1 // SPDX-License-Identifier: GPL-2.0
3 #define __EXPORTED_HEADERS__
8 #include <linux/falloc.h>
10 #include <linux/memfd.h>
18 #include <sys/syscall.h>
24 #define MEMFD_STR "memfd:"
25 #define MEMFD_HUGE_STR "memfd-hugetlb:"
26 #define SHARED_FT_STR "(shared file-table)"
28 #define MFD_DEF_SIZE 8192
29 #define STACK_SIZE 65536
32 * Default is not to test hugetlbfs
34 static size_t mfd_def_size = MFD_DEF_SIZE;
35 static const char *memfd_str = MEMFD_STR;
37 static int mfd_assert_new(const char *name, loff_t sz, unsigned int flags)
41 fd = sys_memfd_create(name, flags);
43 printf("memfd_create(\"%s\", %u) failed: %m\n",
48 r = ftruncate(fd, sz);
50 printf("ftruncate(%llu) failed: %m\n", (unsigned long long)sz);
57 static int mfd_assert_reopen_fd(int fd_in)
62 sprintf(path, "/proc/self/fd/%d", fd_in);
64 fd = open(path, O_RDWR);
66 printf("re-open of existing fd %d failed\n", fd_in);
73 static void mfd_fail_new(const char *name, unsigned int flags)
77 r = sys_memfd_create(name, flags);
79 printf("memfd_create(\"%s\", %u) succeeded, but failure expected\n",
86 static unsigned int mfd_assert_get_seals(int fd)
90 r = fcntl(fd, F_GET_SEALS);
92 printf("GET_SEALS(%d) failed: %m\n", fd);
96 return (unsigned int)r;
99 static void mfd_assert_has_seals(int fd, unsigned int seals)
103 s = mfd_assert_get_seals(fd);
105 printf("%u != %u = GET_SEALS(%d)\n", seals, s, fd);
110 static void mfd_assert_add_seals(int fd, unsigned int seals)
115 s = mfd_assert_get_seals(fd);
116 r = fcntl(fd, F_ADD_SEALS, seals);
118 printf("ADD_SEALS(%d, %u -> %u) failed: %m\n", fd, s, seals);
123 static void mfd_fail_add_seals(int fd, unsigned int seals)
128 r = fcntl(fd, F_GET_SEALS);
134 r = fcntl(fd, F_ADD_SEALS, seals);
136 printf("ADD_SEALS(%d, %u -> %u) didn't fail as expected\n",
142 static void mfd_assert_size(int fd, size_t size)
149 printf("fstat(%d) failed: %m\n", fd);
151 } else if (st.st_size != size) {
152 printf("wrong file size %lld, but expected %lld\n",
153 (long long)st.st_size, (long long)size);
158 static int mfd_assert_dup(int fd)
164 printf("dup(%d) failed: %m\n", fd);
171 static void *mfd_assert_mmap_shared(int fd)
177 PROT_READ | PROT_WRITE,
181 if (p == MAP_FAILED) {
182 printf("mmap() failed: %m\n");
189 static void *mfd_assert_mmap_private(int fd)
199 if (p == MAP_FAILED) {
200 printf("mmap() failed: %m\n");
207 static int mfd_assert_open(int fd, int flags, mode_t mode)
212 sprintf(buf, "/proc/self/fd/%d", fd);
213 r = open(buf, flags, mode);
215 printf("open(%s) failed: %m\n", buf);
222 static void mfd_fail_open(int fd, int flags, mode_t mode)
227 sprintf(buf, "/proc/self/fd/%d", fd);
228 r = open(buf, flags, mode);
230 printf("open(%s) didn't fail as expected\n", buf);
235 static void mfd_assert_read(int fd)
241 l = read(fd, buf, sizeof(buf));
242 if (l != sizeof(buf)) {
243 printf("read() failed: %m\n");
247 /* verify PROT_READ *is* allowed */
254 if (p == MAP_FAILED) {
255 printf("mmap() failed: %m\n");
258 munmap(p, mfd_def_size);
260 /* verify MAP_PRIVATE is *always* allowed (even writable) */
263 PROT_READ | PROT_WRITE,
267 if (p == MAP_FAILED) {
268 printf("mmap() failed: %m\n");
271 munmap(p, mfd_def_size);
274 /* Test that PROT_READ + MAP_SHARED mappings work. */
275 static void mfd_assert_read_shared(int fd)
279 /* verify PROT_READ and MAP_SHARED *is* allowed */
286 if (p == MAP_FAILED) {
287 printf("mmap() failed: %m\n");
290 munmap(p, mfd_def_size);
293 static void mfd_assert_fork_private_write(int fd)
300 PROT_READ | PROT_WRITE,
304 if (p == MAP_FAILED) {
305 printf("mmap() failed: %m\n");
316 waitpid(pid, NULL, 0);
319 printf("MAP_PRIVATE copy-on-write failed: %m\n");
324 munmap(p, mfd_def_size);
327 static void mfd_assert_write(int fd)
334 * huegtlbfs does not support write, but we want to
335 * verify everything else here.
