1 /* $NetBSD: t_sigstack.c,v 1.10 2024/05/06 06:58:00 skrll Exp $ */ 2 3 /*- 4 * Copyright (c) 2024 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 17 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 18 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 19 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 20 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 * POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 #include <sys/cdefs.h> 30 __RCSID("$NetBSD: t_sigstack.c,v 1.10 2024/05/06 06:58:00 skrll Exp $"); 31 32 #include <setjmp.h> 33 #include <signal.h> 34 #include <stddef.h> 35 #include <stdlib.h> 36 #include <ucontext.h> 37 38 #include "h_macros.h" 39 40 struct sigaltstack ss[3]; 41 jmp_buf jmp; 42 sigjmp_buf sigjmp; 43 unsigned nentries; 44 const char *bailname; 45 void (*bailfn)(void) __dead; 46 47 static void 48 on_sigusr1(int signo, siginfo_t *si, void *ctx) 49 { 50 ucontext_t *uc = ctx; 51 void *sp = (void *)(uintptr_t)_UC_MACHINE_SP(uc); 52 void *fp = __builtin_frame_address(0); 53 struct sigaltstack *ssp; 54 55 /* 56 * Ensure we haven't re-entered the signal handler too many 57 * times. We should enter only twice. 58 */ 59 ATF_REQUIRE_MSG(nentries < 2, 60 "%u recursive signal handler entries is too many in this test", 61 nentries + 1); 62 63 /* 64 * Ensure that the signal handler was called in the alternate 65 * signal stack. 66 */ 67 ssp = &ss[nentries]; 68 ATF_REQUIRE_MSG((fp >= ssp->ss_sp && 69 fp < (void *)((char *)ssp->ss_sp + ssp->ss_size)), 70 "sigaltstack failed to take effect on entry %u --" 71 " signal handler's frame pointer %p doesn't lie in sigaltstack" 72 " [%p, %p), size 0x%zx", 73 nentries, 74 fp, ssp->ss_sp, (char *)ssp->ss_sp + ssp->ss_size, ssp->ss_size); 75 76 /* 77 * Ensure that if we enter the signal handler, we are entering 78 * it from the original stack, not from any of the alternate 79 * signal stacks. 80 * 81 * On some architectures, this is broken. Those that appear to 82 * get this right are: 83 * 84 * aarch64 85 * alpha 86 * i386 87 * m68k 88 * or1k 89 * powerpc 90 * powerpc64 91 * riscv 92 * vax 93 * x86_64 94 */ 95 #if defined __hppa__ || \ 96 defined __ia64__ || defined __mips__ || defined __sh3__ || \ 97 defined __sparc__ || defined __sparc64__ 98 if (nentries > 0) 99 atf_tc_expect_fail("PR lib/57946"); 100 #endif 101 for (ssp = &ss[0]; ssp < &ss[__arraycount(ss)]; ssp++) { 102 ATF_REQUIRE_MSG((sp < ssp->ss_sp || 103 sp >= (void *)((char *)ssp->ss_sp + ssp->ss_size)), 104 "%s failed to restore stack" 105 " before allowing signal on entry %u --" 106 " interrupted stack pointer %p lies in sigaltstack %zd" 107 " [%p, %p), size 0x%zx", 108 bailname, 109 nentries, 110 sp, ssp - ss, 111 ssp->ss_sp, (char *)ssp->ss_sp + ssp->ss_size, 112 ssp->ss_size); 113 } 114 115 /* 116 * First time through, we want to test whether longjmp restores 117 * the signal mask first, or restores the stack pointer first. 118 * The signal should be blocked at this point, so we re-raise 119 * the signal to queue it up for delivery as soon as it is 120 * unmasked -- which should wait until the stack pointer has 121 * been restored in longjmp. 