2 * Copyright (c) 2019 Alexey Dobriyan <adobriyan@gmail.com>
4 * Permission to use, copy, modify, and distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 * Fork and exec tiny 1 page executable which precisely controls its VM.
18 * Test /proc/$PID/maps
19 * Test /proc/$PID/smaps
20 * Test /proc/$PID/smaps_rollup
21 * Test /proc/$PID/statm
23 * FIXME require CONFIG_TMPFS which can be disabled
24 * FIXME test other values from "smaps"
25 * FIXME support other archs
37 #include <sys/mount.h>
38 #include <sys/types.h>
43 #include <sys/syscall.h>
45 #include <linux/kdev_t.h>
47 #include <sys/resource.h>
49 static inline long sys_execveat(int dirfd, const char *pathname, char **argv, char **envp, int flags)
51 return syscall(SYS_execveat, dirfd, pathname, argv, envp, flags);
54 static void make_private_tmp(void)
56 if (unshare(CLONE_NEWNS) == -1) {
57 if (errno == ENOSYS || errno == EPERM) {
62 if (mount(NULL, "/", NULL, MS_PRIVATE|MS_REC, NULL) == -1) {
65 if (mount(NULL, "/tmp", "tmpfs", 0, NULL) == -1) {
70 static pid_t pid = -1;
107 #define PAGE_SIZE 4096
108 #define VADDR (1UL << 32)
109 #define MAPS_OFFSET 73
111 #define syscall 0x0f, 0x05
114 (x)&0xff, ((x)>>8)&0xff, ((x)>>16)&0xff, ((x)>>24)&0xff, \
115 ((x)>>32)&0xff, ((x)>>40)&0xff, ((x)>>48)&0xff, ((x)>>56)&0xff
119 (x)&0xff, ((x)>>8)&0xff, ((x)>>16)&0xff, ((x)>>24)&0xff, \
120 ((x)>>32)&0xff, ((x)>>40)&0xff, ((x)>>48)&0xff, ((x)>>56)&0xff
123 0xb8, (x)&0xff, ((x)>>8)&0xff, ((x)>>16)&0xff, ((x)>>24)&0xff
125 static const uint8_t payload[] = {
126 /* Casually unmap stack, vDSO and everything else. */
128 mov_rdi(VADDR + 4096),
129 mov_rsi((1ULL << 47) - 4096 - VADDR - 4096),
134 /* write(0, &c, 1); */
135 0x31, 0xff, /* xor edi, edi */
136 0x48, 0x8d, 0x35, 0x00, 0x00, 0x00, 0x00, /* lea rsi, [rip] */
137 0xba, 0x01, 0x00, 0x00, 0x00, /* mov edx, 1 */
145 0xeb, 0xf7, /* jmp 1b */
148 static int make_exe(const uint8_t *payload, size_t len)
151 struct elf64_phdr ph;
153 struct iovec iov[3] = {
154 {&h, sizeof(struct elf64_hdr)},
155 {&ph, sizeof(struct elf64_phdr)},
156 {(void *)payload, len},
161 memset(&h, 0, sizeof(h));
173 h.e_entry = VADDR + sizeof(struct elf64_hdr) + sizeof(struct elf64_phdr);
174 h.e_phoff = sizeof(struct elf64_hdr);
177 h.e_ehsize = sizeof(struct elf64_hdr);
178 h.e_phentsize = sizeof(struct elf64_phdr);
184 memset(&ph, 0, sizeof(ph));
186 ph.p_flags = (1<<2)|1;
190 ph.p_filesz = sizeof(struct elf64_hdr) + sizeof(struct elf64_phdr) + sizeof(payload);
191 ph.p_memsz = sizeof(struct elf64_hdr) + sizeof(struct elf64_phdr) + sizeof(payload);
194 fd = openat(AT_FDCWD, "/tmp", O_WRONLY|O_EXCL|O_TMPFILE, 0700);
199 if (writev(fd, iov, 3) != sizeof(struct elf64_hdr) + sizeof(struct elf64_phdr) + len) {
203 /* Avoid ETXTBSY on exec. */
204 snprintf(buf, sizeof(buf), "/proc/self/fd/%u", fd);
205 fd1 = open(buf, O_RDONLY|O_CLOEXEC);
212 static bool g_vsyscall = false;
214 static const char str_vsyscall[] =
215 "ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]\n";
219 * vsyscall page can't be unmapped, probe it with memory load.
