Hi Daniel, Thanks for initiating the analysis.

On Fri, Mar 31, 2023 at 10:57 AM Daniel Verkamp dverkamp@chromium.org wrote:

On Fri, Mar 31, 2023 at 8:05 AM kernel test robot yujie.liu@intel.com wrote:

...

Hello,

kernel test robot noticed kernel-selftests.memfd.run_fuse_test.sh.fail due to commit (built with gcc-11):

commit: 11f75a01448f1b7a739e75dbd8f17b844fcfc510 ("selftests/memfd: add tests for MFD_NOEXEC_SEAL MFD_EXEC") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master

in testcase: kernel-selftests version: kernel-selftests-x86_64-d4cf28ee-1_20230110 with following parameters:

    group: group-02

test-description: The kernel contains a set of "self tests" under the tools/testing/selftests/ directory. These are intended to be small unit tests to exercise individual code paths in the kernel. test-url: https://www.kernel.org/doc/Documentation/kselftest.txt

on test machine: 4 threads Intel(R) Xeon(R) CPU E3-1225 v5 @ 3.30GHz (Skylake) with 16G memory

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):

# selftests: memfd: run_fuse_test.sh # Aborted not ok 2 selftests: memfd: run_fuse_test.sh # exit=134

$ ./run_fuse_test.sh opening: ./mnt/memfd 8 != 40 = GET_SEALS(4) Aborted

Hi Jeff,

I think this is caused by test_sysctl() in memfd_test, which sets /proc/sys/vm/memfd_noexec to a non-zero value and does not restore it at the end of the test. If fuse_test runs after that, it will unexpectedly get F_SEAL_EXEC in its memfd seals in addition to the F_SEAL_WRITE that it intended to add.

The sysctl for /proc/sys/vm/memfd_noexec is pid-namespaced, and designed to be non-reservable due to security reasons.

I think the fix is to run this set of test_sysctl in a child namespace, instead of init namespace. I will work on a fix for this.

I'm not sure how kernel selftests normally perform cleanup (e.g. an atexit() hook to make sure it cleans up if a test fails?), but at least we should probably set /proc/sys/vm/memfd_noexec back to its original value after test_sysctl().

Thanks, -- Daniel

Thanks! -Jeff

-Jeff