122 */ 123 if (nentries++ == 0) 124 RL(raise(SIGUSR1)); 125 126 /* 127 * Set up the next sigaltstack. We can't reuse the current one 128 * for the next signal handler re-entry until the system clears 129 * the SS_ONSTACK process state -- which normal return from 130 * signal handler does, but which longjmp does not. So to keep 131 * it simple (ha), we just use another sigaltstack. 132 */ 133 RL(sigaltstack(&ss[nentries], NULL)); 134 135 /* 136 * Jump back to the original context. 137 */ 138 (*bailfn)(); 139 } 140 141 static void 142 go(const char *name, void (*fn)(void) __dead) 143 { 144 struct sigaction sa; 145 unsigned i; 146 147 bailname = name; 148 bailfn = fn; 149 150 /* 151 * Allocate a stack for the signal handler to run in, and 152 * configure the system to use the first one. 153 * 154 * XXX Should maybe use a guard page but this is simpler. 155 */ 156 for (i = 0; i < __arraycount(ss); i++) { 157 ss[i].ss_size = SIGSTKSZ; 158 REQUIRE_LIBC(ss[i].ss_sp = malloc(ss[i].ss_size), NULL); 159 } 160 RL(sigaltstack(&ss[0], NULL)); 161 162 /* 163 * Set up a test signal handler for SIGUSR1. Allow all 164 * signals, except SIGUSR1 (which is masked by default) -- that 165 * way we don't inadvertently obscure weird crashes in the 166 * signal handler. 167 * 168 * Set SA_SIGINFO so the system will pass siginfo -- and, more 169 * to the point, ucontext, so the signal handler can determine 170 * the stack pointer of the logic it interrupted. 171 * 172 * Set SA_ONSTACK so the system will use the alternate signal 173 * stack to call the signal handler -- that way, it can tell 174 * whether the stack was restored before the second time 175 * around. 176 */ 177 memset(&sa, 0, sizeof(sa)); 178 sa.sa_sigaction = &on_sigusr1; 179 RL(sigemptyset(&sa.sa_mask)); 180 sa.sa_flags = SA_SIGINFO|SA_ONSTACK; 181 RL(sigaction(SIGUSR1, &sa, NULL)); 182 183 /* 184 * Raise the signal to enter the signal handler the first time. 185 */ 186 RL(raise(SIGUSR1)); 187 188 /* 189 * If we ever reach this point, something went seriously wrong. 190 */ 191 atf_tc_fail("unreachable"); 192 } 193 194 static void __dead 195 bail_longjmp(void) 196 { 197 198 longjmp(jmp, 1); 199 } 200 201 ATF_TC(setjmp); 202 ATF_TC_HEAD(setjmp, tc) 203 { 204 atf_tc_set_md_var(tc, "descr", 205 "Test longjmp restores stack first, then signal mask"); 206 } 207 ATF_TC_BODY(setjmp, tc) 208 { 209 210 /* 211 * Set up a return point for the signal handler: when the 212 * signal handler does longjmp(jmp, 1), it comes flying out of 213 * here. 214 */ 215 if (setjmp(jmp) == 1) 216 return; 217 218 /* 219 * Run the test with longjmp. 220 */ 221 go("longjmp", &bail_longjmp); 222 } 223 224 static void __dead 225 bail_siglongjmp(void) 226 { 227 228 siglongjmp(sigjmp, 1); 229 } 230 231 ATF_TC(sigsetjmp); 232 ATF_TC_HEAD(sigsetjmp, tc) 233 { 234 atf_tc_set_md_var(tc, "descr", 235 "Test siglongjmp restores stack first, then signal mask"); 236 } 237 ATF_TC_BODY(sigsetjmp, tc) 238 { 239 240 /* 241 * Set up a return point for the signal handler: when the 242 * signal handler does siglongjmp(sigjmp, 1), it comes flying 243 * out of here. 244 */ 245 if (sigsetjmp(sigjmp, /*savesigmask*/1) == 1) 246 return; 247 248 /* 249 * Run the test with siglongjmp. 250 */ 251 go("siglongjmp", &bail_siglongjmp); 252 } 253 254 ATF_TP_ADD_TCS(tp) 255 { 256 257 ATF_TP_ADD_TC(tp, setjmp); 258 ATF_TP_ADD_TC(tp, sigsetjmp); 259 260 return atf_no_error(); 261 } 262