firefox/ipc/gtest/TestSharedMemory.cpp

/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this file,
 * You can obtain one at http://mozilla.org/MPL/2.0/. */

#include "gtest/gtest.h"

#include "mozilla/MathAlgorithms.h"
#include "mozilla/ipc/SharedMemoryCursor.h"
#include "mozilla/ipc/SharedMemoryHandle.h"
#include "mozilla/ipc/SharedMemoryMapping.h"

#ifdef XP_LINUX
#  include <errno.h>
#  include <linux/magic.h>
#  include <stdio.h>
#  include <string.h>
#  include <sys/statfs.h>
#  include <sys/utsname.h>
#endif

#ifdef XP_WIN
#  include <windows.h>
#endif

namespace mozilla::ipc {

#define ASSERT_SHMEM(handle, size)            \
  do {                                        \
    ASSERT_EQ((handle).Size(), size_t(size)); \
    if (size_t(size) == 0) {                  \
      ASSERT_FALSE((handle).IsValid());       \
      ASSERT_FALSE(handle);                   \
    } else {                                  \
      ASSERT_TRUE((handle).IsValid());        \
      ASSERT_TRUE(handle);                    \
    }                                         \
  } while (0)

template <typename T>
struct IPCSharedMemoryFixture : public testing::Test {};

using HandleAndMappingTypes =
    testing::Types<MutableSharedMemoryHandle, ReadOnlySharedMemoryHandle,
                   FreezableSharedMemoryHandle, SharedMemoryMapping,
                   ReadOnlySharedMemoryMapping, FreezableSharedMemoryMapping,
                   MutableOrReadOnlySharedMemoryMapping>;
TYPED_TEST_SUITE(IPCSharedMemoryFixture, HandleAndMappingTypes);

TYPED_TEST(IPCSharedMemoryFixture, Null) {
  TypeParam t;
  ASSERT_SHMEM(t, 0);

  if constexpr (std::is_same_v<TypeParam, MutableSharedMemoryHandle> ||
                std::is_same_v<TypeParam, ReadOnlySharedMemoryHandle>) {
    auto cloned = t.Clone();
    ASSERT_SHMEM(cloned, 0);
    ASSERT_SHMEM(t, 0);
  }
}

TEST(IPCSharedMemoryHandle, Create)
{
  auto handle = shared_memory::Create(1);
  ASSERT_SHMEM(handle, 1);
}

TEST(IPCSharedMemoryHandle, Move)
{
  auto handle = shared_memory::Create(1);

  MutableSharedMemoryHandle newHandle(std::move(handle));
  ASSERT_SHMEM(handle, 0);
  ASSERT_SHMEM(newHandle, 1);

  MutableSharedMemoryHandle assignedHandle;
  assignedHandle = std::move(newHandle);
  ASSERT_SHMEM(newHandle, 0);
  ASSERT_SHMEM(assignedHandle, 1);
}

TEST(IPCSharedMemoryHandle, ToReadOnly)
{
  auto handle = shared_memory::Create(1);
  auto roHandle = std::move(handle).ToReadOnly();
  ASSERT_SHMEM(handle, 0);
  ASSERT_SHMEM(roHandle, 1);
}

TEST(IPCSharedMemoryHandle, Clone)
{
  auto handle = shared_memory::Create(1);
  auto clonedHandle = handle.Clone();
  ASSERT_SHMEM(handle, 1);
  ASSERT_SHMEM(clonedHandle, 1);
}

TEST(IPCSharedMemoryHandle, ROClone)
{
  auto handle = shared_memory::Create(1).ToReadOnly();
  auto clonedHandle = handle.Clone();
  ASSERT_SHMEM(handle, 1);
  ASSERT_SHMEM(clonedHandle, 1);
}

TEST(IPCSharedMemoryHandle, CreateFreezable)
{
  auto handle = shared_memory::CreateFreezable(1);
  ASSERT_SHMEM(handle, 1);
}

TEST(IPCSharedMemoryHandle, WontFreeze)
{
  auto handle = shared_memory::CreateFreezable(1);
  ASSERT_SHMEM(handle, 1);

  auto mHandle = std::move(handle).WontFreeze();
  ASSERT_SHMEM(handle, 0);
  ASSERT_SHMEM(mHandle, 1);
}

