testcases/cve/stack_clash.c - platform/external/ltp - Git at Google

 /*
  * Copyright (c) 2017 Pavel Boldin <pboldin@cloudlinux.com>
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation, either version 2 of the License, or
  * (at your option) any later version.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  *
  * Adapted from code by Michal Hocko.
  */

 /* This is a regression test of the Stack Clash [1] vulnerability. This tests
  * that there is at least 256 PAGE_SIZE of stack guard gap which is considered
  * hard to hop above. Code adapted from the Novell's bugzilla [2].
  *
  * The code `mmap(2)`s region close to the stack end. The code then allocates
  * memory on stack until it hits guard page and SIGSEGV or SIGBUS is generated
  * by the kernel. The signal handler checks that fault address is further than
  * THRESHOLD from the mmapped area.
  *
  * We read /proc/self/maps to examine exact top of the stack and `mmap(2)`
  * our region exactly GAP_PAGES * PAGE_SIZE away. We read /proc/cmdline to
  * see if a different stack_guard_gap size is configured. We set stack limit
  * to infinity and preallocate REQ_STACK_SIZE bytes of stack so that no calls
  * after `mmap` are moving stack further.
  *
  * [1] https://blog.qualys.com/securitylabs/2017/06/19/the-stack-clash
  * [2] https://bugzilla.novell.com/show_bug.cgi?id=CVE-2017-1000364
  */

 #include <sys/mman.h>
 #include <sys/wait.h>
 #include <stdio.h>
 #include <unistd.h>
 #include <alloca.h>
 #include <signal.h>
 #include <stdlib.h>

 #include "tst_test.h"
 #include "tst_safe_stdio.h"

 static unsigned long page_size;
 static unsigned long page_mask;
 static unsigned long GAP_PAGES = 256;
 static unsigned long THRESHOLD;
 static int STACK_GROWSDOWN;

 #define SIGNAL_STACK_SIZE	(1UL<<20)
 #define FRAME_SIZE		1024
 #define REQ_STACK_SIZE		(1024 * 1024)

 #define EXIT_TESTBROKE		TBROK

 void exhaust_stack_into_sigsegv(void)
 {
 	volatile char * ptr = alloca(FRAME_SIZE - sizeof(long));
 	*ptr = '\0';
 	exhaust_stack_into_sigsegv();
 }

 #define MAPPED_LEN page_size
 static unsigned long mapped_addr;

 void segv_handler(int sig, siginfo_t *info, void *data LTP_ATTRIBUTE_UNUSED)
 {
 	unsigned long fault_addr = (unsigned long)info->si_addr;
 	unsigned long mmap_end = mapped_addr + MAPPED_LEN;
 	ssize_t diff;

 	if (sig != SIGSEGV && sig != SIGBUS)
 		return;

 	if (STACK_GROWSDOWN)
 		diff = fault_addr - mmap_end;
 	else
 		diff = mapped_addr - fault_addr;

 	tst_res(TINFO,
 		"mmap = [%lx, %lx), addr = %lx, diff = %zx, THRESHOLD = %lx",
 		mapped_addr, mmap_end, fault_addr, diff, THRESHOLD);
 	if (diff < 0 || (unsigned long)diff < THRESHOLD)
 		_exit(EXIT_FAILURE);
 	else
 		_exit(EXIT_SUCCESS);
 }

 unsigned long read_stack_addr_from_proc(unsigned long *stack_size)
 {
 	FILE *fh;
 	char buf[1024];
 	unsigned long stack_top = -1UL, start, end;

 	fh = SAFE_FOPEN("/proc/self/maps", "r");

 	while (!feof(fh)) {
 		if (fgets(buf, sizeof(buf), fh) == NULL) {
 			tst_brk(TBROK | TERRNO, "fgets");
 			goto out;
 		}

 		if (!strstr(buf, "[stack"))
 			continue;

 		if (sscanf(buf, "%lx-%lx", &start, &end) != 2) {
 			tst_brk(TBROK | TERRNO, "sscanf");
 			goto out;
 		}

