HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
[linux/fpc-iii.git] / tools / testing / selftests / x86 / ldt_gdt.c
blob412b845412d2978f40e09a0152c54215a17f82db
1 /*
2 * ldt_gdt.c - Test cases for LDT and GDT access
3 * Copyright (c) 2015 Andrew Lutomirski
4 */
6 #define _GNU_SOURCE
7 #include <err.h>
8 #include <stdio.h>
9 #include <stdint.h>
10 #include <signal.h>
11 #include <setjmp.h>
12 #include <stdlib.h>
13 #include <string.h>
14 #include <errno.h>
15 #include <unistd.h>
16 #include <sys/syscall.h>
17 #include <asm/ldt.h>
18 #include <sys/types.h>
19 #include <sys/wait.h>
20 #include <stdbool.h>
21 #include <pthread.h>
22 #include <sched.h>
23 #include <linux/futex.h>
25 #define AR_ACCESSED (1<<8)
27 #define AR_TYPE_RODATA (0 * (1<<9))
28 #define AR_TYPE_RWDATA (1 * (1<<9))
29 #define AR_TYPE_RODATA_EXPDOWN (2 * (1<<9))
30 #define AR_TYPE_RWDATA_EXPDOWN (3 * (1<<9))
31 #define AR_TYPE_XOCODE (4 * (1<<9))
32 #define AR_TYPE_XRCODE (5 * (1<<9))
33 #define AR_TYPE_XOCODE_CONF (6 * (1<<9))
34 #define AR_TYPE_XRCODE_CONF (7 * (1<<9))
36 #define AR_DPL3 (3 * (1<<13))
38 #define AR_S (1 << 12)
39 #define AR_P (1 << 15)
40 #define AR_AVL (1 << 20)
41 #define AR_L (1 << 21)
42 #define AR_DB (1 << 22)
43 #define AR_G (1 << 23)
45 static int nerrs;
47 static void check_invalid_segment(uint16_t index, int ldt)
49 uint32_t has_limit = 0, has_ar = 0, limit, ar;
50 uint32_t selector = (index << 3) | (ldt << 2) | 3;
52 asm ("lsl %[selector], %[limit]\n\t"
53 "jnz 1f\n\t"
54 "movl $1, %[has_limit]\n\t"
55 "1:"
56 : [limit] "=r" (limit), [has_limit] "+rm" (has_limit)
57 : [selector] "r" (selector));
58 asm ("larl %[selector], %[ar]\n\t"
59 "jnz 1f\n\t"
60 "movl $1, %[has_ar]\n\t"
61 "1:"
62 : [ar] "=r" (ar), [has_ar] "+rm" (has_ar)
63 : [selector] "r" (selector));
65 if (has_limit || has_ar) {
66 printf("[FAIL]\t%s entry %hu is valid but should be invalid\n",
67 (ldt ? "LDT" : "GDT"), index);
68 nerrs++;
69 } else {
70 printf("[OK]\t%s entry %hu is invalid\n",
71 (ldt ? "LDT" : "GDT"), index);
75 static void check_valid_segment(uint16_t index, int ldt,
76 uint32_t expected_ar, uint32_t expected_limit,
77 bool verbose)
79 uint32_t has_limit = 0, has_ar = 0, limit, ar;
80 uint32_t selector = (index << 3) | (ldt << 2) | 3;
82 asm ("lsl %[selector], %[limit]\n\t"
83 "jnz 1f\n\t"
84 "movl $1, %[has_limit]\n\t"
85 "1:"
86 : [limit] "=r" (limit), [has_limit] "+rm" (has_limit)
87 : [selector] "r" (selector));
88 asm ("larl %[selector], %[ar]\n\t"
89 "jnz 1f\n\t"
90 "movl $1, %[has_ar]\n\t"
91 "1:"
92 : [ar] "=r" (ar), [has_ar] "+rm" (has_ar)
93 : [selector] "r" (selector));
95 if (!has_limit || !has_ar) {
96 printf("[FAIL]\t%s entry %hu is invalid but should be valid\n",
97 (ldt ? "LDT" : "GDT"), index);
98 nerrs++;
99 return;
102 if (ar != expected_ar) {
103 printf("[FAIL]\t%s entry %hu has AR 0x%08X but expected 0x%08X\n",
104 (ldt ? "LDT" : "GDT"), index, ar, expected_ar);
105 nerrs++;
106 } else if (limit != expected_limit) {
107 printf("[FAIL]\t%s entry %hu has limit 0x%08X but expected 0x%08X\n",
108 (ldt ? "LDT" : "GDT"), index, limit, expected_limit);
109 nerrs++;
110 } else if (verbose) {
111 printf("[OK]\t%s entry %hu has AR 0x%08X and limit 0x%08X\n",
112 (ldt ? "LDT" : "GDT"), index, ar, limit);
