sgx-lkl icon indicating copy to clipboard operation
sgx-lkl copied to clipboard

[Tests] getgroups system call causing SIGILL when size is “-1”

Open shaikshavali1 opened this issue 4 years ago • 5 comments

This test case tests “getgroups01” system call behavior by passing different parameter values. Below are the test cases. Sub-Test-Case-1: Check to see if getgroups(-1, gidset) fails and sets errno to EINVAL.

Link: https://github.com/linux-test-project/ltp/blob/c5311d26fb80988de010301c0855a5f65442c6c0/testcases/kernel/syscalls/getgroups/getgroups01.c#L83

Sub-Test-Case-2: Check to see if getgroups(0, gidset) does not return -1 and gidset is not modified.

Link: https://github.com/linux-test-project/ltp/blob/c5311d26fb80988de010301c0855a5f65442c6c0/testcases/kernel/syscalls/getgroups/getgroups01.c#L104

Sub-Test-Case-3: Check to see if getgroups(x, gigset) fails and sets errno to EINVAL, where x is one less then what is returned by getgroups(0, gidset).

Link: https://github.com/linux-test-project/ltp/blob/c5311d26fb80988de010301c0855a5f65442c6c0/testcases/kernel/syscalls/getgroups/getgroups01.c#L126

Sub-Test-Case-4: Check to see if getgroups() succeeds and gidset contains group id returned from getgid().

Link: https://github.com/linux-test-project/ltp/blob/c5311d26fb80988de010301c0855a5f65442c6c0/testcases/kernel/syscalls/getgroups/getgroups01.c#L143

The Sub-Test-Case-1 is failed with “illegal instruction” and enclave is aborted. Below logs list GDB traces.

--------------------------GDB Logs ------------------------------------
(gdb) s
getgroups (__s=<optimized out>, __l=-1) at /usr/include/fortify/unistd.h:77
77      /usr/include/fortify/unistd.h: No such file or directory.
(gdb) bt
  0  getgroups (__s=<optimized out>, __l=-1) at /usr/include/fortify/unistd.h:77
  1  GETGROUPS (list=<optimized out>, gidsetsize=18446744073709551615, cleanup=0x7fff1fabf990 <cleanup>)
    at /ltp/testcases/kernel/syscalls/getgroups/../utils/compat_16.h:84
  2  main (ac=<optimized out>, av=<optimized out>) at getgroups01.c:83
  3  0x00007fff00538402 in libc_start_main_stage2 (main=0x7fff1fabf790 <main>, argc=1, argv=0x7fff40b5ee80)
    at src/env/__libc_start_main.c:168
  4  0x00007fff00538361 in __libc_start_main (main=0x7fff1fabf790 <main>, argc=1, argv=0x7fff40b5ee80) at src/env/__libc_start_main.c:153
  5  0x00007fff1fabf858 in _start_c (p=<optimized out>) at crt/crt1.c:17
  6  0x00007fff1fabf830 in _start ()
  7  0x00007fff00b6a6b0 in ?? ()
  8  0x0000000000000001 in ?? ()
  9  0x00007fff00b65890 in ?? ()
  10 0x0000000000000000 in ?? ()
(gdb) s

Thread 6 "ENCLAVE" received signal SIGILL, Illegal instruction.
main (ac=<optimized out>, av=<optimized out>) at getgroups01.c:83
83      getgroups01.c: No such file or directory.
(gdb) bt
  0  main (ac=<optimized out>, av=<optimized out>) at getgroups01.c:83
  1  0x00007fff00538402 in libc_start_main_stage2 (main=0x7fff1fabf790 <main>, argc=1, argv=0x7fff40b5ee80)
    at src/env/__libc_start_main.c:168
  2  0x00007fff00538361 in __libc_start_main (main=0x7fff1fabf790 <main>, argc=1, argv=0x7fff40b5ee80) at src/env/__libc_start_main.c:153
  3  0x00007fff1fabf858 in _start_c (p=<optimized out>) at crt/crt1.c:17
  4  0x00007fff1fabf830 in _start ()
  5  0x00007fff00b6a6b0 in ?? ()
  6  0x0000000000000001 in ?? ()
  7  0x00007fff00b65890 in ?? ()
  8  0x0000000000000000 in ?? ()
(gdb)
 -----------------------GDB Logs End ----------------------------------

shaikshavali1 avatar Jun 25 '20 15:06 shaikshavali1

@hukoyu this still needs cleanup.

prp avatar Jul 08 '20 15:07 prp

@shaikshavali1 can you do the cleanup Peter is asking for?

hukoyu avatar Jul 08 '20 16:07 hukoyu

@prp, Could you please suggest what more information I need to update here?

shaikshavali1 avatar Jul 08 '20 19:07 shaikshavali1

@shaikshavali1

  1. Does only the first sub-test fail and the others pass?
  2. Please use GDB to find out what the illegal assembly instruction is. Then provide a stracktrace with symbols for the location of the exception.
  3. Use proper markdown formatting, e.g. terminal output should be in code blocks etc. Thanks.

prp avatar Jul 08 '20 20:07 prp

@prp ,

  1. Yes, only the first subtest case is failed, other subtest cases are passed.
  2. Please find below GDB logs.
[[  SGX-LKL ]] libc_start_main_stage2(): Calling app main: /ltp/testcases/kernel/syscalls/getgroups/getgroups01
[Switching to Thread 0x7fff919b0700 (LWP 16282)]

