Commit 60371f43 authored by Kees Cook's avatar Kees Cook
Browse files

exec: Add KUnit test for bprm_stack_limits() 

Since bprm_stack_limits() operates with very limited side-effects, add
it as the first exec.c KUnit test. Add to Kconfig and adjust MAINTAINERS
file to include it.

Tested on 64-bit UML:
$ tools/testing/kunit/kunit.py run exec

Link: https://lore.kernel.org/lkml/20240520021615.741800-1-keescook@chromium.org/


Signed-off-by: default avatarKees Cook <kees@kernel.org>
parent 3545deff

MAINTAINERS

+2 −0
Original line number Diff line number Diff line
@@ -8218,7 +8218,9 @@ S: Supported 
T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/execve

F:	Documentation/userspace-api/ELF.rst

F:	fs/*binfmt_*.c

F:	fs/Kconfig.binfmt

F:	fs/exec.c

F:	fs/exec_test.c

F:	include/linux/binfmts.h

F:	include/linux/elf.h

F:	include/uapi/linux/binfmts.h

fs/Kconfig.binfmt

+8 −0
Original line number Diff line number Diff line
@@ -176,4 +176,12 @@ config COREDUMP 
	  certainly want to say Y here. Not necessary on systems that never

	  need debugging or only ever run flawless code.



config EXEC_KUNIT_TEST

	bool "Build execve tests" if !KUNIT_ALL_TESTS

	depends on KUNIT=y

	default KUNIT_ALL_TESTS

	help

	  This builds the exec KUnit tests, which tests boundary conditions

	  of various aspects of the exec internals.



endmenu

fs/exec.c

+13 −0
Original line number Diff line number Diff line
@@ -486,6 +486,15 @@ static int count_strings_kernel(const char *const *argv) 
	return i;

}



/*

 * Calculate bprm->argmin from:

 * - _STK_LIM

 * - ARG_MAX

 * - bprm->rlim_stack.rlim_cur

 * - bprm->argc

 * - bprm->envc

 * - bprm->p

 */

static int bprm_stack_limits(struct linux_binprm *bprm)

{

	unsigned long limit, ptr_size;
@@ -2211,3 +2220,7 @@ static int __init init_fs_exec_sysctls(void) 


fs_initcall(init_fs_exec_sysctls);

#endif /* CONFIG_SYSCTL */



#ifdef CONFIG_EXEC_KUNIT_TEST

#include "exec_test.c"

#endif

fs/exec_test.c

0 → 100644
+113 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

#include <kunit/test.h>



struct bprm_stack_limits_result {

	struct linux_binprm bprm;

	int expected_rc;

	unsigned long expected_argmin;

};



static const struct bprm_stack_limits_result bprm_stack_limits_results[] = {

	/* Giant values produce -E2BIG */

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,

	    .argc = INT_MAX, .envc = INT_MAX }, .expected_rc = -E2BIG },

	/*

	 * 0 rlim_stack will get raised to ARG_MAX. With 1 string pointer,

	 * we should see p - ARG_MAX + sizeof(void *).

	 */

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,

	    .argc = 1, .envc = 0 }, .expected_argmin = ULONG_MAX - ARG_MAX + sizeof(void *)},

	/* Validate that argc is always raised to a minimum of 1. */

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,

	    .argc = 0, .envc = 0 }, .expected_argmin = ULONG_MAX - ARG_MAX + sizeof(void *)},

	/*

	 * 0 rlim_stack will get raised to ARG_MAX. With pointers filling ARG_MAX,

	 * we should see -E2BIG. (Note argc is always raised to at least 1.)

