1 #include <mach/mach.h>
2 #include <stdlib.h>
3 #include <pthread.h>
4 #include <unistd.h>
5 #include <stdio.h>
6 #include <assert.h>
7 #include <mach/task.h>
8 #include <stdbool.h>
9 #include <mach/mk_timer.h>
10 #include "cs_helpers.h"
11
12 /*
13 * DO NOT run this test file by itself.
14 * This test is meant to be invoked by control_port_options darwintest.
15 *
16 * If hard enforcement for pinned control port is on, pinned tests are
17 * expected to generate fatal EXC_GUARD.
18 *
19 * If hard enforcement for immovable control port is on, immovable tests are
20 * expected to generate fatal EXC_GUARD.
21 *
22 * The type of exception raised (if any) is checked on control_port_options side.
23 */
24 #define MAX_TEST_NUM 21
25
26 #ifndef MACH64_SEND_ANY
27 #define MACH64_SEND_ANY 0x0000000800000000ull
28 #define MACH64_SEND_MQ_CALL 0x0000000400000000ull
29 #endif
30
31 static int
attempt_send_immovable_port(mach_port_name_t port,mach_msg_type_name_t disp)32 attempt_send_immovable_port(mach_port_name_t port, mach_msg_type_name_t disp)
33 {
34 mach_port_t server;
35 kern_return_t kr;
36 kr = mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &server);
37 assert(kr == 0);
38
39 kr = mach_port_insert_right(mach_task_self(), server, server, MACH_MSG_TYPE_MAKE_SEND);
40 assert(kr == 0);
41
42 struct {
43 mach_msg_header_t header;
44 mach_msg_body_t body;
45 mach_msg_port_descriptor_t desc;
46 } msg;
47
48 msg.header.msgh_remote_port = server;
49 msg.header.msgh_local_port = MACH_PORT_NULL;
50 msg.header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0) | MACH_MSGH_BITS_COMPLEX;
51 msg.header.msgh_size = sizeof msg;
52
53 msg.body.msgh_descriptor_count = 1;
54
55 msg.desc.name = port;
56 msg.desc.disposition = disp;
57 msg.desc.type = MACH_MSG_PORT_DESCRIPTOR;
58
59 return mach_msg_send(&msg.header);
60 }
61
62 static void
pinned_test_main_thread_mod_ref(void)63 pinned_test_main_thread_mod_ref(void)
64 {
65 printf("[Crasher]: Mod refs main thread's self port to 0\n");
66 mach_port_t thread_self = mach_thread_self();
67 kern_return_t kr = mach_port_mod_refs(mach_task_self(), thread_self, MACH_PORT_RIGHT_SEND, -2);
68
69 printf("[Crasher pinned_test_main_thread_mod_ref] mach_port_mod_refs returned %s \n.", mach_error_string(kr));
70 }
71
72 static void* _Nullable
pthread_run(void * _Nullable)73 pthread_run(void *_Nullable)
74 {
75 printf("[Crasher]: Deallocate pthread_self\n");
76 mach_port_t th_self = pthread_mach_thread_np(pthread_self());
77 kern_return_t kr = mach_port_deallocate(mach_task_self(), th_self);
78
79 printf("[Crasher pinned_test_pthread_dealloc] mach_port_deallocate returned %s \n.", mach_error_string(kr));
80 return NULL;
81 }
82
83 static void
pinned_test_pthread_dealloc(void)84 pinned_test_pthread_dealloc(void)
85 {
86 printf("[Crasher]: Create a pthread and deallocate its self port\n");
87 pthread_t thread;
88 int ret = pthread_create(&thread, NULL, pthread_run, NULL);
89 assert(ret == 0);
90 ret = pthread_join(thread, NULL);
91 assert(ret == 0);
92 }
93
94 static void
pinned_test_task_self_dealloc(void)95 pinned_test_task_self_dealloc(void)
96 {
97 printf("[Crasher]: Deallocate mach_task_self twice\n");
98 mach_port_t task_self = mach_task_self();
99 kern_return_t kr = mach_port_deallocate(task_self, task_self);
100 assert(kr == 0);
101 kr = mach_port_deallocate(task_self, task_self);
102
