Alexey Dobriyan | e483b02 | 2019-03-05 15:50:39 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (c) 2019 Alexey Dobriyan <adobriyan@gmail.com> |
| 3 | * |
| 4 | * Permission to use, copy, modify, and distribute this software for any |
| 5 | * purpose with or without fee is hereby granted, provided that the above |
| 6 | * copyright notice and this permission notice appear in all copies. |
| 7 | * |
| 8 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
| 9 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
| 10 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR |
| 11 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
| 12 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN |
| 13 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF |
| 14 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. |
| 15 | */ |
| 16 | /* |
| 17 | * Fork and exec tiny 1 page executable which precisely controls its VM. |
| 18 | * Test /proc/$PID/maps |
| 19 | * Test /proc/$PID/smaps |
| 20 | * Test /proc/$PID/smaps_rollup |
| 21 | * Test /proc/$PID/statm |
| 22 | * |
| 23 | * FIXME require CONFIG_TMPFS which can be disabled |
| 24 | * FIXME test other values from "smaps" |
| 25 | * FIXME support other archs |
| 26 | */ |
| 27 | #undef NDEBUG |
| 28 | #include <assert.h> |
| 29 | #include <errno.h> |
| 30 | #include <sched.h> |
| 31 | #include <signal.h> |
Alexey Dobriyan | 1741560 | 2019-03-13 11:44:29 -0700 | [diff] [blame] | 32 | #include <stdbool.h> |
Alexey Dobriyan | e483b02 | 2019-03-05 15:50:39 -0800 | [diff] [blame] | 33 | #include <stdint.h> |
| 34 | #include <stdio.h> |
| 35 | #include <string.h> |
| 36 | #include <stdlib.h> |
| 37 | #include <sys/mount.h> |
| 38 | #include <sys/types.h> |
| 39 | #include <sys/stat.h> |
Alexey Dobriyan | 1741560 | 2019-03-13 11:44:29 -0700 | [diff] [blame] | 40 | #include <sys/wait.h> |
Alexey Dobriyan | e483b02 | 2019-03-05 15:50:39 -0800 | [diff] [blame] | 41 | #include <fcntl.h> |
| 42 | #include <unistd.h> |
| 43 | #include <sys/syscall.h> |
| 44 | #include <sys/uio.h> |
| 45 | #include <linux/kdev_t.h> |
Alexey Dobriyan | 1741560 | 2019-03-13 11:44:29 -0700 | [diff] [blame] | 46 | #include <sys/time.h> |
| 47 | #include <sys/resource.h> |
Alexey Dobriyan | e483b02 | 2019-03-05 15:50:39 -0800 | [diff] [blame] | 48 | |
| 49 | static inline long sys_execveat(int dirfd, const char *pathname, char **argv, char **envp, int flags) |
| 50 | { |
| 51 | return syscall(SYS_execveat, dirfd, pathname, argv, envp, flags); |
| 52 | } |
| 53 | |
| 54 | static void make_private_tmp(void) |
| 55 | { |
| 56 | if (unshare(CLONE_NEWNS) == -1) { |