337 if (!hugetlbfs_test) {
338 /* verify write() succeeds */
339 l = write(fd, "\0\0\0\0", 4);
341 printf("write() failed: %m\n");
346 /* verify PROT_READ | PROT_WRITE is allowed */
349 PROT_READ | PROT_WRITE,
353 if (p == MAP_FAILED) {
354 printf("mmap() failed: %m\n");
358 munmap(p, mfd_def_size);
360 /* verify PROT_WRITE is allowed */
367 if (p == MAP_FAILED) {
368 printf("mmap() failed: %m\n");
372 munmap(p, mfd_def_size);
374 /* verify PROT_READ with MAP_SHARED is allowed and a following
375 * mprotect(PROT_WRITE) allows writing */
382 if (p == MAP_FAILED) {
383 printf("mmap() failed: %m\n");
387 r = mprotect(p, mfd_def_size, PROT_READ | PROT_WRITE);
389 printf("mprotect() failed: %m\n");
394 munmap(p, mfd_def_size);
396 /* verify PUNCH_HOLE works */
398 FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
402 printf("fallocate(PUNCH_HOLE) failed: %m\n");
407 static void mfd_fail_write(int fd)
413 /* verify write() fails */
414 l = write(fd, "data", 4);
416 printf("expected EPERM on write(), but got %d: %m\n", (int)l);
420 /* verify PROT_READ | PROT_WRITE is not allowed */
423 PROT_READ | PROT_WRITE,
427 if (p != MAP_FAILED) {
428 printf("mmap() didn't fail as expected\n");
432 /* verify PROT_WRITE is not allowed */
439 if (p != MAP_FAILED) {
440 printf("mmap() didn't fail as expected\n");
444 /* Verify PROT_READ with MAP_SHARED with a following mprotect is not
445 * allowed. Note that for r/w the kernel already prevents the mmap. */
452 if (p != MAP_FAILED) {
453 r = mprotect(p, mfd_def_size, PROT_READ | PROT_WRITE);
455 printf("mmap()+mprotect() didn't fail as expected\n");
460 /* verify PUNCH_HOLE fails */
462 FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
466 printf("fallocate(PUNCH_HOLE) didn't fail as expected\n");
471 static void mfd_assert_shrink(int fd)
475 r = ftruncate(fd, mfd_def_size / 2);
477 printf("ftruncate(SHRINK) failed: %m\n");
481 mfd_assert_size(fd, mfd_def_size / 2);
483 fd2 = mfd_assert_open(fd,
484 O_RDWR | O_CREAT | O_TRUNC,
488 mfd_assert_size(fd, 0);
491 static void mfd_fail_shrink(int fd)
495 r = ftruncate(fd, mfd_def_size / 2);
497 printf("ftruncate(SHRINK) didn't fail as expected\n");
502 O_RDWR | O_CREAT | O_TRUNC,
506 static void mfd_assert_grow(int fd)
510 r = ftruncate(fd, mfd_def_size * 2);
512 printf("ftruncate(GROW) failed: %m\n");
516 mfd_assert_size(fd, mfd_def_size * 2);
523 printf("fallocate(ALLOC) failed: %m\n");
