- Linux-kselftest-mirror - lists.linaro.org

[REGRESSION] lkft kselftest for next-20220113

by lkft＠linaro.org

## Build * kernel: 5.16.0 * git: https://gitlab.com/Linaro/lkft/mirrors/next/linux-next * git branch: master * git commit: 27c9d5b3c24af29de643533984f1ba3e650c7c78 * git describe: next-20220113 * test details: https://qa-reports.linaro.org/lkft/linux-next-master/build/next-20220113 ## Test Regressions (compared to next-20211224) * dragonboard-410c, kselftest-capabilities - capabilities.test_execve * dragonboard-410c, kselftest-cgroup - cgroup.test_freezer - cgroup.test_freezer.test_cgfreezer_ptrace - cgroup.test_kill * dragonboard-410c, kselftest-kvm - kvm.get-reg-list * dragonboard-410c, kselftest-pidfd - pidfd.pidfd_setns_test * dragonboard-410c, kselftest-proc - proc.fd-001-lookup - proc.fd-002-posix-eq - proc.proc-fsconfig-hidepid - proc.proc-multiple-procfs - proc.proc-uptime-001 * dragonboard-410c, kselftest-rseq - rseq.basic_percpu_ops_test - rseq.basic_test - rseq.param_test - rseq.param_test_benchmark - rseq.param_test_compare_twice * dragonboard-410c, kselftest-sync - sync.sync_test * dragonboard-410c, kselftest-timens - timens.procfs - timens.timens * dragonboard-410c, kselftest-timers - timers.nsleep-lat * hi6220-hikey, kselftest-pidfd - pidfd.pidfd_setns_test * hi6220-hikey, kselftest-proc - proc.fd-001-lookup - proc.fd-002-posix-eq - proc.proc-multiple-procfs * hi6220-hikey, kselftest-sync - sync.sync_test * hi6220-hikey, kselftest-timens - timens.procfs - timens.timens * hi6220-hikey, kselftest-timers - timers.set-timer-lat * qemu_i386, kselftest-cgroup - cgroup.test_freezer - cgroup.test_kill * qemu_i386, kselftest-pidfd - pidfd.pidfd_setns_test * qemu_i386, kselftest-proc - proc.fd-001-lookup - proc.fd-002-posix-eq - proc.proc-multiple-procfs * qemu_i386, kselftest-timens - timens.procfs - timens.timens * qemu_x86_64, kselftest-cgroup - cgroup.test_freezer - cgroup.test_kill * qemu_x86_64, kselftest-kvm - kvm.cr4_cpuid_sync_test - kvm.debug_regs - kvm.demand_paging_test - kvm.dirty_log_perf_test - kvm.emulator_error_test - kvm.get_cpuid_test - kvm.get_msr_index_features - kvm.hardware_disable_test - kvm.hyperv_cpuid - kvm.hyperv_features - kvm.kvm_binary_stats_test - kvm.kvm_create_max_vcpus - kvm.kvm_page_table_test - kvm.kvm_pv_test - kvm.memslot_modification_stress_test - kvm.mmu_role_test - kvm.platform_info_test - kvm.set_boot_cpu_id - kvm.set_memory_region_test - kvm.set_sregs_test - kvm.smm_test - kvm.state_test - kvm.svm_int_ctl_test - kvm.svm_vmcall_test - kvm.sync_regs_test - kvm.system_counter_offset_test - kvm.tsc_msrs_test - kvm.userspace_io_test - kvm.userspace_msr_exit_test - kvm.xapic_ipi_test * qemu_x86_64, kselftest-pidfd - pidfd.pidfd_setns_test * qemu_x86_64, kselftest-proc - proc.fd-001-lookup - proc.fd-002-posix-eq - proc.proc-multiple-procfs * qemu_x86_64, kselftest-sync - sync.sync_test * qemu_x86_64, kselftest-timens - timens.procfs - timens.timens * x15, kselftest-capabilities - capabilities.test_execve * x15, kselftest-cgroup - cgroup.test_freezer - cgroup.test_kill - cgroup.test_kill.test_cgkill_simple * x15, kselftest-core - core.close_range_test ## Metric Regressions (compared to next-20211224) No metric regressions found. Reported-by: Linux Kernel Functional Testing <lkft(a)linaro.org> ## Test Fixes (compared to next-20211224) * dragonboard-410c, kselftest-capabilities - capabilities.test_execve * dragonboard-410c, kselftest-lkdtm - lkdtm.SLAB_FREE_DOUBLE.sh * dragonboard-410c, kselftest-proc - proc.proc-fsconfig-hidepid * dragonboard-410c, kselftest-rseq - rseq.basic_percpu_ops_test - rseq.basic_test - rseq.param_test - rseq.param_test_benchmark - rseq.param_test_compare_twice * dragonboard-410c, kselftest-seccomp - seccomp.seccomp_bpf - seccomp.seccomp_bpf.global.user_notification_filter_empty - seccomp.seccomp_bpf.global.user_notification_filter_empty_threaded * i386, kselftest-rtc - rtc.rtctest * juno-r2, kselftest-cgroup - cgroup.test_freezer - cgroup.test_freezer.test_cgfreezer_ptrace * juno-r2, kselftest-clone3 - clone3.clone3_set_tid * qemu_arm, kselftest-rtc - rtc.rtctest * x15, kselftest-capabilities - capabilities.test_execve * x15, kselftest-cgroup - cgroup.test_freezer - cgroup.test_kill - cgroup.test_kill.test_cgkill_simple * x15, kselftest-core - core.close_range_test ## Metric Fixes (compared to next-20211224) No metric fixes found. ## Test result summary total: 3775, pass: 1936, fail: 489, skip: 1350, xfail: 0 ## Build Summary ## Test suites summary * kselftest-android * kselftest-arm64 * kselftest-arm64/arm64.btitest.bti_c_func * kselftest-arm64/arm64.btitest.bti_j_func * kselftest-arm64/arm64.btitest.bti_jc_func * kselftest-arm64/arm64.btitest.bti_none_func * kselftest-arm64/arm64.btitest.nohint_func * kselftest-arm64/arm64.btitest.paciasp_func * kselftest-arm64/arm64.nobtitest.bti_c_func * kselftest-arm64/arm64.nobtitest.bti_j_func * kselftest-arm64/arm64.nobtitest.bti_jc_func * kselftest-arm64/arm64.nobtitest.bti_none_func * kselftest-arm64/arm64.nobtitest.nohint_func * kselftest-arm64/arm64.nobtitest.paciasp_func * kselftest-bpf * kselftest-breakpoints * kselftest-capabilities * kselftest-cgroup * kselftest-clone3 * kselftest-core * kselftest-cpu-hotplug * kselftest-cpufreq * kselftest-drivers * kselftest-efivarfs * kselftest-filesystems * kselftest-firmware * kselftest-fpu * kselftest-futex * kselftest-gpio * kselftest-intel_pstate * kselftest-ipc * kselftest-ir * kselftest-kcmp * kselftest-kexec * kselftest-kvm * kselftest-lib * kselftest-livepatch * kselftest-lkdtm * kselftest-membarrier * kselftest-memfd * kselftest-memory-hotplug * kselftest-mincore * kselftest-mount * kselftest-mqueue * kselftest-openat2 * kselftest-pid_namespace * kselftest-pidfd * kselftest-proc * kselftest-pstore * kselftest-ptrace * kselftest-rseq * kselftest-rtc * kselftest-seccomp * kselftest-sigaltstack * kselftest-size * kselftest-splice * kselftest-static_keys * kselftest-sync * kselftest-sysctl * kselftest-timens * kselftest-timers * kselftest-tmpfs * kselftest-tpm2 * kselftest-user * kselftest-vm * kselftest-x86 * kselftest-zram -- Linaro LKFT https://lkft.linaro.org

