return uprobe, which is sensitive to shadow stack 807 * (crashes without extra fix). After executing the uretprobe we fail 808 * the test if we receive SIGSEGV, no crash means we're good. 809 * 810 * Helper functions above borrowed from bpf selftests. 811 */ 812 static int test_uretprobe(void) 813 { 814 const size_t attr_sz = sizeof(struct perf_event_attr); 815 const char *file = "/proc/self/exe"; 816 int bit, fd = 0, type, err = 1; 817 struct perf_event_attr attr; 818 struct sigaction sa = {}; 819 ssize_t offset; 820 821 type = determine_uprobe_perf_type(); 822 if (type < 0) { 823 if (type == -ENOENT) 824 printf("[SKIP]\tUretprobe test, uprobes are not available\n"); 825 return 0; 826 } 827 828 offset = get_uprobe_offset(uretprobe_trigger); 829 if (offset < 0) 830 return 1; 831 832 bit = determine_uprobe_retprobe_bit(); 833 if (bit < 0) 834 return 1; 835 836 sa.sa_sigaction = segv_gp_handler; 837 sa.sa_flags = SA_SIGINFO; 838 if (sigaction(SIGSEGV, &sa, NULL)) 839 return 1; 840 841 /* Setup return uprobe through perf event interface. */ 842 memset(&attr, 0, attr_sz); 843 attr.size = attr_sz; 844 attr.type = type; 845 attr.config = 1 << bit; 846 attr.config1 = (__u64) (unsigned long) file; 847 attr.config2 = offset; 848 849 fd = syscall(__NR_perf_event_open, &attr, 0 /* pid */, -1 /* cpu */, 850 -1 /* group_fd */, PERF_FLAG_FD_CLOEXEC); 851 if (fd < 0) 852 goto out; 853 854 if (sigsetjmp(jmp_buffer, 1)) 855 goto out; 856 857 ARCH_PRCTL(ARCH_SHSTK_ENABLE, ARCH_SHSTK_SHSTK); 858 859 /* 860 * This either segfaults and goes through sigsetjmp above 861 * or succeeds and we're good. 862 */ 863 uretprobe_trigger(); 864 865 printf("[OK]\tUretprobe test\n"); 866 err = 0; 867 868 out: 869 ARCH_PRCTL(ARCH_SHSTK_DISABLE, ARCH_SHSTK_SHSTK); 870 signal(SIGSEGV, SIG_DFL); 871 if (fd) 872 close(fd); 873 return err; 874 } 875 876 /* Keep the CALL first so the function address is exactly the probed CALL. */ 877 extern void uprobe_call_trigger(void); 878 asm (".pushsection .text\n" 879 ".global uprobe_call_target\n" 880 ".type uprobe_call_target, @function\n" 881 "uprobe_call_target:\n" 882 " ret\n" 883 ".size uprobe_call_target, .-uprobe_call_target\n" 884 885 ".global uprobe_call_trigger\n" 886 ".type uprobe_call_trigger, @function\n" 887 "uprobe_call_trigger:\n" 888 " call uprobe_call_target\n" 889 " ret\n" 890 ".size uprobe_call_trigger, .-uprobe_call_trigger\n" 891 ".popsection\n" 892 ); 893 894 /* If CALL emulation misses the shadow stack update, this exits via SIGSEGV. */ 895 static int test_uprobe_call(void) 896 { 897 const size_t attr_sz = sizeof(struct perf_event_attr); 898 const char *file = "/proc/self/exe"; 899 int fd = -1, type, err = 1; 900 struct perf_event_attr attr; 901 struct sigaction sa = {}; 902 ssize_t offset; 903 904 type = determine_uprobe_perf_type(); 905 if (type < 0) { 906 if (type == -ENOENT) 907 printf("[SKIP]\tUprobe on CALL test, uprobes are not available\n"); 908 return 0; 909 } 910 911 offset = get_uprobe_offset(uprobe_call_trigger); 912 if (offset < 0) 913 return 1; 914 