OLD | NEW |
(Empty) | |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. |
| 4 |
| 5 // A crazy linker test to: |
| 6 // - Load a library (libfoo.so) with the linker. |
| 7 // - Find the address of the "Foo" function in it. |
| 8 // - Call the function. |
| 9 // - Close the library. |
| 10 |
| 11 #include <errno.h> |
| 12 #include <pthread.h> |
| 13 #include <stdarg.h> |
| 14 #include <stdio.h> |
| 15 #include <stdlib.h> |
| 16 #include <sys/socket.h> |
| 17 #include <sys/uio.h> |
| 18 #include <sys/wait.h> |
| 19 #include <unistd.h> |
| 20 |
| 21 #include <crazy_linker.h> |
| 22 |
| 23 typedef void (*FunctionPtr)(); |
| 24 |
| 25 static void Panic(const char* fmt, ...) { |
| 26 va_list args; |
| 27 fprintf(stderr, "PANIC: "); |
| 28 va_start(args, fmt); |
| 29 vfprintf(stderr, fmt, args); |
| 30 va_end(args); |
| 31 exit(1); |
| 32 } |
| 33 |
| 34 static pthread_mutex_t s_lock; |
| 35 static pthread_cond_t s_cond; |
| 36 |
| 37 static void CheckMaps(int expected_count) { |
| 38 printf("Checking for %d RELROs in /proc/self/maps\n", expected_count); |
| 39 |
| 40 FILE* file = fopen("/proc/self/maps", "rb"); |
| 41 if (!file) |
| 42 Panic("Could not open /proc/self/maps (pid %d): %s\n", |
| 43 getpid(), strerror(errno)); |
| 44 |
| 45 char line[512]; |
| 46 int count_relros = 0; |
| 47 printf("proc/%d/maps:\n", getpid()); |
| 48 while (fgets(line, sizeof line, file)) { |
| 49 if (strstr(line, "with_relro")) { |
| 50 printf("%s", line); |
| 51 if (strstr(line, "/dev/ashmem/RELRO:")) |
| 52 count_relros++; |
| 53 } |
| 54 } |
| 55 fclose(file); |
| 56 |
| 57 if (count_relros != expected_count) |
| 58 Panic("Invalid shared RELRO sections in /proc/self/maps: %d" |
| 59 " (expected %d)\n", count_relros, expected_count); |
| 60 |
| 61 printf("RELRO count check ok!\n"); |
| 62 } |
| 63 |
| 64 // Send a file descriptor |fd| through |socket|. |
| 65 // Return 0 on success, -1/errno on failure. |
| 66 static int SendFd(int socket, int fd) { |
| 67 struct iovec iov; |
| 68 |
| 69 char buffer[1]; |
| 70 buffer[0] = 0; |
| 71 |
| 72 iov.iov_base = buffer; |
| 73 iov.iov_len = 1; |
| 74 |
| 75 struct msghdr msg; |
| 76 struct cmsghdr *cmsg; |
| 77 char cms[CMSG_SPACE(sizeof(int))]; |
| 78 |
| 79 ::memset(&msg, 0, sizeof(msg)); |
| 80 msg.msg_iov = &iov; |
| 81 msg.msg_iovlen = 1; |
| 82 msg.msg_control = reinterpret_cast<caddr_t>(cms); |
| 83 msg.msg_controllen = CMSG_LEN(sizeof(int)); |
| 84 |
| 85 cmsg = CMSG_FIRSTHDR(&msg); |
| 86 cmsg->cmsg_len = CMSG_LEN(sizeof(int)); |
| 87 cmsg->cmsg_level = SOL_SOCKET; |
| 88 cmsg->cmsg_type = SCM_RIGHTS; |
| 89 ::memcpy(CMSG_DATA(cmsg), &fd, sizeof(int)); |
| 90 |
| 91 int ret = sendmsg(socket, &msg, 0); |
| 92 if (ret < 0) |
| 93 return -1; |
| 94 |
| 95 if (ret != iov.iov_len) { |
| 96 errno = EIO; |
| 97 return -1; |
