1*b6f5ee4dSKees Cook // SPDX-License-Identifier: GPL-2.0-only
2*b6f5ee4dSKees Cook #include <kunit/test.h>
3*b6f5ee4dSKees Cook
4*b6f5ee4dSKees Cook struct bprm_stack_limits_result {
5*b6f5ee4dSKees Cook struct linux_binprm bprm;
6*b6f5ee4dSKees Cook int expected_rc;
7*b6f5ee4dSKees Cook unsigned long expected_argmin;
8*b6f5ee4dSKees Cook };
9*b6f5ee4dSKees Cook
10*b6f5ee4dSKees Cook static const struct bprm_stack_limits_result bprm_stack_limits_results[] = {
11*b6f5ee4dSKees Cook /* Negative argc/envc counts produce -E2BIG */
12*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,
13*b6f5ee4dSKees Cook .argc = INT_MIN, .envc = INT_MIN }, .expected_rc = -E2BIG },
14*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,
15*b6f5ee4dSKees Cook .argc = 5, .envc = -1 }, .expected_rc = -E2BIG },
16*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,
17*b6f5ee4dSKees Cook .argc = -1, .envc = 10 }, .expected_rc = -E2BIG },
18*b6f5ee4dSKees Cook /* The max value of argc or envc is MAX_ARG_STRINGS. */
19*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,
20*b6f5ee4dSKees Cook .argc = INT_MAX, .envc = INT_MAX }, .expected_rc = -E2BIG },
21*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,
22*b6f5ee4dSKees Cook .argc = MAX_ARG_STRINGS, .envc = MAX_ARG_STRINGS }, .expected_rc = -E2BIG },
23*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,
24*b6f5ee4dSKees Cook .argc = 0, .envc = MAX_ARG_STRINGS }, .expected_rc = -E2BIG },
25*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,
26*b6f5ee4dSKees Cook .argc = MAX_ARG_STRINGS, .envc = 0 }, .expected_rc = -E2BIG },
27*b6f5ee4dSKees Cook /*
28*b6f5ee4dSKees Cook * On 32-bit system these argc and envc counts, while likely impossible
29*b6f5ee4dSKees Cook * to represent within the associated TASK_SIZE, could overflow the
30*b6f5ee4dSKees Cook * limit calculation, and bypass the ptr_size <= limit check.
31*b6f5ee4dSKees Cook */
32*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,
33*b6f5ee4dSKees Cook .argc = 0x20000001, .envc = 0x20000001 }, .expected_rc = -E2BIG },
34*b6f5ee4dSKees Cook #ifdef CONFIG_MMU
35*b6f5ee4dSKees Cook /* Make sure a pathological bprm->p doesn't cause an overflow. */
36*b6f5ee4dSKees Cook { { .p = sizeof(void *), .rlim_stack.rlim_cur = ULONG_MAX,
37*b6f5ee4dSKees Cook .argc = 10, .envc = 10 }, .expected_rc = -E2BIG },
38*b6f5ee4dSKees Cook #endif
39*b6f5ee4dSKees Cook /*
40*b6f5ee4dSKees Cook * 0 rlim_stack will get raised to ARG_MAX. With 1 string pointer,
41*b6f5ee4dSKees Cook * we should see p - ARG_MAX + sizeof(void *).
42*b6f5ee4dSKees Cook */
43*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
44*b6f5ee4dSKees Cook .argc = 1, .envc = 0 }, .expected_argmin = ULONG_MAX - ARG_MAX + sizeof(void *)},
45*b6f5ee4dSKees Cook /* Validate that argc is always raised to a minimum of 1. */
46*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
47*b6f5ee4dSKees Cook .argc = 0, .envc = 0 }, .expected_argmin = ULONG_MAX - ARG_MAX + sizeof(void *)},
48*b6f5ee4dSKees Cook /*
49*b6f5ee4dSKees Cook * 0 rlim_stack will get raised to ARG_MAX. With pointers filling ARG_MAX,
50*b6f5ee4dSKees Cook * we should see -E2BIG. (Note argc is always raised to at least 1.)
