linux-kernel - Re: Attaching userspace VM to kernel thread (was Re: [PATCH] fs/binfmt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CABVgOSkgzo0bE5iHWB5HdMokgyEcbw-R-MrrnvD-QBzsHmz4OQ@mail.gmail.com>
Date:   Fri, 18 Nov 2022 15:29:43 +0800
From:   David Gow <davidgow@...gle.com>
To:     Kees Cook <keescook@...omium.org>
Cc:     Matthew Wilcox <willy@...radead.org>, linux-mm@...ck.org,
        Pedro Falcato <pedro.falcato@...il.com>,
        linux-kernel@...r.kernel.org, sam@...too.org,
        Alexander Viro <viro@...iv.linux.org.uk>,
        Eric Biederman <ebiederm@...ssion.com>,
        linux-fsdevel@...r.kernel.org, Rich Felker <dalias@...c.org>,
        linux-kselftest@...r.kernel.org, kunit-dev@...glegroups.com
Subject: Re: Attaching userspace VM to kernel thread (was Re: [PATCH]
 fs/binfmt_elf: Fix memsz > filesz handling)

On Fri, Nov 18, 2022 at 6:06 AM Kees Cook <keescook@...omium.org> wrote:
>
> Hi,
>
> This has diverged from the original topic a bit, so I've changed the
> Subject to hopefully gain visibility. :)
>
> For KUnit, it would be REALLY nice to have a way to attach a userspace
> VM to a kernel thread so we can do userspace memory mapping
> manipulation, etc. Neither David nor I have been able to figure out the
> right set of steps to make this happen. What are we missing?
>
> Details below...
>
> On Wed, Nov 16, 2022 at 12:34:40PM +0800, David Gow wrote:
> > On Mon, Nov 7, 2022 at 11:59 AM Kees Cook <keescook@...omium.org> wrote:
> > >
> > > On Sun, Nov 06, 2022 at 02:16:57AM +0000, Pedro Falcato wrote:
> > > David, has there been any work on adding a way to instantiate
> > > userspace VMAs in a KUnit test? I tried to write this myself, but I
> > > couldn't figure out how to make the userspace memory mappings appear.
> > > Here's my fumbling attempt:
> > > https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/log/?h=devel/kunit/usercopy
> > >
> > > I really wish KUnit had userspace mapping support -- I have a bunch of
> > > unit tests that need to get built up around checking for regressions
> > > here, etc.
> >
> > Hi Kees,
> >
> > Sorry the the delayed response!
> >
> > Alas, my attempts to get this to work haven't been much more
> > successful than yours. It's definitely something we'd like to support,
> > but I confess to not knowing enough about the mm code to know exactly
> > what would be involved.
> >
> > The workaround is to load tests as modules, and use something like
> > Vitor's original patch here:
> > https://lore.kernel.org/all/20200721174036.71072-1-vitor@massaru.org/
> >
> > Basically, using the existing mm of the module loader. Adapting those
> > changes to your branch (and fixing a couple of back-to-front KUnit
> > assertions) does work for me when built as a module, in an x86_64 vm:
> >
> > root@...cestar:~# modprobe usercopy_kunit
> > [   52.986290]     # Subtest: usercopy
> > [   52.986701]     1..1
> > [   53.246058]     ok 1 - usercopy_test
> > [   53.246628] ok 1 - usercopy
> >
> > But getting it to work with built-in tests hasn't been successful so
> > far. I wondered if we could just piggy-back on init_mm or similar, but
> > that doesn't seem to work either.
> >
> > So, in the short-term, this is only possible for modules. If that's
> > useful enough, we can get Vitor's support patch (or something similar)
> > in, and just mark any tests module-only (or have them skip if there's
> > no mm). Because kunit.py only runs built-in tests, though, it's
> > definitely less convenient.
>
> Thanks for any pointers! :)
>
> -Kees
>
> --
> Kees Cook

FWIW, I had another quick look at this yesterday, and I suspect that
(at least one of) the problem(s) is that function pointers like
mm->get_unmapped_area are only setup as part of exec(), so a
newly-created mm isn't actually useful. Looking at, e.g.,
arch_pick_mm_layout(), there's a whole bunch of architecture-dependent
stuff here to handle, e.g., 32-bit compat.

Cheers,
-- David

Download attachment "smime.p7s" of type "application/pkcs7-signature" (4003 bytes)