On Thu, Feb 24, 2022 at 2:13 PM Kees Cook <keescook@xxxxxxxxxxxx> wrote:
>
> On Wed, Feb 23, 2022 at 10:07:04PM -0800, Daniel Latypov wrote:
> > On Wed, Feb 23, 2022 at 9:43 PM Kees Cook <keescook@xxxxxxxxxxxx> wrote:
> > >
> > > Adds simple KUnit test for some binfmt_elf internals: specifically a
> > > regression test for the problem fixed by commit 8904d9cd90ee ("ELF:
> > > fix overflow in total mapping size calculation").
> > >
> > > Cc: Eric Biederman <ebiederm@xxxxxxxxxxxx>
> > > Cc: David Gow <davidgow@xxxxxxxxxx>
> > > Cc: Alexey Dobriyan <adobriyan@xxxxxxxxx>
> > > Cc: "Magnus Groß" <magnus.gross@xxxxxxxxxxxxxx>
> > > Cc: kunit-dev@xxxxxxxxxxxxxxxx
> > > Cc: linux-fsdevel@xxxxxxxxxxxxxxx
> > > Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
> > > ---
> > > I'm exploring ways to mock copy_to_user() for more tests in here.
> > > kprobes doesn't seem to let me easily hijack a function...
> >
> > Yeah, there doesn't seem to be a good way to do so. It seems more
> > feasible if one is willing to write arch-specific code, but I'm not
> > quite sure if that works either.
>
> Yeah, I'm hoping maybe Steven has some ideas.
>
> Steven, I want to do fancy live-patch kind or things to replace functions,
> but it doesn't need to be particularly fancy because KUnit tests (usually)
> run single-threaded, etc. It looks like kprobes could almost do it, but
> I don't see a way to have it _avoid_ making a function call.
>
> > https://kunit.dev/mocking.html has some thoughts on this.
> > Not sure if there's anything there that would be useful to you, but
> > perhaps it can give you some ideas.
>
> Yeah, I figure a small refactoring to use a passed task_struct can avoid
> the "current" uses in load_elf_binary(), etc, but the copy_to_user() is
> more of a problem. I have considered inverting the Makefile logic,
> though, and having binfmt_elf_test.c include binfmt_elf.c and have it
> just use a #define to redirect copy_to_user, kind of how all the compat
> handling is already done. But it'd be nice to have a "cleaner" mocking
> solution...
>
I think inverting the Makefile makes some sense here, even if it leads
to some code-duplication #define ugliness. Unfortunately, there just
doesn't seem to be a "clean" way of mocking out functions which is
also safe (particularly for something like copy_to_user(), which might
be running in a different thread concurrently with a test) and
performant. If there is a way to refactor the code to avoid the need
for mocking, that's always nice, but can lead to a lot of extraneous
exported functions / interfaces and other code churn.
> >
> > > ---
> > > fs/Kconfig.binfmt | 17 +++++++++++
> > > fs/binfmt_elf.c | 4 +++
> > > fs/binfmt_elf_test.c | 64 ++++++++++++++++++++++++++++++++++++++++++
> > > fs/compat_binfmt_elf.c | 2 ++
> > > 4 files changed, 87 insertions(+)
> > > create mode 100644 fs/binfmt_elf_test.c
> > >
> > > diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
> > > index 4d5ae61580aa..8e14589ee9cc 100644
> > > --- a/fs/Kconfig.binfmt
> > > +++ b/fs/Kconfig.binfmt
> > > @@ -28,6 +28,23 @@ config BINFMT_ELF
> > > ld.so (check the file <file:Documentation/Changes> for location and
> > > latest version).
> > >
> > > +config BINFMT_ELF_KUNIT_TEST
> > > + bool "Build KUnit tests for ELF binary support" if !KUNIT_ALL_TESTS
> > > + depends on KUNIT=y && BINFMT_ELF=y
> > > + default KUNIT_ALL_TESTS
> > > + help
> > > + This builds the ELF loader KUnit tests.
> > > +
> > > + KUnit tests run during boot and output the results to the debug log
> > > + in TAP format (https://testanything.org/). Only useful for kernel devs
> >
> > Tangent: should we update the kunit style guide to not refer to TAP
> > anymore as it's not accurate?
> > The KTAP spec is live on kernel.org at
> > https://www.kernel.org/doc/html/latest/dev-tools/ktap.html
> >
> > We can leave this patch as-is and update later, or have it be the
> > guinea pig for the new proposed wording.
>
> Oops, good point. I was actually thinking it doesn't make too much sense
> to keep repeating the same long boilerplate generally.