TEST(IPCSharedMemoryHandle, Freeze)
{
  auto handle = shared_memory::CreateFreezable(1);
  ASSERT_SHMEM(handle, 1);

  auto roHandle = std::move(handle).Freeze();
  ASSERT_SHMEM(handle, 0);
  ASSERT_SHMEM(roHandle, 1);
}

TEST(IPCSharedMemory, Map)
{
  auto handle = shared_memory::Create(1);

  auto mapping = handle.Map();
  ASSERT_SHMEM(handle, 1);
  ASSERT_SHMEM(mapping, 1);
}

TEST(IPCSharedMemory, ROMap)
{
  auto handle = shared_memory::Create(1).ToReadOnly();

  auto mapping = handle.Map();
  ASSERT_SHMEM(handle, 1);
  ASSERT_SHMEM(mapping, 1);
}

TEST(IPCSharedMemory, FreezeMap)
{
  auto handle = shared_memory::CreateFreezable(1);

  auto mapping = std::move(handle).Map();
  ASSERT_SHMEM(handle, 0);
  ASSERT_SHMEM(mapping, 1);
}

TEST(IPCSharedMemoryMapping, Move)
{
  auto handle = shared_memory::Create(1);

  auto mapping = handle.Map();

  SharedMemoryMapping moved(std::move(mapping));
  ASSERT_SHMEM(mapping, 0);
  ASSERT_SHMEM(moved, 1);

  SharedMemoryMapping moveAssigned;
  moveAssigned = std::move(moved);
  ASSERT_SHMEM(moved, 0);
  ASSERT_SHMEM(moveAssigned, 1);
}

TEST(IPCSharedMemoryMapping, ROMove)
{
  auto handle = shared_memory::Create(1).ToReadOnly();

  auto mapping = handle.Map();

  ReadOnlySharedMemoryMapping moved(std::move(mapping));
  ASSERT_SHMEM(mapping, 0);
  ASSERT_SHMEM(moved, 1);

  ReadOnlySharedMemoryMapping moveAssigned;
  moveAssigned = std::move(moved);
  ASSERT_SHMEM(moved, 0);
  ASSERT_SHMEM(moveAssigned, 1);
}

TEST(IPCSharedMemoryMapping, FreezeMove)
{
  auto handle = shared_memory::CreateFreezable(1);

  auto mapping = std::move(handle).Map();

  FreezableSharedMemoryMapping moved(std::move(mapping));
  ASSERT_SHMEM(mapping, 0);
  ASSERT_SHMEM(moved, 1);

  FreezableSharedMemoryMapping moveAssigned;
  moveAssigned = std::move(moved);
  ASSERT_SHMEM(moved, 0);
  ASSERT_SHMEM(moveAssigned, 1);
}

TEST(IPCSharedMemoryMapping, MutableOrReadOnly)
{
  auto handle = shared_memory::Create(1);
  auto roHandle = handle.Clone().ToReadOnly();

  MutableOrReadOnlySharedMemoryMapping mapping;
  mapping = handle.Map();
  ASSERT_SHMEM(mapping, 1);
  ASSERT_FALSE(mapping.IsReadOnly());

  mapping = roHandle.Map();
  ASSERT_SHMEM(mapping, 1);
  ASSERT_TRUE(mapping.IsReadOnly());
}

TEST(IPCSharedMemoryMapping, FreezableFreeze)
{
  auto handle = shared_memory::CreateFreezable(1);

  auto mapping = std::move(handle).Map();
  auto roHandle = std::move(mapping).Freeze();
  ASSERT_SHMEM(mapping, 0);
  ASSERT_SHMEM(roHandle, 1);
}

TEST(IPCSharedMemoryMapping, FreezableFreezeWithMutableMapping)
{
  auto handle = shared_memory::CreateFreezable(1);

  auto mapping = std::move(handle).Map();
  auto [roHandle, m] = std::move(mapping).FreezeWithMutableMapping();
  ASSERT_SHMEM(mapping, 0);
  ASSERT_SHMEM(roHandle, 1);
  ASSERT_SHMEM(m, 1);
}

TEST(IPCSharedMemoryMapping, FreezableUnmap)
{
  auto handle = shared_memory::CreateFreezable(1);

  auto mapping = std::move(handle).Map();
  handle = std::move(mapping).Unmap();
  ASSERT_SHMEM(handle, 1);
  ASSERT_SHMEM(mapping, 0);
}