| 57 | if (errno == ENOSYS || errno == EPERM) { |
| 58 | exit(4); |
| 59 | } |
| 60 | exit(1); |
| 61 | } |
| 62 | if (mount(NULL, "/", NULL, MS_PRIVATE|MS_REC, NULL) == -1) { |
| 63 | exit(1); |
| 64 | } |
| 65 | if (mount(NULL, "/tmp", "tmpfs", 0, NULL) == -1) { |
| 66 | exit(1); |
| 67 | } |
| 68 | } |
| 69 | |
| 70 | static pid_t pid = -1; |
| 71 | static void ate(void) |
| 72 | { |
| 73 | if (pid > 0) { |
| 74 | kill(pid, SIGTERM); |
| 75 | } |
| 76 | } |
| 77 | |
| 78 | struct elf64_hdr { |
| 79 | uint8_t e_ident[16]; |
| 80 | uint16_t e_type; |
| 81 | uint16_t e_machine; |
| 82 | uint32_t e_version; |
| 83 | uint64_t e_entry; |
| 84 | uint64_t e_phoff; |
| 85 | uint64_t e_shoff; |
| 86 | uint32_t e_flags; |
| 87 | uint16_t e_ehsize; |
| 88 | uint16_t e_phentsize; |
| 89 | uint16_t e_phnum; |
| 90 | uint16_t e_shentsize; |
| 91 | uint16_t e_shnum; |
| 92 | uint16_t e_shstrndx; |
| 93 | }; |
| 94 | |
| 95 | struct elf64_phdr { |
| 96 | uint32_t p_type; |
| 97 | uint32_t p_flags; |
| 98 | uint64_t p_offset; |
| 99 | uint64_t p_vaddr; |
| 100 | uint64_t p_paddr; |
| 101 | uint64_t p_filesz; |
| 102 | uint64_t p_memsz; |
| 103 | uint64_t p_align; |
| 104 | }; |
| 105 | |
| 106 | #ifdef __x86_64__ |
| 107 | #define PAGE_SIZE 4096 |
| 108 | #define VADDR (1UL << 32) |
| 109 | #define MAPS_OFFSET 73 |
| 110 | |
| 111 | #define syscall 0x0f, 0x05 |
| 112 | #define mov_rdi(x) \ |
| 113 | 0x48, 0xbf, \ |
| 114 | (x)&0xff, ((x)>>8)&0xff, ((x)>>16)&0xff, ((x)>>24)&0xff, \ |
| 115 | ((x)>>32)&0xff, ((x)>>40)&0xff, ((x)>>48)&0xff, ((x)>>56)&0xff |
| 116 | |
| 117 | #define mov_rsi(x) \ |
| 118 | 0x48, 0xbe, \ |
| 119 | (x)&0xff, ((x)>>8)&0xff, ((x)>>16)&0xff, ((x)>>24)&0xff, \ |
| 120 | ((x)>>32)&0xff, ((x)>>40)&0xff, ((x)>>48)&0xff, ((x)>>56)&0xff |
| 121 | |
| 122 | #define mov_eax(x) \ |
| 123 | 0xb8, (x)&0xff, ((x)>>8)&0xff, ((x)>>16)&0xff, ((x)>>24)&0xff |
| 124 | |
| 125 | static const uint8_t payload[] = { |
| 126 | /* Casually unmap stack, vDSO and everything else. */ |
| 127 | /* munmap */ |
| 128 | mov_rdi(VADDR + 4096), |
| 129 | mov_rsi((1ULL << 47) - 4096 - VADDR - 4096), |
| 130 | mov_eax(11), |
| 131 | syscall, |
| 132 | |
| 133 | /* Ping parent. */ |
| 134 | /* write(0, &c, 1); */ |
| 135 | 0x31, 0xff, /* xor edi, edi */ |
| 136 | 0x48, 0x8d, 0x35, 0x00, 0x00, 0x00, 0x00, /* lea rsi, [rip] */ |
| 137 | 0xba, 0x01, 0x00, 0x00, 0x00, /* mov edx, 1 */ |
| 138 | mov_eax(1), |
| 139 | syscall, |
| 140 | |
| 141 | /* 1: pause(); */ |
| 142 | mov_eax(34), |
| 143 | syscall, |
| 144 | |
| 145 | 0xeb, 0xf7, /* jmp 1b */ |
| 146 | }; |
| 147 | |