221 static void vsyscall(void)
228 fprintf(stderr, "fork, errno %d\n", errno);
232 struct rlimit rlim = {0, 0};
233 (void)setrlimit(RLIMIT_CORE, &rlim);
234 *(volatile int *)0xffffffffff600000UL;
238 if (WIFEXITED(wstatus)) {
254 /* Reserve fd 0 for 1-byte pipe ping from child. */
256 if (open("/", O_RDONLY|O_DIRECTORY|O_PATH) != 0) {
260 exec_fd = make_exe(payload, sizeof(payload));
262 if (pipe(pipefd) == -1) {
265 if (dup2(pipefd[1], 0) != 0) {
274 sys_execveat(exec_fd, "", NULL, NULL, AT_EMPTY_PATH);
279 if (read(pipefd[0], &_, 1) != 1) {
284 if (fstat(exec_fd, &st) == -1) {
288 /* Generate "head -n1 /proc/$PID/maps" */
290 memset(buf0, ' ', sizeof(buf0));
291 int len = snprintf(buf0, sizeof(buf0),
292 "%08lx-%08lx r-xp 00000000 %02lx:%02lx %llu",
293 VADDR, VADDR + PAGE_SIZE,
294 MAJOR(st.st_dev), MINOR(st.st_dev),
295 (unsigned long long)st.st_ino);
297 snprintf(buf0 + MAPS_OFFSET, sizeof(buf0) - MAPS_OFFSET,
298 "/tmp/#%llu (deleted)\n", (unsigned long long)st.st_ino);
300 /* Test /proc/$PID/maps */
302 const size_t len = strlen(buf0) + (g_vsyscall ? strlen(str_vsyscall) : 0);
307 snprintf(buf, sizeof(buf), "/proc/%u/maps", pid);
308 fd = open(buf, O_RDONLY);
312 rv = read(fd, buf, sizeof(buf));
314 assert(memcmp(buf, buf0, strlen(buf0)) == 0);
316 assert(memcmp(buf + strlen(buf0), str_vsyscall, strlen(str_vsyscall)) == 0);
320 /* Test /proc/$PID/smaps */
326 snprintf(buf, sizeof(buf), "/proc/%u/smaps", pid);
327 fd = open(buf, O_RDONLY);
331 rv = read(fd, buf, sizeof(buf));
332 assert(0 <= rv && rv <= sizeof(buf));
334 assert(rv >= strlen(buf0));
335 assert(memcmp(buf, buf0, strlen(buf0)) == 0);
337 #define RSS1 "Rss: 4 kB\n"
338 #define RSS2 "Rss: 0 kB\n"
339 #define PSS1 "Pss: 4 kB\n"
340 #define PSS2 "Pss: 0 kB\n"
341 assert(memmem(buf, rv, RSS1, strlen(RSS1)) ||
342 memmem(buf, rv, RSS2, strlen(RSS2)));
343 assert(memmem(buf, rv, PSS1, strlen(PSS1)) ||
344 memmem(buf, rv, PSS2, strlen(PSS2)));
346 static const char *S[] = {
348 "KernelPageSize: 4 kB\n",
349 "MMUPageSize: 4 kB\n",
351 "AnonHugePages: 0 kB\n",
352 "Shared_Hugetlb: 0 kB\n",
353 "Private_Hugetlb: 0 kB\n",
358 for (i = 0; i < sizeof(S)/sizeof(S[0]); i++) {
359 assert(memmem(buf, rv, S[i], strlen(S[i])));
363 assert(memmem(buf, rv, str_vsyscall, strlen(str_vsyscall)));
367 /* Test /proc/$PID/smaps_rollup */
370 memset(bufr, ' ', sizeof(bufr));
371 len = snprintf(bufr, sizeof(bufr),
372 "%08lx-%08lx ---p 00000000 00:00 0",
373 VADDR, VADDR + PAGE_SIZE);
375 snprintf(bufr + MAPS_OFFSET, sizeof(bufr) - MAPS_OFFSET,
382 snprintf(buf, sizeof(buf), "/proc/%u/smaps_rollup", pid);
383 fd = open(buf, O_RDONLY);
387 rv = read(fd, buf, sizeof(buf));
388 assert(0 <= rv && rv <= sizeof(buf));
390 assert(rv >= strlen(bufr));
391 assert(memcmp(buf, bufr, strlen(bufr)) == 0);
393 assert(memmem(buf, rv, RSS1, strlen(RSS1)) ||
394 memmem(buf, rv, RSS2, strlen(RSS2)));
395 assert(memmem(buf, rv, PSS1, strlen(PSS1)) ||
396 memmem(buf, rv, PSS2, strlen(PSS2)));
398 static const char *S[] = {
400 "AnonHugePages: 0 kB\n",
401 "Shared_Hugetlb: 0 kB\n",
402 "Private_Hugetlb: 0 kB\n",
407 for (i = 0; i < sizeof(S)/sizeof(S[0]); i++) {
408 assert(memmem(buf, rv, S[i], strlen(S[i])));
412 /* Test /proc/$PID/statm */
418 snprintf(buf, sizeof(buf), "/proc/%u/statm", pid);
419 fd = open(buf, O_RDONLY);
423 rv = read(fd, buf, sizeof(buf));
426 assert(buf[0] == '1'); /* ->total_vm */
427 assert(buf[1] == ' ');
428 assert(buf[2] == '0' || buf[2] == '1'); /* rss */
429 assert(buf[3] == ' ');
430 assert(buf[4] == '0' || buf[2] == '1'); /* file rss */
431 assert(buf[5] == ' ');
432 assert(buf[6] == '1'); /* ELF executable segments */
433 assert(buf[7] == ' ');
434 assert(buf[8] == '0');
435 assert(buf[9] == ' ');
436 assert(buf[10] == '0'); /* ->data_vm + ->stack_vm */
437 assert(buf[11] == ' ');
438 assert(buf[12] == '0');
439 assert(buf[13] == '\n');