selftests/pidfd: test that fields beyond the struct size are not reported

PIDFD_GET_INFO must not set the mask bit of a field that lies beyond
the struct size encoded in the ioctl command. Add a test that requests
the coredump fields and the supported mask with PIDFD_INFO_SIZE_VER0
over a full-size, poisoned struct, and checks that the mask names none
of those fields and that the poison behind the first 64 bytes is
intact.

Add fallback definitions of PIDFD_INFO_SIZE_VER0 to VER3 to pidfd.h,
like the other uapi constants there.

Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Link: https://patch.msgid.link/20261024041334.831273-3-nickolai@csail.mit.edu
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

2 files changed, 64 insertions, 0 deletions

diff --git a/tools/testing/selftests/pidfd/pidfd.h b/tools/testing/selftests/pidfd/pidfd.h
index 5a4e78c10f43..cf146d327334 100644
--- a/tools/testing/selftests/pidfd/pidfd.h
+++ b/tools/testing/selftests/pidfd/pidfd.h
@@ -160,6 +160,22 @@
 #define PIDFD_INFO_COREDUMP_CODE	(1UL << 7)
 #endif
 
+#ifndef PIDFD_INFO_SIZE_VER0
+#define PIDFD_INFO_SIZE_VER0		64 /* sizeof first published struct */
+#endif
+
+#ifndef PIDFD_INFO_SIZE_VER1
+#define PIDFD_INFO_SIZE_VER1		72 /* sizeof second published struct */
+#endif
+
+#ifndef PIDFD_INFO_SIZE_VER2
+#define PIDFD_INFO_SIZE_VER2		80 /* sizeof third published struct */
+#endif
+
+#ifndef PIDFD_INFO_SIZE_VER3
+#define PIDFD_INFO_SIZE_VER3		88 /* sizeof fourth published struct */
+#endif
+
 #ifndef PIDFD_COREDUMPED
 #define PIDFD_COREDUMPED	(1U << 0) /* Did crash and... */
 #endif
diff --git a/tools/testing/selftests/pidfd/pidfd_info_test.c b/tools/testing/selftests/pidfd/pidfd_info_test.c
index 597012ed195f..ee08df3dc3d2 100644
--- a/tools/testing/selftests/pidfd/pidfd_info_test.c
+++ b/tools/testing/selftests/pidfd/pidfd_info_test.c
@@ -764,4 +764,52 @@ TEST(supported_mask_with_other_fields)
 	close(pidfd);
 }
 
+/*
+ * Test: fields beyond the caller's struct size are not reported
+ *
+ * Request the coredump and supported_mask fields with a struct of the
+ * first published size. None of those fields fit, so the returned mask
+ * must not name them and the memory behind the struct must be untouched.
+ */
+TEST(info_size_ver0_mask)
+{
+	struct pidfd_info info = {
+		.mask = PIDFD_INFO_COREDUMP | PIDFD_INFO_SUPPORTED_MASK,
+		.coredump_mask = 0xdeadbeef,
+		.coredump_signal = 0xdeadbeef,
+		.coredump_code = 0xdeadbeef,
+		.supported_mask = 0xdeadbeefdeadbeefULL,
+	};
+	unsigned int cmd = _IOC(_IOC_READ | _IOC_WRITE, PIDFS_IOCTL_MAGIC, 11,
+				PIDFD_INFO_SIZE_VER0);
+	int pidfd;
+	pid_t pid;
+
+	pid = create_child(&pidfd, 0);
+	ASSERT_GE(pid, 0);
+
+	if (pid == 0)
+		pause();
+
+	ASSERT_EQ(ioctl(pidfd, cmd, &info), 0);
+
+	/* The fields that fit are reported as usual. */
+	ASSERT_TRUE(!!(info.mask & PIDFD_INFO_PID));
+	ASSERT_TRUE(!!(info.mask & PIDFD_INFO_CREDS));
+
+	/* The fields that do not fit are neither reported nor written. */
+	ASSERT_FALSE(!!(info.mask & (PIDFD_INFO_COREDUMP |
+				     PIDFD_INFO_COREDUMP_SIGNAL |
+				     PIDFD_INFO_COREDUMP_CODE |
+				     PIDFD_INFO_SUPPORTED_MASK)));
+	ASSERT_EQ(info.coredump_mask, 0xdeadbeef);
+	ASSERT_EQ(info.coredump_signal, 0xdeadbeef);
+	ASSERT_EQ(info.coredump_code, 0xdeadbeef);
+	ASSERT_EQ(info.supported_mask, 0xdeadbeefdeadbeefULL);
+
+	sys_pidfd_send_signal(pidfd, SIGKILL, NULL, 0);
+	sys_waitid(P_PIDFD, pidfd, NULL, WEXITED);
+	close(pidfd);
+}
+
 TEST_HARNESS_MAIN