3 years, 5 months

1
0
0 0

[PATCH AUTOSEL 5.16 199/217] bpf/selftests: Fix namespace mount setup in tc_redirect

by Sasha Levin

From: Jiri Olsa <jolsa(a)redhat.com> [ Upstream commit 5e22dd18626726028a93ff1350a8a71a00fd843d ] The tc_redirect umounts /sys in the new namespace, which can be mounted as shared and cause global umount. The lazy umount also takes down mounted trees under /sys like debugfs, which won't be available after sysfs mounts again and could cause fails in other tests. # cat /proc/self/mountinfo | grep debugfs 34 23 0:7 / /sys/kernel/debug rw,nosuid,nodev,noexec,relatime shared:14 - debugfs debugfs rw # cat /proc/self/mountinfo | grep sysfs 23 86 0:22 / /sys rw,nosuid,nodev,noexec,relatime shared:2 - sysfs sysfs rw # mount | grep debugfs debugfs on /sys/kernel/debug type debugfs (rw,nosuid,nodev,noexec,relatime) # ./test_progs -t tc_redirect #164 tc_redirect:OK Summary: 1/4 PASSED, 0 SKIPPED, 0 FAILED # mount | grep debugfs # cat /proc/self/mountinfo | grep debugfs # cat /proc/self/mountinfo | grep sysfs 25 86 0:22 / /sys rw,relatime shared:2 - sysfs sysfs rw Making the sysfs private under the new namespace so the umount won't trigger the global sysfs umount. Reported-by: Hangbin Liu <haliu(a)redhat.com> Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Cc: Jussi Maki <joamaki(a)gmail.com> Link: https://lore.kernel.org/bpf/20220104121030.138216-1-jolsa@kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- tools/testing/selftests/bpf/prog_tests/tc_redirect.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/tools/testing/selftests/bpf/prog_tests/tc_redirect.c b/tools/testing/selftests/bpf/prog_tests/tc_redirect.c index 4b18b73df10b6..c2426df58e172 100644 --- a/tools/testing/selftests/bpf/prog_tests/tc_redirect.c +++ b/tools/testing/selftests/bpf/prog_tests/tc_redirect.c @@ -105,6 +105,13 @@ static int setns_by_fd(int nsfd) if (!ASSERT_OK(err, "unshare")) return err; + /* Make our /sys mount private, so the following umount won't + * trigger the global umount in case it's shared. + */ + err = mount("none", "/sys", NULL, MS_PRIVATE, NULL); + if (!ASSERT_OK(err, "remount private /sys")) + return err; + err = umount2("/sys", MNT_DETACH); if (!ASSERT_OK(err, "umount2 /sys")) return err; -- 2.34.1

3 years, 5 months

1
0
0 0

[PATCH AUTOSEL 5.16 128/217] kunit: Don't crash if no parameters are generated

by Sasha Levin

From: David Gow <davidgow(a)google.com> [ Upstream commit 37dbb4c7c7442dbfc9b651e4ddd4afe30b26afc9 ] It's possible that a parameterised test could end up with zero parameters. At the moment, the test function will nevertheless be called with NULL as the parameter. Instead, don't try to run the test code, and just mark the test as SKIPped. Reported-by: Daniel Latypov <dlatypov(a)google.com> Signed-off-by: David Gow <davidgow(a)google.com> Reviewed-by: Daniel Latypov <dlatypov(a)google.com> Reviewed-by: Brendan Higgins <brendanhiggins(a)google.com> Signed-off-by: Shuah Khan <skhan(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- lib/kunit/test.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/lib/kunit/test.c b/lib/kunit/test.c index 3bd741e50a2d3..f96498ede2cc5 100644 --- a/lib/kunit/test.c +++ b/lib/kunit/test.c @@ -504,16 +504,18 @@ int kunit_run_tests(struct kunit_suite *suite) struct kunit_result_stats param_stats = { 0 }; test_case->status = KUNIT_SKIPPED; - if (test_case->generate_params) { + if (!test_case->generate_params) { + /* Non-parameterised test. */ + kunit_run_case_catch_errors(suite, test_case, &test); + kunit_update_stats(&param_stats, test.status); + } else { /* Get initial param. */ param_desc[0] = '\0'; test.param_value = test_case->generate_params(NULL, param_desc); - } - do { - kunit_run_case_catch_errors(suite, test_case, &test); + while (test.param_value) { + kunit_run_case_catch_errors(suite, test_case, &test); - if (test_case->generate_params) { if (param_desc[0] == '\0') { snprintf(param_desc, sizeof(param_desc), "param-%d", test.param_index); @@ -530,11 +532,11 @@ int kunit_run_tests(struct kunit_suite *suite) param_desc[0] = '\0'; test.param_value = test_case->generate_params(test.param_value, param_desc); test.param_index++; - } - kunit_update_stats(&param_stats, test.status); + kunit_update_stats(&param_stats, test.status); + } + } - } while (test.param_value); kunit_print_test_stats(&test, param_stats); -- 2.34.1