527 mfd_assert_size(fd, mfd_def_size * 4);
530 static void mfd_fail_grow(int fd)
534 r = ftruncate(fd, mfd_def_size * 2);
536 printf("ftruncate(GROW) didn't fail as expected\n");
545 printf("fallocate(ALLOC) didn't fail as expected\n");
550 static void mfd_assert_grow_write(int fd)
555 /* hugetlbfs does not support write */
559 buf = malloc(mfd_def_size * 8);
561 printf("malloc(%zu) failed: %m\n", mfd_def_size * 8);
565 l = pwrite(fd, buf, mfd_def_size * 8, 0);
566 if (l != (mfd_def_size * 8)) {
567 printf("pwrite() failed: %m\n");
571 mfd_assert_size(fd, mfd_def_size * 8);
574 static void mfd_fail_grow_write(int fd)
579 /* hugetlbfs does not support write */
583 buf = malloc(mfd_def_size * 8);
585 printf("malloc(%zu) failed: %m\n", mfd_def_size * 8);
589 l = pwrite(fd, buf, mfd_def_size * 8, 0);
590 if (l == (mfd_def_size * 8)) {
591 printf("pwrite() didn't fail as expected\n");
596 static int idle_thread_fn(void *arg)
601 /* dummy waiter; SIGTERM terminates us anyway */
603 sigaddset(&set, SIGTERM);
609 static pid_t spawn_idle_thread(unsigned int flags)
614 stack = malloc(STACK_SIZE);
616 printf("malloc(STACK_SIZE) failed: %m\n");
620 pid = clone(idle_thread_fn,
625 printf("clone() failed: %m\n");
632 static void join_idle_thread(pid_t pid)
635 waitpid(pid, NULL, 0);
639 * Test memfd_create() syscall
640 * Verify syscall-argument validation, including name checks, flag validation
643 static void test_create(void)
648 printf("%s CREATE\n", memfd_str);
651 mfd_fail_new(NULL, 0);
653 /* test over-long name (not zero-terminated) */
654 memset(buf, 0xff, sizeof(buf));
655 mfd_fail_new(buf, 0);
657 /* test over-long zero-terminated name */
658 memset(buf, 0xff, sizeof(buf));
659 buf[sizeof(buf) - 1] = 0;
660 mfd_fail_new(buf, 0);
662 /* verify "" is a valid name */
663 fd = mfd_assert_new("", 0, 0);
666 /* verify invalid O_* open flags */
667 mfd_fail_new("", 0x0100);
668 mfd_fail_new("", ~MFD_CLOEXEC);
669 mfd_fail_new("", ~MFD_ALLOW_SEALING);
670 mfd_fail_new("", ~0);
671 mfd_fail_new("", 0x80000000U);
673 /* verify MFD_CLOEXEC is allowed */
674 fd = mfd_assert_new("", 0, MFD_CLOEXEC);
677 /* verify MFD_ALLOW_SEALING is allowed */
678 fd = mfd_assert_new("", 0, MFD_ALLOW_SEALING);
681 /* verify MFD_ALLOW_SEALING | MFD_CLOEXEC is allowed */
682 fd = mfd_assert_new("", 0, MFD_ALLOW_SEALING | MFD_CLOEXEC);
688 * A very basic sealing test to see whether setting/retrieving seals works.