| 98 } |
| 99 |
| 100 return 0; |
| 101 } |
| 102 |
| 103 static int ReceiveFd(int socket, int* fd) { |
| 104 char buffer[1]; |
| 105 struct iovec iov; |
| 106 |
| 107 iov.iov_base = buffer; |
| 108 iov.iov_len = 1; |
| 109 |
| 110 struct msghdr msg; |
| 111 struct cmsghdr *cmsg; |
| 112 char cms[CMSG_SPACE(sizeof(int))]; |
| 113 |
| 114 ::memset(&msg, 0, sizeof msg); |
| 115 msg.msg_name = 0; |
| 116 msg.msg_namelen = 0; |
| 117 msg.msg_iov = &iov; |
| 118 msg.msg_iovlen = 1; |
| 119 |
| 120 msg.msg_control = reinterpret_cast<caddr_t>(cms); |
| 121 msg.msg_controllen = sizeof(cms); |
| 122 |
| 123 int ret = recvmsg(socket, &msg, 0); |
| 124 if (ret < 0) |
| 125 return -1; |
| 126 if (ret == 0) { |
| 127 errno = EIO; |
| 128 return -1; |
| 129 } |
| 130 |
| 131 cmsg = CMSG_FIRSTHDR(&msg); |
| 132 ::memcpy(fd, CMSG_DATA(cmsg), sizeof(int)); |
| 133 return 0; |
| 134 } |
| 135 |
| 136 |
| 137 int main() { |
| 138 |
| 139 // Initialize process-shared mutex. |
| 140 { |
| 141 pthread_mutexattr_t attr; |
| 142 pthread_mutexattr_init(&attr); |
| 143 pthread_mutexattr_setpshared(&attr, PTHREAD_PROCESS_SHARED); |
| 144 pthread_mutex_init(&s_lock, &attr); |
| 145 pthread_mutexattr_destroy(&attr); |
| 146 } |
| 147 // Initialize process-shared condition variable. |
| 148 { |
| 149 pthread_condattr_t attr; |
| 150 pthread_condattr_init(&attr); |
| 151 pthread_condattr_setpshared(&attr, PTHREAD_PROCESS_SHARED); |
| 152 pthread_cond_init(&s_cond, &attr); |
| 153 pthread_condattr_destroy(&attr); |
| 154 } |
| 155 |
| 156 crazy_context_t* context = crazy_context_create(); |
| 157 crazy_library_t* library; |
| 158 |
| 159 // Load at fixed address to simplify testing. |
| 160 crazy_context_set_load_address(context, 0x20000000); |
| 161 |
| 162 // Load libfoo_with_relro.so |
| 163 if (!crazy_library_open(&library, |
| 164 "libfoo_with_relro.so", |
| 165 context)) { |
| 166 Panic("Could not open library: %s\n", crazy_context_get_error(context)); |
| 167 } |
| 168 |
| 169 printf("Library loaded\n"); |
| 170 |
| 171 int pipes[2]; |
| 172 if (socketpair(AF_UNIX, SOCK_STREAM, 0, pipes) < 0) |
| 173 Panic("Could not create socket pair: %s", strerror(errno)); |
| 174 |
| 175 pid_t child = fork(); |
| 176 if (child < 0) |
| 177 Panic("Could not fork test program!"); |
| 178 |
| 179 if (child == 0) { |
| 180 // In the child. |
| 181 crazy_library_info_t info; |
| 182 |
| 183 printf("Child waiting for relro fd\n"); |
| 184 // Receive relro information from parent. |
| 185 int relro_fd = -1; |
| 186 if (ReceiveFd(pipes[0], &relro_fd) < 0) |
| 187 Panic("Could not receive relro descriptor from parent"); |
| 188 |
| 189 printf("Child received relro fd %d\n", relro_fd); |
| 190 |
| 191 int ret = TEMP_FAILURE_RETRY(::read(pipes[0], &info, sizeof(info))); |
| 192 if (ret != static_cast<int>(sizeof(info))) |
