exec: Add KUnit test for bprm_stack_limits()

Since bprm_stack_limits() operates with very limited side-effects, add
it as the first exec.c KUnit test. Add to Kconfig and adjust MAINTAINERS
file to include it.

Tested on 64-bit UML:
$ tools/testing/kunit/kunit.py run exec

Link: https://lore.kernel.org/lkml/20240520021615.741800-1-keescook@chromium.org/
Signed-off-by: Kees Cook <kees@kernel.org>

diff --git a/MAINTAINERS b/MAINTAINERS
index 8754ac2c259dc9f7ca27737aa373d74ad24a0add..8dfbe998f175f9b8df13c43de93d981359842b33 100644 (file)
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -8218,7 +8218,9 @@ S:        Supported
 T:     git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/execve
 F:     Documentation/userspace-api/ELF.rst
 F:     fs/*binfmt_*.c
+F:     fs/Kconfig.binfmt
 F:     fs/exec.c
+F:     fs/exec_test.c
 F:     include/linux/binfmts.h
 F:     include/linux/elf.h
 F:     include/uapi/linux/binfmts.h

diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
index f5693164ca9a311e97eed173c73ce27ab740d8cf..bd2f530e574086ff5b6d67fd0b906b5196271f58 100644 (file)
--- a/fs/Kconfig.binfmt
+++ b/fs/Kconfig.binfmt
@@ -176,4 +176,12 @@ config COREDUMP
          certainly want to say Y here. Not necessary on systems that never
          need debugging or only ever run flawless code.
 
+config EXEC_KUNIT_TEST
+       bool "Build execve tests" if !KUNIT_ALL_TESTS
+       depends on KUNIT=y
+       default KUNIT_ALL_TESTS
+       help
+         This builds the exec KUnit tests, which tests boundary conditions
+         of various aspects of the exec internals.
+
 endmenu

diff --git a/fs/exec.c b/fs/exec.c
index 40073142288f7a104ef794525b08706b68703795..c3bec126505bad285e2ff720cadac110d3a59028 100644 (file)
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -486,6 +486,15 @@ static int count_strings_kernel(const char *const *argv)
        return i;
 }
 
+/*
+ * Calculate bprm->argmin from:
+ * - _STK_LIM
+ * - ARG_MAX
+ * - bprm->rlim_stack.rlim_cur
+ * - bprm->argc
+ * - bprm->envc
+ * - bprm->p
+ */
 static int bprm_stack_limits(struct linux_binprm *bprm)
 {
        unsigned long limit, ptr_size;
@@ -2211,3 +2220,7 @@ static int __init init_fs_exec_sysctls(void)
 
 fs_initcall(init_fs_exec_sysctls);
 #endif /* CONFIG_SYSCTL */
+
+#ifdef CONFIG_EXEC_KUNIT_TEST
+#include "exec_test.c"
+#endif