3 years, 5 months

1
0
0 0

[PATCH AUTOSEL 5.16 117/217] selftests/ftrace: make kprobe profile testcase description unique

by Sasha Levin

From: Heiko Carstens <hca(a)linux.ibm.com> [ Upstream commit e5992f373c6eed6d09e5858e9623df1259b3ce30 ] Commit 32f6e5da83c7 ("selftests/ftrace: Add kprobe profile testcase") added a new kprobes testcase, but has a description which does not describe what the test case is doing and is duplicating the description of another test case. Therefore change the test case description, so it is unique and then allows easily to tell which test case actually passed or failed. Reported-by: Alexander Egorenkov <egorenar(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Acked-by: Masami Hiramatsu <mhiramat(a)kernel.org> Signed-off-by: Shuah Khan <skhan(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- tools/testing/selftests/ftrace/test.d/kprobe/profile.tc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/profile.tc b/tools/testing/selftests/ftrace/test.d/kprobe/profile.tc index 98166fa3eb91c..34fb89b0c61fa 100644 --- a/tools/testing/selftests/ftrace/test.d/kprobe/profile.tc +++ b/tools/testing/selftests/ftrace/test.d/kprobe/profile.tc @@ -1,6 +1,6 @@ #!/bin/sh # SPDX-License-Identifier: GPL-2.0 -# description: Kprobe dynamic event - adding and removing +# description: Kprobe profile # requires: kprobe_events ! grep -q 'myevent' kprobe_profile -- 2.34.1

3 years, 5 months

1
0
0 0

[PATCH AUTOSEL 5.16 014/217] selftests/bpf: Fix bpf_object leak in skb_ctx selftest

by Sasha Levin

From: Andrii Nakryiko <andrii(a)kernel.org> [ Upstream commit 8c7a95520184b6677ca6075e12df9c208d57d088 ] skb_ctx selftest didn't close bpf_object implicitly allocated by bpf_prog_test_load() helper. Fix the problem by explicitly calling bpf_object__close() at the end of the test. Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Reviewed-by: Hengqi Chen <hengqi.chen(a)gmail.com> Link: https://lore.kernel.org/bpf/20211107165521.9240-10-andrii@kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- tools/testing/selftests/bpf/prog_tests/skb_ctx.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tools/testing/selftests/bpf/prog_tests/skb_ctx.c b/tools/testing/selftests/bpf/prog_tests/skb_ctx.c index c437e6ba8fe20..db4d72563aaeb 100644 --- a/tools/testing/selftests/bpf/prog_tests/skb_ctx.c +++ b/tools/testing/selftests/bpf/prog_tests/skb_ctx.c @@ -111,4 +111,6 @@ void test_skb_ctx(void) "ctx_out_mark", "skb->mark == %u, expected %d\n", skb.mark, 10); + + bpf_object__close(obj); } -- 2.34.1

3 years, 5 months

1
0
0 0

[PATCH AUTOSEL 5.16 013/217] selftests/bpf: Destroy XDP link correctly

by Sasha Levin

From: Andrii Nakryiko <andrii(a)kernel.org> [ Upstream commit f91231eeeed752119f49eb6620cae44ec745a007 ] bpf_link__detach() was confused with bpf_link__destroy() and leaves leaked FD in the process. Fix the problem. Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Reviewed-by: Hengqi Chen <hengqi.chen(a)gmail.com> Link: https://lore.kernel.org/bpf/20211107165521.9240-9-andrii@kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- tools/testing/selftests/bpf/prog_tests/migrate_reuseport.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/bpf/prog_tests/migrate_reuseport.c b/tools/testing/selftests/bpf/prog_tests/migrate_reuseport.c index 7589c03fd26be..eb2feaac81fe2 100644 --- a/tools/testing/selftests/bpf/prog_tests/migrate_reuseport.c +++ b/tools/testing/selftests/bpf/prog_tests/migrate_reuseport.c @@ -204,8 +204,8 @@ static int pass_ack(struct migrate_reuseport_test_case *test_case) { int err; - err = bpf_link__detach(test_case->link); - if (!ASSERT_OK(err, "bpf_link__detach")) + err = bpf_link__destroy(test_case->link); + if (!ASSERT_OK(err, "bpf_link__destroy")) return -1; test_case->link = NULL; -- 2.34.1