116 static bool install_valid_mode(const struct user_desc *desc, uint32_t ar,
117 bool oldmode)
119 int ret = syscall(SYS_modify_ldt, oldmode ? 1 : 0x11,
120 desc, sizeof(*desc));
121 if (ret < -1)
122 errno = -ret;
123 if (ret == 0) {
124 uint32_t limit = desc->limit;
125 if (desc->limit_in_pages)
126 limit = (limit << 12) + 4095;
127 check_valid_segment(desc->entry_number, 1, ar, limit, true);
128 return true;
129 } else if (errno == ENOSYS) {
130 printf("[OK]\tmodify_ldt returned -ENOSYS\n");
131 return false;
132 } else {
133 if (desc->seg_32bit) {
134 printf("[FAIL]\tUnexpected modify_ldt failure %d\n",
135 errno);
136 nerrs++;
137 return false;
138 } else {
139 printf("[OK]\tmodify_ldt rejected 16 bit segment\n");
140 return false;
145 static bool install_valid(const struct user_desc *desc, uint32_t ar)
147 return install_valid_mode(desc, ar, false);
150 static void install_invalid(const struct user_desc *desc, bool oldmode)
152 int ret = syscall(SYS_modify_ldt, oldmode ? 1 : 0x11,
153 desc, sizeof(*desc));
154 if (ret < -1)
155 errno = -ret;
156 if (ret == 0) {
157 check_invalid_segment(desc->entry_number, 1);
158 } else if (errno == ENOSYS) {
159 printf("[OK]\tmodify_ldt returned -ENOSYS\n");
160 } else {
161 if (desc->seg_32bit) {
162 printf("[FAIL]\tUnexpected modify_ldt failure %d\n",
163 errno);
164 nerrs++;
165 } else {
166 printf("[OK]\tmodify_ldt rejected 16 bit segment\n");
171 static int safe_modify_ldt(int func, struct user_desc *ptr,
172 unsigned long bytecount)
174 int ret = syscall(SYS_modify_ldt, 0x11, ptr, bytecount);
175 if (ret < -1)
176 errno = -ret;
177 return ret;
180 static void fail_install(struct user_desc *desc)
182 if (safe_modify_ldt(0x11, desc, sizeof(*desc)) == 0) {
183 printf("[FAIL]\tmodify_ldt accepted a bad descriptor\n");
184 nerrs++;
185 } else if (errno == ENOSYS) {
186 printf("[OK]\tmodify_ldt returned -ENOSYS\n");
187 } else {
188 printf("[OK]\tmodify_ldt failure %d\n", errno);
192 static void do_simple_tests(void)
194 struct user_desc desc = {
195 .entry_number = 0,
196 .base_addr = 0,
197 .limit = 10,
198 .seg_32bit = 1,
199 .contents = 2, /* Code, not conforming */
200 .read_exec_only = 0,
201 .limit_in_pages = 0,
202 .seg_not_present = 0,
203 .useable = 0
205 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | AR_S | AR_P | AR_DB);
207 desc.limit_in_pages = 1;
208 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
209 AR_S | AR_P | AR_DB | AR_G);
211 check_invalid_segment(1, 1);
213 desc.entry_number = 2;
214 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
215 AR_S | AR_P | AR_DB | AR_G);
217 check_invalid_segment(1, 1);
219 desc.base_addr = 0xf0000000;
220 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
221 AR_S | AR_P | AR_DB | AR_G);
223 desc.useable = 1;
224 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
225 AR_S | AR_P | AR_DB | AR_G | AR_AVL);
227 desc.seg_not_present = 1;
228 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
229 AR_S | AR_DB | AR_G | AR_AVL);
231 desc.seg_32bit = 0;
232 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
233 AR_S | AR_G | AR_AVL);
235 desc.seg_32bit = 1;
236 desc.contents = 0;
237 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA |
238 AR_S | AR_DB | AR_G | AR_AVL);
