[LTP] [PATCH 1/3] cve-2015-3290: Make stack selector and CPU flags check more verbose

[Martin Doucha]

The original reproducer reported all errors in signal handler and
triggered INT3 to signal itself. Pass stack selector and CPU flags
values to C variables and report any discrepancies using standard
LTP functions.

Signed-off-by: Martin Doucha <mdoucha@suse.cz>
---
 testcases/cve/cve-2015-3290.c | 39 ++++++++++++++++++++++-------------
 1 file changed, 25 insertions(+), 14 deletions(-)

diff --git a/testcases/cve/cve-2015-3290.c b/testcases/cve/cve-2015-3290.c
index 143c98230..4185c22a7 100644
--- a/testcases/cve/cve-2015-3290.c
+++ b/testcases/cve/cve-2015-3290.c
@@ -177,6 +177,8 @@ static greg_t *csptr(ucontext_t *ctx)
 }
 #endif
 
+#define LDT_SS 0x7
+
 static volatile long expected_rsp;
 static int running = 1;
 
@@ -220,6 +222,8 @@ static void set_ldt(void)
 
 static void try_corrupt_stack(unsigned short *orig_ss)
 {
+	unsigned long flags = 0, new_ss = 0;
+
 #ifdef __x86_64__
 	asm volatile (
 	      /* A small puzzle for the curious reader. */
@@ -227,6 +231,7 @@ static void try_corrupt_stack(unsigned short *orig_ss)
 
 	      /* Save rsp for diagnostics */
 	      "mov    %%rsp, %[expected_rsp] \n\t"
+	      "xorq   %%rax, %%rax    \n\t"
 
 	      /*
 	       * Let 'er rip.
@@ -255,16 +260,14 @@ static void try_corrupt_stack(unsigned short *orig_ss)
 
 	      "subq   $128, %%rsp \n\t"
 	      "pushfq	 \n\t"
-	      "testl  $(1<<9),(%%rsp)   \n\t"
+	      "movq   (%%rsp),%%rdx	 \n\t"
 	      "addq   $136, %%rsp \n\t"
-	      "jz 3f      \n\t"
-	      "cmpl   %[ss], %%eax    \n\t"
-	      "je 4f      \n\t"
+	      "jmp    4f      \n\t"
 	      "3:  int3	   \n\t"
 	      "4:	     \n\t"
-	      : [expected_rsp] "=m" (expected_rsp)
-	      : [ss] "n" (0x7), [orig_ss] "r" (orig_ss)
-		 : "rax", "rcx", "rdx", "rbp", "r11", "flags"
+	      : [expected_rsp] "=m" (expected_rsp), "+d" (flags), "+a" (new_ss)
+	      : [ss] "n" (LDT_SS), [orig_ss] "r" (orig_ss)
+		 : "rcx", "rbp", "r11", "flags"
 	);
 #else
 	asm volatile (
@@ -274,6 +277,7 @@ static void try_corrupt_stack(unsigned short *orig_ss)
 
 	      /* Save rsp for diagnostics */
 	      "mov    %%esp, %[expected_rsp] \n\t"
+	      "xorl   %%eax, %%eax    \n\t"
 
 	      /*
 	       * Let 'er rip.
@@ -303,18 +307,25 @@ static void try_corrupt_stack(unsigned short *orig_ss)
 	      "mov    (%[orig_ss]), %%ss \n\t"  /* end corruption */
 
 	      "pushf	  \n\t"
-	      "testl  $(1<<9),(%%esp)   \n\t"
+	      "movl   (%%esp), %%edx \n\t"
 	      "addl   $4, %%esp   \n\t"
-	      "jz 3f      \n\t"
-	      "cmpl   %[ss], %%eax    \n\t"
-	      "je 4f      \n\t"
+	      "jmp    4f      \n\t"
 	      "3:  int3	   \n\t"
 	      "4:  mov %%esi, %%ebp   \n\t"
-	      : [expected_rsp] "=m" (expected_rsp)
-	      : [ss] "n" (0x7), [orig_ss] "r" (orig_ss)
-		 : "eax", "ecx", "edx", "esi", "ebp", "flags"
+	      : [expected_rsp] "=m" (expected_rsp), "+d" (flags), "+a" (new_ss)
+	      : [ss] "n" (LDT_SS), [orig_ss] "r" (orig_ss)
+		 : "ecx", "esi", "ebp", "flags"
 	);
 #endif
+
+	if (!(flags & (1 << 9))) {
+		tst_res(TFAIL, "Interrupt flag is disabled (0x%lx)", flags);
+	}
+
+	if (new_ss != LDT_SS) {
+		tst_res(TFAIL, "Wrong stack selector 0x%lx, expected 0x%x",
+			new_ss, LDT_SS);
+	}
 }
 
 static int perf_event_open(struct perf_event_attr *hw_event, pid_t pid,
-- 
2.46.0