2 * Copyright (c) 2019 Alexey Dobriyan <adobriyan@gmail.com>
4 * Permission to use, copy, modify, and distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 * Fork and exec tiny 1 page executable which precisely controls its VM.
18 * Test /proc/$PID/maps
19 * Test /proc/$PID/smaps
20 * Test /proc/$PID/smaps_rollup
21 * Test /proc/$PID/statm
23 * FIXME require CONFIG_TMPFS which can be disabled
24 * FIXME test other values from "smaps"
25 * FIXME support other archs
37 #include <sys/mount.h>
38 #include <sys/types.h>
43 #include <sys/syscall.h>
45 #include <linux/kdev_t.h>
47 #include <sys/resource.h>
49 static inline long sys_execveat(int dirfd
, const char *pathname
, char **argv
, char **envp
, int flags
)
51 return syscall(SYS_execveat
, dirfd
, pathname
, argv
, envp
, flags
);
54 static void make_private_tmp(void)
56 if (unshare(CLONE_NEWNS
) == -1) {
57 if (errno
== ENOSYS
|| errno
== EPERM
) {
62 if (mount(NULL
, "/", NULL
, MS_PRIVATE
|MS_REC
, NULL
) == -1) {
65 if (mount(NULL
, "/tmp", "tmpfs", 0, NULL
) == -1) {
70 static pid_t pid
= -1;
107 #define PAGE_SIZE 4096
108 #define VADDR (1UL << 32)
109 #define MAPS_OFFSET 73
111 #define syscall 0x0f, 0x05
114 (x)&0xff, ((x)>>8)&0xff, ((x)>>16)&0xff, ((x)>>24)&0xff, \
115 ((x)>>32)&0xff, ((x)>>40)&0xff, ((x)>>48)&0xff, ((x)>>56)&0xff
119 (x)&0xff, ((x)>>8)&0xff, ((x)>>16)&0xff, ((x)>>24)&0xff, \
120 ((x)>>32)&0xff, ((x)>>40)&0xff, ((x)>>48)&0xff, ((x)>>56)&0xff
123 0xb8, (x)&0xff, ((x)>>8)&0xff, ((x)>>16)&0xff, ((x)>>24)&0xff
125 static const uint8_t payload
[] = {
126 /* Casually unmap stack, vDSO and everything else. */
128 mov_rdi(VADDR
+ 4096),
129 mov_rsi((1ULL << 47) - 4096 - VADDR
- 4096),
134 /* write(0, &c, 1); */
135 0x31, 0xff, /* xor edi, edi */
136 0x48, 0x8d, 0x35, 0x00, 0x00, 0x00, 0x00, /* lea rsi, [rip] */
137 0xba, 0x01, 0x00, 0x00, 0x00, /* mov edx, 1 */
145 0xeb, 0xf7, /* jmp 1b */
148 static int make_exe(const uint8_t *payload
, size_t len
)
151 struct elf64_phdr ph
;
153 struct iovec iov
[3] = {
154 {&h
, sizeof(struct elf64_hdr
)},
155 {&ph
, sizeof(struct elf64_phdr
)},
156 {(void *)payload
, len
},
161 memset(&h
, 0, sizeof(h
));
173 h
.e_entry
= VADDR
+ sizeof(struct elf64_hdr
) + sizeof(struct elf64_phdr
);
174 h
.e_phoff
= sizeof(struct elf64_hdr
);
177 h
.e_ehsize
= sizeof(struct elf64_hdr
);
178 h
.e_phentsize
= sizeof(struct elf64_phdr
);
184 memset(&ph
, 0, sizeof(ph
));
186 ph
.p_flags
= (1<<2)|1;
190 ph
.p_filesz
= sizeof(struct elf64_hdr
) + sizeof(struct elf64_phdr
) + len
;
191 ph
.p_memsz
= sizeof(struct elf64_hdr
) + sizeof(struct elf64_phdr
) + len
;
194 fd
= openat(AT_FDCWD
, "/tmp", O_WRONLY
|O_EXCL
|O_TMPFILE
, 0700);
199 if (writev(fd
, iov
, 3) != sizeof(struct elf64_hdr
) + sizeof(struct elf64_phdr
) + len
) {
203 /* Avoid ETXTBSY on exec. */
204 snprintf(buf
, sizeof(buf
), "/proc/self/fd/%u", fd
);
205 fd1
= open(buf
, O_RDONLY
|O_CLOEXEC
);
212 static bool g_vsyscall
= false;
214 static const char str_vsyscall
[] =
215 "ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]\n";
218 static void sigaction_SIGSEGV(int _
, siginfo_t
*__
, void *___
)
224 * vsyscall page can't be unmapped, probe it with memory load.