// Try to map a frozen shm for writing.  Threat model: the process is
// compromised and then receives a frozen handle.
TEST(IPCSharedMemory, FreezeAndMapRW)
{
  // Create
  auto handle = ipc::shared_memory::CreateFreezable(1);
  ASSERT_TRUE(handle);

  // Initialize
  auto mapping = std::move(handle).Map();
  ASSERT_TRUE(mapping);
  auto* mem = mapping.DataAs<char>();
  ASSERT_TRUE(mem);
  *mem = 'A';

  // Freeze
  auto [roHandle, rwMapping] = std::move(mapping).FreezeWithMutableMapping();
  ASSERT_TRUE(rwMapping);
  ASSERT_TRUE(roHandle);

  auto roMapping = roHandle.Map();
  ASSERT_TRUE(roMapping);
  const auto* roMem = roMapping.DataAs<char>();
  ASSERT_TRUE(roMem);
  ASSERT_EQ(*roMem, 'A');
}

// Try to restore write permissions to a frozen mapping.  Threat
// model: the process has mapped frozen shm normally and then is
// compromised, or as for FreezeAndMapRW (see also the
// proof-of-concept at https://crbug.com/project-zero/1671 ).
TEST(IPCSharedMemory, FreezeAndReprotect)
{
  // Create
  auto handle = ipc::shared_memory::CreateFreezable(1);
  ASSERT_TRUE(handle);

  // Initialize
  auto mapping = std::move(handle).Map();
  ASSERT_TRUE(mapping);
  auto* mem = mapping.DataAs<char>();
  ASSERT_TRUE(mem);
  *mem = 'A';

  // Freeze
  auto roHandle = std::move(mapping).Freeze();
  ASSERT_TRUE(roHandle);

  auto roMapping = roHandle.Map();
  ASSERT_TRUE(roMapping);

  const auto* roMem = roMapping.DataAs<char>();
  ASSERT_EQ(*roMem, 'A');

  // Try to alter protection; should fail
  EXPECT_FALSE(ipc::shared_memory::LocalProtect(
      (char*)roMem, 1, ipc::shared_memory::AccessReadWrite));
}

#if !defined(XP_WIN) && !defined(XP_DARWIN)
// This essentially tests whether FreezeAndReprotect would have failed
// without the freeze.
//
// It doesn't work on Windows: VirtualProtect can't exceed the permissions set
// in MapViewOfFile regardless of the security status of the original handle.
//
// It doesn't work on MacOS: we can set a higher max_protection for the memory
// when creating the handle, but we wouldn't want to do this for freezable
// handles (to prevent creating additional RW mappings that break the memory
// freezing invariants).
TEST(IPCSharedMemory, Reprotect)
{
  // Create
  auto handle = ipc::shared_memory::CreateFreezable(1);
  ASSERT_TRUE(handle);

  // Initialize
  auto mapping = std::move(handle).Map();
  ASSERT_TRUE(mapping);
  auto* mem = mapping.DataAs<char>();
  ASSERT_TRUE(mem);
  *mem = 'A';

  // Unmap without freezing.
  auto rwHandle = std::move(mapping).Unmap().WontFreeze();
  ASSERT_TRUE(rwHandle);
  auto roHandle = std::move(rwHandle).ToReadOnly();
  ASSERT_TRUE(roHandle);

  // Re-map
  auto roMapping = roHandle.Map();
  ASSERT_TRUE(roMapping);
  const auto* cmem = roMapping.DataAs<char>();
  ASSERT_EQ(*cmem, 'A');

  // Try to alter protection; should succeed, because not frozen
  EXPECT_TRUE(ipc::shared_memory::LocalProtect(
      (char*)cmem, 1, ipc::shared_memory::AccessReadWrite));
}
#endif

#ifdef XP_WIN
// Try to regain write permissions on a read-only handle using
// DuplicateHandle; this will succeed if the object has no DACL.
// See also https://crbug.com/338538
TEST(IPCSharedMemory, WinUnfreeze)
{
  // Create
  auto handle = ipc::shared_memory::CreateFreezable(1);
  ASSERT_TRUE(handle);

  // Initialize
  auto mapping = std::move(handle).Map();
  ASSERT_TRUE(mapping);
  auto* mem = mapping.DataAs<char>();
  ASSERT_TRUE(mem);
  *mem = 'A';

  // Freeze
  auto roHandle = std::move(mapping).Freeze();
  ASSERT_TRUE(roHandle);

