34 Commits

Author SHA1 Message Date
Minos Galanakis
b70f0fd9a9 Merge branch 'development' into 'development-restricted'
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2024-03-19 22:24:40 +00:00
Paul Elliott
50da462fc8
Merge pull request #8829 from paul-elliott-arm/add_framework_meta_tests
Add metatests for failing TEST_EQUAL and TEST_LE_*
2024-03-14 15:55:14 +00:00
David Horstmann
93fa4e1b87 Merge branch 'development' into buffer-sharing-merge 2024-03-12 15:05:06 +00:00
Gilles Peskine
72da8b3521 Don't authorize private access to fields where not actually needed
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-22 12:07:29 +01:00
Paul Elliott
60bbfe63a1 Add metatests for failing TEST_EQUAL and TEST_LE_*
After getting caught with deadlock issues when these tests fail, add a
metatest to test them failing.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2024-02-14 14:55:04 +00:00
Paul Elliott
54ad01efed Merge remote-tracking branch 'upstream/development' into make_tests_thread_safe 2024-02-09 14:33:58 +00:00
David Horstmann
9de6edd462 Separate memory poisoning tests from generic ASan
Some platforms may support ASan but be C99-only (no C11 support).
These platforms will support ASan metatests but not memory poisoning,
which requires C11 features.

To allow for this, create a separate platform requirement, "poison",
in metatest.c to distinguish generic ASan metatests from ones that
require suppport for memory poisoning.

In practice our platforms support both, so run "poison" tests in
the same all.sh components where we run "asan" ones.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-01-17 14:53:08 +00:00
David Horstmann
9432e64933 Only run memory poisoning metatests when poisoning
When we cannot memory poison due to platform constraints, do not attempt
to run memory poisoning metatests (but still run other ASan metatests).

Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-01-12 15:13:54 +00:00
Paul Elliott
17c119a5e3 Migrate to threading_helpers.h
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2024-01-05 21:04:52 +00:00
Paul Elliott
4580d4d829 Add accessor helpers for mbedtls_test_info
Step one of being able to control access to mbedtls_test_info with
a mutex.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2024-01-05 19:13:43 +00:00
Gilles Peskine
6f8ca29ce4 Use the existing definition of __func__
Now that library is in the include path when compiling metatest.c, don't
duplicate the definition of __func__ from library/common.h.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-29 19:42:43 +01:00
Gilles Peskine
895ebc30f0 Protect against compiler optimizations
GCC 5.4 optimized the write after poisoning (the surprising thing is that
11.4 doesn't).

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-29 19:42:36 +01:00
Gilles Peskine
ef0f01fee6 Memory poisoning: meta-test writes as well as reads
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-29 19:42:36 +01:00
Gilles Peskine
e0acf8787d Port to platforms where printf doesn't have %zu
Reuse the existing abstraction from include/mbedtls/debug.h.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-29 19:22:03 +01:00
Gilles Peskine
f5dd00288e Fix MSVC build failure
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-29 19:22:03 +01:00
Gilles Peskine
0bdb6dc079 Fix memory poisoning with Asan on arbitrary byte boundaries
Asan poisons memory with an 8-byte granularity. We want to make sure that
the whole specified region is poisoned (our typical use case is a
heap-allocated object, and we want to poison the whole object, and we don't
care about the bytes after the end of the object and up to the beginning of
the next object). So align the start and end of the region to (un)poison to
an 8-byte boundary.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-29 19:22:03 +01:00
Gilles Peskine
d29cce91d0 Add memory poisoning framework
While an area of memory is poisoned, reading or writing from it triggers a
sanitizer violation.

Implemented for ASan.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-29 19:22:03 +01:00
Gilles Peskine
7a715c4537 Fix the build with gcc-12 -Wuse-after-free
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-21 13:42:40 +01:00
Gilles Peskine
2f40cc05f0 Improve explanations of what bad thing a metatest does
Especially clarify the situation with respect to mutex usage.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-16 15:13:38 +01:00
Gilles Peskine
ad2a17eb60 Uniformly use MBEDTLS_THREADING_C guards
Since the code compiles with MBEDTLS_THREADING_C, not just with
MBEDTLS_THREADING_PTHREAD, use MBEDTLS_THREADING_C as the guard. The runtime
behavior is only as desired under certain conditions that imply
MBEDTLS_THREADING_PTHREAD, but that's fine: no metatest is expected to pass
in all scenarios, only under specific build- and run-time conditions.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-16 15:09:48 +01:00
Gilles Peskine
cce0012463 Add documentation
Explain the goals of metatests, how to write them, and how to read their
output.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-10 15:36:15 +01:00
Gilles Peskine
ccb121500d Uninitialized read: make the pointer non-volatile rather than the buffer
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-10 11:35:36 +01:00
Gilles Peskine
da6e7a2ac2 More consistent usage of volatile
Fix MSVC warning C4090.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-10 10:09:27 +01:00
Gilles Peskine
d2fa698155 Strengthen against possible compiler optimizations
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-09 21:46:24 +01:00
Gilles Peskine
102aea2ba8 Add metatests for mutex usage
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-06 20:33:19 +01:00
Gilles Peskine
f0d5cf9a0c Don't use %llx in printf
We still do MinGW builds on our CI whose printf doesn't support it!

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-06 20:33:19 +01:00
Gilles Peskine
a1dfa14c06 Fix cast from pointer to integer of different size
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-06 20:33:19 +01:00
Gilles Peskine
ee8109541a Don't cast a function pointer to a data pointer
That's nonstandard. Instead, convert to an integer.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-06 20:33:19 +01:00
Gilles Peskine
6aa9f32124 Use casts when doing nonstandard pointer conversions
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-06 20:33:19 +01:00
Gilles Peskine
69e8db0366 Strengthen against Clang optimizations
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-06 20:33:19 +01:00
Gilles Peskine
b0f0a64de0 Metatests for basic Asan and Msan features
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-06 20:33:19 +01:00
Gilles Peskine
80ba832be6 Metatests for null pointer dereference
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-06 20:33:09 +01:00
Gilles Peskine
f309fbf0d5 Validate that test_fail causes a test failure
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-06 20:33:09 +01:00
Gilles Peskine
33406b645d Add a metatest program
This program can be used to validate that things that should be detected as
test failures are indeed caught, either by setting the test result to
MBEDTLS_TEST_RESULT_FAILED or by aborting the program.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-11-06 20:33:09 +01:00