915 sa.sa_sigaction = segv_gp_handler; 916 sa.sa_flags = SA_SIGINFO; 917 if (sigaction(SIGSEGV, &sa, NULL)) 918 return 1; 919 920 /* Setup entry uprobe through perf event interface. */ 921 memset(&attr, 0, attr_sz); 922 attr.size = attr_sz; 923 attr.type = type; 924 attr.config = 0; 925 attr.config1 = (__u64)(unsigned long)file; 926 attr.config2 = offset; 927 928 fd = syscall(__NR_perf_event_open, &attr, 0 /* pid */, -1 /* cpu */, 929 -1 /* group_fd */, PERF_FLAG_FD_CLOEXEC); 930 if (fd < 0) 931 goto out; 932 933 if (sigsetjmp(jmp_buffer, 1)) 934 goto out; 935 936 if (ARCH_PRCTL(ARCH_SHSTK_ENABLE, ARCH_SHSTK_SHSTK)) 937 goto out; 938 939 /* 940 * This either segfaults and goes through sigsetjmp above 941 * or succeeds and we're good. 942 */ 943 uprobe_call_trigger(); 944 945 printf("[OK]\tUprobe on CALL test\n"); 946 err = 0; 947 948 out: 949 ARCH_PRCTL(ARCH_SHSTK_DISABLE, ARCH_SHSTK_SHSTK); 950 signal(SIGSEGV, SIG_DFL); 951 if (fd >= 0) 952 close(fd); 953 return err; 954 } 955 956 void segv_handler_ptrace(int signum, siginfo_t *si, void *uc) 957 { 958 /* The SSP adjustment caused a segfault. */ 959 exit(0); 960 } 961 962 int test_ptrace(void) 963 { 964 unsigned long saved_ssp, ssp = 0; 965 struct sigaction sa= {}; 966 struct iovec iov; 967 int status; 968 int pid; 969 970 iov.iov_base = &ssp; 971 iov.iov_len = sizeof(ssp); 972 973 pid = fork(); 974 if (!pid) { 975 ssp = get_ssp(); 976 977 sa.sa_sigaction = segv_handler_ptrace; 978 sa.sa_flags = SA_SIGINFO; 979 if (sigaction(SIGSEGV, &sa, NULL)) 980 return 1; 981 982 ptrace(PTRACE_TRACEME, NULL, NULL, NULL); 983 /* 984 * The parent will tweak the SSP and return from this function 985 * will #CP. 986 */ 987 raise(SIGTRAP); 988 989 exit(1); 990 } 991 992 while (waitpid(pid, &status, 0) != -1 && WSTOPSIG(status) != SIGTRAP); 993 994 if (ptrace(PTRACE_GETREGSET, pid, NT_X86_SHSTK, &iov)) { 995 printf("[INFO]\tFailed to PTRACE_GETREGS\n"); 996 goto out_kill; 997 } 998 999 if (!ssp) { 1000 printf("[INFO]\tPtrace child SSP was 0\n"); 1001 goto out_kill; 1002 } 1003 1004 saved_ssp = ssp; 1005 1006 iov.iov_len = 0; 1007 if (!ptrace(PTRACE_SETREGSET, pid, NT_X86_SHSTK, &iov)) { 1008 printf("[INFO]\tToo small size accepted via PTRACE_SETREGS\n"); 1009 goto out_kill; 1010 } 1011 1012 iov.iov_len = sizeof(ssp) + 1; 1013 if (!ptrace(PTRACE_SETREGSET, pid, NT_X86_SHSTK, &iov)) { 1014 printf("[INFO]\tToo large size accepted via PTRACE_SETREGS\n"); 1015 goto out_kill; 1016 } 1017 1018 ssp += 1; 1019 if (!ptrace(PTRACE_SETREGSET, pid, NT_X86_SHSTK, &iov)) { 1020 printf("[INFO]\tUnaligned SSP written via PTRACE_SETREGS\n"); 1021 goto out_kill; 1022 } 1023 1024 ssp = 0xFFFFFFFFFFFF0000; 1025 if (!ptrace(PTRACE_SETREGSET, pid, NT_X86_SHSTK, &iov)) { 1026 printf("[INFO]\tKernel range SSP written via PTRACE_SETREGS\n"); 1027 goto out_kill; 1028 } 1029 1030 /* 1031 * Tweak the SSP so the child with #CP when it resumes and returns 1032 * from raise() 1033 */ 1034 ssp = saved_ssp + 8; 1035 iov.iov_len = sizeof(ssp); 1036 if (ptrace(PTRACE_SETREGSET, pid, NT_X86_SHSTK, &iov)) { 