>
The KUnit style guide actually never referred to TAP in its example
Kconfig entry, though a number of existing tests did:
https://www.kernel.org/doc/html/latest/dev-tools/kunit/style.html#test-kconfig-entries
> > (I'm personally in favor of people not copy-pasting these paragraphs
> > in the first place, but that is what the style-guide currently
> > recommends)
>
> Let's change the guide? :)
>
I don't think the actual text recommended in the guide is a problem:
it basically just points to the KUnit documentation, but I can send a
patch to soften the wording from "you MUST describe KUnit in the help
text" (or remove it entirely) if people really don't like it.
> >
> > > + running KUnit test harness and are not for inclusion into a
> > > + production build.
> > > +
> > > + For more information on KUnit and unit tests in general please refer
> > > + to the KUnit documentation in Documentation/dev-tools/kunit/.
> > > +
> > > + If unsure, say N.
> > > +
> > > config COMPAT_BINFMT_ELF
> > > def_bool y
> > > depends on COMPAT && BINFMT_ELF
> > > diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> > > index 76ff2af15ba5..9bea703ed1c2 100644
> > > --- a/fs/binfmt_elf.c
> > > +++ b/fs/binfmt_elf.c
> > > @@ -2335,3 +2335,7 @@ static void __exit exit_elf_binfmt(void)
> > > core_initcall(init_elf_binfmt);
> > > module_exit(exit_elf_binfmt);
> > > MODULE_LICENSE("GPL");
> > > +
> > > +#ifdef CONFIG_BINFMT_ELF_KUNIT_TEST
> > > +#include "binfmt_elf_test.c"
> > > +#endif
> > > diff --git a/fs/binfmt_elf_test.c b/fs/binfmt_elf_test.c
> > > new file mode 100644
> > > index 000000000000..486ad419f763
> > > --- /dev/null
> > > +++ b/fs/binfmt_elf_test.c
> > > @@ -0,0 +1,64 @@
> > > +// SPDX-License-Identifier: GPL-2.0-only
> > > +#include <kunit/test.h>
> > > +
> > > +static void total_mapping_size_test(struct kunit *test)
> > > +{
> > > + struct elf_phdr empty[] = {
> > > + { .p_type = PT_LOAD, .p_vaddr = 0, .p_memsz = 0, },
> > > + { .p_type = PT_INTERP, .p_vaddr = 10, .p_memsz = 999999, },
> > > + };
> > > + /*
> > > + * readelf -lW /bin/mount | grep '^ .*0x0' | awk '{print "\t\t{ .p_type = PT_" \
> > > + * $1 ", .p_vaddr = " $3 ", .p_memsz = " $6 ", },"}'
> > > + */
> > > + struct elf_phdr mount[] = {
> > > + { .p_type = PT_PHDR, .p_vaddr = 0x00000040, .p_memsz = 0x0002d8, },
> > > + { .p_type = PT_INTERP, .p_vaddr = 0x00000318, .p_memsz = 0x00001c, },
> > > + { .p_type = PT_LOAD, .p_vaddr = 0x00000000, .p_memsz = 0x0033a8, },
> > > + { .p_type = PT_LOAD, .p_vaddr = 0x00004000, .p_memsz = 0x005c91, },
> > > + { .p_type = PT_LOAD, .p_vaddr = 0x0000a000, .p_memsz = 0x0022f8, },
> > > + { .p_type = PT_LOAD, .p_vaddr = 0x0000d330, .p_memsz = 0x000d40, },
> > > + { .p_type = PT_DYNAMIC, .p_vaddr = 0x0000d928, .p_memsz = 0x000200, },
> > > + { .p_type = PT_NOTE, .p_vaddr = 0x00000338, .p_memsz = 0x000030, },
> > > + { .p_type = PT_NOTE, .p_vaddr = 0x00000368, .p_memsz = 0x000044, },
> > > + { .p_type = PT_GNU_PROPERTY, .p_vaddr = 0x00000338, .p_memsz = 0x000030, },
> > > + { .p_type = PT_GNU_EH_FRAME, .p_vaddr = 0x0000b490, .p_memsz = 0x0001ec, },
> > > + { .p_type = PT_GNU_STACK, .p_vaddr = 0x00000000, .p_memsz = 0x000000, },
> > > + { .p_type = PT_GNU_RELRO, .p_vaddr = 0x0000d330, .p_memsz = 0x000cd0, },
> > > + };
> > > + size_t mount_size = 0xE070;
> > > + /* https://lore.kernel.org/lkml/YfF18Dy85mCntXrx@fractal.localdomain */
> >
> > Slight nit, it looks like that message wasn't sent to lkml.
> > lore gives a suggestion to change to
> > https://lore.kernel.org/linux-fsdevel/YfF18Dy85mCntXrx@fractal.localdomain/
>
> Ah, thank you. I was replacing the /r/ that used to be in that URL, and
> got lost. :)
>
> --
> Kees Cook
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
