exec: Add KUnit test for bprm_stack_limits()
Since bprm_stack_limits() operates with very limited side-effects, add it as the first exec.c KUnit test. Add to Kconfig and adjust MAINTAINERS file to include it. Tested on 64-bit UML: $ tools/testing/kunit/kunit.py run exec Link: https://lore.kernel.org/lkml/20240520021615.741800-1-keescook@chromium.org/ Signed-off-by: Kees Cook <kees@kernel.org>
This commit is contained in:
Kees Cook
parent
3545deff0e
commit
60371f43e5
@ -8218,7 +8218,9 @@ S: Supported
|
||||
T: git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/execve
|
||||
F: Documentation/userspace-api/ELF.rst
|
||||
F: fs/*binfmt_*.c
|
||||
F: fs/Kconfig.binfmt
|
||||
F: fs/exec.c
|
||||
F: fs/exec_test.c
|
||||
F: include/linux/binfmts.h
|
||||
F: include/linux/elf.h
|
||||
F: include/uapi/linux/binfmts.h
|
||||
|
||||
@ -176,4 +176,12 @@ config COREDUMP
|
||||
certainly want to say Y here. Not necessary on systems that never
|
||||
need debugging or only ever run flawless code.
|
||||
|
||||
config EXEC_KUNIT_TEST
|
||||
bool "Build execve tests" if !KUNIT_ALL_TESTS
|
||||
depends on KUNIT=y
|
||||
default KUNIT_ALL_TESTS
|
||||
help
|
||||
This builds the exec KUnit tests, which tests boundary conditions
|
||||
of various aspects of the exec internals.
|
||||
|
||||
endmenu
|
||||
|
||||
13
fs/exec.c
13
fs/exec.c
@ -486,6 +486,15 @@ static int count_strings_kernel(const char *const *argv)
|
||||
return i;
|
||||
}
|
||||
|
||||
/*
|
||||
* Calculate bprm->argmin from:
|
||||
* - _STK_LIM
|
||||
* - ARG_MAX
|
||||
* - bprm->rlim_stack.rlim_cur
|
||||
* - bprm->argc
|
||||
* - bprm->envc
|
||||
* - bprm->p
|
||||
*/
|
||||
static int bprm_stack_limits(struct linux_binprm *bprm)
|
||||
{
|
||||
unsigned long limit, ptr_size;
|
||||
@ -2211,3 +2220,7 @@ static int __init init_fs_exec_sysctls(void)
|
||||
|
||||
fs_initcall(init_fs_exec_sysctls);
|
||||
#endif /* CONFIG_SYSCTL */
|
||||
|
||||
#ifdef CONFIG_EXEC_KUNIT_TEST
|
||||
#include "exec_test.c"
|
||||
#endif
|
||||
|
||||
113
fs/exec_test.c
Normal file
113
fs/exec_test.c
Normal file
@ -0,0 +1,113 @@
|
||||
// SPDX-License-Identifier: GPL-2.0-only
|
||||
#include <kunit/test.h>
|
||||
|
||||
struct bprm_stack_limits_result {
|
||||
struct linux_binprm bprm;
|
||||
int expected_rc;
|
||||
unsigned long expected_argmin;
|
||||
};
|
||||
|
||||
static const struct bprm_stack_limits_result bprm_stack_limits_results[] = {
|
||||
/* Giant values produce -E2BIG */
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,
|
||||
.argc = INT_MAX, .envc = INT_MAX }, .expected_rc = -E2BIG },
|
||||
/*
|
||||
* 0 rlim_stack will get raised to ARG_MAX. With 1 string pointer,
|
||||
* we should see p - ARG_MAX + sizeof(void *).
|
||||
*/
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
|
||||
.argc = 1, .envc = 0 }, .expected_argmin = ULONG_MAX - ARG_MAX + sizeof(void *)},
|
||||
/* Validate that argc is always raised to a minimum of 1. */
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
|
||||
.argc = 0, .envc = 0 }, .expected_argmin = ULONG_MAX - ARG_MAX + sizeof(void *)},
|
||||
/*
|
||||
* 0 rlim_stack will get raised to ARG_MAX. With pointers filling ARG_MAX,
|
||||
* we should see -E2BIG. (Note argc is always raised to at least 1.)