690 static void test_basic(void)
694 printf("%s BASIC\n", memfd_str);
696 fd = mfd_assert_new("kern_memfd_basic",
698 MFD_CLOEXEC | MFD_ALLOW_SEALING);
700 /* add basic seals */
701 mfd_assert_has_seals(fd, 0);
702 mfd_assert_add_seals(fd, F_SEAL_SHRINK |
704 mfd_assert_has_seals(fd, F_SEAL_SHRINK |
708 mfd_assert_add_seals(fd, F_SEAL_SHRINK |
710 mfd_assert_has_seals(fd, F_SEAL_SHRINK |
713 /* add more seals and seal against sealing */
714 mfd_assert_add_seals(fd, F_SEAL_GROW | F_SEAL_SEAL);
715 mfd_assert_has_seals(fd, F_SEAL_SHRINK |
720 /* verify that sealing no longer works */
721 mfd_fail_add_seals(fd, F_SEAL_GROW);
722 mfd_fail_add_seals(fd, 0);
726 /* verify sealing does not work without MFD_ALLOW_SEALING */
727 fd = mfd_assert_new("kern_memfd_basic",
730 mfd_assert_has_seals(fd, F_SEAL_SEAL);
731 mfd_fail_add_seals(fd, F_SEAL_SHRINK |
734 mfd_assert_has_seals(fd, F_SEAL_SEAL);
740 * Test whether SEAL_WRITE actually prevents modifications.
742 static void test_seal_write(void)
746 printf("%s SEAL-WRITE\n", memfd_str);
748 fd = mfd_assert_new("kern_memfd_seal_write",
750 MFD_CLOEXEC | MFD_ALLOW_SEALING);
751 mfd_assert_has_seals(fd, 0);
752 mfd_assert_add_seals(fd, F_SEAL_WRITE);
753 mfd_assert_has_seals(fd, F_SEAL_WRITE);
757 mfd_assert_shrink(fd);
759 mfd_fail_grow_write(fd);
765 * Test SEAL_FUTURE_WRITE
766 * Test whether SEAL_FUTURE_WRITE actually prevents modifications.
768 static void test_seal_future_write(void)
773 printf("%s SEAL-FUTURE-WRITE\n", memfd_str);
775 fd = mfd_assert_new("kern_memfd_seal_future_write",
777 MFD_CLOEXEC | MFD_ALLOW_SEALING);
779 p = mfd_assert_mmap_shared(fd);
781 mfd_assert_has_seals(fd, 0);
783 mfd_assert_add_seals(fd, F_SEAL_FUTURE_WRITE);
784 mfd_assert_has_seals(fd, F_SEAL_FUTURE_WRITE);
786 /* read should pass, writes should fail */
788 mfd_assert_read_shared(fd);
791 fd2 = mfd_assert_reopen_fd(fd);
792 /* read should pass, writes should still fail */
793 mfd_assert_read(fd2);
794 mfd_assert_read_shared(fd2);
797 mfd_assert_fork_private_write(fd);
799 munmap(p, mfd_def_size);
806 * Test whether SEAL_SHRINK actually prevents shrinking
808 static void test_seal_shrink(void)
812 printf("%s SEAL-SHRINK\n", memfd_str);
814 fd = mfd_assert_new("kern_memfd_seal_shrink",
816 MFD_CLOEXEC | MFD_ALLOW_SEALING);
817 mfd_assert_has_seals(fd, 0);
818 mfd_assert_add_seals(fd, F_SEAL_SHRINK);
819 mfd_assert_has_seals(fd, F_SEAL_SHRINK);
822 mfd_assert_write(fd);
825 mfd_assert_grow_write(fd);
832 * Test whether SEAL_GROW actually prevents growing
834 static void test_seal_grow(void)
838 printf("%s SEAL-GROW\n", memfd_str);
840 fd = mfd_assert_new("kern_memfd_seal_grow",
842 MFD_CLOEXEC | MFD_ALLOW_SEALING);
843 mfd_assert_has_seals(fd, 0);
844 mfd_assert_add_seals(fd, F_SEAL_GROW);
845 mfd_assert_has_seals(fd, F_SEAL_GROW);
848 mfd_assert_write(fd);
849 mfd_assert_shrink(fd);
851 mfd_fail_grow_write(fd);
857 * Test SEAL_SHRINK | SEAL_GROW
858 * Test whether SEAL_SHRINK | SEAL_GROW actually prevents resizing
860 static void test_seal_resize(void)
864 printf("%s SEAL-RESIZE\n", memfd_str);
866 fd = mfd_assert_new("kern_memfd_seal_resize",
868 MFD_CLOEXEC | MFD_ALLOW_SEALING);
869 mfd_assert_has_seals(fd, 0);
870 mfd_assert_add_seals(fd, F_SEAL_SHRINK | F_SEAL_GROW);
871 mfd_assert_has_seals(fd, F_SEAL_SHRINK | F_SEAL_GROW);
874 mfd_assert_write(fd);
877 mfd_fail_grow_write(fd);
883 * Test sharing via dup()
884 * Test that seals are shared between dupped FDs and they're all equal.