103 printf("[Crasher pinned_test_task_self_dealloc] mach_port_deallocate returned %s \n.", mach_error_string(kr));
104 }
105
106 static void
pinned_test_task_self_mod_ref(void)107 pinned_test_task_self_mod_ref(void)
108 {
109 printf("[Crasher]: Mod refs mach_task_self() to 0\n");
110 kern_return_t kr = mach_port_mod_refs(mach_task_self(), mach_task_self(), MACH_PORT_RIGHT_SEND, -2);
111
112 printf("[Crasher pinned_test_task_self_mod_ref] mach_port_mod_refs returned %s \n.", mach_error_string(kr));
113 }
114
115 static void
pinned_test_task_threads_mod_ref(void)116 pinned_test_task_threads_mod_ref(void)
117 {
118 printf("[Crasher]: task_threads should return pinned thread ports. Mod refs them to 0\n");
119 thread_array_t th_list;
120 mach_msg_type_number_t th_cnt;
121 kern_return_t kr;
122 mach_port_t th_kp = mach_thread_self();
123 mach_port_deallocate(mach_task_self(), th_kp);
124
125 kr = task_threads(mach_task_self(), &th_list, &th_cnt);
126 mach_port_deallocate(mach_task_self(), th_list[0]);
127
128 kr = mach_port_mod_refs(mach_task_self(), th_list[0], MACH_PORT_RIGHT_SEND, -1);
129
130 printf("[Crasher pinned_test_task_threads_mod_ref] mach_port_mod_refs returned %s \n.", mach_error_string(kr));
131 }
132
133 static void
pinned_test_mach_port_destroy(void)134 pinned_test_mach_port_destroy(void)
135 {
136 kern_return_t kr = mach_port_destroy(mach_task_self(), mach_task_self());
137 printf("[Crasher pinned_test_mach_port_destroy] mach_port_destroy returned %s \n.", mach_error_string(kr));
138 }
139
140 static void
pinned_test_move_send_as_remote_port(void)141 pinned_test_move_send_as_remote_port(void)
142 {
143 struct {
144 mach_msg_header_t header;
145 } msg;
146
147 kern_return_t kr = mach_port_deallocate(mach_task_self(), mach_task_self());
148 assert(kr == 0);
149
150 /*
151 * We allow move send on remote kobject port but this should trip on pinning on last ref.
152 * See: IPC_OBJECT_COPYIN_FLAGS_ALLOW_IMMOVABLE_SEND.
153 */
154 msg.header.msgh_remote_port = mach_task_self();
155 msg.header.msgh_local_port = MACH_PORT_NULL;
156 msg.header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_MOVE_SEND, 0);
157 msg.header.msgh_id = 2000;
158 msg.header.msgh_size = sizeof msg;
159
160 kr = mach_msg_send(&msg.header);
161
162 printf("[Crasher pinned_test_move_send_as_remote_port] mach_msg_send returned %s \n.", mach_error_string(kr));
163 }
164
165 static void
immovable_test_move_send_as_remote_port(void)166 immovable_test_move_send_as_remote_port(void)
167 {
168 struct {
169 mach_msg_header_t header;
170 } msg;
171
172 /* Local port cannot be immovable. See: ipc_right_copyin_check_reply() */
173 msg.header.msgh_remote_port = mach_task_self();
174 msg.header.msgh_local_port = mach_task_self();
175 msg.header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_MOVE_SEND, MACH_MSG_TYPE_MOVE_SEND);
176 msg.header.msgh_id = 2000;
177 msg.header.msgh_size = sizeof msg;
178
179 kern_return_t kr = mach_msg_send(&msg.header);
180
181 printf("[Crasher immovable_test_move_send_as_remote_port] mach_msg_send returned %s \n.", mach_error_string(kr));
182 }
183
184 static void
immovable_test_move_send_task_self(void)185 immovable_test_move_send_task_self(void)
186 {
187 kern_return_t kr;
188 printf("[Crasher]: Move send mach_task_self_\n");
189 kr = attempt_send_immovable_port(mach_task_self(), MACH_MSG_TYPE_MOVE_SEND);
190