240 desc.read_exec_only = 1;
241 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA |
242 AR_S | AR_DB | AR_G | AR_AVL);
244 desc.contents = 1;
245 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA_EXPDOWN |
246 AR_S | AR_DB | AR_G | AR_AVL);
248 desc.read_exec_only = 0;
249 desc.limit_in_pages = 0;
250 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA_EXPDOWN |
251 AR_S | AR_DB | AR_AVL);
253 desc.contents = 3;
254 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE_CONF |
255 AR_S | AR_DB | AR_AVL);
257 desc.read_exec_only = 1;
258 install_valid(&desc, AR_DPL3 | AR_TYPE_XOCODE_CONF |
259 AR_S | AR_DB | AR_AVL);
261 desc.read_exec_only = 0;
262 desc.contents = 2;
263 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE |
264 AR_S | AR_DB | AR_AVL);
266 desc.read_exec_only = 1;
268 #ifdef __x86_64__
269 desc.lm = 1;
270 install_valid(&desc, AR_DPL3 | AR_TYPE_XOCODE |
271 AR_S | AR_DB | AR_AVL);
272 desc.lm = 0;
273 #endif
275 bool entry1_okay = install_valid(&desc, AR_DPL3 | AR_TYPE_XOCODE |
276 AR_S | AR_DB | AR_AVL);
278 if (entry1_okay) {
279 printf("[RUN]\tTest fork\n");
280 pid_t child = fork();
281 if (child == 0) {
282 nerrs = 0;
283 check_valid_segment(desc.entry_number, 1,
284 AR_DPL3 | AR_TYPE_XOCODE |
285 AR_S | AR_DB | AR_AVL, desc.limit,
286 true);
287 check_invalid_segment(1, 1);
288 exit(nerrs ? 1 : 0);
289 } else {
290 int status;
291 if (waitpid(child, &status, 0) != child ||
292 !WIFEXITED(status)) {
293 printf("[FAIL]\tChild died\n");
294 nerrs++;
295 } else if (WEXITSTATUS(status) != 0) {
296 printf("[FAIL]\tChild failed\n");
297 nerrs++;
298 } else {
299 printf("[OK]\tChild succeeded\n");
303 printf("[RUN]\tTest size\n");
304 int i;
305 for (i = 0; i < 8192; i++) {
306 desc.entry_number = i;
307 desc.limit = i;
308 if (safe_modify_ldt(0x11, &desc, sizeof(desc)) != 0) {
309 printf("[FAIL]\tFailed to install entry %d\n", i);
310 nerrs++;
311 break;
314 for (int j = 0; j < i; j++) {
315 check_valid_segment(j, 1, AR_DPL3 | AR_TYPE_XOCODE |
316 AR_S | AR_DB | AR_AVL, j, false);
318 printf("[DONE]\tSize test\n");
319 } else {
320 printf("[SKIP]\tSkipping fork and size tests because we have no LDT\n");
323 /* Test entry_number too high. */
324 desc.entry_number = 8192;
325 fail_install(&desc);
327 /* Test deletion and actions mistakeable for deletion. */
328 memset(&desc, 0, sizeof(desc));
329 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P);
331 desc.seg_not_present = 1;
332 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S);
334 desc.seg_not_present = 0;
335 desc.read_exec_only = 1;
336 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S | AR_P);
338 desc.read_exec_only = 0;
339 desc.seg_not_present = 1;
340 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S);
342 desc.read_exec_only = 1;
343 desc.limit = 1;
344 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S);
346 desc.limit = 0;
347 desc.base_addr = 1;
348 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S);
350 desc.base_addr = 0;
351 install_invalid(&desc, false);
353 desc.seg_not_present = 0;
354 desc.seg_32bit = 1;
355 desc.read_exec_only = 0;
356 desc.limit = 0xfffff;
358 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P | AR_DB);
360 desc.limit_in_pages = 1;
