142 lines · c
1// SPDX-License-Identifier: GPL-2.0-only2#include <kunit/test.h>3 4struct bprm_stack_limits_result {5 struct linux_binprm bprm;6 int expected_rc;7 unsigned long expected_argmin;8};9 10static const struct bprm_stack_limits_result bprm_stack_limits_results[] = {11 /* Negative argc/envc counts produce -E2BIG */12 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,13 .argc = INT_MIN, .envc = INT_MIN }, .expected_rc = -E2BIG },14 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,15 .argc = 5, .envc = -1 }, .expected_rc = -E2BIG },16 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,17 .argc = -1, .envc = 10 }, .expected_rc = -E2BIG },18 /* The max value of argc or envc is MAX_ARG_STRINGS. */19 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,20 .argc = INT_MAX, .envc = INT_MAX }, .expected_rc = -E2BIG },21 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,22 .argc = MAX_ARG_STRINGS, .envc = MAX_ARG_STRINGS }, .expected_rc = -E2BIG },23 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,24 .argc = 0, .envc = MAX_ARG_STRINGS }, .expected_rc = -E2BIG },25 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,26 .argc = MAX_ARG_STRINGS, .envc = 0 }, .expected_rc = -E2BIG },27 /*28 * On 32-bit system these argc and envc counts, while likely impossible29 * to represent within the associated TASK_SIZE, could overflow the30 * limit calculation, and bypass the ptr_size <= limit check.31 */32 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,33 .argc = 0x20000001, .envc = 0x20000001 }, .expected_rc = -E2BIG },34#ifdef CONFIG_MMU35 /* Make sure a pathological bprm->p doesn't cause an overflow. */36 { { .p = sizeof(void *), .rlim_stack.rlim_cur = ULONG_MAX,37 .argc = 10, .envc = 10 }, .expected_rc = -E2BIG },38#endif39 /*40 * 0 rlim_stack will get raised to ARG_MAX. With 1 string pointer,41 * we should see p - ARG_MAX + sizeof(void *).42 */43 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,44 .argc = 1, .envc = 0 }, .expected_argmin = ULONG_MAX - ARG_MAX + sizeof(void *)},45 /* Validate that argc is always raised to a minimum of 1. */46 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,47 .argc = 0, .envc = 0 }, .expected_argmin = ULONG_MAX - ARG_MAX + sizeof(void *)},48 /*49 * 0 rlim_stack will get raised to ARG_MAX. With pointers filling ARG_MAX,50 * we should see -E2BIG. (Note argc is always raised to at least 1.)51 */52 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,53 .argc = ARG_MAX / sizeof(void *), .envc = 0 }, .expected_rc = -E2BIG },54 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,55 .argc = 0, .envc = ARG_MAX / sizeof(void *) - 1 }, .expected_rc = -E2BIG },56 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,57 .argc = ARG_MAX / sizeof(void *) + 1, .envc = 0 }, .expected_rc = -E2BIG },58 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,59 .argc = 0, .envc = ARG_MAX / sizeof(void *) }, .expected_rc = -E2BIG },60 /* And with one less, we see space for exactly 1 pointer. */61 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,62 .argc = (ARG_MAX / sizeof(void *)) - 1, .envc = 0 },63 .expected_argmin = ULONG_MAX - sizeof(void *) },64 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,65 .argc = 0, .envc = (ARG_MAX / sizeof(void *)) - 2, },66 .expected_argmin = ULONG_MAX - sizeof(void *) },67 /* If we raise rlim_stack / 4 to exactly ARG_MAX, nothing changes. */68 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,69 .argc = ARG_MAX / sizeof(void *), .envc = 0 }, .expected_rc = -E2BIG },70 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,71 .argc = 0, .envc = ARG_MAX / sizeof(void *) - 1 }, .expected_rc = -E2BIG },72 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,73 .argc = ARG_MAX / sizeof(void *) + 1, .envc = 0 }, .expected_rc = -E2BIG },74 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,75 .argc = 0, .envc = ARG_MAX / sizeof(void *) }, .expected_rc = -E2BIG },76 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,77 .argc = (ARG_MAX / sizeof(void *)) - 1, .envc = 0 },78 .expected_argmin = ULONG_MAX - sizeof(void *) },79 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,80 .argc = 0, .envc = (ARG_MAX / sizeof(void *)) - 2, },81 .expected_argmin = ULONG_MAX - sizeof(void *) },82 /* But raising it another pointer * 4 will provide space for 1 more pointer. */83 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = (ARG_MAX + sizeof(void *)) * 4,84 .argc = ARG_MAX / sizeof(void *), .envc = 0 },85 .expected_argmin = ULONG_MAX - sizeof(void *) },86 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = (ARG_MAX + sizeof(void *)) * 4,87 .argc = 0, .envc = ARG_MAX / sizeof(void *) - 1 },88 .expected_argmin = ULONG_MAX - sizeof(void *) },89 /* Raising rlim_stack / 4 to _STK_LIM / 4 * 3 will see more space. */90 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * 3),91 .argc = 0, .envc = 0 },92 .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },93 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * 3),94 .argc = 0, .envc = 0 },95 .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },96 /* But raising it any further will see no increase. */97 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * 3 + sizeof(void *)),98 .argc = 0, .envc = 0 },99 .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },100 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * + sizeof(void *)),101 .argc = 0, .envc = 0 },102 .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },103 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * _STK_LIM,104 .argc = 0, .envc = 0 },105 .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },106 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * _STK_LIM,107 .argc = 0, .envc = 0 },108 .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },109};110 111static void exec_test_bprm_stack_limits(struct kunit *test)112{113 /* Double-check the constants. */114 KUNIT_EXPECT_EQ(test, _STK_LIM, SZ_8M);115 KUNIT_EXPECT_EQ(test, ARG_MAX, 32 * SZ_4K);116 KUNIT_EXPECT_EQ(test, MAX_ARG_STRINGS, 0x7FFFFFFF);117 118 for (int i = 0; i < ARRAY_SIZE(bprm_stack_limits_results); i++) {119 const struct bprm_stack_limits_result *result = &bprm_stack_limits_results[i];120 struct linux_binprm bprm = result->bprm;121 int rc;122 123 rc = bprm_stack_limits(&bprm);124 KUNIT_EXPECT_EQ_MSG(test, rc, result->expected_rc, "on loop %d", i);125#ifdef CONFIG_MMU126 KUNIT_EXPECT_EQ_MSG(test, bprm.argmin, result->expected_argmin, "on loop %d", i);127#endif128 }129}130 131static struct kunit_case exec_test_cases[] = {132 KUNIT_CASE(exec_test_bprm_stack_limits),133 {},134};135 136static struct kunit_suite exec_test_suite = {137 .name = "exec",138 .test_cases = exec_test_cases,139};140 141kunit_test_suite(exec_test_suite);142