191 printf("[Crasher immovable_test_move_send_task_self] attempt_send_immovable_port returned %s \n.", mach_error_string(kr));
192 }
193
194 static void
immovable_test_copy_send_task_self(void)195 immovable_test_copy_send_task_self(void)
196 {
197 kern_return_t kr;
198 printf("[Crasher]: Copy send mach_task_self_\n");
199 kr = attempt_send_immovable_port(mach_task_self(), MACH_MSG_TYPE_COPY_SEND);
200
201 printf("[Crasher immovable_test_copy_send_task_self] attempt_send_immovable_port returned %s \n.", mach_error_string(kr));
202 }
203
204 static void
immovable_test_move_send_thread_self(void)205 immovable_test_move_send_thread_self(void)
206 {
207 kern_return_t kr;
208 printf("[Crasher]: Move send main thread's self port\n");
209 kr = attempt_send_immovable_port(mach_thread_self(), MACH_MSG_TYPE_MOVE_SEND);
210
211 printf("[Crasher immovable_test_move_send_thread_self] attempt_send_immovable_port returned %s \n.", mach_error_string(kr));
212 }
213
214 static void
immovable_test_copy_send_thread_self(void)215 immovable_test_copy_send_thread_self(void)
216 {
217 kern_return_t kr;
218 mach_port_t port;
219 printf("[Crasher]: Copy send main thread's self port\n");
220 port = mach_thread_self();
221 kr = attempt_send_immovable_port(port, MACH_MSG_TYPE_COPY_SEND);
222 printf("[Crasher immovable_test_copy_send_thread_self] attempt_send_immovable_port returned %s \n.", mach_error_string(kr));
223
224 mach_port_deallocate(mach_task_self(), port);
225 }
226
227 static void
immovable_test_copy_send_task_read(void)228 immovable_test_copy_send_task_read(void)
229 {
230 kern_return_t kr;
231 mach_port_t port;
232 printf("[Crasher]: Copy send task read port\n");
233 kr = task_get_special_port(mach_task_self(), TASK_READ_PORT, &port);
234 assert(kr == 0);
235 kr = attempt_send_immovable_port(port, MACH_MSG_TYPE_COPY_SEND);
236 printf("[Crasher immovable_test_copy_send_task_read] attempt_send_immovable_port returned %s \n.", mach_error_string(kr));
237
238 mach_port_deallocate(mach_task_self(), port);
239 }
240
241 static void
immovable_test_copy_send_task_inspect(void)242 immovable_test_copy_send_task_inspect(void)
243 {
244 kern_return_t kr;
245 mach_port_t port;
246 printf("[Crasher]: Move send task inspect port\n");
247 kr = task_get_special_port(mach_task_self(), TASK_INSPECT_PORT, &port);
248 assert(kr == 0);
249 kr = attempt_send_immovable_port(port, MACH_MSG_TYPE_MOVE_SEND);
250 printf("[Crasher immovable_test_copy_send_task_inspect] attempt_send_immovable_port returned %s \n.", mach_error_string(kr));
251 }
252
253 static void
immovable_test_move_send_thread_inspect(void)254 immovable_test_move_send_thread_inspect(void)
255 {
256 kern_return_t kr;
257 mach_port_t port;
258 mach_port_t th_port = mach_thread_self();
259
260 printf("[Crasher]: Move send thread inspect port\n");
261 kr = thread_get_special_port(th_port, THREAD_INSPECT_PORT, &port);
262 assert(kr == 0);
263 kr = attempt_send_immovable_port(port, MACH_MSG_TYPE_MOVE_SEND);
264 printf("[Crasher immovable_test_move_send_thread_inspect] attempt_send_immovable_port returned %s \n.", mach_error_string(kr));
265
266 mach_port_deallocate(mach_task_self(), th_port);
267 }
268
269 static void
immovable_test_move_send_raw_thread(void)270 immovable_test_move_send_raw_thread(void)
271 {
272 kern_return_t kr;
273 mach_port_t port;
274
275 kr = thread_create(mach_task_self(), &port);
