[Devel] [PATCH hci-8.1 5/7] selftests/mm: check VM_MAYEXEC of MADV_DOEXEC ranges in smaps

[Konstantin Khorenko]

An EACCES from mprotect(PROT_EXEC) does not prove that VM_MAYEXEC is
clear: an LSM or MDWE refuses it the same way. Read the flag from
VmFlags as well. Also check that a fork child and the new image get
VM_MAYEXEC back, as the mark is dropped from their copies.

https://virtuozzo.atlassian.net/browse/VSTOR-150234

Feature: oracle/mm: MADV_DOEXEC madvise() flag
Assisted-by: LLM
Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
---
 tools/testing/selftests/mm/doexec.c | 94 +++++++++++++++++++++++++------------
 1 file changed, 64 insertions(+), 30 deletions(-)

diff --git a/tools/testing/selftests/mm/doexec.c b/tools/testing/selftests/mm/doexec.c
index 01e786a4cb75c..89862e0b6a4dc 100644
--- a/tools/testing/selftests/mm/doexec.c
+++ b/tools/testing/selftests/mm/doexec.c
@@ -583,9 +583,43 @@ static int devzero_exec(void)
 	return KSFT_FAIL;
 }
 
+/* Copy the line of the smaps entry of the VMA at @addr that starts with @prefix. */
+static bool smaps_line(char *addr, const char *prefix, char *line, size_t len)
+{
+	FILE *file = fopen("/proc/self/smaps", "r");
+	bool in_vma = false, found = false;
+	char want[32];
+
+	if (!file)
+		return false;
+	snprintf(want, sizeof(want), "%lx-", (unsigned long)addr);
+	while (!found && fgets(line, len, file)) {
+		char *space = strchr(line, ' ');
+
+		if (space && memchr(line, '-', space - line) && !memchr(line, ':', space - line))
+			in_vma = !strncmp(line, want, strlen(want));
+		else if (in_vma)
+			found = !strncmp(line, prefix, strlen(prefix));
+	}
+	fclose(file);
+	return found;
+}
+
+static bool smaps_has_flag(char *addr, const char *flag)
+{
+	char line[512];
+
+	return smaps_line(addr, "VmFlags:", line, sizeof(line)) && strstr(line, flag);
+}
+
+/* VM_MAYEXEC ("me") is clear, so mprotect(PROT_EXEC) fails. */
 static bool exec_refused(char *ram, size_t size)
 {
-	return mprotect(ram, size, PROT_READ | PROT_EXEC) && errno == EACCES;
+	char line[512];
+
+	return smaps_line(ram, "VmFlags:", line, sizeof(line)) &&
+	       !strstr(line, " me ") &&
+	       mprotect(ram, size, PROT_READ | PROT_EXEC) && errno == EACCES;
 }
 
 /* MADV_DONTEXEC must not grant more than mmap() did on a noexec mount. */
@@ -645,35 +679,6 @@ static int doexec_noexec(void)
 	return ret;
 }
 
-/* Copy the line of the smaps entry of the VMA at @addr that starts with @prefix. */
-static bool smaps_line(char *addr, const char *prefix, char *line, size_t len)
-{
-	FILE *file = fopen("/proc/self/smaps", "r");
-	bool in_vma = false, found = false;
-	char want[32];
-
-	if (!file)
-		return false;
-	snprintf(want, sizeof(want), "%lx-", (unsigned long)addr);
-	while (!found && fgets(line, len, file)) {
-		char *space = strchr(line, ' ');
-
-		if (space && memchr(line, '-', space - line) && !memchr(line, ':', space - line))
-			in_vma = !strncmp(line, want, strlen(want));
-		else if (in_vma)
-			found = !strncmp(line, prefix, strlen(prefix));
-	}
-	fclose(file);
-	return found;
-}
-
-static bool smaps_has_flag(char *addr, const char *flag)
-{
-	char line[512];
-
-	return smaps_line(addr, "VmFlags:", line, sizeof(line)) && strstr(line, flag);
-}
-
 static int after_pfnmap_exec(char *bar, size_t size)
 {
 	size_t page = sysconf(_SC_PAGESIZE), i;
@@ -1274,6 +1279,33 @@ static int locked_exec(void)
 	return exec_with_flag(ram, size, "--unlocked", " lo ");
 }
 
+/* Dropping the mark in a copy gives VM_MAYEXEC back. */
+static int mayexec_exec(void)
+{
+	size_t size = sysconf(_SC_PAGESIZE);
+	char *ram = preserved_ram(size);
+	pid_t pid;
+
+	if (!ram)
+		return unsupported();
+	if (!exec_refused(ram, size))
+		return fail("VM_MAYEXEC kept by MADV_DOEXEC");
+	pid = fork();
+	if (!pid)
+		_exit(smaps_has_flag(ram, " me ") ? KSFT_PASS : KSFT_FAIL);
+	if (pid < 0 || wait_child(pid) != KSFT_PASS)
+		return fail("VM_MAYEXEC not back in a fork child");
+	exec_mode("/proc/self/exe", "--mayexec", ram, size);
+	return KSFT_FAIL;
+}
+
+static int after_mayexec(char *ram, size_t size)
+{
+	if (!smaps_has_flag(ram, " me "))
+		return fail("VM_MAYEXEC not back after exec");
+	return check_contents(ram, size, 0x31);
+}
+
 static int after_unlocked(char *ram, size_t size)
 {
 	if (smaps_has_flag(ram, " lo "))
@@ -1832,6 +1864,7 @@ static const struct after_mode after_modes[] = {
 	{ "--no-uffd", after_no_uffd },
 	{ "--mempolicy", after_mempolicy },
 	{ "--thp-half", after_thp_half },
+	{ "--mayexec", after_mayexec },
 };
 
 struct more_case {
@@ -1886,6 +1919,7 @@ static const struct more_case more_cases[] = {
 	{ "swapped out pages: preserved", swapped_exec },
 	{ "half of a THP: preserved", thp_half_exec },
 	{ "vfork() child: preserving exec refused", vfork_exec },
+	{ "exec permission back in a fork child and the new image", mayexec_exec },
 };
 
 int main(int argc, char **argv)

-- 
2.43.0