|
||||
*/
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
|
||||
.argc = ARG_MAX / sizeof(void *), .envc = 0 }, .expected_rc = -E2BIG },
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
|
||||
.argc = 0, .envc = ARG_MAX / sizeof(void *) - 1 }, .expected_rc = -E2BIG },
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
|
||||
.argc = ARG_MAX / sizeof(void *) + 1, .envc = 0 }, .expected_rc = -E2BIG },
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
|
||||
.argc = 0, .envc = ARG_MAX / sizeof(void *) }, .expected_rc = -E2BIG },
|
||||
/* And with one less, we see space for exactly 1 pointer. */
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
|
||||
.argc = (ARG_MAX / sizeof(void *)) - 1, .envc = 0 },
|
||||
.expected_argmin = ULONG_MAX - sizeof(void *) },
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
|
||||
.argc = 0, .envc = (ARG_MAX / sizeof(void *)) - 2, },
|
||||
.expected_argmin = ULONG_MAX - sizeof(void *) },
|
||||
/* If we raise rlim_stack / 4 to exactly ARG_MAX, nothing changes. */
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
|
||||
.argc = ARG_MAX / sizeof(void *), .envc = 0 }, .expected_rc = -E2BIG },
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
|
||||
.argc = 0, .envc = ARG_MAX / sizeof(void *) - 1 }, .expected_rc = -E2BIG },
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
|
||||
.argc = ARG_MAX / sizeof(void *) + 1, .envc = 0 }, .expected_rc = -E2BIG },
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
|
||||
.argc = 0, .envc = ARG_MAX / sizeof(void *) }, .expected_rc = -E2BIG },
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
|
||||
.argc = (ARG_MAX / sizeof(void *)) - 1, .envc = 0 },
|
||||
.expected_argmin = ULONG_MAX - sizeof(void *) },
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
|
||||
.argc = 0, .envc = (ARG_MAX / sizeof(void *)) - 2, },
|
||||
.expected_argmin = ULONG_MAX - sizeof(void *) },
|
||||
/* But raising it another pointer * 4 will provide space for 1 more pointer. */
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = (ARG_MAX + sizeof(void *)) * 4,
|
||||
.argc = ARG_MAX / sizeof(void *), .envc = 0 },
|
||||
.expected_argmin = ULONG_MAX - sizeof(void *) },
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = (ARG_MAX + sizeof(void *)) * 4,
|
||||
.argc = 0, .envc = ARG_MAX / sizeof(void *) - 1 },
|
||||
.expected_argmin = ULONG_MAX - sizeof(void *) },
|
||||
/* Raising rlim_stack / 4 to _STK_LIM / 4 * 3 will see more space. */
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * 3),
|
||||
.argc = 0, .envc = 0 },
|
||||
.expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * 3),
|
||||
.argc = 0, .envc = 0 },
|
||||
.expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
|
||||
/* But raising it any further will see no increase. */
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * 3 + sizeof(void *)),
|
||||
.argc = 0, .envc = 0 },
|
||||
.expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * + sizeof(void *)),
|
||||
.argc = 0, .envc = 0 },
|
||||
.expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * _STK_LIM,
|
||||
.argc = 0, .envc = 0 },
|
||||
.expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
|
||||
{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * _STK_LIM,
|
||||
.argc = 0, .envc = 0 },
|
||||
.expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
|
||||
};
|
||||
|
||||
static void exec_test_bprm_stack_limits(struct kunit *test)
|
||||
{
|
||||
/* Double-check the constants. */
|
||||
KUNIT_EXPECT_EQ(test, _STK_LIM, SZ_8M);
|
||||
KUNIT_EXPECT_EQ(test, ARG_MAX, 32 * SZ_4K);
|
||||
|
||||
for (int i = 0; i < ARRAY_SIZE(bprm_stack_limits_results); i++) {
|
||||
const struct bprm_stack_limits_result *result = &bprm_stack_limits_results[i];
|
||||
struct linux_binprm bprm = result->bprm;
|
||||
int rc;
|
||||
|
||||
rc = bprm_stack_limits(&bprm);
|
||||
KUNIT_EXPECT_EQ_MSG(test, rc, result->expected_rc, "on loop %d", i);
|
||||
KUNIT_EXPECT_EQ_MSG(test, bprm.argmin, result->expected_argmin, "on loop %d", i);
|
||||
}
|
||||
}
|
||||
|
||||
static struct kunit_case exec_test_cases[] = {
|
||||
KUNIT_CASE(exec_test_bprm_stack_limits),
|
||||
{},
|
||||
};
|
||||
|
||||
static struct kunit_suite exec_test_suite = {
|
||||
.name = "exec",
|
||||
.test_cases = exec_test_cases,
|
||||
};
|
||||
|
||||
kunit_test_suite(exec_test_suite);
|
||||
Loading…
Reference in New Issue
Block a user