1 /* $OpenBSD: t_mmap.c,v 1.3 2020/12/06 18:46:07 bluhm Exp $ */ 2 /* $NetBSD: t_mmap.c,v 1.14 2020/06/26 07:50:11 jruoho Exp $ */ 3 4 /*- 5 * Copyright (c) 2011 The NetBSD Foundation, Inc. 6 * All rights reserved. 7 * 8 * This code is derived from software contributed to The NetBSD Foundation 9 * by Jukka Ruohonen. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 21 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 24 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 /*- 34 * Copyright (c)2004 YAMAMOTO Takashi, 35 * All rights reserved. 36 * 37 * Redistribution and use in source and binary forms, with or without 38 * modification, are permitted provided that the following conditions 39 * are met: 40 * 1. Redistributions of source code must retain the above copyright 41 * notice, this list of conditions and the following disclaimer. 42 * 2. Redistributions in binary form must reproduce the above copyright 43 * notice, this list of conditions and the following disclaimer in the 44 * documentation and/or other materials provided with the distribution. 45 * 46 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 47 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 48 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 49 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 50 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 51 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 52 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 53 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 54 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 55 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 56 * SUCH DAMAGE. 57 */ 58 59 #include "macros.h" 60 61 #include <sys/cdefs.h> 62 __RCSID("$NetBSD: t_mmap.c,v 1.14 2020/06/26 07:50:11 jruoho Exp $"); 63 64 #include <sys/param.h> 65 #include <sys/disklabel.h> 66 #include <sys/mman.h> 67 #include <sys/stat.h> 68 #include <sys/socket.h> 69 #include <sys/sysctl.h> 70 #include <sys/wait.h> 71 72 #include "atf-c.h" 73 #include <errno.h> 74 #include <fcntl.h> 75 #include <signal.h> 76 #include <stdio.h> 77 #include <stdlib.h> 78 #include <string.h> 79 #include <unistd.h> 80 #include <paths.h> 81 82 static long page = 0; 83 static char path[] = "mmap"; 84 static void map_check(void *, int); 85 static void map_sighandler(int); 86 static void testloan(void *, void *, char, int); 87 88 #define BUFSIZE (32 * 1024) /* enough size to trigger sosend_loan */ 89 90 static void 91 map_check(void *map, int flag) 92 { 93 94 if (flag != 0) { 95 ATF_REQUIRE(map == MAP_FAILED); 96 return; 97 } 98 99 ATF_REQUIRE(map != MAP_FAILED); 100 ATF_REQUIRE(munmap(map, page) == 0); 101 } 102 103 void 104 testloan(void *vp, void *vp2, char pat, int docheck) 105 { 106 char buf[BUFSIZE]; 107 char backup[BUFSIZE]; 108 ssize_t nwritten; 109 ssize_t nread; 110 int fds[2]; 111 int val; 112 113 val = BUFSIZE; 114 115 if (docheck != 0) 116 (void)memcpy(backup, vp, BUFSIZE); 117 118 if (socketpair(AF_LOCAL, SOCK_STREAM, PF_UNSPEC, fds) != 0) 119 atf_tc_fail("socketpair() failed"); 120 121 val = BUFSIZE; 122 123 if (setsockopt(fds[1], SOL_SOCKET, SO_RCVBUF, &val, sizeof(val)) != 0) 124 atf_tc_fail("setsockopt() failed, SO_RCVBUF"); 125 126 val = BUFSIZE; 127 128 if (setsockopt(fds[0], SOL_SOCKET, SO_SNDBUF, &val, sizeof(val)) != 0) 129 atf_tc_fail("setsockopt() failed, SO_SNDBUF"); 