 		*stack_size = end - start;

 		if (STACK_GROWSDOWN)
 			stack_top = start;
 		else
 			stack_top = end;
 		break;
 	}

 out:
 	SAFE_FCLOSE(fh);
 	return stack_top;
 }

 void dump_proc_self_maps(void)
 {
 	static char buf[64];
 	static const char *cmd[] = {"cat", buf, NULL};
 	sprintf(buf, "/proc/%d/maps", getpid());
 	tst_run_cmd(cmd, NULL, NULL, 0);
 }

 void __attribute__((noinline)) preallocate_stack(unsigned long required)
 {
 	volatile char *garbage;

 	garbage = alloca(required);
 	garbage[0] = garbage[required - 1] = '\0';
 }

 void do_child(void)
 {
 	unsigned long stack_addr, stack_size;
 	stack_t signal_stack;
 	struct sigaction segv_sig = {.sa_sigaction = segv_handler, .sa_flags = SA_ONSTACK|SA_SIGINFO};
 	void *map;
 	unsigned long gap = GAP_PAGES * page_size;
 	struct rlimit rlimit;

 	rlimit.rlim_cur = rlimit.rlim_max = RLIM_INFINITY;
 	SAFE_SETRLIMIT(RLIMIT_STACK, &rlimit);

 	preallocate_stack(REQ_STACK_SIZE);

 	stack_addr = read_stack_addr_from_proc(&stack_size);
 	if (stack_addr == -1UL) {
 		tst_brk(TBROK, "can't read stack top from /proc/self/maps");
 		return;
 	}

 	if (STACK_GROWSDOWN)
 		mapped_addr = stack_addr - gap - MAPPED_LEN;
 	else
 		mapped_addr = stack_addr + gap;

 	mapped_addr &= page_mask;
 	map = SAFE_MMAP((void *)mapped_addr, MAPPED_LEN,
 			PROT_READ|PROT_WRITE,
 			MAP_ANON|MAP_PRIVATE|MAP_FIXED, -1, 0);
 	tst_res(TINFO, "Stack:0x%lx+0x%lx mmap:%p+0x%lx",
 		stack_addr, stack_size, map, MAPPED_LEN);

 	signal_stack.ss_sp = SAFE_MALLOC(SIGNAL_STACK_SIZE);
 	signal_stack.ss_size = SIGNAL_STACK_SIZE;
 	signal_stack.ss_flags = 0;
 	if (sigaltstack(&signal_stack, NULL) == -1) {
 		tst_brk(TBROK | TERRNO, "sigaltstack");
 		return;
 	}
 	if (sigaction(SIGSEGV, &segv_sig, NULL) == -1 ||
 	    sigaction(SIGBUS,  &segv_sig, NULL) == -1) {
 		tst_brk(TBROK | TERRNO, "sigaction");
 		return;
 	}

 #ifdef DEBUG
 	dump_proc_self_maps();
 #endif

 	exhaust_stack_into_sigsegv();
 }

 void setup(void)
 {
 	char buf[4096], *p;

 	page_size = sysconf(_SC_PAGESIZE);
 	page_mask = ~(page_size - 1);

 	buf[4095] = '\0';
 	SAFE_FILE_SCANF("/proc/cmdline", "%4095[^\n]", buf);

 	if ((p = strstr(buf, "stack_guard_gap=")) != NULL) {
 		if (sscanf(p, "stack_guard_gap=%ld", &GAP_PAGES) != 1) {
 			tst_brk(TBROK | TERRNO, "sscanf");
 			return;
 		}
 		tst_res(TINFO, "stack_guard_gap = %ld", GAP_PAGES);
 	}

 	THRESHOLD = (GAP_PAGES - 1) * page_size;

 	{
 		volatile int *a = alloca(128);

 		{
 			volatile int *b = alloca(128);

 			STACK_GROWSDOWN = a > b;
 			tst_res(TINFO, "STACK_GROWSDOWN = %d == %p > %p", STACK_GROWSDOWN, a, b);
 		}
 	}
 }

 void stack_clash_test(void)
 {
 	int status;
 	pid_t pid;

 	pid = SAFE_FORK();
 	if (!pid) {
 		do_child();
 		exit(EXIT_TESTBROKE);
 		return;
 	}

 	SAFE_WAITPID(pid, &status, 0);

 	if (WIFEXITED(status)) {
 		switch (WEXITSTATUS(status)) {
 		case EXIT_FAILURE:
 			tst_res(TFAIL, "stack is too close to the mmaped area");
 			return;
 		case EXIT_SUCCESS:
 			tst_res(TPASS, "stack is far enough from mmaped area");
 			return;
 		default:
 		case EXIT_TESTBROKE:
 			break;
 		}
 	}

 	tst_brk(TBROK, "Child %s", tst_strstatus(status));
 }

 static struct tst_test test = {
 	.forks_child = 1,
 	.needs_root = 1,
 	.setup = setup,
 	.test_all = stack_clash_test,
 };
	/*
	* Copyright (c) 2017 Pavel Boldin <pboldin@cloudlinux.com>
	*
	* This program is free software: you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation, either version 2 of the License, or
	* (at your option) any later version.
	*
	* This program is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program. If not, see <http://www.gnu.org/licenses/>.
	*
	* Adapted from code by Michal Hocko.
	*/