| 148 | static int make_exe(const uint8_t *payload, size_t len) |
| 149 | { |
| 150 | struct elf64_hdr h; |
| 151 | struct elf64_phdr ph; |
| 152 | |
| 153 | struct iovec iov[3] = { |
| 154 | {&h, sizeof(struct elf64_hdr)}, |
| 155 | {&ph, sizeof(struct elf64_phdr)}, |
| 156 | {(void *)payload, len}, |
| 157 | }; |
| 158 | int fd, fd1; |
| 159 | char buf[64]; |
| 160 | |
| 161 | memset(&h, 0, sizeof(h)); |
| 162 | h.e_ident[0] = 0x7f; |
| 163 | h.e_ident[1] = 'E'; |
| 164 | h.e_ident[2] = 'L'; |
| 165 | h.e_ident[3] = 'F'; |
| 166 | h.e_ident[4] = 2; |
| 167 | h.e_ident[5] = 1; |
| 168 | h.e_ident[6] = 1; |
| 169 | h.e_ident[7] = 0; |
| 170 | h.e_type = 2; |
| 171 | h.e_machine = 0x3e; |
| 172 | h.e_version = 1; |
| 173 | h.e_entry = VADDR + sizeof(struct elf64_hdr) + sizeof(struct elf64_phdr); |
| 174 | h.e_phoff = sizeof(struct elf64_hdr); |
| 175 | h.e_shoff = 0; |
| 176 | h.e_flags = 0; |
| 177 | h.e_ehsize = sizeof(struct elf64_hdr); |
| 178 | h.e_phentsize = sizeof(struct elf64_phdr); |
| 179 | h.e_phnum = 1; |
| 180 | h.e_shentsize = 0; |
| 181 | h.e_shnum = 0; |
| 182 | h.e_shstrndx = 0; |
| 183 | |
| 184 | memset(&ph, 0, sizeof(ph)); |
| 185 | ph.p_type = 1; |
| 186 | ph.p_flags = (1<<2)|1; |
| 187 | ph.p_offset = 0; |
| 188 | ph.p_vaddr = VADDR; |
| 189 | ph.p_paddr = 0; |
Alexey Dobriyan | 68545aa | 2019-04-18 17:50:27 -0700 | [diff] [blame] | 190 | ph.p_filesz = sizeof(struct elf64_hdr) + sizeof(struct elf64_phdr) + len; |
| 191 | ph.p_memsz = sizeof(struct elf64_hdr) + sizeof(struct elf64_phdr) + len; |
Alexey Dobriyan | e483b02 | 2019-03-05 15:50:39 -0800 | [diff] [blame] | 192 | ph.p_align = 4096; |
| 193 | |
| 194 | fd = openat(AT_FDCWD, "/tmp", O_WRONLY|O_EXCL|O_TMPFILE, 0700); |
| 195 | if (fd == -1) { |
| 196 | exit(1); |
| 197 | } |
| 198 | |
| 199 | if (writev(fd, iov, 3) != sizeof(struct elf64_hdr) + sizeof(struct elf64_phdr) + len) { |
| 200 | exit(1); |
| 201 | } |
| 202 | |
| 203 | /* Avoid ETXTBSY on exec. */ |
| 204 | snprintf(buf, sizeof(buf), "/proc/self/fd/%u", fd); |
| 205 | fd1 = open(buf, O_RDONLY|O_CLOEXEC); |
| 206 | close(fd); |
| 207 | |
| 208 | return fd1; |
| 209 | } |
| 210 | #endif |
| 211 | |
Alexey Dobriyan | 1741560 | 2019-03-13 11:44:29 -0700 | [diff] [blame] | 212 | static bool g_vsyscall = false; |
| 213 | |
| 214 | static const char str_vsyscall[] = |
| 215 | "ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]\n"; |
| 216 | |
Alexey Dobriyan | e483b02 | 2019-03-05 15:50:39 -0800 | [diff] [blame] | 217 | #ifdef __x86_64__ |
Alexey Dobriyan | 1741560 | 2019-03-13 11:44:29 -0700 | [diff] [blame] | 218 | /* |