886 static void test_share_dup(char *banner, char *b_suffix)
890 printf("%s %s %s\n", memfd_str, banner, b_suffix);
892 fd = mfd_assert_new("kern_memfd_share_dup",
894 MFD_CLOEXEC | MFD_ALLOW_SEALING);
895 mfd_assert_has_seals(fd, 0);
897 fd2 = mfd_assert_dup(fd);
898 mfd_assert_has_seals(fd2, 0);
900 mfd_assert_add_seals(fd, F_SEAL_WRITE);
901 mfd_assert_has_seals(fd, F_SEAL_WRITE);
902 mfd_assert_has_seals(fd2, F_SEAL_WRITE);
904 mfd_assert_add_seals(fd2, F_SEAL_SHRINK);
905 mfd_assert_has_seals(fd, F_SEAL_WRITE | F_SEAL_SHRINK);
906 mfd_assert_has_seals(fd2, F_SEAL_WRITE | F_SEAL_SHRINK);
908 mfd_assert_add_seals(fd, F_SEAL_SEAL);
909 mfd_assert_has_seals(fd, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_SEAL);
910 mfd_assert_has_seals(fd2, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_SEAL);
912 mfd_fail_add_seals(fd, F_SEAL_GROW);
913 mfd_fail_add_seals(fd2, F_SEAL_GROW);
914 mfd_fail_add_seals(fd, F_SEAL_SEAL);
915 mfd_fail_add_seals(fd2, F_SEAL_SEAL);
919 mfd_fail_add_seals(fd, F_SEAL_GROW);
924 * Test sealing with active mmap()s
925 * Modifying seals is only allowed if no other mmap() refs exist.
927 static void test_share_mmap(char *banner, char *b_suffix)
932 printf("%s %s %s\n", memfd_str, banner, b_suffix);
934 fd = mfd_assert_new("kern_memfd_share_mmap",
936 MFD_CLOEXEC | MFD_ALLOW_SEALING);
937 mfd_assert_has_seals(fd, 0);
939 /* shared/writable ref prevents sealing WRITE, but allows others */
940 p = mfd_assert_mmap_shared(fd);
941 mfd_fail_add_seals(fd, F_SEAL_WRITE);
942 mfd_assert_has_seals(fd, 0);
943 mfd_assert_add_seals(fd, F_SEAL_SHRINK);
944 mfd_assert_has_seals(fd, F_SEAL_SHRINK);
945 munmap(p, mfd_def_size);
947 /* readable ref allows sealing */
948 p = mfd_assert_mmap_private(fd);
949 mfd_assert_add_seals(fd, F_SEAL_WRITE);
950 mfd_assert_has_seals(fd, F_SEAL_WRITE | F_SEAL_SHRINK);
951 munmap(p, mfd_def_size);
957 * Test sealing with open(/proc/self/fd/%d)
958 * Via /proc we can get access to a separate file-context for the same memfd.