130 131 if (fcntl(fds[0], F_SETFL, O_NONBLOCK) != 0) 132 atf_tc_fail("fcntl() failed"); 133 134 nwritten = write(fds[0], (char *)vp + page, BUFSIZE - page); 135 136 if (nwritten == -1) 137 atf_tc_fail("write() failed"); 138 139 /* Break loan. */ 140 (void)memset(vp2, pat, BUFSIZE); 141 142 nread = read(fds[1], buf + page, BUFSIZE - page); 143 144 if (nread == -1) 145 atf_tc_fail("read() failed"); 146 147 if (nread != nwritten) 148 atf_tc_fail("too short read"); 149 150 if (docheck != 0 && memcmp(backup, buf + page, nread) != 0) 151 atf_tc_fail("data mismatch"); 152 153 ATF_REQUIRE(close(fds[0]) == 0); 154 ATF_REQUIRE(close(fds[1]) == 0); 155 } 156 157 static void 158 map_sighandler(int signo) 159 { 160 _exit(signo); 161 } 162 163 ATF_TC(mmap_block); 164 ATF_TC_HEAD(mmap_block, tc) 165 { 166 atf_tc_set_md_var(tc, "descr", "Test mmap(2) with a block device"); 167 atf_tc_set_md_var(tc, "require.user", "root"); 168 } 169 170 ATF_TC_BODY(mmap_block, tc) 171 { 172 static const int mib[] = { CTL_HW, HW_DISKNAMES }; 173 static const unsigned int miblen = __arraycount(mib); 174 char *map, *dk, *drives, dev[PATH_MAX]; 175 size_t len; 176 int fd = -1; 177 178 #ifndef __OpenBSD__ 179 /* works for us */ 180 atf_tc_skip("The test case causes a panic " \ 181 "(PR kern/38889, PR kern/46592)"); 182 #endif 183 184 ATF_REQUIRE(sysctl(mib, miblen, NULL, &len, NULL, 0) == 0); 185 drives = malloc(len); 186 ATF_REQUIRE(drives != NULL); 187 ATF_REQUIRE(sysctl(mib, miblen, drives, &len, NULL, 0) == 0); 188 #ifdef __OpenBSD__ 189 /* devices separated by comma, disk uid by colon */ 190 for (dk = strtok(drives, ",:"); dk != NULL; dk = strtok(NULL, ",:")) { 191 #else 192 for (dk = strtok(drives, " "); dk != NULL; dk = strtok(NULL, " ")) { 193 #endif 194 if (strncmp(dk, "dk", 2) == 0) 195 snprintf(dev, sizeof(dev), _PATH_DEV "%s", dk); 196 else 197 snprintf(dev, sizeof(dev), _PATH_DEV "%s%c", dk, 198 'a' + RAW_PART); 199 fprintf(stderr, "trying: %s\n", dev); 200 201 if ((fd = open(dev, O_RDONLY)) >= 0) { 202 (void)fprintf(stderr, "using %s\n", dev); 203 break; 204 } else 205 (void)fprintf(stderr, "%s: %s\n", dev, strerror(errno)); 206 } 207 free(drives); 208 209 if (fd < 0) 210 atf_tc_skip("failed to find suitable block device"); 211 212 map = mmap(NULL, 4096, PROT_READ, MAP_FILE, fd, 0); 213 ATF_REQUIRE_MSG(map != MAP_FAILED, "mmap: %s", strerror(errno)); 214 215 (void)fprintf(stderr, "first byte %x\n", *map); 216 ATF_REQUIRE(close(fd) == 0); 217 (void)fprintf(stderr, "first byte %x\n", *map); 218 219 ATF_REQUIRE(munmap(map, 4096) == 0); 220 } 221 222 ATF_TC(mmap_err); 223 ATF_TC_HEAD(mmap_err, tc) 224 { 225 atf_tc_set_md_var(tc, "descr", "Test error conditions of mmap(2)"); 226 } 227 228 ATF_TC_BODY(mmap_err, tc) 229 { 230 size_t addr = SIZE_MAX; 231 void *map; 232 233 errno = 0; 234 map = mmap(NULL, 3, PROT_READ, MAP_FILE|MAP_PRIVATE, -1, 0); 235 236 ATF_REQUIRE(map == MAP_FAILED); 237 ATF_REQUIRE(errno == EBADF); 238 239 errno = 0; 240 map = mmap(&addr, page, PROT_READ, MAP_FIXED|MAP_PRIVATE, -1, 0); 241 242 ATF_REQUIRE(map == MAP_FAILED); 243 ATF_REQUIRE(errno == EINVAL); 244 245 errno = 0; 246 map = mmap(NULL, page, PROT_READ, MAP_ANON|MAP_PRIVATE, INT_MAX, 0); 247 248 ATF_REQUIRE(map == MAP_FAILED); 249 ATF_REQUIRE(errno == EINVAL); 250 } 251 252 ATF_TC_WITH_CLEANUP(mmap_loan); 253 ATF_TC_HEAD(mmap_loan, tc) 