| 219 | * vsyscall page can't be unmapped, probe it with memory load. |
| 220 | */ |
| 221 | static void vsyscall(void) |
| 222 | { |
| 223 | pid_t pid; |
| 224 | int wstatus; |
| 225 | |
| 226 | pid = fork(); |
| 227 | if (pid < 0) { |
| 228 | fprintf(stderr, "fork, errno %d\n", errno); |
| 229 | exit(1); |
| 230 | } |
| 231 | if (pid == 0) { |
| 232 | struct rlimit rlim = {0, 0}; |
| 233 | (void)setrlimit(RLIMIT_CORE, &rlim); |
| 234 | *(volatile int *)0xffffffffff600000UL; |
| 235 | exit(0); |
| 236 | } |
| 237 | wait(&wstatus); |
| 238 | if (WIFEXITED(wstatus)) { |
| 239 | g_vsyscall = true; |
| 240 | } |
| 241 | } |
| 242 | |
Alexey Dobriyan | e483b02 | 2019-03-05 15:50:39 -0800 | [diff] [blame] | 243 | int main(void) |
| 244 | { |
| 245 | int pipefd[2]; |
| 246 | int exec_fd; |
| 247 | |
Alexey Dobriyan | 1741560 | 2019-03-13 11:44:29 -0700 | [diff] [blame] | 248 | vsyscall(); |
| 249 | |
Alexey Dobriyan | e483b02 | 2019-03-05 15:50:39 -0800 | [diff] [blame] | 250 | atexit(ate); |
| 251 | |
| 252 | make_private_tmp(); |
| 253 | |
| 254 | /* Reserve fd 0 for 1-byte pipe ping from child. */ |
| 255 | close(0); |
| 256 | if (open("/", O_RDONLY|O_DIRECTORY|O_PATH) != 0) { |
| 257 | return 1; |
| 258 | } |
| 259 | |
| 260 | exec_fd = make_exe(payload, sizeof(payload)); |
| 261 | |
| 262 | if (pipe(pipefd) == -1) { |
| 263 | return 1; |
| 264 | } |
| 265 | if (dup2(pipefd[1], 0) != 0) { |
| 266 | return 1; |
| 267 | } |
| 268 | |
| 269 | pid = fork(); |
| 270 | if (pid == -1) { |
| 271 | return 1; |
| 272 | } |
| 273 | if (pid == 0) { |
| 274 | sys_execveat(exec_fd, "", NULL, NULL, AT_EMPTY_PATH); |
| 275 | return 1; |
| 276 | } |
| 277 | |
| 278 | char _; |
| 279 | if (read(pipefd[0], &_, 1) != 1) { |
| 280 | return 1; |
| 281 | } |
| 282 | |
| 283 | struct stat st; |
| 284 | if (fstat(exec_fd, &st) == -1) { |
| 285 | return 1; |
| 286 | } |
| 287 | |
| 288 | /* Generate "head -n1 /proc/$PID/maps" */ |
| 289 | char buf0[256]; |
| 290 | memset(buf0, ' ', sizeof(buf0)); |
| 291 | int len = snprintf(buf0, sizeof(buf0), |
| 292 | "%08lx-%08lx r-xp 00000000 %02lx:%02lx %llu", |
| 293 | VADDR, VADDR + PAGE_SIZE, |
| 294 | MAJOR(st.st_dev), MINOR(st.st_dev), |
| 295 | (unsigned long long)st.st_ino); |
| 296 | buf0[len] = ' '; |
| 297 | snprintf(buf0 + MAPS_OFFSET, sizeof(buf0) - MAPS_OFFSET, |
| 298 | "/tmp/#%llu (deleted)\n", (unsigned long long)st.st_ino); |
| 299 | |
Alexey Dobriyan | e483b02 | 2019-03-05 15:50:39 -0800 | [diff] [blame] | 300 | /* Test /proc/$PID/maps */ |
| 301 | { |
Alexey Dobriyan | 1741560 | 2019-03-13 11:44:29 -0700 | [diff] [blame] | 302 | const size_t len = strlen(buf0) + (g_vsyscall ? strlen(str_vsyscall) : 0); |