	 */

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,

	    .argc = ARG_MAX / sizeof(void *), .envc = 0 }, .expected_rc = -E2BIG },

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,

	    .argc = 0, .envc = ARG_MAX / sizeof(void *) - 1 }, .expected_rc = -E2BIG },

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,

	    .argc = ARG_MAX / sizeof(void *) + 1, .envc = 0 }, .expected_rc = -E2BIG },

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,

	    .argc = 0, .envc = ARG_MAX / sizeof(void *) }, .expected_rc = -E2BIG },

	/* And with one less, we see space for exactly 1 pointer. */

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,

	    .argc = (ARG_MAX / sizeof(void *)) - 1, .envc = 0 },

	  .expected_argmin = ULONG_MAX - sizeof(void *) },

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,

	    .argc = 0, .envc = (ARG_MAX / sizeof(void *)) - 2, },

	  .expected_argmin = ULONG_MAX - sizeof(void *) },

	/* If we raise rlim_stack / 4 to exactly ARG_MAX, nothing changes. */

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,

	    .argc = ARG_MAX / sizeof(void *), .envc = 0 }, .expected_rc = -E2BIG },

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,

	    .argc = 0, .envc = ARG_MAX / sizeof(void *) - 1 }, .expected_rc = -E2BIG },

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,

	    .argc = ARG_MAX / sizeof(void *) + 1, .envc = 0 }, .expected_rc = -E2BIG },

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,

	    .argc = 0, .envc = ARG_MAX / sizeof(void *) }, .expected_rc = -E2BIG },

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,

	    .argc = (ARG_MAX / sizeof(void *)) - 1, .envc = 0 },

	  .expected_argmin = ULONG_MAX - sizeof(void *) },

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,

	    .argc = 0, .envc = (ARG_MAX / sizeof(void *)) - 2, },

	  .expected_argmin = ULONG_MAX - sizeof(void *) },

	/* But raising it another pointer * 4 will provide space for 1 more pointer. */

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = (ARG_MAX + sizeof(void *)) * 4,

	    .argc = ARG_MAX / sizeof(void *), .envc = 0 },

	  .expected_argmin = ULONG_MAX - sizeof(void *) },

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = (ARG_MAX + sizeof(void *)) * 4,

	    .argc = 0, .envc = ARG_MAX / sizeof(void *) - 1 },

	  .expected_argmin = ULONG_MAX - sizeof(void *) },

	/* Raising rlim_stack / 4 to _STK_LIM / 4 * 3 will see more space. */

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * 3),

	    .argc = 0, .envc = 0 },

	  .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * 3),

	    .argc = 0, .envc = 0 },

	  .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },

	/* But raising it any further will see no increase. */

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * 3 + sizeof(void *)),

	    .argc = 0, .envc = 0 },

	  .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 *  + sizeof(void *)),

	    .argc = 0, .envc = 0 },

	  .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * _STK_LIM,

	    .argc = 0, .envc = 0 },

	  .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },

	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * _STK_LIM,

	    .argc = 0, .envc = 0 },

	  .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },

};



static void exec_test_bprm_stack_limits(struct kunit *test)

{

	/* Double-check the constants. */

	KUNIT_EXPECT_EQ(test, _STK_LIM, SZ_8M);

	KUNIT_EXPECT_EQ(test, ARG_MAX, 32 * SZ_4K);



	for (int i = 0; i < ARRAY_SIZE(bprm_stack_limits_results); i++) {

		const struct bprm_stack_limits_result *result = &bprm_stack_limits_results[i];

		struct linux_binprm bprm = result->bprm;

		int rc;



		rc = bprm_stack_limits(&bprm);

		KUNIT_EXPECT_EQ_MSG(test, rc, result->expected_rc, "on loop %d", i);

		KUNIT_EXPECT_EQ_MSG(test, bprm.argmin, result->expected_argmin, "on loop %d", i);

	}

}



static struct kunit_case exec_test_cases[] = {

	KUNIT_CASE(exec_test_bprm_stack_limits),

	{},

};



static struct kunit_suite exec_test_suite = {

	.name = "exec",

	.test_cases = exec_test_cases,

};



kunit_test_suite(exec_test_suite);