362 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P | AR_DB | AR_G);
363 desc.read_exec_only = 1;
364 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S | AR_P | AR_DB | AR_G);
365 desc.contents = 1;
366 desc.read_exec_only = 0;
367 install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA_EXPDOWN | AR_S | AR_P | AR_DB | AR_G);
368 desc.read_exec_only = 1;
369 install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA_EXPDOWN | AR_S | AR_P | AR_DB | AR_G);
371 desc.limit = 0;
372 install_invalid(&desc, true);
376 * 0: thread is idle
377 * 1: thread armed
378 * 2: thread should clear LDT entry 0
379 * 3: thread should exit
381 static volatile unsigned int ftx;
383 static void *threadproc(void *ctx)
385 cpu_set_t cpuset;
386 CPU_ZERO(&cpuset);
387 CPU_SET(1, &cpuset);
388 if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0)
389 err(1, "sched_setaffinity to CPU 1"); /* should never fail */
391 while (1) {
392 syscall(SYS_futex, &ftx, FUTEX_WAIT, 0, NULL, NULL, 0);
393 while (ftx != 2) {
394 if (ftx >= 3)
395 return NULL;
398 /* clear LDT entry 0 */
399 const struct user_desc desc = {};
400 if (syscall(SYS_modify_ldt, 1, &desc, sizeof(desc)) != 0)
401 err(1, "modify_ldt");
403 /* If ftx == 2, set it to zero. If ftx == 100, quit. */
404 unsigned int x = -2;
405 asm volatile ("lock xaddl %[x], %[ftx]" :
406 [x] "+r" (x), [ftx] "+m" (ftx));
407 if (x != 2)
408 return NULL;
412 #ifdef __i386__
414 #ifndef SA_RESTORE
415 #define SA_RESTORER 0x04000000
416 #endif
419 * The UAPI header calls this 'struct sigaction', which conflicts with
420 * glibc. Sigh.
422 struct fake_ksigaction {
423 void *handler; /* the real type is nasty */
424 unsigned long sa_flags;
425 void (*sa_restorer)(void);
426 unsigned char sigset[8];
429 static void fix_sa_restorer(int sig)
431 struct fake_ksigaction ksa;
433 if (syscall(SYS_rt_sigaction, sig, NULL, &ksa, 8) == 0) {
435 * glibc has a nasty bug: it sometimes writes garbage to
436 * sa_restorer. This interacts quite badly with anything
437 * that fiddles with SS because it can trigger legacy
438 * stack switching. Patch it up. See:
440 * https://sourceware.org/bugzilla/show_bug.cgi?id=21269
442 if (!(ksa.sa_flags & SA_RESTORER) && ksa.sa_restorer) {
443 ksa.sa_restorer = NULL;
444 if (syscall(SYS_rt_sigaction, sig, &ksa, NULL,
445 sizeof(ksa.sigset)) != 0)
446 err(1, "rt_sigaction");
450 #else
451 static void fix_sa_restorer(int sig)
453 /* 64-bit glibc works fine. */
455 #endif
457 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
458 int flags)
460 struct sigaction sa;
461 memset(&sa, 0, sizeof(sa));
462 sa.sa_sigaction = handler;
463 sa.sa_flags = SA_SIGINFO | flags;
464 sigemptyset(&sa.sa_mask);
465 if (sigaction(sig, &sa, 0))
466 err(1, "sigaction");
468 fix_sa_restorer(sig);
471 static jmp_buf jmpbuf;
473 static void sigsegv(int sig, siginfo_t *info, void *ctx_void)
475 siglongjmp(jmpbuf, 1);
478 static void do_multicpu_tests(void)
480 cpu_set_t cpuset;
481 pthread_t thread;
482 int failures = 0, iters = 5, i;
483 unsigned short orig_ss;
485 CPU_ZERO(&cpuset);
486 CPU_SET(1, &cpuset);
487 if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) {
488 printf("[SKIP]\tCannot set affinity to CPU 1\n");
489 return;
492 CPU_ZERO(&cpuset);
