selftests/vm: anon_cow: test COW handling of anonymous memory
authorDavid Hildenbrand <david@redhat.com>
Tue, 27 Sep 2022 11:01:14 +0000 (13:01 +0200)
committerAndrew Morton <akpm@linux-foundation.org>
Wed, 9 Nov 2022 01:37:14 +0000 (17:37 -0800)
Patch series "selftests/vm: test COW handling of anonymous memory".

This is my current set of tests for testing COW handling of anonymous
memory, especially when interacting with GUP.  I developed these tests
while working on PageAnonExclusive and managed to clean them up just now.

On current upstream Linux, all tests pass except the hugetlb tests that
rely on vmsplice -- these tests should pass as soon as vmsplice properly
uses FOLL_PIN instead of FOLL_GET.

I'm working on additional tests for COW handling in private mappings,
focusing on long-term R/O pinning e.g., of the shared zeropage, pagecache
pages and KSM pages.  These tests, however, will go into a different file.
So this is everything I have regarding tests for anonymous memory.

This patch (of 7):

Let's start adding tests for our COW handling of anonymous memory.  We'll
focus on basic tests that we can achieve without additional libraries or
gup_test extensions.

We'll add THP and hugetlb tests separately.

[david@redhat.com: s/size_t/ssize_t/ on `cur', `total', `transferred';]
Link: https://lkml.kernel.org/r/51302b9e-dc69-d709-3214-f23868028555@redhat.com
Link: https://lkml.kernel.org/r/20220927110120.106906-1-david@redhat.com
Link: https://lkml.kernel.org/r/20220927110120.106906-2-david@redhat.com
Signed-off-by: David Hildenbrand <david@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Christoph von Recklinghausen <crecklin@redhat.com>
Cc: Don Dutile <ddutile@redhat.com>
Cc: Jason Gunthorpe <jgg@nvidia.com>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Nadav Amit <namit@vmware.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
tools/testing/selftests/vm/.gitignore
tools/testing/selftests/vm/Makefile
tools/testing/selftests/vm/anon_cow.c [new file with mode: 0644]
tools/testing/selftests/vm/run_vmtests.sh
tools/testing/selftests/vm/vm_util.c
tools/testing/selftests/vm/vm_util.h

index 7b9dc24..8a536c7 100644 (file)
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0-only
+anon_cow
 hugepage-mmap
 hugepage-mremap
 hugepage-shm
index 163c2fd..ad07d7a 100644 (file)
@@ -25,7 +25,8 @@ MAKEFLAGS += --no-builtin-rules
 
 CFLAGS = -Wall -I $(top_srcdir) -I $(top_srcdir)/usr/include $(EXTRA_CFLAGS) $(KHDR_INCLUDES)
 LDLIBS = -lrt -lpthread
-TEST_GEN_FILES = compaction_test
+TEST_GEN_FILES = anon_cow
+TEST_GEN_FILES += compaction_test
 TEST_GEN_FILES += gup_test
 TEST_GEN_FILES += hmm-tests
 TEST_GEN_FILES += hugetlb-madvise
@@ -95,6 +96,7 @@ TEST_FILES += va_128TBswitch.sh
 
