1 // SPDX-License-Identifier: GPL-2.0-only
2 #include <kunit/test.h>
3
4 struct bprm_stack_limits_result {
5 struct linux_binprm bprm;
6 int expected_rc;
7 unsigned long expected_argmin;
8 };
9
10 static const struct bprm_stack_limits_result bprm_stack_limits_results[] = {
11 /* Negative argc/envc counts produce -E2BIG */
12 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,
13 .argc = INT_MIN, .envc = INT_MIN }, .expected_rc = -E2BIG },
14 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,
15 .argc = 5, .envc = -1 }, .expected_rc = -E2BIG },
16 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,
17 .argc = -1, .envc = 10 }, .expected_rc = -E2BIG },
18 /* The max value of argc or envc is MAX_ARG_STRINGS. */
19 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,
20 .argc = INT_MAX, .envc = INT_MAX }, .expected_rc = -E2BIG },
21 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,
22 .argc = MAX_ARG_STRINGS, .envc = MAX_ARG_STRINGS }, .expected_rc = -E2BIG },
23 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,
24 .argc = 0, .envc = MAX_ARG_STRINGS }, .expected_rc = -E2BIG },
25 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,
26 .argc = MAX_ARG_STRINGS, .envc = 0 }, .expected_rc = -E2BIG },
27 /*
28 * On 32-bit system these argc and envc counts, while likely impossible
29 * to represent within the associated TASK_SIZE, could overflow the
30 * limit calculation, and bypass the ptr_size <= limit check.
31 */
32 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX,
33 .argc = 0x20000001, .envc = 0x20000001 }, .expected_rc = -E2BIG },
34 #ifdef CONFIG_MMU
35 /* Make sure a pathological bprm->p doesn't cause an overflow. */
36 { { .p = sizeof(void *), .rlim_stack.rlim_cur = ULONG_MAX,
37 .argc = 10, .envc = 10 }, .expected_rc = -E2BIG },
38 #endif
39 /*
40 * 0 rlim_stack will get raised to ARG_MAX. With 1 string pointer,
41 * we should see p - ARG_MAX + sizeof(void *).
42 */
43 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
44 .argc = 1, .envc = 0 }, .expected_argmin = ULONG_MAX - ARG_MAX + sizeof(void *)},
45 /* Validate that argc is always raised to a minimum of 1. */
46 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
47 .argc = 0, .envc = 0 }, .expected_argmin = ULONG_MAX - ARG_MAX + sizeof(void *)},
48 /*
49 * 0 rlim_stack will get raised to ARG_MAX. With pointers filling ARG_MAX,
50 * we should see -E2BIG. (Note argc is always raised to at least 1.)
51 */
52 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
53 .argc = ARG_MAX / sizeof(void *), .envc = 0 }, .expected_rc = -E2BIG },
54 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
55 .argc = 0, .envc = ARG_MAX / sizeof(void *) - 1 }, .expected_rc = -E2BIG },
56 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
57 .argc = ARG_MAX / sizeof(void *) + 1, .envc = 0 }, .expected_rc = -E2BIG },
58 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
59 .argc = 0, .envc = ARG_MAX / sizeof(void *) }, .expected_rc = -E2BIG },
60 /* And with one less, we see space for exactly 1 pointer. */
61 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
62 .argc = (ARG_MAX / sizeof(void *)) - 1, .envc = 0 },
63 .expected_argmin = ULONG_MAX - sizeof(void *) },
64 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 0,
65 .argc = 0, .envc = (ARG_MAX / sizeof(void *)) - 2, },
66 .expected_argmin = ULONG_MAX - sizeof(void *) },
67 /* If we raise rlim_stack / 4 to exactly ARG_MAX, nothing changes. */
68 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
69 .argc = ARG_MAX / sizeof(void *), .envc = 0 }, .expected_rc = -E2BIG },
70 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
71 .argc = 0, .envc = ARG_MAX / sizeof(void *) - 1 }, .expected_rc = -E2BIG },
72 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
73 .argc = ARG_MAX / sizeof(void *) + 1, .envc = 0 }, .expected_rc = -E2BIG },
74 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
75 .argc = 0, .envc = ARG_MAX / sizeof(void *) }, .expected_rc = -E2BIG },
76 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
77 .argc = (ARG_MAX / sizeof(void *)) - 1, .envc = 0 },
78 .expected_argmin = ULONG_MAX - sizeof(void *) },
79 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ARG_MAX * 4,
80 .argc = 0, .envc = (ARG_MAX / sizeof(void *)) - 2, },
81 .expected_argmin = ULONG_MAX - sizeof(void *) },
82 /* But raising it another pointer * 4 will provide space for 1 more pointer. */
83 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = (ARG_MAX + sizeof(void *)) * 4,
84 .argc = ARG_MAX / sizeof(void *), .envc = 0 },
85 .expected_argmin = ULONG_MAX - sizeof(void *) },
86 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = (ARG_MAX + sizeof(void *)) * 4,
87 .argc = 0, .envc = ARG_MAX / sizeof(void *) - 1 },
88 .expected_argmin = ULONG_MAX - sizeof(void *) },
89 /* Raising rlim_stack / 4 to _STK_LIM / 4 * 3 will see more space. */
90 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * 3),
91 .argc = 0, .envc = 0 },
92 .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
93 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * 3),
94 .argc = 0, .envc = 0 },
95 .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
96 /* But raising it any further will see no increase. */
97 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * 3 + sizeof(void *)),
98 .argc = 0, .envc = 0 },
99 .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
100 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * + sizeof(void *)),
101 .argc = 0, .envc = 0 },
102 .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
103 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * _STK_LIM,
104 .argc = 0, .envc = 0 },
105 .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
106 { { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * _STK_LIM,
107 .argc = 0, .envc = 0 },
108 .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
109 };
110
exec_test_bprm_stack_limits(struct kunit * test)111 static void exec_test_bprm_stack_limits(struct kunit *test)
112 {
113 /* Double-check the constants. */
114 KUNIT_EXPECT_EQ(test, _STK_LIM, SZ_8M);
115 KUNIT_EXPECT_EQ(test, ARG_MAX, 32 * SZ_4K);
116 KUNIT_EXPECT_EQ(test, MAX_ARG_STRINGS, 0x7FFFFFFF);
117
118 for (int i = 0; i < ARRAY_SIZE(bprm_stack_limits_results); i++) {
119 const struct bprm_stack_limits_result *result = &bprm_stack_limits_results[i];
120 struct linux_binprm bprm = result->bprm;
121 int rc;
122
123 rc = bprm_stack_limits(&bprm);
124 KUNIT_EXPECT_EQ_MSG(test, rc, result->expected_rc, "on loop %d", i);
125 #ifdef CONFIG_MMU
126 KUNIT_EXPECT_EQ_MSG(test, bprm.argmin, result->expected_argmin, "on loop %d", i);
127 #endif
128 }
129 }
130
131 static struct kunit_case exec_test_cases[] = {
132 KUNIT_CASE(exec_test_bprm_stack_limits),
133 {},
134 };
135
136 static struct kunit_suite exec_test_suite = {
137 .name = "exec",
138 .test_cases = exec_test_cases,
139 };
140
141 kunit_test_suite(exec_test_suite);
142