1 #include <mach/mach.h>
2 #include <stdlib.h>
3 #include <pthread.h>
4 #include <unistd.h>
5 #include <stdio.h>
6 #include <assert.h>
7 #include <mach/task.h>
8 #include <stdbool.h>
9 #include <mach/mk_timer.h>
10 #include "cs_helpers.h"
11
12 /*
13 * DO NOT run this test file by itself.
14 * This test is meant to be invoked by control_port_options darwintest.
15 *
16 * If hard enforcement for pinned control port is on, pinned tests are
17 * expected to generate fatal EXC_GUARD.
18 *
19 * If hard enforcement for immovable control port is on, immovable tests are
20 * expected to generate fatal EXC_GUARD.
21 *
22 * The type of exception raised (if any) is checked on control_port_options side.
23 */
24 #define MAX_TEST_NUM 21
25
26 #ifndef MACH64_SEND_ANY
27 #define MACH64_SEND_ANY 0x0000000800000000ull
28 #define MACH64_SEND_MQ_CALL 0x0000000400000000ull
29 #endif
30
31 static int
attempt_send_immovable_port(mach_port_name_t port,mach_msg_type_name_t disp)32 attempt_send_immovable_port(mach_port_name_t port, mach_msg_type_name_t disp)
33 {
34 mach_port_t server;
35 kern_return_t kr;
36 kr = mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &server);
37 assert(kr == 0);
38
39 kr = mach_port_insert_right(mach_task_self(), server, server, MACH_MSG_TYPE_MAKE_SEND);
40 assert(kr == 0);
41
42 struct {
43 mach_msg_header_t header;
44 mach_msg_body_t body;
45 mach_msg_port_descriptor_t desc;
46 } msg;
47
48 msg.header.msgh_remote_port = server;
49 msg.header.msgh_local_port = MACH_PORT_NULL;
50 msg.header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0) | MACH_MSGH_BITS_COMPLEX;
51 msg.header.msgh_size = sizeof msg;
52
53 msg.body.msgh_descriptor_count = 1;
54
55 msg.desc.name = port;
56 msg.desc.disposition = disp;
57 msg.desc.type = MACH_MSG_PORT_DESCRIPTOR;
58
59 return mach_msg_send(&msg.header);
60 }
61
62 static void
pinned_test_main_thread_mod_ref(void)63 pinned_test_main_thread_mod_ref(void)
64 {
65 printf("[Crasher]: Mod refs main thread's self port to 0\n");
66 mach_port_t thread_self = mach_thread_self();
67 kern_return_t kr = mach_port_mod_refs(mach_task_self(), thread_self, MACH_PORT_RIGHT_SEND, -2);
68
69 printf("[Crasher pinned_test_main_thread_mod_ref] mach_port_mod_refs returned %s \n.", mach_error_string(kr));
70 }
71
72 static void* _Nullable
pthread_run(void * _Nullable)73 pthread_run(void *_Nullable)
74 {
75 printf("[Crasher]: Deallocate pthread_self\n");
76 mach_port_t th_self = pthread_mach_thread_np(pthread_self());
77 kern_return_t kr = mach_port_deallocate(mach_task_self(), th_self);
78
79 printf("[Crasher pinned_test_pthread_dealloc] mach_port_deallocate returned %s \n.", mach_error_string(kr));
80 return NULL;
81 }
82
83 static void
pinned_test_pthread_dealloc(void)84 pinned_test_pthread_dealloc(void)
85 {
86 printf("[Crasher]: Create a pthread and deallocate its self port\n");
87 pthread_t thread;
88 int ret = pthread_create(&thread, NULL, pthread_run, NULL);
89 assert(ret == 0);
90 ret = pthread_join(thread, NULL);
91 assert(ret == 0);
92 }
93
94 static void
pinned_test_task_self_dealloc(void)95 pinned_test_task_self_dealloc(void)
96 {
97 printf("[Crasher]: Deallocate mach_task_self thrice\n");
98 mach_port_t task_self = mach_task_self();
99 kern_return_t kr = mach_port_deallocate(task_self, task_self);
100 assert(kr == 0);
101 kr = mach_port_deallocate(task_self, task_self);