 include ../lib.mk
 
+$(OUTPUT)/anon_cow: vm_util.c
 $(OUTPUT)/khugepaged: vm_util.c
 $(OUTPUT)/madv_populate: vm_util.c
 $(OUTPUT)/soft-dirty: vm_util.c
diff --git a/tools/testing/selftests/vm/anon_cow.c b/tools/testing/selftests/vm/anon_cow.c
new file mode 100644 (file)
index 0000000..4613294
--- /dev/null
@@ -0,0 +1,401 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * COW (Copy On Write) tests for anonymous memory.
+ *
+ * Copyright 2022, Red Hat, Inc.
+ *
+ * Author(s): David Hildenbrand <david@redhat.com>
+ */
+#define _GNU_SOURCE
+#include <stdlib.h>
+#include <string.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <unistd.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <dirent.h>
+#include <assert.h>
+#include <sys/mman.h>
+#include <sys/wait.h>
+
+#include "../kselftest.h"
+#include "vm_util.h"
+
+static size_t pagesize;
+static int pagemap_fd;
+
+struct comm_pipes {
+       int child_ready[2];
+       int parent_ready[2];
+};
+
+static int setup_comm_pipes(struct comm_pipes *comm_pipes)
+{
+       if (pipe(comm_pipes->child_ready) < 0)
+               return -errno;
+       if (pipe(comm_pipes->parent_ready) < 0) {
+               close(comm_pipes->child_ready[0]);
+               close(comm_pipes->child_ready[1]);
+               return -errno;
+       }
+
+       return 0;
+}
+
+static void close_comm_pipes(struct comm_pipes *comm_pipes)
+{
+       close(comm_pipes->child_ready[0]);
+       close(comm_pipes->child_ready[1]);
+       close(comm_pipes->parent_ready[0]);
+       close(comm_pipes->parent_ready[1]);
+}
+
+static int child_memcmp_fn(char *mem, size_t size,
+                          struct comm_pipes *comm_pipes)
+{
+       char *old = malloc(size);
+       char buf;
+
+       /* Backup the original content. */
+       memcpy(old, mem, size);
+
+       /* Wait until the parent modified the page. */
+       write(comm_pipes->child_ready[1], "0", 1);
+       while (read(comm_pipes->parent_ready[0], &buf, 1) != 1)
+               ;
+
+       /* See if we still read the old values. */
+       return memcmp(old, mem, size);
+}
+
+static int child_vmsplice_memcmp_fn(char *mem, size_t size,
+                                   struct comm_pipes *comm_pipes)
+{
+       struct iovec iov = {
+               .iov_base = mem,
+               .iov_len = size,
+       };
+       ssize_t cur, total, transferred;
+       char *old, *new;
+       int fds[2];
+       char buf;
+
+       old = malloc(size);
+       new = malloc(size);
+
+       /* Backup the original content. */
+       memcpy(old, mem, size);
+
+       if (pipe(fds) < 0)
+               return -errno;
+
+       /* Trigger a read-only pin. */
+       transferred = vmsplice(fds[1], &iov, 1, 0);
+       if (transferred < 0)
+               return -errno;
+       if (transferred == 0)
+               return -EINVAL;
+
+       /* Unmap it from our page tables. */
+       if (munmap(mem, size) < 0)
+               return -errno;
+
+       /* Wait until the parent modified it. */
+       write(comm_pipes->child_ready[1], "0", 1);
+       while (read(comm_pipes->parent_ready[0], &buf, 1) != 1)
+               ;
+
+       /* See if we still read the old values via the pipe. */
+       for (total = 0; total < transferred; total += cur) {
+               cur = read(fds[0], new + total, transferred - total);
+               if (cur < 0)
+                       return -errno;
+       }
+
+       return memcmp(old, new, transferred);
+}
+
+typedef int (*child_fn)(char *mem, size_t size, struct comm_pipes *comm_pipes);
+
+static void do_test_cow_in_parent(char *mem, size_t size, child_fn fn)
+{
+       struct comm_pipes comm_pipes;
+       char buf;
+       int ret;
+
+       ret = setup_comm_pipes(&comm_pipes);
+       if (ret) {
+               ksft_test_result_fail("pipe() failed\n");
+               return;
+       }
+
+       ret = fork();
+       if (ret < 0) {
+               ksft_test_result_fail("fork() failed\n");
+               goto close_comm_pipes;
+       } else if (!ret) {
+               exit(fn(mem, size, &comm_pipes));
+       }
+
+       while (read(comm_pipes.child_ready[0], &buf, 1) != 1)
+               ;
+       /* Modify the page. */
+       memset(mem, 0xff, size);