3 years, 5 months

1
0
0 0

[PATCH AUTOSEL 5.16 012/217] selftests/bpf: Fix memory leaks in btf_type_c_dump() helper

by Sasha Levin

From: Andrii Nakryiko <andrii(a)kernel.org> [ Upstream commit 8ba285874913da21ca39a46376e9cc5ce0f45f94 ] Free up memory and resources used by temporary allocated memstream and btf_dump instance. Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Reviewed-by: Hengqi Chen <hengqi.chen(a)gmail.com> Link: https://lore.kernel.org/bpf/20211107165521.9240-4-andrii@kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- tools/testing/selftests/bpf/btf_helpers.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/bpf/btf_helpers.c b/tools/testing/selftests/bpf/btf_helpers.c index b5b6b013a245e..3d1a748d09d81 100644 --- a/tools/testing/selftests/bpf/btf_helpers.c +++ b/tools/testing/selftests/bpf/btf_helpers.c @@ -251,18 +251,23 @@ const char *btf_type_c_dump(const struct btf *btf) d = btf_dump__new(btf, NULL, &opts, btf_dump_printf); if (libbpf_get_error(d)) { fprintf(stderr, "Failed to create btf_dump instance: %ld\n", libbpf_get_error(d)); - return NULL; + goto err_out; } for (i = 1; i < btf__type_cnt(btf); i++) { err = btf_dump__dump_type(d, i); if (err) { fprintf(stderr, "Failed to dump type [%d]: %d\n", i, err); - return NULL; + goto err_out; } } + btf_dump__free(d); fflush(buf_file); fclose(buf_file); return buf; +err_out: + btf_dump__free(d); + fclose(buf_file); + return NULL; } -- 2.34.1

3 years, 5 months

1
0
0 0

Re: [RFC PATCH 0/5] RSEQ selftests uplift for glibc-2.35 compatibility

by Mathieu Desnoyers

[ I should really have CC'd the selftests maintainer and mailing list. Adding them in Cc to patch 0/5 to bring this series to their attention. ] ----- On Jan 17, 2022, at 3:39 PM, Mathieu Desnoyers mathieu.desnoyers(a)efficios.com wrote: > glibc-2.35 will be released on 2022-02-01. It introduces a user-space ABI > based on the thread pointer to access a reserved area of the TCB. > > The rseq selftests originally expected the rseq thread data to sit in a > __rseq_abi TLS variable. > > Considering that the rseq ABI only allows a single rseq registration per > thread, both cannot actively coexist in a process. > > Adapt the selftests librseq implementation to become compatible with > glibc-2.35. Keep a fallback implementation based on TLS available when > an older glibc is detected. > > Feedback is welcome, > > Thanks, > > Mathieu > > Mathieu Desnoyers (5): > selftests/rseq: Remove useless assignment to cpu variable > selftests/rseq: Remove volatile from __rseq_abi > selftests/rseq: Introduce rseq_get_abi() helper > selftests/rseq: Introduce thread pointer getters > selftests/rseq: Uplift rseq selftests for compatibility with > glibc-2.35 > > tools/testing/selftests/rseq/Makefile | 2 +- > tools/testing/selftests/rseq/param_test.c | 4 +- > tools/testing/selftests/rseq/rseq-arm.h | 32 ++-- > tools/testing/selftests/rseq/rseq-arm64.h | 32 ++-- > .../rseq/rseq-generic-thread-pointer.h | 25 +++ > tools/testing/selftests/rseq/rseq-mips.h | 32 ++-- > .../selftests/rseq/rseq-ppc-thread-pointer.h | 30 ++++ > tools/testing/selftests/rseq/rseq-ppc.h | 32 ++-- > tools/testing/selftests/rseq/rseq-s390.h | 24 +-- > .../selftests/rseq/rseq-thread-pointer.h | 19 +++ > .../selftests/rseq/rseq-x86-thread-pointer.h | 40 +++++ > tools/testing/selftests/rseq/rseq-x86.h | 30 ++-- > tools/testing/selftests/rseq/rseq.c | 161 +++++++++--------- > tools/testing/selftests/rseq/rseq.h | 24 ++- > 14 files changed, 302 insertions(+), 185 deletions(-) > create mode 100644 tools/testing/selftests/rseq/rseq-generic-thread-pointer.h > create mode 100644 tools/testing/selftests/rseq/rseq-ppc-thread-pointer.h > create mode 100644 tools/testing/selftests/rseq/rseq-thread-pointer.h > create mode 100644 tools/testing/selftests/rseq/rseq-x86-thread-pointer.h > > -- > 2.17.1 -- Mathieu Desnoyers EfficiOS Inc. http://www.efficios.com