51*b6f5ee4dSKees Cook */
52*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
53*b6f5ee4dSKees Cook .argc = ARG_MAX / sizeof(void *), .envc = 0 }, .expected_rc = -E2BIG },
54*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
55*b6f5ee4dSKees Cook .argc = 0, .envc = ARG_MAX / sizeof(void *) - 1 }, .expected_rc = -E2BIG },
56*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
57*b6f5ee4dSKees Cook .argc = ARG_MAX / sizeof(void *) + 1, .envc = 0 }, .expected_rc = -E2BIG },
58*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
59*b6f5ee4dSKees Cook .argc = 0, .envc = ARG_MAX / sizeof(void *) }, .expected_rc = -E2BIG },
60*b6f5ee4dSKees Cook /* And with one less, we see space for exactly 1 pointer. */
61*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
62*b6f5ee4dSKees Cook .argc = (ARG_MAX / sizeof(void *)) - 1, .envc = 0 },
63*b6f5ee4dSKees Cook .expected_argmin = ULONG_MAX - sizeof(void *) },
64*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
65*b6f5ee4dSKees Cook .argc = 0, .envc = (ARG_MAX / sizeof(void *)) - 2, },
66*b6f5ee4dSKees Cook .expected_argmin = ULONG_MAX - sizeof(void *) },
67*b6f5ee4dSKees Cook /* If we raise rlim_stack / 4 to exactly ARG_MAX, nothing changes. */
68*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
69*b6f5ee4dSKees Cook .argc = ARG_MAX / sizeof(void *), .envc = 0 }, .expected_rc = -E2BIG },
70*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
71*b6f5ee4dSKees Cook .argc = 0, .envc = ARG_MAX / sizeof(void *) - 1 }, .expected_rc = -E2BIG },
72*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
73*b6f5ee4dSKees Cook .argc = ARG_MAX / sizeof(void *) + 1, .envc = 0 }, .expected_rc = -E2BIG },
74*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
75*b6f5ee4dSKees Cook .argc = 0, .envc = ARG_MAX / sizeof(void *) }, .expected_rc = -E2BIG },
76*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
77*b6f5ee4dSKees Cook .argc = (ARG_MAX / sizeof(void *)) - 1, .envc = 0 },
78*b6f5ee4dSKees Cook .expected_argmin = ULONG_MAX - sizeof(void *) },
79*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
80*b6f5ee4dSKees Cook .argc = 0, .envc = (ARG_MAX / sizeof(void *)) - 2, },
81*b6f5ee4dSKees Cook .expected_argmin = ULONG_MAX - sizeof(void *) },
82*b6f5ee4dSKees Cook /* But raising it another pointer * 4 will provide space for 1 more pointer. */
83*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = (ARG_MAX + sizeof(void *)) * 4,
84*b6f5ee4dSKees Cook .argc = ARG_MAX / sizeof(void *), .envc = 0 },
85*b6f5ee4dSKees Cook .expected_argmin = ULONG_MAX - sizeof(void *) },
86*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = (ARG_MAX + sizeof(void *)) * 4,
87*b6f5ee4dSKees Cook .argc = 0, .envc = ARG_MAX / sizeof(void *) - 1 },
88*b6f5ee4dSKees Cook .expected_argmin = ULONG_MAX - sizeof(void *) },
89*b6f5ee4dSKees Cook /* Raising rlim_stack / 4 to _STK_LIM / 4 * 3 will see more space. */
90*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * 3),
91*b6f5ee4dSKees Cook .argc = 0, .envc = 0 },
92*b6f5ee4dSKees Cook .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
93*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * 3),
94*b6f5ee4dSKees Cook .argc = 0, .envc = 0 },
95*b6f5ee4dSKees Cook .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
96*b6f5ee4dSKees Cook /* But raising it any further will see no increase. */
97*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * 3 + sizeof(void *)),
98*b6f5ee4dSKees Cook .argc = 0, .envc = 0 },
99*b6f5ee4dSKees Cook .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
100*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * + sizeof(void *)),
101*b6f5ee4dSKees Cook .argc = 0, .envc = 0 },
102*b6f5ee4dSKees Cook .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
103*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * _STK_LIM,
104*b6f5ee4dSKees Cook .argc = 0, .envc = 0 },
105*b6f5ee4dSKees Cook .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
106*b6f5ee4dSKees Cook { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * _STK_LIM,
107*b6f5ee4dSKees Cook .argc = 0, .envc = 0 },
108*b6f5ee4dSKees Cook .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
109*b6f5ee4dSKees Cook };
110*b6f5ee4dSKees Cook
exec_test_bprm_stack_limits(struct kunit * test)111*b6f5ee4dSKees Cook static void exec_test_bprm_stack_limits(struct kunit *test)
112*b6f5ee4dSKees Cook {
113*b6f5ee4dSKees Cook /* Double-check the constants. */
114*b6f5ee4dSKees Cook KUNIT_EXPECT_EQ(test, _STK_LIM, SZ_8M);
115*b6f5ee4dSKees Cook KUNIT_EXPECT_EQ(test, ARG_MAX, 32 * SZ_4K);
116*b6f5ee4dSKees Cook KUNIT_EXPECT_EQ(test, MAX_ARG_STRINGS, 0x7FFFFFFF);
117*b6f5ee4dSKees Cook
118*b6f5ee4dSKees Cook for (int i = 0; i < ARRAY_SIZE(bprm_stack_limits_results); i++) {
119*b6f5ee4dSKees Cook const struct bprm_stack_limits_result *result = &bprm_stack_limits_results[i];
120*b6f5ee4dSKees Cook struct linux_binprm bprm = result->bprm;
121*b6f5ee4dSKees Cook int rc;
122*b6f5ee4dSKees Cook
123*b6f5ee4dSKees Cook rc = bprm_stack_limits(&bprm);
124*b6f5ee4dSKees Cook KUNIT_EXPECT_EQ_MSG(test, rc, result->expected_rc, "on loop %d", i);
125*b6f5ee4dSKees Cook #ifdef CONFIG_MMU
126*b6f5ee4dSKees Cook KUNIT_EXPECT_EQ_MSG(test, bprm.argmin, result->expected_argmin, "on loop %d", i);
127*b6f5ee4dSKees Cook #endif
128*b6f5ee4dSKees Cook }
129*b6f5ee4dSKees Cook }
130*b6f5ee4dSKees Cook
131*b6f5ee4dSKees Cook static struct kunit_case exec_test_cases[] = {
132*b6f5ee4dSKees Cook KUNIT_CASE(exec_test_bprm_stack_limits),
133*b6f5ee4dSKees Cook {},
134*b6f5ee4dSKees Cook };
135*b6f5ee4dSKees Cook
136*b6f5ee4dSKees Cook static struct kunit_suite exec_test_suite = {
137*b6f5ee4dSKees Cook .name = "exec",
138*b6f5ee4dSKees Cook .test_cases = exec_test_cases,
139*b6f5ee4dSKees Cook };
140*b6f5ee4dSKees Cook
141*b6f5ee4dSKees Cook kunit_test_suite(exec_test_suite);
142