  // Extract handle.
  auto platformHandle = std::move(roHandle).TakePlatformHandle();

  // Unfreeze.
  HANDLE newHandle = INVALID_HANDLE_VALUE;
  bool unfroze = ::DuplicateHandle(
      GetCurrentProcess(), platformHandle.release(), GetCurrentProcess(),
      &newHandle, FILE_MAP_ALL_ACCESS, false, DUPLICATE_CLOSE_SOURCE);
  ASSERT_FALSE(unfroze);
}
#endif

// Test that a read-only copy sees changes made to the writeable
// mapping in the case that the page wasn't accessed before the copy.
TEST(IPCSharedMemory, ROCopyAndWrite)
{
  auto handle = ipc::shared_memory::CreateFreezable(1);
  ASSERT_TRUE(handle);

  auto [roHandle, rwMapping] =
      std::move(handle).Map().FreezeWithMutableMapping();
  ASSERT_TRUE(rwMapping);
  ASSERT_TRUE(roHandle);

  auto roMapping = roHandle.Map();

  auto* memRW = rwMapping.DataAs<char>();
  ASSERT_TRUE(memRW);
  const auto* memRO = roMapping.DataAs<char>();
  ASSERT_TRUE(memRO);

  ASSERT_NE(memRW, memRO);

  *memRW = 'A';
  EXPECT_EQ(*memRO, 'A');
}

// Test that a read-only copy sees changes made to the writeable
// mapping in the case that the page was accessed before the copy
// (and, before that, sees the state as of when the copy was made).
TEST(IPCSharedMemory, ROCopyAndRewrite)
{
  auto handle = ipc::shared_memory::CreateFreezable(1);
  ASSERT_TRUE(handle);

  auto [roHandle, rwMapping] =
      std::move(handle).Map().FreezeWithMutableMapping();
  ASSERT_TRUE(rwMapping);
  ASSERT_TRUE(roHandle);

  auto roMapping = roHandle.Map();

  auto* memRW = rwMapping.DataAs<char>();
  ASSERT_TRUE(memRW);
  *memRW = 'A';

  const auto* memRO = roMapping.DataAs<char>();
  ASSERT_TRUE(memRO);

  ASSERT_NE(memRW, memRO);

  ASSERT_EQ(*memRW, 'A');
  EXPECT_EQ(*memRO, 'A');
  *memRW = 'X';
  EXPECT_EQ(*memRO, 'X');
}

#ifndef FUZZING
TEST(IPCSharedMemory, BasicIsZero)
{
  static constexpr size_t kSize = 65536;
  auto shm = ipc::shared_memory::Create(kSize).Map();

  auto* mem = shm.DataAs<char>();
  for (size_t i = 0; i < kSize; ++i) {
    ASSERT_EQ(mem[i], 0) << "offset " << i;
  }
}
#endif

#if defined(XP_LINUX) && !defined(ANDROID)
class IPCSharedMemoryLinuxTest : public ::testing::Test {
  int mMajor = 0;
  int mMinor = 0;

 protected:
  void SetUp() override {
    if (mMajor != 0) {
      return;
    }
    struct utsname uts{};
    ASSERT_EQ(uname(&uts), 0) << strerror(errno);
    ASSERT_STREQ(uts.sysname, "Linux");
    ASSERT_EQ(sscanf(uts.release, "%d.%d", &mMajor, &mMinor), 2);
  }

  bool HaveKernelVersion(int aMajor, int aMinor) {
    return mMajor > aMajor || (mMajor == aMajor && mMinor >= aMinor);
  }

  bool ShouldHaveMemfd() { return HaveKernelVersion(3, 17); }

  bool ShouldHaveMemfdNoExec() { return HaveKernelVersion(6, 3); }
};

// Test that memfd_create is used where expected.
//
// More precisely: if memfd_create support is expected, verify that
// shared memory isn't subject to a filesystem size limit.
TEST_F(IPCSharedMemoryLinuxTest, IsMemfd) {
  auto handle = ipc::shared_memory::Create(1);
  UniqueFileHandle fd = std::move(handle).TakePlatformHandle();
  ASSERT_TRUE(fd);

  struct statfs fs{};
  ASSERT_EQ(fstatfs(fd.get(), &fs), 0) << strerror(errno);
  EXPECT_EQ(fs.f_type, TMPFS_MAGIC);
  static constexpr decltype(fs.f_blocks) kNoLimit = 0;
  if (ShouldHaveMemfd()) {
    EXPECT_EQ(fs.f_blocks, kNoLimit);
  } else {
    // On older kernels, we expect the memfd / no-limit test to fail.
    // (In theory it could succeed if backported memfd support exists;
    // if that ever happens, this check can be removed.)
    EXPECT_NE(fs.f_blocks, kNoLimit);
  }
}