Thread 6 "ENCLAVE" hit Breakpoint 1, main (ac=<optimized out>, av=<optimized out>) at getgroups01.c:84
84      getgroups01.c: No such file or directory.
(gdb) s
__errno_location () at src/errno/__errno_location.c:6
6               struct schedctx *sch = __scheduler_self();
(gdb) s
__scheduler_self () at ./arch/x86_64/pthread_arch.h:4
4               __asm__ __volatile__ ("mov %%fs:48,%0" : "=r" (self) );
(gdb) s
5               return self;
(gdb) s
6       }
(gdb) s
__errno_location () at src/errno/__errno_location.c:7
7               struct lthread *lt = sch->sched.current_lthread;
(gdb) s
8               return lt ? &lt->err : &sch->errno_val;
(gdb) s
9       }
(gdb) s
GETGROUPS (list=<optimized out>, gidsetsize=18446744073709551615, cleanup=0x7fe03daa7990 <cleanup>) at getgroups01.c:84
84      getgroups01.c: No such file or directory.
(gdb) bt
#0  GETGROUPS (list=<optimized out>, gidsetsize=18446744073709551615, cleanup=0x7fe03daa7990 <cleanup>) at getgroups01.c:84
#1  main (ac=<optimized out>, av=<optimized out>) at getgroups01.c:84
#2  0x00007fe00052d12e in libc_start_main_stage2 (main=0x7fe03daa7790 <main>, argc=1, argv=0x7fe040b46f78) at src/env/__libc_start_main.c:168
#3  0x00007fe00052d088 in __libc_start_main (main=0x7fe03daa7790 <main>, argc=1, argv=0x7fe040b46f78) at src/env/__libc_start_main.c:153
#4  0x00007fe03daa7858 in _start_c (p=<optimized out>) at crt/crt1.c:17
#5  0x00007fe03daa7830 in _start ()
#6  0x0000000000000001 in ?? ()
#7  0x00007fe000b48e40 in ?? ()
#8  0x0000000000000000 in ?? ()
(gdb) s
getgroups (__s=<optimized out>, __l=-1) at /usr/include/fortify/unistd.h:77
77      /usr/include/fortify/unistd.h: No such file or directory.
(gdb) bt
#0  getgroups (__s=<optimized out>, __l=-1) at /usr/include/fortify/unistd.h:77
#1  GETGROUPS (list=<optimized out>, gidsetsize=18446744073709551615, cleanup=0x7fe03daa7990 <cleanup>)
    at /ltp/testcases/kernel/syscalls/getgroups/../utils/compat_16.h:84
#2  main (ac=<optimized out>, av=<optimized out>) at getgroups01.c:84
#3  0x00007fe00052d12e in libc_start_main_stage2 (main=0x7fe03daa7790 <main>, argc=1, argv=0x7fe040b46f78) at src/env/__libc_start_main.c:168
#4  0x00007fe00052d088 in __libc_start_main (main=0x7fe03daa7790 <main>, argc=1, argv=0x7fe040b46f78) at src/env/__libc_start_main.c:153
#5  0x00007fe03daa7858 in _start_c (p=<optimized out>) at crt/crt1.c:17
#6  0x00007fe03daa7830 in _start ()
#7  0x0000000000000001 in ?? ()
#8  0x00007fe000b48e40 in ?? ()
#9  0x0000000000000000 in ?? ()
(gdb) list
72      in /usr/include/fortify/unistd.h
(gdb) s

Thread 6 "ENCLAVE" received signal SIGILL, Illegal instruction.
main (ac=<optimized out>, av=<optimized out>) at getgroups01.c:84
84      getgroups01.c: No such file or directory.
(gdb) bt
#0  main (ac=<optimized out>, av=<optimized out>) at getgroups01.c:84
#1  0x00007fe00052d12e in libc_start_main_stage2 (main=0x7fe03daa7790 <main>, argc=1, argv=0x7fe040b46f78) at src/env/__libc_start_main.c:168
#2  0x00007fe00052d088 in __libc_start_main (main=0x7fe03daa7790 <main>, argc=1, argv=0x7fe040b46f78) at src/env/__libc_start_main.c:153
#3  0x00007fe03daa7858 in _start_c (p=<optimized out>) at crt/crt1.c:17
#4  0x00007fe03daa7830 in _start ()
#5  0x0000000000000001 in ?? ()
#6  0x00007fe000b48e40 in ?? ()
#7  0x0000000000000000 in ?? ()
(gdb)

when I verified the file (after mounting and chroot the sgxlkl-miniroot-fs.img.master) "/usr/include/fortify/unistd.h". It looks this code is verifying the size. If size is <0 it invokes build in trap and which intern causing the illegal instruction.

File: /usr/include/fortify/unistd.h
_FORTIFY_FN(getgroups) int getgroups(int __l, gid_t *__s)
{
        size_t __b = __builtin_object_size(__s, 0);

        if (__l < 0 || (size_t)__l > __b / sizeof(gid_t))
                __builtin_trap();
        return __orig_getgroups(__l, __s);
}
  1. I corrected the formatting errors.

shaikshavali1 avatar Jul 31 '20 09:07 shaikshavali1