102 assert(kr == 0);
103 kr = mach_port_deallocate(task_self, task_self);
104
105 printf("[Crasher pinned_test_task_self_dealloc] mach_port_deallocate returned %s \n.", mach_error_string(kr));
106 }
107
108 static void
pinned_test_task_self_mod_ref(void)109 pinned_test_task_self_mod_ref(void)
110 {
111 printf("[Crasher]: Mod refs mach_task_self() to 0\n");
112 kern_return_t kr = mach_port_mod_refs(mach_task_self(), mach_task_self(), MACH_PORT_RIGHT_SEND, -3);
113
114 printf("[Crasher pinned_test_task_self_mod_ref] mach_port_mod_refs returned %s \n.", mach_error_string(kr));
115 }
116
117 static void
pinned_test_task_threads_mod_ref(void)118 pinned_test_task_threads_mod_ref(void)
119 {
120 printf("[Crasher]: task_threads should return pinned thread ports. Mod refs them to 0\n");
121 thread_array_t th_list;
122 mach_msg_type_number_t th_cnt;
123 kern_return_t kr;
124 mach_port_t th_kp = mach_thread_self();
125 mach_port_deallocate(mach_task_self(), th_kp);
126
127 kr = task_threads(mach_task_self(), &th_list, &th_cnt);
128 mach_port_deallocate(mach_task_self(), th_list[0]);
129
130 kr = mach_port_mod_refs(mach_task_self(), th_list[0], MACH_PORT_RIGHT_SEND, -1);
131
132 printf("[Crasher pinned_test_task_threads_mod_ref] mach_port_mod_refs returned %s \n.", mach_error_string(kr));
133 }
134
135 static void
pinned_test_mach_port_destroy(void)136 pinned_test_mach_port_destroy(void)
137 {
138 kern_return_t kr = mach_port_destroy(mach_task_self(), mach_task_self());
139 printf("[Crasher pinned_test_mach_port_destroy] mach_port_destroy returned %s \n.", mach_error_string(kr));
140 }
141
142 static void
pinned_test_move_send_as_remote_port(void)143 pinned_test_move_send_as_remote_port(void)
144 {
145 struct {
146 mach_msg_header_t header;
147 } msg;
148
149 kern_return_t kr = mach_port_deallocate(mach_task_self(), mach_task_self());
150 assert(kr == 0);
151
152 /*
153 * We allow move send on remote kobject port but this should trip on pinning on last ref.
154 * See: IPC_OBJECT_COPYIN_FLAGS_ALLOW_IMMOVABLE_SEND.
155 */
156 msg.header.msgh_remote_port = mach_task_self();
157 msg.header.msgh_local_port = MACH_PORT_NULL;
158 msg.header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_MOVE_SEND, 0);
159 msg.header.msgh_id = 2000;
160 msg.header.msgh_size = sizeof msg;
161
162 kr = mach_msg_send(&msg.header);
163
164 printf("[Crasher pinned_test_move_send_as_remote_port] mach_msg_send returned %s \n.", mach_error_string(kr));
165 }
166
167 static void
immovable_test_move_send_as_remote_port(void)168 immovable_test_move_send_as_remote_port(void)
169 {
170 struct {
171 mach_msg_header_t header;
172 } msg;
173
174 /* Local port cannot be immovable. See: ipc_right_copyin_check_reply() */
175 msg.header.msgh_remote_port = mach_task_self();
176 msg.header.msgh_local_port = mach_task_self();
177 msg.header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_MOVE_SEND, MACH_MSG_TYPE_MOVE_SEND);
178 msg.header.msgh_id = 2000;
179 msg.header.msgh_size = sizeof msg;
180
181 kern_return_t kr = mach_msg_send(&msg.header);
182
183 printf("[Crasher immovable_test_move_send_as_remote_port] mach_msg_send returned %s \n.", mach_error_string(kr));
184 }
185
186 static void
immovable_test_move_send_task_self(void)187 immovable_test_move_send_task_self(void)
188 {
189 kern_return_t kr;