959 * This is *not* like dup(), but like a real separate open(). Make sure the
960 * semantics are as expected and we correctly check for RDONLY / WRONLY / RDWR.
962 static void test_share_open(char *banner, char *b_suffix)
966 printf("%s %s %s\n", memfd_str, banner, b_suffix);
968 fd = mfd_assert_new("kern_memfd_share_open",
970 MFD_CLOEXEC | MFD_ALLOW_SEALING);
971 mfd_assert_has_seals(fd, 0);
973 fd2 = mfd_assert_open(fd, O_RDWR, 0);
974 mfd_assert_add_seals(fd, F_SEAL_WRITE);
975 mfd_assert_has_seals(fd, F_SEAL_WRITE);
976 mfd_assert_has_seals(fd2, F_SEAL_WRITE);
978 mfd_assert_add_seals(fd2, F_SEAL_SHRINK);
979 mfd_assert_has_seals(fd, F_SEAL_WRITE | F_SEAL_SHRINK);
980 mfd_assert_has_seals(fd2, F_SEAL_WRITE | F_SEAL_SHRINK);
983 fd = mfd_assert_open(fd2, O_RDONLY, 0);
985 mfd_fail_add_seals(fd, F_SEAL_SEAL);
986 mfd_assert_has_seals(fd, F_SEAL_WRITE | F_SEAL_SHRINK);
987 mfd_assert_has_seals(fd2, F_SEAL_WRITE | F_SEAL_SHRINK);
990 fd2 = mfd_assert_open(fd, O_RDWR, 0);
992 mfd_assert_add_seals(fd2, F_SEAL_SEAL);
993 mfd_assert_has_seals(fd, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_SEAL);
994 mfd_assert_has_seals(fd2, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_SEAL);
1001 * Test sharing via fork()
1002 * Test whether seal-modifications work as expected with forked childs.
1004 static void test_share_fork(char *banner, char *b_suffix)
1009 printf("%s %s %s\n", memfd_str, banner, b_suffix);
1011 fd = mfd_assert_new("kern_memfd_share_fork",
1013 MFD_CLOEXEC | MFD_ALLOW_SEALING);
1014 mfd_assert_has_seals(fd, 0);
1016 pid = spawn_idle_thread(0);
1017 mfd_assert_add_seals(fd, F_SEAL_SEAL);
1018 mfd_assert_has_seals(fd, F_SEAL_SEAL);
1020 mfd_fail_add_seals(fd, F_SEAL_WRITE);
1021 mfd_assert_has_seals(fd, F_SEAL_SEAL);
1023 join_idle_thread(pid);
1025 mfd_fail_add_seals(fd, F_SEAL_WRITE);
1026 mfd_assert_has_seals(fd, F_SEAL_SEAL);
1031 int main(int argc, char **argv)
1036 if (!strcmp(argv[1], "hugetlbfs")) {
1037 unsigned long hpage_size = default_huge_page_size();
1040 printf("Unable to determine huge page size\n");
1045 memfd_str = MEMFD_HUGE_STR;
1046 mfd_def_size = hpage_size * 2;
1048 printf("Unknown option: %s\n", argv[1]);
1057 test_seal_future_write();
1062 test_share_dup("SHARE-DUP", "");
1063 test_share_mmap("SHARE-MMAP", "");
1064 test_share_open("SHARE-OPEN", "");
1065 test_share_fork("SHARE-FORK", "");
1067 /* Run test-suite in a multi-threaded environment with a shared
1069 pid = spawn_idle_thread(CLONE_FILES | CLONE_FS | CLONE_VM);
1070 test_share_dup("SHARE-DUP", SHARED_FT_STR);
1071 test_share_mmap("SHARE-MMAP", SHARED_FT_STR);
1072 test_share_open("SHARE-OPEN", SHARED_FT_STR);
1073 test_share_fork("SHARE-FORK", SHARED_FT_STR);
1074 join_idle_thread(pid);
1076 printf("memfd: DONE\n");