diff --git a/fs/exec_test.c b/fs/exec_test.c
new file mode 100644 (file)
index 0000000..32a90c6
--- /dev/null
+++ b/fs/exec_test.c
@@ -0,0 +1,113 @@
+// SPDX-License-Identifier: GPL-2.0-only
+#include <kunit/test.h>
+
+struct bprm_stack_limits_result {
+       struct linux_binprm bprm;
+       int expected_rc;
+       unsigned long expected_argmin;
+};
+
+static const struct bprm_stack_limits_result bprm_stack_limits_results[] = {
+       /* Giant values produce -E2BIG */
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,
+           .argc = INT_MAX, .envc = INT_MAX }, .expected_rc = -E2BIG },
+       /*
+        * 0 rlim_stack will get raised to ARG_MAX. With 1 string pointer,
+        * we should see p - ARG_MAX + sizeof(void *).
+        */
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
+           .argc = 1, .envc = 0 }, .expected_argmin = ULONG_MAX - ARG_MAX + sizeof(void *)},
+       /* Validate that argc is always raised to a minimum of 1. */
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
+           .argc = 0, .envc = 0 }, .expected_argmin = ULONG_MAX - ARG_MAX + sizeof(void *)},
+       /*
+        * 0 rlim_stack will get raised to ARG_MAX. With pointers filling ARG_MAX,
+        * we should see -E2BIG. (Note argc is always raised to at least 1.)
+        */
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
+           .argc = ARG_MAX / sizeof(void *), .envc = 0 }, .expected_rc = -E2BIG },
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
+           .argc = 0, .envc = ARG_MAX / sizeof(void *) - 1 }, .expected_rc = -E2BIG },
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
+           .argc = ARG_MAX / sizeof(void *) + 1, .envc = 0 }, .expected_rc = -E2BIG },
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
+           .argc = 0, .envc = ARG_MAX / sizeof(void *) }, .expected_rc = -E2BIG },
+       /* And with one less, we see space for exactly 1 pointer. */
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
+           .argc = (ARG_MAX / sizeof(void *)) - 1, .envc = 0 },
+         .expected_argmin = ULONG_MAX - sizeof(void *) },
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
+           .argc = 0, .envc = (ARG_MAX / sizeof(void *)) - 2, },
+         .expected_argmin = ULONG_MAX - sizeof(void *) },
+       /* If we raise rlim_stack / 4 to exactly ARG_MAX, nothing changes. */
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
+           .argc = ARG_MAX / sizeof(void *), .envc = 0 }, .expected_rc = -E2BIG },
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
+           .argc = 0, .envc = ARG_MAX / sizeof(void *) - 1 }, .expected_rc = -E2BIG },
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
+           .argc = ARG_MAX / sizeof(void *) + 1, .envc = 0 }, .expected_rc = -E2BIG },
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
+           .argc = 0, .envc = ARG_MAX / sizeof(void *) }, .expected_rc = -E2BIG },
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
+           .argc = (ARG_MAX / sizeof(void *)) - 1, .envc = 0 },
+         .expected_argmin = ULONG_MAX - sizeof(void *) },
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
+           .argc = 0, .envc = (ARG_MAX / sizeof(void *)) - 2, },
+         .expected_argmin = ULONG_MAX - sizeof(void *) },
+       /* But raising it another pointer * 4 will provide space for 1 more pointer. */
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = (ARG_MAX + sizeof(void *)) * 4,
+           .argc = ARG_MAX / sizeof(void *), .envc = 0 },
+         .expected_argmin = ULONG_MAX - sizeof(void *) },
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = (ARG_MAX + sizeof(void *)) * 4,
+           .argc = 0, .envc = ARG_MAX / sizeof(void *) - 1 },
+         .expected_argmin = ULONG_MAX - sizeof(void *) },
+       /* Raising rlim_stack / 4 to _STK_LIM / 4 * 3 will see more space. */
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * 3),
+           .argc = 0, .envc = 0 },
+         .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * 3),
+           .argc = 0, .envc = 0 },
+         .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
+       /* But raising it any further will see no increase. */
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * 3 + sizeof(void *)),
+           .argc = 0, .envc = 0 },
+         .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 *  + sizeof(void *)),
+           .argc = 0, .envc = 0 },
+         .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * _STK_LIM,
+           .argc = 0, .envc = 0 },
+         .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
+       { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * _STK_LIM,
+           .argc = 0, .envc = 0 },
+         .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
+};
+
+static void exec_test_bprm_stack_limits(struct kunit *test)
+{
+       /* Double-check the constants. */
+       KUNIT_EXPECT_EQ(test, _STK_LIM, SZ_8M);
+       KUNIT_EXPECT_EQ(test, ARG_MAX, 32 * SZ_4K);
+
+       for (int i = 0; i < ARRAY_SIZE(bprm_stack_limits_results); i++) {
+               const struct bprm_stack_limits_result *result = &bprm_stack_limits_results[i];
+               struct linux_binprm bprm = result->bprm;
+               int rc;
+
+               rc = bprm_stack_limits(&bprm);
+               KUNIT_EXPECT_EQ_MSG(test, rc, result->expected_rc, "on loop %d", i);
+               KUNIT_EXPECT_EQ_MSG(test, bprm.argmin, result->expected_argmin, "on loop %d", i);
+       }
+}
+
+static struct kunit_case exec_test_cases[] = {
+       KUNIT_CASE(exec_test_bprm_stack_limits),
+       {},
+};
+
+static struct kunit_suite exec_test_suite = {
+       .name = "exec",
+       .test_cases = exec_test_cases,
+};
+
+kunit_test_suite(exec_test_suite);