Alexey Dobriyan | e483b02 | 2019-03-05 15:50:39 -0800 | [diff] [blame] | 303 | char buf[256]; |
| 304 | ssize_t rv; |
| 305 | int fd; |
| 306 | |
| 307 | snprintf(buf, sizeof(buf), "/proc/%u/maps", pid); |
| 308 | fd = open(buf, O_RDONLY); |
| 309 | if (fd == -1) { |
| 310 | return 1; |
| 311 | } |
| 312 | rv = read(fd, buf, sizeof(buf)); |
Alexey Dobriyan | 1741560 | 2019-03-13 11:44:29 -0700 | [diff] [blame] | 313 | assert(rv == len); |
Alexey Dobriyan | e483b02 | 2019-03-05 15:50:39 -0800 | [diff] [blame] | 314 | assert(memcmp(buf, buf0, strlen(buf0)) == 0); |
Alexey Dobriyan | 1741560 | 2019-03-13 11:44:29 -0700 | [diff] [blame] | 315 | if (g_vsyscall) { |
| 316 | assert(memcmp(buf + strlen(buf0), str_vsyscall, strlen(str_vsyscall)) == 0); |
| 317 | } |
Alexey Dobriyan | e483b02 | 2019-03-05 15:50:39 -0800 | [diff] [blame] | 318 | } |
| 319 | |
| 320 | /* Test /proc/$PID/smaps */ |
| 321 | { |
Alexey Dobriyan | 1741560 | 2019-03-13 11:44:29 -0700 | [diff] [blame] | 322 | char buf[4096]; |
Alexey Dobriyan | e483b02 | 2019-03-05 15:50:39 -0800 | [diff] [blame] | 323 | ssize_t rv; |
| 324 | int fd; |
| 325 | |
| 326 | snprintf(buf, sizeof(buf), "/proc/%u/smaps", pid); |
| 327 | fd = open(buf, O_RDONLY); |
| 328 | if (fd == -1) { |
| 329 | return 1; |
| 330 | } |
| 331 | rv = read(fd, buf, sizeof(buf)); |
| 332 | assert(0 <= rv && rv <= sizeof(buf)); |
| 333 | |
| 334 | assert(rv >= strlen(buf0)); |
| 335 | assert(memcmp(buf, buf0, strlen(buf0)) == 0); |
| 336 | |
| 337 | #define RSS1 "Rss: 4 kB\n" |
| 338 | #define RSS2 "Rss: 0 kB\n" |
| 339 | #define PSS1 "Pss: 4 kB\n" |
| 340 | #define PSS2 "Pss: 0 kB\n" |
| 341 | assert(memmem(buf, rv, RSS1, strlen(RSS1)) || |
| 342 | memmem(buf, rv, RSS2, strlen(RSS2))); |
| 343 | assert(memmem(buf, rv, PSS1, strlen(PSS1)) || |
| 344 | memmem(buf, rv, PSS2, strlen(PSS2))); |
| 345 | |
| 346 | static const char *S[] = { |
| 347 | "Size: 4 kB\n", |
| 348 | "KernelPageSize: 4 kB\n", |
| 349 | "MMUPageSize: 4 kB\n", |
| 350 | "Anonymous: 0 kB\n", |
| 351 | "AnonHugePages: 0 kB\n", |
| 352 | "Shared_Hugetlb: 0 kB\n", |
| 353 | "Private_Hugetlb: 0 kB\n", |
| 354 | "Locked: 0 kB\n", |
| 355 | }; |
| 356 | int i; |
| 357 | |
| 358 | for (i = 0; i < sizeof(S)/sizeof(S[0]); i++) { |
| 359 | assert(memmem(buf, rv, S[i], strlen(S[i]))); |
| 360 | } |
Alexey Dobriyan | 1741560 | 2019-03-13 11:44:29 -0700 | [diff] [blame] | 361 | |
| 362 | if (g_vsyscall) { |
| 363 | assert(memmem(buf, rv, str_vsyscall, strlen(str_vsyscall))); |
| 364 | } |