190 printf("[Crasher]: Move send mach_task_self_\n");
191 kr = attempt_send_immovable_port(mach_task_self(), MACH_MSG_TYPE_MOVE_SEND);
192
193 printf("[Crasher immovable_test_move_send_task_self] attempt_send_immovable_port returned %s \n.", mach_error_string(kr));
194 }
195
196 static void
immovable_test_copy_send_task_self(void)197 immovable_test_copy_send_task_self(void)
198 {
199 kern_return_t kr;
200 printf("[Crasher]: Copy send mach_task_self_\n");
201 kr = attempt_send_immovable_port(mach_task_self(), MACH_MSG_TYPE_COPY_SEND);
202
203 printf("[Crasher immovable_test_copy_send_task_self] attempt_send_immovable_port returned %s \n.", mach_error_string(kr));
204 }
205
206 static void
immovable_test_move_send_thread_self(void)207 immovable_test_move_send_thread_self(void)
208 {
209 kern_return_t kr;
210 printf("[Crasher]: Move send main thread's self port\n");
211 kr = attempt_send_immovable_port(mach_thread_self(), MACH_MSG_TYPE_MOVE_SEND);
212
213 printf("[Crasher immovable_test_move_send_thread_self] attempt_send_immovable_port returned %s \n.", mach_error_string(kr));
214 }
215
216 static void
immovable_test_copy_send_thread_self(void)217 immovable_test_copy_send_thread_self(void)
218 {
219 kern_return_t kr;
220 mach_port_t port;
221 printf("[Crasher]: Copy send main thread's self port\n");
222 port = mach_thread_self();
223 kr = attempt_send_immovable_port(port, MACH_MSG_TYPE_COPY_SEND);
224 printf("[Crasher immovable_test_copy_send_thread_self] attempt_send_immovable_port returned %s \n.", mach_error_string(kr));
225
226 mach_port_deallocate(mach_task_self(), port);
227 }
228
229 static void
immovable_test_copy_send_task_read(void)230 immovable_test_copy_send_task_read(void)
231 {
232 kern_return_t kr;
233 mach_port_t port;
234 printf("[Crasher]: Copy send task read port\n");
235 kr = task_get_special_port(mach_task_self(), TASK_READ_PORT, &port);
236 assert(kr == 0);
237 kr = attempt_send_immovable_port(port, MACH_MSG_TYPE_COPY_SEND);
238 printf("[Crasher immovable_test_copy_send_task_read] attempt_send_immovable_port returned %s \n.", mach_error_string(kr));
239
240 mach_port_deallocate(mach_task_self(), port);
241 }
242
243 static void
immovable_test_copy_send_task_inspect(void)244 immovable_test_copy_send_task_inspect(void)
245 {
246 kern_return_t kr;
247 mach_port_t port;
248 printf("[Crasher]: Move send task inspect port\n");
249 kr = task_get_special_port(mach_task_self(), TASK_INSPECT_PORT, &port);
250 assert(kr == 0);
251 kr = attempt_send_immovable_port(port, MACH_MSG_TYPE_MOVE_SEND);
252 printf("[Crasher immovable_test_copy_send_task_inspect] attempt_send_immovable_port returned %s \n.", mach_error_string(kr));
253 }
254
255 static void
immovable_test_move_send_thread_inspect(void)256 immovable_test_move_send_thread_inspect(void)
257 {
258 kern_return_t kr;
259 mach_port_t port;
260 mach_port_t th_port = mach_thread_self();
261
262 printf("[Crasher]: Move send thread inspect port\n");
263 kr = thread_get_special_port(th_port, THREAD_INSPECT_PORT, &port);
264 assert(kr == 0);
265 kr = attempt_send_immovable_port(port, MACH_MSG_TYPE_MOVE_SEND);
266 printf("[Crasher immovable_test_move_send_thread_inspect] attempt_send_immovable_port returned %s \n.", mach_error_string(kr));
267
268 mach_port_deallocate(mach_task_self(), th_port);
269 }
270
271 static void