1037 printf("[INFO]\tFailed to PTRACE_SETREGS\n"); 1038 goto out_kill; 1039 } 1040 1041 if (ptrace(PTRACE_DETACH, pid, NULL, NULL)) { 1042 printf("[INFO]\tFailed to PTRACE_DETACH\n"); 1043 goto out_kill; 1044 } 1045 1046 waitpid(pid, &status, 0); 1047 if (WEXITSTATUS(status)) 1048 return 1; 1049 1050 printf("[OK]\tPtrace test\n"); 1051 return 0; 1052 1053 out_kill: 1054 kill(pid, SIGKILL); 1055 return 1; 1056 } 1057 1058 int main(int argc, char *argv[]) 1059 { 1060 int ret = 0; 1061 1062 if (ARCH_PRCTL(ARCH_SHSTK_ENABLE, ARCH_SHSTK_SHSTK)) { 1063 printf("[SKIP]\tCould not enable Shadow stack\n"); 1064 return 1; 1065 } 1066 1067 if (ARCH_PRCTL(ARCH_SHSTK_DISABLE, ARCH_SHSTK_SHSTK)) { 1068 ret = 1; 1069 printf("[FAIL]\tDisabling shadow stack failed\n"); 1070 } 1071 1072 if (ARCH_PRCTL(ARCH_SHSTK_ENABLE, ARCH_SHSTK_SHSTK)) { 1073 printf("[SKIP]\tCould not re-enable Shadow stack\n"); 1074 return 1; 1075 } 1076 1077 if (ARCH_PRCTL(ARCH_SHSTK_ENABLE, ARCH_SHSTK_WRSS)) { 1078 printf("[SKIP]\tCould not enable WRSS\n"); 1079 ret = 1; 1080 goto out; 1081 } 1082 1083 /* Should have succeeded if here, but this is a test, so double check. */ 1084 if (!get_ssp()) { 1085 printf("[FAIL]\tShadow stack disabled\n"); 1086 return 1; 1087 } 1088 1089 if (test_shstk_pivot()) { 1090 ret = 1; 1091 printf("[FAIL]\tShadow stack pivot\n"); 1092 goto out; 1093 } 1094 1095 if (test_shstk_faults()) { 1096 ret = 1; 1097 printf("[FAIL]\tShadow stack fault test\n"); 1098 goto out; 1099 } 1100 1101 if (test_shstk_violation()) { 1102 ret = 1; 1103 printf("[FAIL]\tShadow stack violation test\n"); 1104 goto out; 1105 } 1106 1107 if (test_gup()) { 1108 ret = 1; 1109 printf("[FAIL]\tShadow shadow stack gup\n"); 1110 goto out; 1111 } 1112 1113 if (test_mprotect()) { 1114 ret = 1; 1115 printf("[FAIL]\tShadow shadow mprotect test\n"); 1116 goto out; 1117 } 1118 1119 if (test_userfaultfd()) { 1120 ret = 1; 1121 printf("[FAIL]\tUserfaultfd test\n"); 1122 goto out; 1123 } 1124 1125 if (test_guard_gap_other_gaps()) { 1126 ret = 1; 1127 printf("[FAIL]\tGuard gap test, other mappings' gaps\n"); 1128 goto out; 1129 } 1130 1131 if (test_guard_gap_new_mappings_gaps()) { 1132 ret = 1; 1133 printf("[FAIL]\tGuard gap test, placement mapping's gaps\n"); 1134 goto out; 1135 } 1136 1137 if (test_ptrace()) { 1138 ret = 1; 1139 printf("[FAIL]\tptrace test\n"); 1140 } 1141 1142 if (test_32bit()) { 1143 ret = 1; 1144 printf("[FAIL]\t32 bit test\n"); 1145 goto out; 1146 } 1147 1148 if (test_uretprobe()) { 1149 ret = 1; 1150 printf("[FAIL]\turetprobe test\n"); 1151 goto out; 1152 } 1153 1154 if (test_uprobe_call()) { 1155 ret = 1; 1156 printf("[FAIL]\tuprobe on CALL test\n"); 1157 goto out; 1158 } 1159 1160 return ret; 1161 1162 out: 1163 /* 1164 * Disable shadow stack before the function returns, or there will be a 1165 * shadow stack violation. 1166 */ 1167 if (ARCH_PRCTL(ARCH_SHSTK_DISABLE, ARCH_SHSTK_SHSTK)) { 1168 ret = 1; 1169 printf("[FAIL]\tDisabling shadow stack failed\n"); 1170 } 1171 1172 return ret; 1173 } 1174 #endif 1175