493 CPU_SET(0, &cpuset);
494 if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) {
495 printf("[SKIP]\tCannot set affinity to CPU 0\n");
496 return;
499 sethandler(SIGSEGV, sigsegv, 0);
500 #ifdef __i386__
501 /* True 32-bit kernels send SIGILL instead of SIGSEGV on IRET faults. */
502 sethandler(SIGILL, sigsegv, 0);
503 #endif
505 printf("[RUN]\tCross-CPU LDT invalidation\n");
507 if (pthread_create(&thread, 0, threadproc, 0) != 0)
508 err(1, "pthread_create");
510 asm volatile ("mov %%ss, %0" : "=rm" (orig_ss));
512 for (i = 0; i < 5; i++) {
513 if (sigsetjmp(jmpbuf, 1) != 0)
514 continue;
516 /* Make sure the thread is ready after the last test. */
517 while (ftx != 0)
520 struct user_desc desc = {
521 .entry_number = 0,
522 .base_addr = 0,
523 .limit = 0xfffff,
524 .seg_32bit = 1,
525 .contents = 0, /* Data */
526 .read_exec_only = 0,
527 .limit_in_pages = 1,
528 .seg_not_present = 0,
529 .useable = 0
532 if (safe_modify_ldt(0x11, &desc, sizeof(desc)) != 0) {
533 if (errno != ENOSYS)
534 err(1, "modify_ldt");
535 printf("[SKIP]\tmodify_ldt unavailable\n");
536 break;
539 /* Arm the thread. */
540 ftx = 1;
541 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
543 asm volatile ("mov %0, %%ss" : : "r" (0x7));
545 /* Go! */
546 ftx = 2;
548 while (ftx != 0)
552 * On success, modify_ldt will segfault us synchronously,
553 * and we'll escape via siglongjmp.
556 failures++;
557 asm volatile ("mov %0, %%ss" : : "rm" (orig_ss));
560 ftx = 100; /* Kill the thread. */
561 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
563 if (pthread_join(thread, NULL) != 0)
564 err(1, "pthread_join");
566 if (failures) {
567 printf("[FAIL]\t%d of %d iterations failed\n", failures, iters);
568 nerrs++;
569 } else {
570 printf("[OK]\tAll %d iterations succeeded\n", iters);
574 static int finish_exec_test(void)
577 * In a sensible world, this would be check_invalid_segment(0, 1);
578 * For better or for worse, though, the LDT is inherited across exec.
579 * We can probably change this safely, but for now we test it.
581 check_valid_segment(0, 1,
582 AR_DPL3 | AR_TYPE_XRCODE | AR_S | AR_P | AR_DB,
583 42, true);
585 return nerrs ? 1 : 0;
588 static void do_exec_test(void)
590 printf("[RUN]\tTest exec\n");
592 struct user_desc desc = {
593 .entry_number = 0,
594 .base_addr = 0,
595 .limit = 42,
596 .seg_32bit = 1,
597 .contents = 2, /* Code, not conforming */
598 .read_exec_only = 0,
599 .limit_in_pages = 0,
600 .seg_not_present = 0,
601 .useable = 0
603 install_valid(&desc, AR_DPL3 | AR_TYPE_XRCODE | AR_S | AR_P | AR_DB);
605 pid_t child = fork();
606 if (child == 0) {
607 execl("/proc/self/exe", "ldt_gdt_test_exec", NULL);
608 printf("[FAIL]\tCould not exec self\n");
609 exit(1); /* exec failed */
610 } else {
611 int status;
612 if (waitpid(child, &status, 0) != child ||
613 !WIFEXITED(status)) {
614 printf("[FAIL]\tChild died\n");
615 nerrs++;
616 } else if (WEXITSTATUS(status) != 0) {
617 printf("[FAIL]\tChild failed\n");
618 nerrs++;
619 } else {
620 printf("[OK]\tChild succeeded\n");
625 int main(int argc, char **argv)
627 if (argc == 1 && !strcmp(argv[0], "ldt_gdt_test_exec"))
628 return finish_exec_test();
630 do_simple_tests();
632 do_multicpu_tests();
634 do_exec_test();
636 return nerrs ? 1 : 0;