3 years, 5 months

1
0
0 0

[PATCH AUTOSEL 5.10 22/34] selftests/powerpc/spectre_v2: Return skip code when miss_percent is high

by Sasha Levin

From: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> [ Upstream commit 3c42e9542050d49610077e083c7c3f5fd5e26820 ] A mis-match between reported and actual mitigation is not restricted to the Vulnerable case. The guest might also report the mitigation as "Software count cache flush" and the host will still mitigate with branch cache disabled. So, instead of skipping depending on the detected mitigation, simply skip whenever the detected miss_percent is the expected one for a fully mitigated system, that is, above 95%. Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://lore.kernel.org/r/20211207130557.40566-1-cascardo@canonical.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- tools/testing/selftests/powerpc/security/spectre_v2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/powerpc/security/spectre_v2.c b/tools/testing/selftests/powerpc/security/spectre_v2.c index adc2b7294e5fd..83647b8277e7d 100644 --- a/tools/testing/selftests/powerpc/security/spectre_v2.c +++ b/tools/testing/selftests/powerpc/security/spectre_v2.c @@ -193,7 +193,7 @@ int spectre_v2_test(void) * We are not vulnerable and reporting otherwise, so * missing such a mismatch is safe. */ - if (state == VULNERABLE) + if (miss_percent > 95) return 4; return 1; -- 2.34.1

3 years, 5 months

1
0
0 0

[PATCH AUTOSEL 5.15 33/44] selftests/powerpc: Add a test of sigreturning to the kernel

