1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2017 Pavel Boldin <[email protected]>
4 * Copyright (c) 2023 Rick Edgecombe <[email protected]>
5 * Copyright (c) Linux Test Project, 2017-2023
6 */
7
8 /*\
9 * [Description]
10 *
11 * This is a regression test of the Stack Clash [1] vulnerability. This tests
12 * that there is at least 256 PAGE_SIZE of stack guard gap which is considered
13 * hard to hop above. Code adapted from the Novell's bugzilla [2].
14 *
15 * The code `mmap(2)`s region close to the stack end. The code then allocates
16 * memory on stack until it hits guard page and SIGSEGV or SIGBUS is generated
17 * by the kernel. The signal handler checks that fault address is further than
18 * THRESHOLD from the mmapped area.
19 *
20 * We read /proc/self/maps to examine exact top of the stack and `mmap(2)`
21 * our region exactly GAP_PAGES * PAGE_SIZE away. We read /proc/cmdline to
22 * see if a different stack_guard_gap size is configured. We set stack limit
23 * to infinity and preallocate REQ_STACK_SIZE bytes of stack so that no calls
24 * after `mmap` are moving stack further.
25 *
26 * If the architecture meets certain requirements (only x86_64 is verified)
27 * then the test also tests that new mmap()s can't be placed in the stack's
28 * guard gap. This part of the test works by forcing a bottom up search. The
29 * assumptions are that the stack grows down (start gap) and either:
30 *
31 * 1. The default search is top down, and will switch to bottom up if
32 * space is exhausted.
33 * 2. The default search is bottom up and the stack is above mmap base.
34 *
35 * [1] https://blog.qualys.com/securitylabs/2017/06/19/the-stack-clash
36 * [2] https://bugzilla.novell.com/show_bug.cgi?id=CVE-2017-1000364
37 */
38
39 #include <sys/wait.h>
40 #include <stdio.h>
41 #include <unistd.h>
42 #include <alloca.h>
43 #include <signal.h>
44 #include <stdlib.h>
45
46 #include "tst_test.h"
47 #include "tst_kconfig.h"
48 #include "tst_safe_stdio.h"
49 #include "lapi/mmap.h"
50
51 static unsigned long page_size;
52 static unsigned long page_mask;
53 static unsigned long GAP_PAGES = 256;
54 static unsigned long THRESHOLD;
55 static int STACK_GROWSDOWN;
56
57 #define SIGNAL_STACK_SIZE (1UL<<20)
58 #define FRAME_SIZE 1024
59 #define REQ_STACK_SIZE (1024 * 1024)
60
61 #define EXIT_TESTBROKE TBROK
62
exhaust_stack_into_sigsegv(void)63 void exhaust_stack_into_sigsegv(void)
64 {
65 volatile char * ptr = alloca(FRAME_SIZE - sizeof(long));
66 *ptr = '\0';
67 exhaust_stack_into_sigsegv();
68 }
69
70 #define MAPPED_LEN page_size
71 static unsigned long mapped_addr;
72
segv_handler(int sig,siginfo_t * info,void * data LTP_ATTRIBUTE_UNUSED)73 void segv_handler(int sig, siginfo_t *info, void *data LTP_ATTRIBUTE_UNUSED)
74 {
75 unsigned long fault_addr = (unsigned long)info->si_addr;
76 unsigned long mmap_end = mapped_addr + MAPPED_LEN;
77 ssize_t diff;
78
79 if (sig != SIGSEGV && sig != SIGBUS)
80 return;
81
82 if (STACK_GROWSDOWN)
83 diff = fault_addr - mmap_end;
84 else
85 diff = mapped_addr - fault_addr;