immovable_test_move_send_raw_thread(void)272 immovable_test_move_send_raw_thread(void)
273 {
274 kern_return_t kr;
275 mach_port_t port;
276
277 kr = thread_create(mach_task_self(), &port);
278 assert(kr == 0);
279 kr = mach_port_deallocate(mach_task_self(), port); /* not pinned, should not crash */
280
281 kr = thread_create(mach_task_self(), &port);
282 assert(kr == 0);
283 kr = attempt_send_immovable_port(port, MACH_MSG_TYPE_MOVE_SEND); /* immovable, should crash here */
284 printf("[Crasher immovable_test_move_send_raw_thread] attempt_send_immovable_port returned %s \n.", mach_error_string(kr));
285
286 kr = thread_terminate(port);
287 assert(kr == 0);
288 }
289
290 static void
immovable_test_copy_send_thread_read(void)291 immovable_test_copy_send_thread_read(void)
292 {
293 kern_return_t kr;
294 mach_port_t port;
295 mach_port_t th_port = mach_thread_self();
296
297 printf("[Crasher]: Copy send thread read port\n");
298 kr = thread_get_special_port(th_port, THREAD_READ_PORT, &port);
299 assert(kr == 0);
300 kr = attempt_send_immovable_port(port, MACH_MSG_TYPE_COPY_SEND);
301 printf("[Crasher immovable_test_copy_send_thread_read] attempt_send_immovable_port returned %s \n.", mach_error_string(kr));
302
303 mach_port_deallocate(mach_task_self(), port);
304 mach_port_deallocate(mach_task_self(), th_port);
305 }
306
307 static void
cfi_test_no_bit_set(void)308 cfi_test_no_bit_set(void)
309 {
310 printf("[Crasher]: Try sending mach_msg2() without setting CFI bits\n");
311
312 mach_msg_header_t header;
313 kern_return_t kr;
314
315 header.msgh_local_port = MACH_PORT_NULL;
316 header.msgh_remote_port = mach_task_self();
317 header.msgh_id = 3409;
318 header.msgh_bits = MACH_MSGH_BITS_SET(MACH_MSG_TYPE_COPY_SEND, 0, 0, 0);
319 header.msgh_size = sizeof(header);
320
321 kr = mach_msg2(&header, MACH64_SEND_MSG, header, header.msgh_size, 0, MACH_PORT_NULL,
322 0, MACH_MSG_PRIORITY_UNSPECIFIED);
323 /* crash */
324 printf("[Crasher cfi_test_no_bit_set]: mach_msg2() returned %d\n", kr);
325 }
326
327 static void
cfi_test_two_bits_set(void)328 cfi_test_two_bits_set(void)
329 {
330 printf("[Crasher]: Try sending mach_msg2() but setting 2 CFI bits\n");
331
332 mach_msg_header_t header;
333 kern_return_t kr;
334
335 header.msgh_local_port = MACH_PORT_NULL;
336 header.msgh_remote_port = mach_task_self();
337 header.msgh_id = 3409;
338 header.msgh_bits = MACH_MSGH_BITS_SET(MACH_MSG_TYPE_COPY_SEND, 0, 0, 0);
339 header.msgh_size = sizeof(header);
340
341 kr = mach_msg2(&header, MACH64_SEND_MSG | MACH64_SEND_ANY | MACH64_SEND_KOBJECT_CALL,
342 header, header.msgh_size, 0, MACH_PORT_NULL,
343 0, MACH_MSG_PRIORITY_UNSPECIFIED);
344 /* crash */
345 printf("[Crasher cfi_test_two_bits_set]: mach_msg2() returned %d\n", kr);
346 }
347
348 static void
cfi_test_msg_to_timer_port(void)349 cfi_test_msg_to_timer_port(void)
350 {
351 printf("[Crasher]: Try sending mach_msg2() to timer port\n");
352
353 mach_port_t timer = MACH_PORT_NULL;
354 struct oversize_msg {
355 mach_msg_header_t header;
356 char data[2048];
357 } msg;
358
359 kern_return_t kr;
360
361 timer = mk_timer_create();
362 assert(timer != MACH_PORT_NULL);
363
364 msg.header.msgh_local_port = MACH_PORT_NULL;
365 msg.header.msgh_remote_port = timer;
366 msg.header.msgh_bits = MACH_MSGH_BITS_SET(MACH_MSG_TYPE_MAKE_SEND, 0, 0, 0);
367 msg.header.msgh_size = sizeof(msg);