226 static void vsyscall(void)
233 fprintf(stderr
, "fork, errno %d\n", errno
);
237 struct rlimit rlim
= {0, 0};
238 (void)setrlimit(RLIMIT_CORE
, &rlim
);
240 /* Hide "segfault at ffffffffff600000" messages. */
241 struct sigaction act
;
242 memset(&act
, 0, sizeof(struct sigaction
));
243 act
.sa_flags
= SA_SIGINFO
;
244 act
.sa_sigaction
= sigaction_SIGSEGV
;
245 (void)sigaction(SIGSEGV
, &act
, NULL
);
247 *(volatile int *)0xffffffffff600000UL
;
250 waitpid(pid
, &wstatus
, 0);
251 if (WIFEXITED(wstatus
) && WEXITSTATUS(wstatus
) == 0) {
267 /* Reserve fd 0 for 1-byte pipe ping from child. */
269 if (open("/", O_RDONLY
|O_DIRECTORY
|O_PATH
) != 0) {
273 exec_fd
= make_exe(payload
, sizeof(payload
));
275 if (pipe(pipefd
) == -1) {
278 if (dup2(pipefd
[1], 0) != 0) {
287 sys_execveat(exec_fd
, "", NULL
, NULL
, AT_EMPTY_PATH
);
292 if (read(pipefd
[0], &_
, 1) != 1) {
297 if (fstat(exec_fd
, &st
) == -1) {
301 /* Generate "head -n1 /proc/$PID/maps" */
303 memset(buf0
, ' ', sizeof(buf0
));
304 int len
= snprintf(buf0
, sizeof(buf0
),
305 "%08lx-%08lx r-xp 00000000 %02lx:%02lx %llu",
306 VADDR
, VADDR
+ PAGE_SIZE
,
307 MAJOR(st
.st_dev
), MINOR(st
.st_dev
),
308 (unsigned long long)st
.st_ino
);
310 snprintf(buf0
+ MAPS_OFFSET
, sizeof(buf0
) - MAPS_OFFSET
,
311 "/tmp/#%llu (deleted)\n", (unsigned long long)st
.st_ino
);
313 /* Test /proc/$PID/maps */
315 const size_t len
= strlen(buf0
) + (g_vsyscall
? strlen(str_vsyscall
) : 0);
320 snprintf(buf
, sizeof(buf
), "/proc/%u/maps", pid
);
321 fd
= open(buf
, O_RDONLY
);
325 rv
= read(fd
, buf
, sizeof(buf
));
327 assert(memcmp(buf
, buf0
, strlen(buf0
)) == 0);
329 assert(memcmp(buf
+ strlen(buf0
), str_vsyscall
, strlen(str_vsyscall
)) == 0);
333 /* Test /proc/$PID/smaps */
339 snprintf(buf
, sizeof(buf
), "/proc/%u/smaps", pid
);
340 fd
= open(buf
, O_RDONLY
);
344 rv
= read(fd
, buf
, sizeof(buf
));
345 assert(0 <= rv
&& rv
<= sizeof(buf
));
347 assert(rv
>= strlen(buf0
));
348 assert(memcmp(buf
, buf0
, strlen(buf0
)) == 0);
350 #define RSS1 "Rss: 4 kB\n"
351 #define RSS2 "Rss: 0 kB\n"
352 #define PSS1 "Pss: 4 kB\n"
353 #define PSS2 "Pss: 0 kB\n"
354 assert(memmem(buf
, rv
, RSS1
