On Thu, Feb 24, 2022 at 1:43 PM Kees Cook <keescook@xxxxxxxxxxxx> wrote:
>
> Adds simple KUnit test for some binfmt_elf internals: specifically a
> regression test for the problem fixed by commit 8904d9cd90ee ("ELF:
> fix overflow in total mapping size calculation").
>
(Just as a note to anyone else testing this, this hasn't hit
linux-next yet, so the test does fail out of the box.)
> Cc: Eric Biederman <ebiederm@xxxxxxxxxxxx>
> Cc: David Gow <davidgow@xxxxxxxxxx>
> Cc: Alexey Dobriyan <adobriyan@xxxxxxxxx>
> Cc: "Magnus Groß" <magnus.gross@xxxxxxxxxxxxxx>
> Cc: kunit-dev@xxxxxxxxxxxxxxxx
> Cc: linux-fsdevel@xxxxxxxxxxxxxxx
> Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
> ---
This looks like a pretty sensible test to me. It's definitely doing a
few weird things with the whole COMPAT support bit, and I do think
that inverting the flow and having the binfmt_elf_test.c file include
binfmt_elf.c is probably the more flexible solution.
In any case, the test works well for me (including the compat_
variant), modulo a build error and needing to apply the aforementioned
fix first.
Cheers,
-- David
> I'm exploring ways to mock copy_to_user() for more tests in here.
> kprobes doesn't seem to let me easily hijack a function...
Not much to add to what Daniel said here, other than to re-tread some
old discussions around using ftrace, weak-linked symbols, and all
sorts of other horrors to intercept function calls.
The least horrifying solution we've thought of thus far is to
literally change the function to add a test to see if it's running
under a KUnit test which wants to mock it out (using the pointer in
task_struct and KUnit named resources to check). Even then, that's
definitely the sort of thing that you want behind an #ifdef
CONFIG_KUNIT check, and even then is likely to be met with some
disapproval for something as performance-sensitive as copy_to_user().
Of course, if just including the binfmt_elf.c file from within the
test file and using #defines works -- i.e., we don't need to care
about very indirect calls from within different files -- then that's
the simplest solution.
More binfmt_elf tests would be great, though, particularly if we can
get some of those nasty parsing functions tested.
> ---
> fs/Kconfig.binfmt | 17 +++++++++++
> fs/binfmt_elf.c | 4 +++
> fs/binfmt_elf_test.c | 64 ++++++++++++++++++++++++++++++++++++++++++
> fs/compat_binfmt_elf.c | 2 ++
> 4 files changed, 87 insertions(+)
> create mode 100644 fs/binfmt_elf_test.c
>
> diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
> index 4d5ae61580aa..8e14589ee9cc 100644
> --- a/fs/Kconfig.binfmt
> +++ b/fs/Kconfig.binfmt
> @@ -28,6 +28,23 @@ config BINFMT_ELF
> ld.so (check the file <file:Documentation/Changes> for location and
> latest version).
>
> +config BINFMT_ELF_KUNIT_TEST
> + bool "Build KUnit tests for ELF binary support" if !KUNIT_ALL_TESTS
> + depends on KUNIT=y && BINFMT_ELF=y
> + default KUNIT_ALL_TESTS
> + help
> + This builds the ELF loader KUnit tests.
> +
> + KUnit tests run during boot and output the results to the debug log
> + in TAP format (https://testanything.org/). Only useful for kernel devs
> + running KUnit test harness and are not for inclusion into a
> + production build.
It might be worth documenting here that this particular config option
actually builds two test suites if COMPAT is enabled.
> +
> + For more information on KUnit and unit tests in general please refer
> + to the KUnit documentation in Documentation/dev-tools/kunit/.
> +
> + If unsure, say N.
> +
> config COMPAT_BINFMT_ELF
> def_bool y
> depends on COMPAT && BINFMT_ELF
> diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> index 76ff2af15ba5..9bea703ed1c2 100644
> --- a/fs/binfmt_elf.c
> +++ b/fs/binfmt_elf.c
> @@ -2335,3 +2335,7 @@ static void __exit exit_elf_binfmt(void)
> core_initcall(init_elf_binfmt);
> module_exit(exit_elf_binfmt);
> MODULE_LICENSE("GPL");
> +
> +#ifdef CONFIG_BINFMT_ELF_KUNIT_TEST
> +#include "binfmt_elf_test.c"
> +#endif
> diff --git a/fs/binfmt_elf_test.c b/fs/binfmt_elf_test.c
> new file mode 100644
> index 000000000000..486ad419f763
> --- /dev/null
> +++ b/fs/binfmt_elf_test.c