86
87 tst_res(TINFO,
88 "mmap = [%lx, %lx), addr = %lx, diff = %zx, THRESHOLD = %lx",
89 mapped_addr, mmap_end, fault_addr, diff, THRESHOLD);
90 if (diff < 0 || (unsigned long)diff < THRESHOLD)
91 _exit(EXIT_FAILURE);
92 else
93 _exit(EXIT_SUCCESS);
94 }
95
96 #ifdef __x86_64__
force_bottom_up(void)97 static void force_bottom_up(void)
98 {
99 FILE *fh;
100 char buf[1024];
101 unsigned long start, end, size, lastend = 0;
102
103 /* start filling from mmap_min_addr */
104 SAFE_FILE_SCANF("/proc/sys/vm/mmap_min_addr", "%lu", &lastend);
105
106 fh = SAFE_FOPEN("/proc/self/maps", "r");
107
108 while (!feof(fh)) {
109 if (fgets(buf, sizeof(buf), fh) == NULL)
110 goto out;
111
112 if (sscanf(buf, "%lx-%lx", &start, &end) != 2) {
113 tst_brk(TBROK | TERRNO, "sscanf");
114 goto out;
115 }
116
117 size = start - lastend;
118
119 /* Skip the PROT_NONE that was just added (!size). */
120 if (!size) {
121 lastend = end;
122 continue;
123 }
124
125 /* If the next area is the stack, quit. */
126 if (!!strstr(buf, "[stack]"))
127 break;
128
129 /* This is not cleaned up. */
130 SAFE_MMAP((void *)lastend, size, PROT_NONE,
131 MAP_ANON|MAP_PRIVATE|MAP_FIXED_NOREPLACE, -1, 0);
132
133 lastend = end;
134 }
135
136 out:
137 SAFE_FCLOSE(fh);
138 }
139 #endif
140
read_stack_addr_from_proc(unsigned long * stack_size)141 unsigned long read_stack_addr_from_proc(unsigned long *stack_size)
142 {
143 FILE *fh;
144 char buf[1024];
145 unsigned long stack_top = -1UL, start, end;
146
147 fh = SAFE_FOPEN("/proc/self/maps", "r");
148
149 while (!feof(fh)) {
150 if (fgets(buf, sizeof(buf), fh) == NULL) {
151 tst_brk(TBROK | TERRNO, "fgets");
152 goto out;
153 }
154
155 if (!strstr(buf, "[stack"))
156 continue;
157
158 if (sscanf(buf, "%lx-%lx", &start, &end) != 2) {
159 tst_brk(TBROK | TERRNO, "sscanf");
160 goto out;
161 }
162
163 *stack_size = end - start;
164
165 if (STACK_GROWSDOWN)
166 stack_top = start;
167 else
168 stack_top = end;
169 break;
170 }
171
172 out:
173 SAFE_FCLOSE(fh);
174 return stack_top;
175 }
176
dump_proc_self_maps(void)177 void dump_proc_self_maps(void)
178 {
179 static char buf[64];
180 static const char *cmd[] = {"cat", buf, NULL};
181 sprintf(buf, "/proc/%d/maps", getpid());
182 tst_cmd(cmd, NULL, NULL, 0);
183 }
184
preallocate_stack(unsigned long required)185 void __attribute__((noinline)) preallocate_stack(unsigned long required)
186 {
187 volatile char *garbage;
188
189 garbage = alloca(required);
190 garbage[0] = garbage[required - 1] = '\0';
191 }
192
193 #ifdef __x86_64__
do_mmap_placement_test(unsigned long stack_addr,unsigned long gap)194 static void do_mmap_placement_test(unsigned long stack_addr, unsigned long gap)
195 {
196 void *map_test_gap;
197
198 force_bottom_up();
199
200 /*
201 * force_bottom_up() used up all the spaces below the stack. The search down
202 * path should fail, and search up might take a look at the guard gap
203 * region. If it avoids it, the allocation will be above the stack. If it
204 * uses it, the allocation will be in the gap and the test should fail.