, strlen(RSS1
)) ||
355 memmem(buf
, rv
, RSS2
, strlen(RSS2
)));
356 assert(memmem(buf
, rv
, PSS1
, strlen(PSS1
)) ||
357 memmem(buf
, rv
, PSS2
, strlen(PSS2
)));
359 static const char *S
[] = {
361 "KernelPageSize: 4 kB\n",
362 "MMUPageSize: 4 kB\n",
364 "AnonHugePages: 0 kB\n",
365 "Shared_Hugetlb: 0 kB\n",
366 "Private_Hugetlb: 0 kB\n",
371 for (i
= 0; i
< sizeof(S
)/sizeof(S
[0]); i
++) {
372 assert(memmem(buf
, rv
, S
[i
], strlen(S
[i
])));
376 assert(memmem(buf
, rv
, str_vsyscall
, strlen(str_vsyscall
)));
380 /* Test /proc/$PID/smaps_rollup */
383 memset(bufr
, ' ', sizeof(bufr
));
384 len
= snprintf(bufr
, sizeof(bufr
),
385 "%08lx-%08lx ---p 00000000 00:00 0",
386 VADDR
, VADDR
+ PAGE_SIZE
);
388 snprintf(bufr
+ MAPS_OFFSET
, sizeof(bufr
) - MAPS_OFFSET
,
395 snprintf(buf
, sizeof(buf
), "/proc/%u/smaps_rollup", pid
);
396 fd
= open(buf
, O_RDONLY
);
400 rv
= read(fd
, buf
, sizeof(buf
));
401 assert(0 <= rv
&& rv
<= sizeof(buf
));
403 assert(rv
>= strlen(bufr
));
404 assert(memcmp(buf
, bufr
, strlen(bufr
)) == 0);
406 assert(memmem(buf
, rv
, RSS1
, strlen(RSS1
)) ||
407 memmem(buf
, rv
, RSS2
, strlen(RSS2
)));
408 assert(memmem(buf
, rv
, PSS1
, strlen(PSS1
)) ||
409 memmem(buf
, rv
, PSS2
, strlen(PSS2
)));
411 static const char *S
[] = {
413 "AnonHugePages: 0 kB\n",
414 "Shared_Hugetlb: 0 kB\n",
415 "Private_Hugetlb: 0 kB\n",
420 for (i
= 0; i
< sizeof(S
)/sizeof(S
[0]); i
++) {
421 assert(memmem(buf
, rv
, S
[i
], strlen(S
[i
])));
425 /* Test /proc/$PID/statm */
431 snprintf(buf
, sizeof(buf
), "/proc/%u/statm", pid
);
432 fd
= open(buf
, O_RDONLY
);
436 rv
= read(fd
, buf
, sizeof(buf
));
439 assert(buf
[0] == '1'); /* ->total_vm */
440 assert(buf
[1] == ' ');
441 assert(buf
[2] == '0' || buf
[2] == '1'); /* rss */
442 assert(buf
[3] == ' ');
443 assert(buf
[4] == '0' || buf
[2] == '1'); /* file rss */
444 assert(buf
[5] == ' ');
445 assert(buf
[6] == '1'); /* ELF executable segments */
446 assert(buf
[7] == ' ');
447 assert(buf
[8] == '0');
448 assert(buf
[9] == ' ');
449 assert(buf
[10] == '0'); /* ->data_vm + ->stack_vm */
450 assert(buf
[11] == ' ');
451 assert(buf
[12] == '0');
452 assert(buf
[13] == '\n');