TEST_F(IPCSharedMemoryLinuxTest, MemfdNoExec) {
  const bool expectExec = ShouldHaveMemfd() && !ShouldHaveMemfdNoExec();

  auto handle = ipc::shared_memory::Create(1);
  UniqueFileHandle fd = std::move(handle).TakePlatformHandle();
  ASSERT_TRUE(fd);

  struct stat sb{};
  ASSERT_EQ(fstat(fd.get(), &sb), 0) << strerror(errno);
  // Check that mode is reasonable.
  EXPECT_EQ(sb.st_mode & (S_IRUSR | S_IWUSR), mode_t(S_IRUSR | S_IWUSR));
  // Chech the exec bit
  EXPECT_EQ(sb.st_mode & S_IXUSR, mode_t(expectExec ? S_IXUSR : 0));
}
#endif

TEST(IPCSharedMemory, CursorWriteRead)
{
  // Select a chunk size which is at least as big as the allocation granularity,
  // as smaller sizes will not be able to map.
  const size_t chunkSize = ipc::shared_memory::SystemAllocationGranularity();
  ASSERT_TRUE(IsPowerOfTwo(chunkSize));

  const uint64_t fullSize = chunkSize * 20;
  auto handle = ipc::shared_memory::Create(fullSize);
  ASSERT_TRUE(handle.IsValid());
  ASSERT_EQ(handle.Size(), fullSize);

  // Map the entire region.
  auto mapping = handle.Map();
  ASSERT_TRUE(mapping.IsValid());
  ASSERT_EQ(mapping.Size(), fullSize);

  // Use a cursor to write some data.
  ipc::shared_memory::Cursor cursor(std::move(handle));
  ASSERT_EQ(cursor.Offset(), 0u);
  ASSERT_EQ(cursor.Size(), fullSize);

  // Set the chunk size to ensure we use multiple mappings for this data region.
  cursor.SetChunkSize(chunkSize);

  // Two basic blocks of data which are used for writeReadTest.
  const char data[] = "Hello, World!";
  const char data2[] = "AnotherString";
  auto writeReadTest = [&]() {
    uint64_t initialOffset = cursor.Offset();

    // Clear out the buffer to a known state so that any checks will fail if
    // they're depending on previous writes.
    memset(mapping.Address(), 0xe5, mapping.Size());

    // Write "Hello, World" at the offset, and ensure it is reflected in the
    // full mapping.
    ASSERT_TRUE(cursor.Write(data, std::size(data)));
    ASSERT_EQ(cursor.Offset(), initialOffset + std::size(data));
    ASSERT_STREQ(mapping.DataAs<char>() + initialOffset, data);

    // Write some data in the full mapping at the same offset, and enure it can
    // be read.
    memcpy(mapping.DataAs<char>() + initialOffset, data2, std::size(data2));
    cursor.Seek(initialOffset);
    ASSERT_EQ(cursor.Offset(), initialOffset);
    char buffer[std::size(data2)];
    ASSERT_TRUE(cursor.Read(buffer, std::size(buffer)));
    ASSERT_EQ(cursor.Offset(), initialOffset + std::size(buffer));
    ASSERT_STREQ(buffer, data2);
  };

  writeReadTest();

  // Run the writeReadTest at various offsets within the buffer, including at
  // every chunk boundary, and in the middle of each chunk.
  for (size_t offset = chunkSize - 3; offset < fullSize - 3;
       offset += chunkSize / 2) {
    cursor.Seek(offset);
    writeReadTest();
  }

  // Do a writeReadTest at the very end of the allocated region to ensure that
  // edge case is handled.
  cursor.Seek(mapping.Size() - std::max(std::size(data), std::size(data2)));
  writeReadTest();

  // Ensure that writes past the end fail safely.
  cursor.Seek(mapping.Size() - 3);
  ASSERT_FALSE(cursor.Write(data, std::size(data)));
}

}  // namespace mozilla::ipc