205 */
206 map_test_gap = SAFE_MMAP(0, MAPPED_LEN,
207 PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE, 0, 0);
208
209 if (stack_addr - gap <= (unsigned long)map_test_gap &&
210 (unsigned long)map_test_gap <= stack_addr) {
211 tst_res(TFAIL, "New mmap was placed in the guard gap.");
212 SAFE_MUNMAP(map_test_gap, MAPPED_LEN);
213 }
214 }
215 #endif
216
do_child(void)217 void do_child(void)
218 {
219 unsigned long stack_addr, stack_size;
220 stack_t signal_stack;
221 struct sigaction segv_sig = {.sa_sigaction = segv_handler, .sa_flags = SA_ONSTACK|SA_SIGINFO};
222 void *map;
223 unsigned long gap = GAP_PAGES * page_size;
224 struct rlimit rlimit;
225
226 rlimit.rlim_cur = rlimit.rlim_max = RLIM_INFINITY;
227 SAFE_SETRLIMIT(RLIMIT_STACK, &rlimit);
228
229 preallocate_stack(REQ_STACK_SIZE);
230
231 stack_addr = read_stack_addr_from_proc(&stack_size);
232 if (stack_addr == -1UL) {
233 tst_brk(TBROK, "can't read stack top from /proc/self/maps");
234 return;
235 }
236
237 if (STACK_GROWSDOWN)
238 mapped_addr = stack_addr - gap - MAPPED_LEN;
239 else
240 mapped_addr = stack_addr + gap;
241
242 mapped_addr &= page_mask;
243 map = SAFE_MMAP((void *)mapped_addr, MAPPED_LEN,
244 PROT_READ|PROT_WRITE,
245 MAP_ANON|MAP_PRIVATE|MAP_FIXED, -1, 0);
246 tst_res(TINFO, "Stack:0x%lx+0x%lx mmap:%p+0x%lx",
247 stack_addr, stack_size, map, MAPPED_LEN);
248
249 signal_stack.ss_sp = SAFE_MALLOC(SIGNAL_STACK_SIZE);
250 signal_stack.ss_size = SIGNAL_STACK_SIZE;
251 signal_stack.ss_flags = 0;
252 if (sigaltstack(&signal_stack, NULL) == -1) {
253 tst_brk(TBROK | TERRNO, "sigaltstack");
254 return;
255 }
256 if (sigaction(SIGSEGV, &segv_sig, NULL) == -1 ||
257 sigaction(SIGBUS, &segv_sig, NULL) == -1) {
258 tst_brk(TBROK | TERRNO, "sigaction");
259 return;
260 }
261
262 #ifdef DEBUG
263 dump_proc_self_maps();
264 #endif
265
266 #ifdef __x86_64__
267 do_mmap_placement_test(stack_addr, gap);
268 #endif
269
270 /* Now see if it can grow too close to an adjacent region. */
271 exhaust_stack_into_sigsegv();
272 }
273
setup(void)274 void setup(void)
275 {
276 page_size = sysconf(_SC_PAGESIZE);
277 page_mask = ~(page_size - 1);
278
279 struct tst_kcmdline_var params = TST_KCMDLINE_INIT("stack_guard_gap");
280 tst_kcmdline_parse(¶ms, 1);
281
282 if (params.found) {
283 GAP_PAGES= atol(params.value);
284 tst_res(TINFO, "stack_guard_gap = %ld", GAP_PAGES);
285 }
286
287 THRESHOLD = (GAP_PAGES - 1) * page_size;
288
289 {
290 volatile int *a = alloca(128);
291
292 {
293 volatile int *b = alloca(128);
294
295 STACK_GROWSDOWN = a > b;
296 tst_res(TINFO, "STACK_GROWSDOWN = %d == %p > %p", STACK_GROWSDOWN, a, b);
297 }
298 }
299 }
300
stack_clash_test(void)301 void stack_clash_test(void)
302 {
303 int status;
304 pid_t pid;
305
306 pid = SAFE_FORK();
307 if (!pid) {
308 do_child();
309 exit(EXIT_TESTBROKE);
310 return;
311 }
312
313 SAFE_WAITPID(pid, &status, 0);
314
315 if (WIFEXITED(status)) {
316 switch (WEXITSTATUS(status)) {
317 case EXIT_FAILURE:
318 tst_res(TFAIL, "stack is too close to the mmaped area");
319 return;
320 case EXIT_SUCCESS:
321 tst_res(TPASS, "stack is far enough from mmaped area");
322 return;
323 default:
324 case EXIT_TESTBROKE:
325 break;
326 }
327 }
328
329 tst_brk(TBROK, "Child %s", tst_strstatus(status));
330 }
331
332 static struct tst_test test = {
333 .forks_child = 1,
334 .needs_root = 1,
335 .setup = setup,
336 .test_all = stack_clash_test,
337 .tags = (const struct tst_tag[]) {
338 {"CVE", "2017-1000364"},
339 {"linux-git", "58c5d0d6d522"},
340 {}
341 }
342 };
343