Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <202303312259.441e35db-yujie.liu@intel.com> <CABVzXA=+7wF4=NWxi0x57YSNs1Mpp7pJCODvyC6JRn9tQQAGLA@mail.gmail.com>
In-Reply-To: <CABVzXA=+7wF4=NWxi0x57YSNs1Mpp7pJCODvyC6JRn9tQQAGLA@mail.gmail.com>
From:   Jeff Xu <jeffxu@google.com>
Date:   Fri, 31 Mar 2023 11:47:58 -0700
Message-ID: <CALmYWFvXuQGuHHm9s5YAvG2VC1b3T+vu29xUYpKgWp6fmeUGaA@mail.gmail.com>
Subject: Re: [linus:master] [selftests/memfd] 11f75a0144: kernel-selftests.memfd.run_fuse_test.sh.fail
To:     Daniel Verkamp <dverkamp@chromium.org>
Cc:     oe-lkp@lists.linux.dev, lkp@intel.com,
        linux-kernel@vger.kernel.org,
        Andrew Morton <akpm@linux-foundation.org>,
        Kees Cook <keescook@chromium.org>,
        David Herrmann <dh.herrmann@gmail.com>,
        Dmitry Torokhov <dmitry.torokhov@gmail.com>,
        Hugh Dickins <hughd@google.com>, Jann Horn <jannh@google.com>,
        Jorge Lucangeli Obes <jorgelo@chromium.org>,
        Shuah Khan <skhan@linuxfoundation.org>,
        linux-kselftest@vger.kernel.org,
        kernel test robot <yujie.liu@intel.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Hi Daniel,
Thanks for initiating the analysis.

On Fri, Mar 31, 2023 at 10:57=E2=80=AFAM Daniel Verkamp <dverkamp@chromium.=
org> wrote:
>
> On Fri, Mar 31, 2023 at 8:05=E2=80=AFAM kernel test robot <yujie.liu@inte=
l.com> wrote:
> >
> > Hello,
> >
> > kernel test robot noticed kernel-selftests.memfd.run_fuse_test.sh.fail =
due to commit (built with gcc-11):
> >
> > commit: 11f75a01448f1b7a739e75dbd8f17b844fcfc510 ("selftests/memfd: add=
 tests for MFD_NOEXEC_SEAL MFD_EXEC")
> > https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
> >
> > in testcase: kernel-selftests
> > version: kernel-selftests-x86_64-d4cf28ee-1_20230110
> > with following parameters:
> >
> >         group: group-02
> >
> > test-description: The kernel contains a set of "self tests" under the t=
ools/testing/selftests/ directory. These are intended to be small unit test=
s to exercise individual code paths in the kernel.
> > test-url: https://www.kernel.org/doc/Documentation/kselftest.txt
> >
> > on test machine: 4 threads Intel(R) Xeon(R) CPU E3-1225 v5 @ 3.30GHz (S=
kylake) with 16G memory
> >
> > caused below changes (please refer to attached dmesg/kmsg for entire lo=
g/backtrace):
> >
> >
> > # selftests: memfd: run_fuse_test.sh
> > # Aborted
> > not ok 2 selftests: memfd: run_fuse_test.sh # exit=3D134
> >
> > $ ./run_fuse_test.sh
> > opening: ./mnt/memfd
> > 8 !=3D 40 =3D GET_SEALS(4)
> > Aborted
>
> Hi Jeff,
>
> I think this is caused by test_sysctl() in memfd_test, which sets
> /proc/sys/vm/memfd_noexec to a non-zero value and does not restore it
> at the end of the test. If fuse_test runs after that, it will
> unexpectedly get F_SEAL_EXEC in its memfd seals in addition to the
> F_SEAL_WRITE that it intended to add.

The sysctl for /proc/sys/vm/memfd_noexec is pid-namespaced, and designed to
be non-reservable due to security reasons.

I think the fix is to run this set of test_sysctl in a child
namespace, instead of init namespace.
I will work on a fix for this.

> I'm not sure how kernel selftests normally perform cleanup (e.g. an
> atexit() hook to make sure it cleans up if a test fails?), but at
> least we should probably set /proc/sys/vm/memfd_noexec back to its
> original value after test_sysctl().
>
> Thanks,
> -- Daniel

Thanks!
-Jeff

-Jeff