> @@ -0,0 +1,64 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +#include <kunit/test.h>
> +
> +static void total_mapping_size_test(struct kunit *test)
> +{
> + struct elf_phdr empty[] = {
> + { .p_type = PT_LOAD, .p_vaddr = 0, .p_memsz = 0, },
> + { .p_type = PT_INTERP, .p_vaddr = 10, .p_memsz = 999999, },
> + };
> + /*
> + * readelf -lW /bin/mount | grep '^ .*0x0' | awk '{print "\t\t{ .p_type = PT_" \
> + * $1 ", .p_vaddr = " $3 ", .p_memsz = " $6 ", },"}'
> + */
> + struct elf_phdr mount[] = {
> + { .p_type = PT_PHDR, .p_vaddr = 0x00000040, .p_memsz = 0x0002d8, },
> + { .p_type = PT_INTERP, .p_vaddr = 0x00000318, .p_memsz = 0x00001c, },
> + { .p_type = PT_LOAD, .p_vaddr = 0x00000000, .p_memsz = 0x0033a8, },
> + { .p_type = PT_LOAD, .p_vaddr = 0x00004000, .p_memsz = 0x005c91, },
> + { .p_type = PT_LOAD, .p_vaddr = 0x0000a000, .p_memsz = 0x0022f8, },
> + { .p_type = PT_LOAD, .p_vaddr = 0x0000d330, .p_memsz = 0x000d40, },
> + { .p_type = PT_DYNAMIC, .p_vaddr = 0x0000d928, .p_memsz = 0x000200, },
> + { .p_type = PT_NOTE, .p_vaddr = 0x00000338, .p_memsz = 0x000030, },
> + { .p_type = PT_NOTE, .p_vaddr = 0x00000368, .p_memsz = 0x000044, },
> + { .p_type = PT_GNU_PROPERTY, .p_vaddr = 0x00000338, .p_memsz = 0x000030, },
> + { .p_type = PT_GNU_EH_FRAME, .p_vaddr = 0x0000b490, .p_memsz = 0x0001ec, },
> + { .p_type = PT_GNU_STACK, .p_vaddr = 0x00000000, .p_memsz = 0x000000, },
> + { .p_type = PT_GNU_RELRO, .p_vaddr = 0x0000d330, .p_memsz = 0x000cd0, },
This doesn't build for me, as PT_GNU_RELRO isn't defined. Adding it
makes the test build:
---
Signed-off-by: David Gow <davidgow@xxxxxxxxxx>
---
diff --git a/include/uapi/linux/elf.h b/include/uapi/linux/elf.h
index 61bf4774b8f2..c33cdb4d9464 100644
--- a/include/uapi/linux/elf.h
+++ b/include/uapi/linux/elf.h
@@ -36,6 +36,7 @@ typedef __s64 Elf64_Sxword;
#define PT_LOPROC 0x70000000
#define PT_HIPROC 0x7fffffff
#define PT_GNU_EH_FRAME 0x6474e550
+#define PT_GNU_RELRO 0x6474e552
#define PT_GNU_PROPERTY 0x6474e553
#define PT_GNU_STACK (PT_LOOS + 0x474e551)
---
> + };
> + size_t mount_size = 0xE070;
> + /* https://lore.kernel.org/lkml/YfF18Dy85mCntXrx@fractal.localdomain */
> + struct elf_phdr unordered[] = {
> + { .p_type = PT_LOAD, .p_vaddr = 0x00000000, .p_memsz = 0x0033a8, },
> + { .p_type = PT_LOAD, .p_vaddr = 0x0000d330, .p_memsz = 0x000d40, },
> + { .p_type = PT_LOAD, .p_vaddr = 0x00004000, .p_memsz = 0x005c91, },
> + { .p_type = PT_LOAD, .p_vaddr = 0x0000a000, .p_memsz = 0x0022f8, },
> + };
> +
> + /* No headers, no size. */
> + KUNIT_EXPECT_EQ(test, total_mapping_size(NULL, 0), 0);
> + KUNIT_EXPECT_EQ(test, total_mapping_size(empty, 0), 0);
> + /* Empty headers, no size. */
> + KUNIT_EXPECT_EQ(test, total_mapping_size(empty, 1), 0);
> + /* No PT_LOAD headers, no size. */
> + KUNIT_EXPECT_EQ(test, total_mapping_size(&empty[1], 1), 0);
> + /* Empty PT_LOAD and non-PT_LOAD headers, no size. */
> + KUNIT_EXPECT_EQ(test, total_mapping_size(empty, 2), 0);
> +
> + /* Normal set of PT_LOADS, and expected size. */
> + KUNIT_EXPECT_EQ(test, total_mapping_size(mount, ARRAY_SIZE(mount)), mount_size);
> + /* Unordered PT_LOADs result in same size. */
> + KUNIT_EXPECT_EQ(test, total_mapping_size(unordered, ARRAY_SIZE(unordered)), mount_size);
> +}
> +
> +static struct kunit_case binfmt_elf_test_cases[] = {
> + KUNIT_CASE(total_mapping_size_test),
> + {},
> +};
> +
> +static struct kunit_suite binfmt_elf_test_suite = {
> + .name = KBUILD_MODNAME,
> + .test_cases = binfmt_elf_test_cases,
> +};
> +
> +kunit_test_suite(binfmt_elf_test_suite);
> diff --git a/fs/compat_binfmt_elf.c b/fs/compat_binfmt_elf.c
> index 95e72d271b95..8f0af4f62631 100644
> --- a/fs/compat_binfmt_elf.c
> +++ b/fs/compat_binfmt_elf.c
> @@ -135,6 +135,8 @@
> #define elf_format compat_elf_format
> #define init_elf_binfmt init_compat_elf_binfmt
> #define exit_elf_binfmt exit_compat_elf_binfmt
> +#define binfmt_elf_test_cases compat_binfmt_elf_test_cases
> +#define binfmt_elf_test_suite compat_binfmt_elf_test_suite
>
> /*
> * We share all the actual code with the native (64-bit) version.
> --
> 2.30.2
>
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