	/* This is a regression test of the Stack Clash [1] vulnerability. This tests
	* that there is at least 256 PAGE_SIZE of stack guard gap which is considered
	* hard to hop above. Code adapted from the Novell's bugzilla [2].
	*
	* The code `mmap(2)`s region close to the stack end. The code then allocates
	* memory on stack until it hits guard page and SIGSEGV or SIGBUS is generated
	* by the kernel. The signal handler checks that fault address is further than
	* THRESHOLD from the mmapped area.
	*
	* We read /proc/self/maps to examine exact top of the stack and `mmap(2)`
	* our region exactly GAP_PAGES * PAGE_SIZE away. We read /proc/cmdline to
	* see if a different stack_guard_gap size is configured. We set stack limit
	* to infinity and preallocate REQ_STACK_SIZE bytes of stack so that no calls
	* after `mmap` are moving stack further.
	*
	* [1] https://blog.qualys.com/securitylabs/2017/06/19/the-stack-clash
	* [2] https://bugzilla.novell.com/show_bug.cgi?id=CVE-2017-1000364
	*/

	#include <sys/mman.h>
	#include <sys/wait.h>
	#include <stdio.h>
	#include <unistd.h>
	#include <alloca.h>
	#include <signal.h>
	#include <stdlib.h>

	#include "tst_test.h"
	#include "tst_safe_stdio.h"

	static unsigned long page_size;
	static unsigned long page_mask;
	static unsigned long GAP_PAGES = 256;
	static unsigned long THRESHOLD;
	static int STACK_GROWSDOWN;

	#define SIGNAL_STACK_SIZE (1UL<<20)
	#define FRAME_SIZE 1024
	#define REQ_STACK_SIZE (1024 * 1024)

	#define EXIT_TESTBROKE TBROK

	void exhaust_stack_into_sigsegv(void)
	{
	volatile char * ptr = alloca(FRAME_SIZE - sizeof(long));
	*ptr = '\0';
	exhaust_stack_into_sigsegv();
	}

	#define MAPPED_LEN page_size
	static unsigned long mapped_addr;

	void segv_handler(int sig, siginfo_t info, void data LTP_ATTRIBUTE_UNUSED)
	{
	unsigned long fault_addr = (unsigned long)info->si_addr;
	unsigned long mmap_end = mapped_addr + MAPPED_LEN;
	ssize_t diff;

	if (sig != SIGSEGV && sig != SIGBUS)
	return;

	if (STACK_GROWSDOWN)
	diff = fault_addr - mmap_end;
	else
	diff = mapped_addr - fault_addr;

	tst_res(TINFO,
	"mmap = [%lx, %lx), addr = %lx, diff = %zx, THRESHOLD = %lx",
	mapped_addr, mmap_end, fault_addr, diff, THRESHOLD);
	if (diff < 0 \|\| (unsigned long)diff < THRESHOLD)
	_exit(EXIT_FAILURE);
	else
	_exit(EXIT_SUCCESS);
	}

	unsigned long read_stack_addr_from_proc(unsigned long *stack_size)
	{
	FILE *fh;
	char buf[1024];
	unsigned long stack_top = -1UL, start, end;

	fh = SAFE_FOPEN("/proc/self/maps", "r");

	while (!feof(fh)) {
	if (fgets(buf, sizeof(buf), fh) == NULL) {
	tst_brk(TBROK \| TERRNO, "fgets");
	goto out;
	}

	if (!strstr(buf, "[stack"))
	continue;

	if (sscanf(buf, "%lx-%lx", &start, &end) != 2) {
	tst_brk(TBROK \| TERRNO, "sscanf");
	goto out;
	}

