On Thu, Jun 13, 2019 at 12:13:26PM +0100, Cristian Marussi wrote:
Added a simple mangle testcase which messes with the ucontext_t from within the sig_handler, trying to badly modify the PC to point toward Kernel land. Expects SIGSEGV on test PASS.
Signed-off-by: Cristian Marussi cristian.marussi@arm.com
.../arm64/signal/testcases/.gitignore | 1 + .../signal/testcases/mangle_pc_invalid.c | 24 +++++++++++++++++++ 2 files changed, 25 insertions(+) create mode 100644 tools/testing/selftests/arm64/signal/testcases/mangle_pc_invalid.c
diff --git a/tools/testing/selftests/arm64/signal/testcases/.gitignore b/tools/testing/selftests/arm64/signal/testcases/.gitignore index 7f7414d241f2..a87fb0f0d2cf 100644 --- a/tools/testing/selftests/arm64/signal/testcases/.gitignore +++ b/tools/testing/selftests/arm64/signal/testcases/.gitignore @@ -1 +1,2 @@ mangle_sp_misaligned +mangle_pc_invalid diff --git a/tools/testing/selftests/arm64/signal/testcases/mangle_pc_invalid.c b/tools/testing/selftests/arm64/signal/testcases/mangle_pc_invalid.c new file mode 100644 index 000000000000..0024032528bc --- /dev/null +++ b/tools/testing/selftests/arm64/signal/testcases/mangle_pc_invalid.c @@ -0,0 +1,24 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* Copyright (C) 2019 ARM Limited */
+#include "test_signals_utils.h" +#include "testcases.h"
+static int mangle_invalid_pc_run(struct tdescr *td, siginfo_t *si,
ucontext_t *uc)+{
- ASSERT_GOOD_CONTEXT(uc);
- uc->uc_mcontext.pc = 0xffffffffcccccccc;
Similarly to the previous test, I don't think this is testing the sigreturn behaviour: the kernel just restores the bogus PC value and returns to userspace. We then rely on the architecture to generate a prefetch abort when trying to fetch from the bogus PC.
Am I missing anything?
Could we have a test that points SP to kernel memory and the calls sigreturn: there is a real behaviour to test there: we must not be able to trick the kernel into interpreting kernel memory as a signal frame.
[...]
Cheers --Dave