/* * single_step_syscall.c - single-steps various x86 syscalls * Copyright (c) 2014-2015 Andrew Lutomirski * * This program is free software; you can redistribute it and/or modify * it under the terms and conditions of the GNU General Public License, * version 2, as published by the Free Software Foundation. * * This program is distributed in the hope it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * General Public License for more details. * * This is a very simple series of tests that makes system calls with * the TF flag set. This exercises some nasty kernel code in the * SYSENTER case: SYSENTER does not clear TF, so SYSENTER with TF set * immediately issues #DB from CPL 0. This requires special handling in * the kernel. */ #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), int flags) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = handler; sa.sa_flags = SA_SIGINFO | flags; sigemptyset(&sa.sa_mask); if (sigaction(sig, &sa, 0)) err(1, "sigaction"); } static volatile sig_atomic_t sig_traps; #ifdef __x86_64__ # define REG_IP REG_RIP # define WIDTH "q" #else # define REG_IP REG_EIP # define WIDTH "l" #endif static unsigned long get_eflags(void) { unsigned long eflags; asm volatile ("pushf" WIDTH "\n\tpop" WIDTH " %0" : "=rm" (eflags)); return eflags; } static void set_eflags(unsigned long eflags) { asm volatile ("push" WIDTH " %0\n\tpopf" WIDTH : : "rm" (eflags) : "flags"); } #define X86_EFLAGS_TF (1UL << 8) static void sigtrap(int sig, siginfo_t *info, void *ctx_void) { ucontext_t *ctx = (ucontext_t*)ctx_void; if (get_eflags() & X86_EFLAGS_TF) { set_eflags(get_eflags() & ~X86_EFLAGS_TF); printf("[WARN]\tSIGTRAP handler had TF set\n"); _exit(1); } sig_traps++; if (sig_traps == 10000 || sig_traps == 10001) { printf("[WARN]\tHit %d SIGTRAPs with si_addr 0x%lx, ip 0x%lx\n", (int)sig_traps, (unsigned long)info->si_addr, (unsigned long)ctx->uc_mcontext.gregs[REG_IP]); } } static void check_result(void) { unsigned long new_eflags = get_eflags(); set_eflags(new_eflags & ~X86_EFLAGS_TF); if (!sig_traps) { printf("[FAIL]\tNo SIGTRAP\n"); exit(1); } if (!(new_eflags & X86_EFLAGS_TF)) { printf("[FAIL]\tTF was cleared\n"); exit(1); } printf("[OK]\tSurvived with TF set and %d traps\n", (int)sig_traps); sig_traps = 0; } int main() { int tmp; sethandler(SIGTRAP, sigtrap, 0); printf("[RUN]\tSet TF and check nop\n"); set_eflags(get_eflags() | X86_EFLAGS_TF); asm volatile ("nop"); check_result(); #ifdef __x86_64__ printf("[RUN]\tSet TF and check syscall-less opportunistic sysret\n"); set_eflags(get_eflags() | X86_EFLAGS_TF); extern unsigned char post_nop[]; asm volatile ("pushf" WIDTH "\n\t" "pop" WIDTH " %%r11\n\t" "nop\n\t" "post_nop:" : : "c" (post_nop) : "r11"); check_result(); #endif printf("[RUN]\tSet TF and check int80\n"); set_eflags(get_eflags() | X86_EFLAGS_TF); asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid)); check_result(); /* * This test is particularly interesting if fast syscalls use * SYSENTER: it triggers a nasty design flaw in SYSENTER. * Specifically, SYSENTER does not clear TF, so either SYSENTER * or the next instruction traps at CPL0. (Of course, Intel * mostly forgot to document exactly what happens here.) So we * get a CPL0 fault with usergs (on 64-bit kernels) and possibly * no stack. The only sane way the kernel can possibly handle * it is to clear TF on return from the #DB handler, but this * happens way too early to set TF in the saved pt_regs, so the * kernel has to do something clever to avoid losing track of * the TF bit. * * Needless to say, we've had bugs in this area. */ syscall(SYS_getpid); /* Force symbol binding without TF set. */ printf("[RUN]\tSet TF and check a fast syscall\n"); set_eflags(get_eflags() | X86_EFLAGS_TF); syscall(SYS_getpid); check_result(); /* Now make sure that another fast syscall doesn't set TF again. */ printf("[RUN]\tFast syscall with TF cleared\n"); fflush(stdout); /* Force a syscall */ if (get_eflags() & X86_EFLAGS_TF) { printf("[FAIL]\tTF is now set\n"); exit(1); } if (sig_traps) { printf("[FAIL]\tGot SIGTRAP\n"); exit(1); } printf("[OK]\tNothing unexpected happened\n"); return 0; } 800 commit02608e02fbec04fccf2eb0cc8d8082f65c0a4286 (patch) tree37ff0410d130cfe77185f591b07cd6403f207f0c /include/net/sctp/tsnmap.h parent7ce7d89f48834cefece7804d38fc5d85382edf77 (diff)
crypto: testmgr - Use heap buffer for acomp test input
Christopher Covington reported a crash on aarch64 on recent Fedora kernels: kernel BUG at ./include/linux/scatterlist.h:140! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 752 Comm: cryptomgr_test Not tainted 4.9.0-11815-ge93b1cc #162 Hardware name: linux,dummy-virt (DT) task: ffff80007c650080 task.stack: ffff800008910000 PC is at sg_init_one+0xa0/0xb8 LR is at sg_init_one+0x24/0xb8 ... [<ffff000008398db8>] sg_init_one+0xa0/0xb8 [<ffff000008350a44>] test_acomp+0x10c/0x438 [<ffff000008350e20>] alg_test_comp+0xb0/0x118 [<ffff00000834f28c>] alg_test+0x17c/0x2f0 [<ffff00000834c6a4>] cryptomgr_test+0x44/0x50 [<ffff0000080dac70>] kthread+0xf8/0x128 [<ffff000008082ec0>] ret_from_fork+0x10/0x50 The test vectors used for input are part of the kernel image. These inputs are passed as a buffer to sg_init_one which eventually blows up with BUG_ON(!virt_addr_valid(buf)). On arm64, virt_addr_valid returns false for the kernel image since virt_to_page will not return the correct page. Fix this by copying the input vectors to heap buffer before setting up the scatterlist. Reported-by: Christopher Covington <cov@codeaurora.org> Fixes: d7db7a882deb ("crypto: acomp - update testmgr with support for acomp") Signed-off-by: Laura Abbott <labbott@redhat.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'include/net/sctp/tsnmap.h')