+       write(comm_pipes.parent_ready[1], "0", 1);
+
+       wait(&ret);
+       if (WIFEXITED(ret))
+               ret = WEXITSTATUS(ret);
+       else
+               ret = -EINVAL;
+
+       ksft_test_result(!ret, "No leak from parent into child\n");
+close_comm_pipes:
+       close_comm_pipes(&comm_pipes);
+}
+
+static void test_cow_in_parent(char *mem, size_t size)
+{
+       do_test_cow_in_parent(mem, size, child_memcmp_fn);
+}
+
+static void test_vmsplice_in_child(char *mem, size_t size)
+{
+       do_test_cow_in_parent(mem, size, child_vmsplice_memcmp_fn);
+}
+
+static void do_test_vmsplice_in_parent(char *mem, size_t size,
+                                      bool before_fork)
+{
+       struct iovec iov = {
+               .iov_base = mem,
+               .iov_len = size,
+       };
+       ssize_t cur, total, transferred;
+       struct comm_pipes comm_pipes;
+       char *old, *new;
+       int ret, fds[2];
+       char buf;
+
+       old = malloc(size);
+       new = malloc(size);
+
+       memcpy(old, mem, size);
+
+       ret = setup_comm_pipes(&comm_pipes);
+       if (ret) {
+               ksft_test_result_fail("pipe() failed\n");
+               goto free;
+       }
+
+       if (pipe(fds) < 0) {
+               ksft_test_result_fail("pipe() failed\n");
+               goto close_comm_pipes;
+       }
+
+       if (before_fork) {
+               transferred = vmsplice(fds[1], &iov, 1, 0);
+               if (transferred <= 0) {
+                       ksft_test_result_fail("vmsplice() failed\n");
+                       goto close_pipe;
+               }
+       }
+
+       ret = fork();
+       if (ret < 0) {
+               ksft_test_result_fail("fork() failed\n");
+               goto close_pipe;
+       } else if (!ret) {
+               write(comm_pipes.child_ready[1], "0", 1);
+               while (read(comm_pipes.parent_ready[0], &buf, 1) != 1)
+                       ;
+               /* Modify page content in the child. */
+               memset(mem, 0xff, size);
+               exit(0);
+       }
+
+       if (!before_fork) {
+               transferred = vmsplice(fds[1], &iov, 1, 0);
+               if (transferred <= 0) {
+                       ksft_test_result_fail("vmsplice() failed\n");
+                       wait(&ret);
+                       goto close_pipe;
+               }
+       }
+
+       while (read(comm_pipes.child_ready[0], &buf, 1) != 1)
+               ;
+       if (munmap(mem, size) < 0) {
+               ksft_test_result_fail("munmap() failed\n");
+               goto close_pipe;
+       }
+       write(comm_pipes.parent_ready[1], "0", 1);
+
+       /* Wait until the child is done writing. */
+       wait(&ret);
+       if (!WIFEXITED(ret)) {
+               ksft_test_result_fail("wait() failed\n");
+               goto close_pipe;
+       }
+
+       /* See if we still read the old values. */
+       for (total = 0; total < transferred; total += cur) {
+               cur = read(fds[0], new + total, transferred - total);
+               if (cur < 0) {
+                       ksft_test_result_fail("read() failed\n");
+                       goto close_pipe;
+               }
+       }
+
+       ksft_test_result(!memcmp(old, new, transferred),
+                        "No leak from child into parent\n");
+close_pipe:
+       close(fds[0]);
+       close(fds[1]);
+close_comm_pipes:
+       close_comm_pipes(&comm_pipes);
+free:
+       free(old);
+       free(new);
+}
+
+static void test_vmsplice_before_fork(char *mem, size_t size)
+{
+       do_test_vmsplice_in_parent(mem, size, true);
+}
+
+static void test_vmsplice_after_fork(char *mem, size_t size)
+{
+       do_test_vmsplice_in_parent(mem, size, false);
+}
+
+typedef void (*test_fn)(char *mem, size_t size);
+
+static void do_run_with_base_page(test_fn fn, bool swapout)
+{
+       char *mem;
+       int ret;
+
+       mem = mmap(NULL, pagesize, PROT_READ | PROT_WRITE,
+                  MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+       if (mem == MAP_FAILED) {
+               ksft_test_result_fail("mmap() failed\n");
+               return;
+       }
+
+       ret = madvise(mem, pagesize, MADV_NOHUGEPAGE);
+       /* Ignore if not around on a kernel. */