368
369 /* Timer port must use MACH64_SEND_MQ_CALL */
370 kr = mach_msg2(&msg, MACH64_SEND_MSG | MACH64_SEND_MQ_CALL,
371 msg.header, msg.header.msgh_size, 0, MACH_PORT_NULL,
372 0, MACH_MSG_PRIORITY_UNSPECIFIED);
373 assert(kr == KERN_SUCCESS);
374 printf("Message sent to timer port successfully\n");
375
376 /* Using MACH64_SEND_KOBJECT_CALL should crash */
377 kr = mach_msg2(&msg, MACH64_SEND_MSG | MACH64_SEND_KOBJECT_CALL,
378 msg.header, msg.header.msgh_size, 0, MACH_PORT_NULL,
379 0, MACH_MSG_PRIORITY_UNSPECIFIED);
380 /* crash */
381 printf("[Crasher cfi_test_timer_port]: mach_msg2() returned %d\n", kr);
382 }
383
384 static void
cfi_test_wrong_bit_set(void)385 cfi_test_wrong_bit_set(void)
386 {
387 printf("[Crasher]: Try sending mach_msg2() but setting wrong CFI bits\n");
388
389 mach_msg_header_t header;
390 kern_return_t kr;
391
392 header.msgh_local_port = MACH_PORT_NULL;
393 header.msgh_remote_port = mach_task_self();
394 header.msgh_id = 3409;
395 header.msgh_bits = MACH_MSGH_BITS_SET(MACH_MSG_TYPE_COPY_SEND, 0, 0, 0);
396 header.msgh_size = sizeof(header);
397
398 /* Using MACH64_SEND_MQ_CALL but destination is a kobject port */
399 kr = mach_msg2(&header, MACH64_SEND_MSG | MACH64_SEND_MQ_CALL,
400 header, header.msgh_size, 0, MACH_PORT_NULL,
401 0, MACH_MSG_PRIORITY_UNSPECIFIED);
402 /* crash */
403 printf("[Crasher cfi_test_wrong_bit_set]: mach_msg2() returned %d\n", kr);
404 }
405
406 int
main(int argc,char * argv[])407 main(int argc, char *argv[])
408 {
409 void (*tests[MAX_TEST_NUM])(void) = {
410 pinned_test_main_thread_mod_ref,
411 pinned_test_pthread_dealloc,
412 pinned_test_task_self_dealloc,
413 pinned_test_task_self_mod_ref,
414 pinned_test_task_threads_mod_ref,
415 pinned_test_mach_port_destroy,
416 pinned_test_move_send_as_remote_port,
417
418 immovable_test_move_send_task_self,
419 immovable_test_copy_send_task_self,
420 immovable_test_move_send_thread_self,
421 immovable_test_copy_send_thread_self,
422 immovable_test_copy_send_task_read,
423 immovable_test_copy_send_task_inspect,
424 immovable_test_move_send_thread_inspect,
425 immovable_test_copy_send_thread_read,
426 immovable_test_move_send_as_remote_port,
427 immovable_test_move_send_raw_thread,
428
429 cfi_test_no_bit_set,
430 cfi_test_two_bits_set,
431 cfi_test_wrong_bit_set,
432 cfi_test_msg_to_timer_port,
433 };
434 printf("[Crasher]: My Pid: %d\n", getpid());
435
436 if (argc < 2) {
437 printf("[Crasher]: Specify a test to run.");
438 exit(-1);
439 }
440
441 bool third_party_hardened = !strcmp(argv[0], "imm_pinned_control_port_crasher_3P_hardened");
442 if (third_party_hardened) {
443 // Ensure that we can set this crasher as a non-platform binary
444 if (remove_platform_binary() != 0) {
445 /*
446 * CS_OPS_CLEARPLATFORM always fail on release build, and it can also
447 * fail depending on global/mac policies of the BATS container (ref: csops_internal).
448 * Skip instead of failing the test.
449 */
450 printf("Failed to remove platform binary, skipping test\n");
451 exit(0);
452 }
453 }
454
455 int test_num = atoi(argv[1]);
456
457
458 if (test_num >= 0 && test_num < MAX_TEST_NUM) {
459 printf("[Crasher]: Running test num %d\n", test_num);
460 (*tests[test_num])();
461 } else {
462 printf("[Crasher]: Invalid test num: %d. Exiting...\n", test_num);
463 exit(-1);
464 }
465
466 exit(0);
467 }
468