276 assert(kr == 0);
277 kr = mach_port_deallocate(mach_task_self(), port); /* not pinned, should not crash */
278
279 kr = thread_create(mach_task_self(), &port);
280 assert(kr == 0);
281 kr = attempt_send_immovable_port(port, MACH_MSG_TYPE_MOVE_SEND); /* immovable, should crash here */
282 printf("[Crasher immovable_test_move_send_raw_thread] attempt_send_immovable_port returned %s \n.", mach_error_string(kr));
283
284 kr = thread_terminate(port);
285 assert(kr == 0);
286 }
287
288 static void
immovable_test_copy_send_thread_read(void)289 immovable_test_copy_send_thread_read(void)
290 {
291 kern_return_t kr;
292 mach_port_t port;
293 mach_port_t th_port = mach_thread_self();
294
295 printf("[Crasher]: Copy send thread read port\n");
296 kr = thread_get_special_port(th_port, THREAD_READ_PORT, &port);
297 assert(kr == 0);
298 kr = attempt_send_immovable_port(port, MACH_MSG_TYPE_COPY_SEND);
299 printf("[Crasher immovable_test_copy_send_thread_read] attempt_send_immovable_port returned %s \n.", mach_error_string(kr));
300
301 mach_port_deallocate(mach_task_self(), port);
302 mach_port_deallocate(mach_task_self(), th_port);
303 }
304
305 static void
cfi_test_no_bit_set(void)306 cfi_test_no_bit_set(void)
307 {
308 printf("[Crasher]: Try sending mach_msg2() without setting CFI bits\n");
309
310 mach_msg_header_t header;
311 kern_return_t kr;
312
313 header.msgh_local_port = MACH_PORT_NULL;
314 header.msgh_remote_port = mach_task_self();
315 header.msgh_id = 3409;
316 header.msgh_bits = MACH_MSGH_BITS_SET(MACH_MSG_TYPE_COPY_SEND, 0, 0, 0);
317 header.msgh_size = sizeof(header);
318
319 kr = mach_msg2(&header, MACH64_SEND_MSG, header, header.msgh_size, 0, MACH_PORT_NULL,
320 0, MACH_MSG_PRIORITY_UNSPECIFIED);
321 /* crash */
322 printf("[Crasher cfi_test_no_bit_set]: mach_msg2() returned %d\n", kr);
323 }
324
325 static void
cfi_test_two_bits_set(void)326 cfi_test_two_bits_set(void)
327 {
328 printf("[Crasher]: Try sending mach_msg2() but setting 2 CFI bits\n");
329
330 mach_msg_header_t header;
331 kern_return_t kr;
332
333 header.msgh_local_port = MACH_PORT_NULL;
334 header.msgh_remote_port = mach_task_self();
335 header.msgh_id = 3409;
336 header.msgh_bits = MACH_MSGH_BITS_SET(MACH_MSG_TYPE_COPY_SEND, 0, 0, 0);
337 header.msgh_size = sizeof(header);
338
339 kr = mach_msg2(&header, MACH64_SEND_MSG | MACH64_SEND_ANY | MACH64_SEND_KOBJECT_CALL,
340 header, header.msgh_size, 0, MACH_PORT_NULL,
341 0, MACH_MSG_PRIORITY_UNSPECIFIED);
342 /* crash */
343 printf("[Crasher cfi_test_two_bits_set]: mach_msg2() returned %d\n", kr);
344 }
345
346 static void
cfi_test_msg_to_timer_port(void)347 cfi_test_msg_to_timer_port(void)
348 {
349 printf("[Crasher]: Try sending mach_msg2() to timer port\n");
350
351 mach_port_t timer = MACH_PORT_NULL;
352 struct oversize_msg {
353 mach_msg_header_t header;
354 char data[2048];
355 } msg;
356
357 kern_return_t kr;
358 natural_t kotype;
359 mach_vm_address_t addr;
360
361 #define IKOT_TIMER 8
362 timer = mk_timer_create();
363 assert(timer != MACH_PORT_NULL);
364
365 /* Make sure it's a kobject port */
366 kr = mach_port_kobject(mach_task_self(), timer, &kotype, &addr);
367 assert(kr == KERN_SUCCESS);
368 assert(kotype == IKOT_TIMER);
369
370 msg.header.msgh_local_port = MACH_PORT_NULL;
371 msg.header.msgh_remote_port = timer;
372 msg.header.msgh_bits = MACH_MSGH_BITS_SET(MACH_MSG_TYPE_MAKE_SEND, 0, 0, 0);