Alexey Dobriyan | e483b02 | 2019-03-05 15:50:39 -0800 | [diff] [blame] | 365 | } |
| 366 | |
| 367 | /* Test /proc/$PID/smaps_rollup */ |
| 368 | { |
| 369 | char bufr[256]; |
| 370 | memset(bufr, ' ', sizeof(bufr)); |
| 371 | len = snprintf(bufr, sizeof(bufr), |
| 372 | "%08lx-%08lx ---p 00000000 00:00 0", |
| 373 | VADDR, VADDR + PAGE_SIZE); |
| 374 | bufr[len] = ' '; |
| 375 | snprintf(bufr + MAPS_OFFSET, sizeof(bufr) - MAPS_OFFSET, |
| 376 | "[rollup]\n"); |
| 377 | |
| 378 | char buf[1024]; |
| 379 | ssize_t rv; |
| 380 | int fd; |
| 381 | |
| 382 | snprintf(buf, sizeof(buf), "/proc/%u/smaps_rollup", pid); |
| 383 | fd = open(buf, O_RDONLY); |
| 384 | if (fd == -1) { |
| 385 | return 1; |
| 386 | } |
| 387 | rv = read(fd, buf, sizeof(buf)); |
| 388 | assert(0 <= rv && rv <= sizeof(buf)); |
| 389 | |
| 390 | assert(rv >= strlen(bufr)); |
| 391 | assert(memcmp(buf, bufr, strlen(bufr)) == 0); |
| 392 | |
| 393 | assert(memmem(buf, rv, RSS1, strlen(RSS1)) || |
| 394 | memmem(buf, rv, RSS2, strlen(RSS2))); |
| 395 | assert(memmem(buf, rv, PSS1, strlen(PSS1)) || |
| 396 | memmem(buf, rv, PSS2, strlen(PSS2))); |
| 397 | |
| 398 | static const char *S[] = { |
| 399 | "Anonymous: 0 kB\n", |
| 400 | "AnonHugePages: 0 kB\n", |
| 401 | "Shared_Hugetlb: 0 kB\n", |
| 402 | "Private_Hugetlb: 0 kB\n", |
| 403 | "Locked: 0 kB\n", |
| 404 | }; |
| 405 | int i; |
| 406 | |
| 407 | for (i = 0; i < sizeof(S)/sizeof(S[0]); i++) { |
| 408 | assert(memmem(buf, rv, S[i], strlen(S[i]))); |
| 409 | } |
| 410 | } |
| 411 | |
| 412 | /* Test /proc/$PID/statm */ |
| 413 | { |
| 414 | char buf[64]; |
| 415 | ssize_t rv; |
| 416 | int fd; |
| 417 | |
| 418 | snprintf(buf, sizeof(buf), "/proc/%u/statm", pid); |
| 419 | fd = open(buf, O_RDONLY); |
| 420 | if (fd == -1) { |
| 421 | return 1; |
| 422 | } |
| 423 | rv = read(fd, buf, sizeof(buf)); |
| 424 | assert(rv == 7 * 2); |
| 425 | |
| 426 | assert(buf[0] == '1'); /* ->total_vm */ |
| 427 | assert(buf[1] == ' '); |
| 428 | assert(buf[2] == '0' || buf[2] == '1'); /* rss */ |
| 429 | assert(buf[3] == ' '); |
| 430 | assert(buf[4] == '0' || buf[2] == '1'); /* file rss */ |
| 431 | assert(buf[5] == ' '); |
| 432 | assert(buf[6] == '1'); /* ELF executable segments */ |
| 433 | assert(buf[7] == ' '); |
| 434 | assert(buf[8] == '0'); |
| 435 | assert(buf[9] == ' '); |
| 436 | assert(buf[10] == '0'); /* ->data_vm + ->stack_vm */ |
| 437 | assert(buf[11] == ' '); |
| 438 | assert(buf[12] == '0'); |
| 439 | assert(buf[13] == '\n'); |
| 440 | } |
| 441 | |
| 442 | return 0; |
| 443 | } |
| 444 | #else |
| 445 | int main(void) |
| 446 | { |
| 447 | return 4; |
| 448 | } |
| 449 | #endif |