+       if (ret && errno != EINVAL) {
+               ksft_test_result_fail("MADV_NOHUGEPAGE failed\n");
+               goto munmap;
+       }
+
+       /* Populate a base page. */
+       memset(mem, 0, pagesize);
+
+       if (swapout) {
+               madvise(mem, pagesize, MADV_PAGEOUT);
+               if (!pagemap_is_swapped(pagemap_fd, mem)) {
+                       ksft_test_result_skip("MADV_PAGEOUT did not work, is swap enabled?\n");
+                       goto munmap;
+               }
+       }
+
+       fn(mem, pagesize);
+munmap:
+       munmap(mem, pagesize);
+}
+
+static void run_with_base_page(test_fn fn, const char *desc)
+{
+       ksft_print_msg("[RUN] %s ... with base page\n", desc);
+       do_run_with_base_page(fn, false);
+}
+
+static void run_with_base_page_swap(test_fn fn, const char *desc)
+{
+       ksft_print_msg("[RUN] %s ... with swapped out base page\n", desc);
+       do_run_with_base_page(fn, true);
+}
+
+struct test_case {
+       const char *desc;
+       test_fn fn;
+};
+
+static const struct test_case test_cases[] = {
+       /*
+        * Basic COW tests for fork() without any GUP. If we miss to break COW,
+        * either the child can observe modifications by the parent or the
+        * other way around.
+        */
+       {
+               "Basic COW after fork()",
+               test_cow_in_parent,
+       },
+       /*
+        * vmsplice() [R/O GUP] + unmap in the child; modify in the parent. If
+        * we miss to break COW, the child observes modifications by the parent.
+        * This is CVE-2020-29374 reported by Jann Horn.
+        */
+       {
+               "vmsplice() + unmap in child",
+               test_vmsplice_in_child
+       },
+       /*
+        * vmsplice() [R/O GUP] in parent before fork(), unmap in parent after
+        * fork(); modify in the child. If we miss to break COW, the parent
+        * observes modifications by the child.
+        */
+       {
+               "vmsplice() before fork(), unmap in parent after fork()",
+               test_vmsplice_before_fork,
+       },
+       /*
+        * vmsplice() [R/O GUP] + unmap in parent after fork(); modify in the
+        * child. If we miss to break COW, the parent observes modifications by
+        * the child.
+        */
+       {
+               "vmsplice() + unmap in parent after fork()",
+               test_vmsplice_after_fork,
+       },
+};
+
+static void run_test_case(struct test_case const *test_case)
+{
+       run_with_base_page(test_case->fn, test_case->desc);
+       run_with_base_page_swap(test_case->fn, test_case->desc);
+}
+
+static void run_test_cases(void)
+{
+       int i;
+
+       for (i = 0; i < ARRAY_SIZE(test_cases); i++)
+               run_test_case(&test_cases[i]);
+}
+
+int main(int argc, char **argv)
+{
+       int nr_test_cases = ARRAY_SIZE(test_cases);
+       int err;
+
+       pagesize = getpagesize();
+
+       ksft_print_header();
+       ksft_set_plan(nr_test_cases * 2);
+
+       pagemap_fd = open("/proc/self/pagemap", O_RDONLY);
+       if (pagemap_fd < 0)
+               ksft_exit_fail_msg("opening pagemap failed\n");
+
+       run_test_cases();
+
+       err = ksft_get_fail_cnt();
+       if (err)
+               ksft_exit_fail_msg("%d out of %d tests failed\n",
+                                  err, ksft_test_num());
+       return ksft_exit_pass();
+}
index 0dc9f54..1fa7837 100755 (executable)
@@ -185,4 +185,7 @@ fi
 
 run_test ./soft-dirty
 
+# COW tests for anonymous memory
+run_test ./anon_cow
+
 exit $exitcode
index f11f8ad..37dd230 100644 (file)
@@ -28,6 +28,13 @@ bool pagemap_is_softdirty(int fd, char *start)
        return entry & 0x0080000000000000ull;
 }
 
+bool pagemap_is_swapped(int fd, char *start)
+{
+       uint64_t entry = pagemap_get_entry(fd, start);
+
+       return entry & 0x4000000000000000ull;
+}
+
 void clear_softdirty(void)
 {
        int ret;
index 5c35de4..833df81 100644 (file)
@@ -4,6 +4,7 @@
 
 uint64_t pagemap_get_entry(int fd, char *start);
 bool pagemap_is_softdirty(int fd, char *start);
+bool pagemap_is_swapped(int fd, char *start);
 void clear_softdirty(void);
 bool check_for_pattern(FILE *fp, const char *pattern, char *buf, size_t len);
 uint64_t read_pmd_pagesize(void);