373 msg.header.msgh_size = sizeof(msg);
374
375 /* Timer port must use MACH64_SEND_MQ_CALL */
376 kr = mach_msg2(&msg, MACH64_SEND_MSG | MACH64_SEND_MQ_CALL,
377 msg.header, msg.header.msgh_size, 0, MACH_PORT_NULL,
378 0, MACH_MSG_PRIORITY_UNSPECIFIED);
379 assert(kr == KERN_SUCCESS);
380 printf("Message sent to timer port successfully\n");
381
382 /* Using MACH64_SEND_KOBJECT_CALL should crash */
383 kr = mach_msg2(&msg, MACH64_SEND_MSG | MACH64_SEND_KOBJECT_CALL,
384 msg.header, msg.header.msgh_size, 0, MACH_PORT_NULL,
385 0, MACH_MSG_PRIORITY_UNSPECIFIED);
386 /* crash */
387 printf("[Crasher cfi_test_timer_port]: mach_msg2() returned %d\n", kr);
388 }
389
390 static void
cfi_test_wrong_bit_set(void)391 cfi_test_wrong_bit_set(void)
392 {
393 printf("[Crasher]: Try sending mach_msg2() but setting wrong CFI bits\n");
394
395 mach_msg_header_t header;
396 kern_return_t kr;
397
398 header.msgh_local_port = MACH_PORT_NULL;
399 header.msgh_remote_port = mach_task_self();
400 header.msgh_id = 3409;
401 header.msgh_bits = MACH_MSGH_BITS_SET(MACH_MSG_TYPE_COPY_SEND, 0, 0, 0);
402 header.msgh_size = sizeof(header);
403
404 /* Using MACH64_SEND_MQ_CALL but destination is a kobject port */
405 kr = mach_msg2(&header, MACH64_SEND_MSG | MACH64_SEND_MQ_CALL,
406 header, header.msgh_size, 0, MACH_PORT_NULL,
407 0, MACH_MSG_PRIORITY_UNSPECIFIED);
408 /* crash */
409 printf("[Crasher cfi_test_wrong_bit_set]: mach_msg2() returned %d\n", kr);
410 }
411
412 int
main(int argc,char * argv[])413 main(int argc, char *argv[])
414 {
415 void (*tests[MAX_TEST_NUM])(void) = {
416 pinned_test_main_thread_mod_ref,
417 pinned_test_pthread_dealloc,
418 pinned_test_task_self_dealloc,
419 pinned_test_task_self_mod_ref,
420 pinned_test_task_threads_mod_ref,
421 pinned_test_mach_port_destroy,
422 pinned_test_move_send_as_remote_port,
423
424 immovable_test_move_send_task_self,
425 immovable_test_copy_send_task_self,
426 immovable_test_move_send_thread_self,
427 immovable_test_copy_send_thread_self,
428 immovable_test_copy_send_task_read,
429 immovable_test_copy_send_task_inspect,
430 immovable_test_move_send_thread_inspect,
431 immovable_test_copy_send_thread_read,
432 immovable_test_move_send_as_remote_port,
433 immovable_test_move_send_raw_thread,
434
435 cfi_test_no_bit_set,
436 cfi_test_two_bits_set,
437 cfi_test_wrong_bit_set,
438 cfi_test_msg_to_timer_port,
439 };
440 printf("[Crasher]: My Pid: %d\n", getpid());
441
442 if (argc < 2) {
443 printf("[Crasher]: Specify a test to run.");
444 exit(-1);
445 }
446
447 bool third_party_hardened = !strcmp(argv[0], "imm_pinned_control_port_crasher_3P_hardened");
448 if (third_party_hardened) {
449 // Ensure that we can set this crasher as a non-platform binary
450 if (remove_platform_binary() != 0) {
451 /*
452 * CS_OPS_CLEARPLATFORM always fail on release build, and it can also
453 * fail depending on global/mac policies of the BATS container (ref: csops_internal).
454 * Skip instead of failing the test.
455 */
456 printf("Failed to remove platform binary, skipping test\n");
457 exit(0);
458 }
459 }
460
461 int test_num = atoi(argv[1]);
462
463
464 if (test_num >= 0 && test_num < MAX_TEST_NUM) {
465 printf("[Crasher]: Running test num %d\n", test_num);
466 (*tests[test_num])();
467 } else {
468 printf("[Crasher]: Invalid test num: %d. Exiting...\n", test_num);
469 exit(-1);
470 }
471
472 exit(0);
473 }
474