| 193 Panic("Could not receive relro information from parent"); |
| 194 |
| 195 info.relro_fd = relro_fd; |
| 196 printf("Child received relro load=%p start=%p size=%p\n", |
| 197 (void*)info.load_address, (void*)info.relro_start, (void*)info.relro_
size); |
| 198 |
| 199 if (!crazy_library_use_relro_sharing(library, |
| 200 info.relro_start, |
| 201 info.relro_size, |
| 202 info.relro_fd, |
| 203 context)) { |
| 204 pthread_cond_signal(&s_cond); |
| 205 Panic("Could not use RELRO sharing: %s", |
| 206 crazy_context_get_error(context)); |
| 207 } |
| 208 |
| 209 printf("RELRO used in child process\n"); |
| 210 |
| 211 CheckMaps(1); |
| 212 |
| 213 FunctionPtr foo_func; |
| 214 if (!crazy_library_find_symbol( |
| 215 library, "Foo", reinterpret_cast<void**>(&foo_func))) |
| 216 Panic("Could not find 'Foo' in library"); |
| 217 |
| 218 printf("Calling Foo()\n"); |
| 219 (*foo_func)(); |
| 220 |
| 221 printf("Foo called, exiting\n"); |
| 222 |
| 223 exit(0); |
| 224 |
| 225 } else { |
| 226 // In the parent. |
| 227 crazy_library_info_t info; |
| 228 |
| 229 |
| 230 printf("Parent enabling RELRO sharing\n"); |
| 231 |
| 232 // Enable RELRO sharing. |
| 233 if (!crazy_library_enable_relro_sharing(library, context)) |
| 234 Panic("Could not enable RELRO sharing: %s", |
| 235 crazy_context_get_error(context)); |
| 236 |
| 237 if (!crazy_library_get_info(library, context, &info)) |
| 238 Panic("Could not get library info: %s", crazy_context_get_error(context)); |
| 239 |
| 240 printf("Parent relro info load_addr=%p load_size=%p relro_start=%p relro_siz
e=%p relro_fd=%d\n", |
| 241 (void*)info.load_address, (void*)info.load_size, |
| 242 (void*)info.relro_start, (void*)info.relro_size, |
| 243 info.relro_fd); |
| 244 |
| 245 CheckMaps(1); |
| 246 |
| 247 if (SendFd(pipes[1], info.relro_fd) < 0) |
| 248 Panic("Parent could not send RELRO fd: %s", strerror(errno)); |
| 249 |
| 250 int ret = TEMP_FAILURE_RETRY(::write(pipes[1], &info, sizeof(info))); |
| 251 if (ret != static_cast<int>(sizeof(info))) |
| 252 Panic("Parent could not send RELRO info: %s", strerror(errno)); |
| 253 |
| 254 printf("Parent waiting for child\n"); |
| 255 |
| 256 // Wait for child to complete. |
| 257 int status; |
| 258 waitpid(child, &status, 0); |
| 259 |
| 260 if (WIFSIGNALED(status)) |
| 261 Panic("Child terminated by signal!!\n"); |
| 262 else if (WIFEXITED(status)) { |
| 263 int child_status = WEXITSTATUS(status); |
| 264 if (child_status != 0) |
| 265 Panic("Child terminated with status=%d\n", child_status); |
| 266 } else |
| 267 Panic("Child exited for unknown reason!!\n"); |
| 268 } |
| 269 |
| 270 printf("Closing library\n"); |
| 271 crazy_library_close(library); |
| 272 |
| 273 crazy_context_destroy(context); |
| 274 return 0; |
| 275 } |
OLD | NEW |