On Thu, Jun 13, 2019 at 12:13:26PM +0100, Cristian Marussi wrote:
> Added a simple mangle testcase which messes with the ucontext_t
> from within the sig_handler, trying to badly modify the PC to point
> toward Kernel land.
> Expects SIGSEGV on test PASS.
>
> Signed-off-by: Cristian Marussi <cristian.marussi@xxxxxxx>
> ---
> .../arm64/signal/testcases/.gitignore | 1 +
> .../signal/testcases/mangle_pc_invalid.c | 24 +++++++++++++++++++
> 2 files changed, 25 insertions(+)
> create mode 100644 tools/testing/selftests/arm64/signal/testcases/mangle_pc_invalid.c
>
> diff --git a/tools/testing/selftests/arm64/signal/testcases/.gitignore b/tools/testing/selftests/arm64/signal/testcases/.gitignore
> index 7f7414d241f2..a87fb0f0d2cf 100644
> --- a/tools/testing/selftests/arm64/signal/testcases/.gitignore
> +++ b/tools/testing/selftests/arm64/signal/testcases/.gitignore
> @@ -1 +1,2 @@
> mangle_sp_misaligned
> +mangle_pc_invalid
> diff --git a/tools/testing/selftests/arm64/signal/testcases/mangle_pc_invalid.c b/tools/testing/selftests/arm64/signal/testcases/mangle_pc_invalid.c
> new file mode 100644
> index 000000000000..0024032528bc
> --- /dev/null
> +++ b/tools/testing/selftests/arm64/signal/testcases/mangle_pc_invalid.c
> @@ -0,0 +1,24 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +/* Copyright (C) 2019 ARM Limited */
> +
> +#include "test_signals_utils.h"
> +#include "testcases.h"
> +
> +static int mangle_invalid_pc_run(struct tdescr *td, siginfo_t *si,
> + ucontext_t *uc)
> +{
> + ASSERT_GOOD_CONTEXT(uc);
> +
> + uc->uc_mcontext.pc = 0xffffffffcccccccc;
Similarly to the previous test, I don't think this is testing the
sigreturn behaviour: the kernel just restores the bogus PC value and
returns to userspace. We then rely on the architecture to generate a
prefetch abort when trying to fetch from the bogus PC.
Am I missing anything?
Could we have a test that points SP to kernel memory and the calls
sigreturn: there is a real behaviour to test there: we must not be able
to trick the kernel into interpreting kernel memory as a signal frame.
[...]
Cheers
--Dave