by Sasha Levin

From: Michael Ellerman <mpe(a)ellerman.id.au> [ Upstream commit a8968521cfdc3e339fe69473d6632e0aa8d7202a ] We have a general signal fuzzer, sigfuz, which can modify the MSR & NIP before sigreturn. But the chance of it hitting a kernel address and also clearing MSR_PR is fairly slim. So add a specific test of sigreturn to a kernel address, both with and without attempting to clear MSR_PR (which the kernel must block). Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://lore.kernel.org/r/20211209115944.4062384-1-mpe@ellerman.id.au Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- .../selftests/powerpc/signal/.gitignore | 1 + .../testing/selftests/powerpc/signal/Makefile | 1 + .../powerpc/signal/sigreturn_kernel.c | 132 ++++++++++++++++++ 3 files changed, 134 insertions(+) create mode 100644 tools/testing/selftests/powerpc/signal/sigreturn_kernel.c diff --git a/tools/testing/selftests/powerpc/signal/.gitignore b/tools/testing/selftests/powerpc/signal/.gitignore index ce3375cd8e73e..8f6c816099a48 100644 --- a/tools/testing/selftests/powerpc/signal/.gitignore +++ b/tools/testing/selftests/powerpc/signal/.gitignore @@ -4,3 +4,4 @@ signal_tm sigfuz sigreturn_vdso sig_sc_double_restart +sigreturn_kernel diff --git a/tools/testing/selftests/powerpc/signal/Makefile b/tools/testing/selftests/powerpc/signal/Makefile index d6ae54663aed7..84e201572466d 100644 --- a/tools/testing/selftests/powerpc/signal/Makefile +++ b/tools/testing/selftests/powerpc/signal/Makefile @@ -1,5 +1,6 @@ # SPDX-License-Identifier: GPL-2.0 TEST_GEN_PROGS := signal signal_tm sigfuz sigreturn_vdso sig_sc_double_restart +TEST_GEN_PROGS += sigreturn_kernel CFLAGS += -maltivec $(OUTPUT)/signal_tm: CFLAGS += -mhtm diff --git a/tools/testing/selftests/powerpc/signal/sigreturn_kernel.c b/tools/testing/selftests/powerpc/signal/sigreturn_kernel.c new file mode 100644 index 0000000000000..0a1b6e591eeed --- /dev/null +++ b/tools/testing/selftests/powerpc/signal/sigreturn_kernel.c @@ -0,0 +1,132 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Test that we can't sigreturn to kernel addresses, or to kernel mode. + */ + +#define _GNU_SOURCE + +#include <stdio.h> +#include <signal.h> +#include <stdlib.h> +#include <sys/types.h> +#include <sys/wait.h> +#include <unistd.h> + +#include "utils.h" + +#define MSR_PR (1ul << 14) + +static volatile unsigned long long sigreturn_addr; +static volatile unsigned long long sigreturn_msr_mask; + +static void sigusr1_handler(int signo, siginfo_t *si, void *uc_ptr) +{ + ucontext_t *uc = (ucontext_t *)uc_ptr; + + if (sigreturn_addr) + UCONTEXT_NIA(uc) = sigreturn_addr; + + if (sigreturn_msr_mask) + UCONTEXT_MSR(uc) &= sigreturn_msr_mask; +} + +static pid_t fork_child(void) +{ + pid_t pid; + + pid = fork(); + if (pid == 0) { + raise(SIGUSR1); + exit(0); + } + + return pid; +} + +static int expect_segv(pid_t pid) +{ + int child_ret; + + waitpid(pid, &child_ret, 0); + FAIL_IF(WIFEXITED(child_ret)); + FAIL_IF(!WIFSIGNALED(child_ret)); + FAIL_IF(WTERMSIG(child_ret) != 11); + + return 0; +} + +int test_sigreturn_kernel(void) +{ + struct sigaction act; + int child_ret, i; + pid_t pid; + + act.sa_sigaction = sigusr1_handler; + act.sa_flags = SA_SIGINFO; + sigemptyset(&act.sa_mask); + + FAIL_IF(sigaction(SIGUSR1, &act, NULL)); + + for (i = 0; i < 2; i++) { + // Return to kernel + sigreturn_addr = 0xcull << 60; + pid = fork_child(); + expect_segv(pid); + + // Return to kernel virtual + sigreturn_addr = 0xc008ull << 48; + pid = fork_child(); + expect_segv(pid); + + // Return out of range + sigreturn_addr = 0xc010ull << 48; + pid = fork_child(); + expect_segv(pid); + + // Return to no-man's land, just below PAGE_OFFSET + sigreturn_addr = (0xcull << 60) - (64 * 1024); + pid = fork_child(); + expect_segv(pid); + + // Return to no-man's land, above TASK_SIZE_4PB + sigreturn_addr = 0x1ull << 52; + pid = fork_child(); + expect_segv(pid); + + // Return to 0xd space + sigreturn_addr = 0xdull << 60; + pid = fork_child(); + expect_segv(pid); + + // Return to 0xe space + sigreturn_addr = 0xeull << 60; + pid = fork_child(); + expect_segv(pid); + + // Return to 0xf space + sigreturn_addr = 0xfull << 60; + pid = fork_child(); + expect_segv(pid); + + // Attempt to set PR=0 for 2nd loop (should be blocked by kernel) + sigreturn_msr_mask = ~MSR_PR; + } + + printf("All children killed as expected\n"); + + // Don't change address, just MSR, should return to user as normal + sigreturn_addr = 0; + sigreturn_msr_mask = ~MSR_PR; + pid = fork_child(); + waitpid(pid, &child_ret, 0); + FAIL_IF(!WIFEXITED(child_ret)); + FAIL_IF(WIFSIGNALED(child_ret)); + FAIL_IF(WEXITSTATUS(child_ret) != 0); + + return 0; +} + +int main(void) +{ + return test_harness(test_sigreturn_kernel, "sigreturn_kernel"); +} -- 2.34.1

3 years, 5 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-kselftest-mirror