	*stack_size = end - start;

	if (STACK_GROWSDOWN)
	stack_top = start;
	else
	stack_top = end;
	break;
	}

	out:
	SAFE_FCLOSE(fh);
	return stack_top;
	}

	void dump_proc_self_maps(void)
	{
	static char buf[64];
	static const char *cmd[] = {"cat", buf, NULL};
	sprintf(buf, "/proc/%d/maps", getpid());
	tst_run_cmd(cmd, NULL, NULL, 0);
	}

	void __attribute__((noinline)) preallocate_stack(unsigned long required)
	{
	volatile char *garbage;

	garbage = alloca(required);
	garbage[0] = garbage[required - 1] = '\0';
	}

	void do_child(void)
	{
	unsigned long stack_addr, stack_size;
	stack_t signal_stack;
	struct sigaction segv_sig = {.sa_sigaction = segv_handler, .sa_flags = SA_ONSTACK\|SA_SIGINFO};
	void *map;
	unsigned long gap = GAP_PAGES * page_size;
	struct rlimit rlimit;

	rlimit.rlim_cur = rlimit.rlim_max = RLIM_INFINITY;
	SAFE_SETRLIMIT(RLIMIT_STACK, &rlimit);

	preallocate_stack(REQ_STACK_SIZE);

	stack_addr = read_stack_addr_from_proc(&stack_size);
	if (stack_addr == -1UL) {
	tst_brk(TBROK, "can't read stack top from /proc/self/maps");
	return;
	}

	if (STACK_GROWSDOWN)
	mapped_addr = stack_addr - gap - MAPPED_LEN;
	else
	mapped_addr = stack_addr + gap;

	mapped_addr &= page_mask;
	map = SAFE_MMAP((void *)mapped_addr, MAPPED_LEN,
	PROT_READ\|PROT_WRITE,
	MAP_ANON\|MAP_PRIVATE\|MAP_FIXED, -1, 0);
	tst_res(TINFO, "Stack:0x%lx+0x%lx mmap:%p+0x%lx",
	stack_addr, stack_size, map, MAPPED_LEN);

	signal_stack.ss_sp = SAFE_MALLOC(SIGNAL_STACK_SIZE);
	signal_stack.ss_size = SIGNAL_STACK_SIZE;
	signal_stack.ss_flags = 0;
	if (sigaltstack(&signal_stack, NULL) == -1) {
	tst_brk(TBROK \| TERRNO, "sigaltstack");
	return;
	}
	if (sigaction(SIGSEGV, &segv_sig, NULL) == -1 \|\|
	sigaction(SIGBUS, &segv_sig, NULL) == -1) {
	tst_brk(TBROK \| TERRNO, "sigaction");
	return;
	}

	#ifdef DEBUG
	dump_proc_self_maps();
	#endif

	exhaust_stack_into_sigsegv();
	}

	void setup(void)
	{
	char buf[4096], *p;

	page_size = sysconf(_SC_PAGESIZE);
	page_mask = ~(page_size - 1);

	buf[4095] = '\0';
	SAFE_FILE_SCANF("/proc/cmdline", "%4095[^\n]", buf);

	if ((p = strstr(buf, "stack_guard_gap=")) != NULL) {
	if (sscanf(p, "stack_guard_gap=%ld", &GAP_PAGES) != 1) {
	tst_brk(TBROK \| TERRNO, "sscanf");
	return;
	}
	tst_res(TINFO, "stack_guard_gap = %ld", GAP_PAGES);
	}

	THRESHOLD = (GAP_PAGES - 1) * page_size;

	{
	volatile int *a = alloca(128);

	{
	volatile int *b = alloca(128);

	STACK_GROWSDOWN = a > b;
	tst_res(TINFO, "STACK_GROWSDOWN = %d == %p > %p", STACK_GROWSDOWN, a, b);
	}
	}
	}

	void stack_clash_test(void)
	{
	int status;
	pid_t pid;

	pid = SAFE_FORK();
	if (!pid) {
	do_child();
	exit(EXIT_TESTBROKE);
	return;
	}

	SAFE_WAITPID(pid, &status, 0);

	if (WIFEXITED(status)) {
	switch (WEXITSTATUS(status)) {
	case EXIT_FAILURE:
	tst_res(TFAIL, "stack is too close to the mmaped area");
	return;
	case EXIT_SUCCESS:
	tst_res(TPASS, "stack is far enough from mmaped area");
	return;
	default:
	case EXIT_TESTBROKE:
	break;
	}
	}

	tst_brk(TBROK, "Child %s", tst_strstatus(status));
	}

	static struct tst_test test = {
	.forks_child = 1,
	.needs_root = 1,
	.setup = setup,
	.test_all = stack_clash_test,
	};