254 { 255 atf_tc_set_md_var(tc, "descr", "Test uvm page loanout with mmap(2)"); 256 } 257 258 ATF_TC_BODY(mmap_loan, tc) 259 { 260 char buf[BUFSIZE]; 261 char *vp, *vp2; 262 int fd; 263 264 fd = open(path, O_RDWR | O_CREAT, 0600); 265 ATF_REQUIRE(fd >= 0); 266 267 (void)memset(buf, 'x', sizeof(buf)); 268 (void)write(fd, buf, sizeof(buf)); 269 270 vp = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE, 271 MAP_FILE | MAP_PRIVATE, fd, 0); 272 273 ATF_REQUIRE(vp != MAP_FAILED); 274 275 vp2 = vp; 276 277 testloan(vp, vp2, 'A', 0); 278 testloan(vp, vp2, 'B', 1); 279 280 ATF_REQUIRE(munmap(vp, BUFSIZE) == 0); 281 282 vp = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE, 283 MAP_FILE | MAP_SHARED, fd, 0); 284 285 vp2 = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE, 286 MAP_FILE | MAP_SHARED, fd, 0); 287 288 ATF_REQUIRE(vp != MAP_FAILED); 289 ATF_REQUIRE(vp2 != MAP_FAILED); 290 291 testloan(vp, vp2, 'E', 1); 292 293 ATF_REQUIRE(munmap(vp, BUFSIZE) == 0); 294 ATF_REQUIRE(munmap(vp2, BUFSIZE) == 0); 295 } 296 297 ATF_TC_CLEANUP(mmap_loan, tc) 298 { 299 (void)unlink(path); 300 } 301 302 ATF_TC_WITH_CLEANUP(mmap_prot_1); 303 ATF_TC_HEAD(mmap_prot_1, tc) 304 { 305 atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #1"); 306 } 307 308 ATF_TC_BODY(mmap_prot_1, tc) 309 { 310 void *map; 311 int fd; 312 313 /* 314 * Open a file write-only and try to 315 * map it read-only. This should fail. 316 */ 317 fd = open(path, O_WRONLY | O_CREAT, 0700); 318 319 if (fd < 0) 320 return; 321 322 ATF_REQUIRE(write(fd, "XXX", 3) == 3); 323 324 map = mmap(NULL, 3, PROT_READ, MAP_FILE|MAP_PRIVATE, fd, 0); 325 map_check(map, 1); 326 327 map = mmap(NULL, 3, PROT_WRITE, MAP_FILE|MAP_PRIVATE, fd, 0); 328 map_check(map, 0); 329 330 ATF_REQUIRE(close(fd) == 0); 331 } 332 333 ATF_TC_CLEANUP(mmap_prot_1, tc) 334 { 335 (void)unlink(path); 336 } 337 338 ATF_TC(mmap_prot_2); 339 ATF_TC_HEAD(mmap_prot_2, tc) 340 { 341 atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #2"); 342 } 343 344 ATF_TC_BODY(mmap_prot_2, tc) 345 { 346 char buf[2]; 347 void *map; 348 pid_t pid; 349 int sta; 350 351 /* 352 * Make a PROT_NONE mapping and try to access it. 353 * If we catch a SIGSEGV, all works as expected. 354 */ 355 map = mmap(NULL, page, PROT_NONE, MAP_ANON|MAP_PRIVATE, -1, 0); 356 ATF_REQUIRE(map != MAP_FAILED); 357 358 pid = fork(); 359 ATF_REQUIRE(pid >= 0); 360 361 if (pid == 0) { 362 ATF_REQUIRE(signal(SIGSEGV, map_sighandler) != SIG_ERR); 363 ATF_REQUIRE(strlcpy(buf, map, sizeof(buf)) != 0); 364 } 365 366 (void)wait(&sta); 367 368 ATF_REQUIRE(WIFEXITED(sta) != 0); 369 ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV); 370 ATF_REQUIRE(munmap(map, page) == 0); 371 } 372 373 ATF_TC_WITH_CLEANUP(mmap_prot_3); 374 ATF_TC_HEAD(mmap_prot_3, tc) 375 { 376 atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #3"); 377 } 378 379 ATF_TC_BODY(mmap_prot_3, tc) 380 { 381 char buf[2]; 382 int fd, sta; 383 void *map; 384 pid_t pid; 385 386 /* 387 * Open a file, change the permissions 388 * to read-only, and try to map it as 389 * PROT_NONE. This should succeed, but 390 * the access should generate SIGSEGV. 391 */ 392 fd = open(path, O_RDWR | O_CREAT, 0700); 393 394 if (fd < 0) 395 return; 396 397 ATF_REQUIRE(write(fd, "XXX", 3) == 3); 398 ATF_REQUIRE(close(fd) == 0); 399 ATF_REQUIRE(chmod(path, 0444) == 0); 400 401 fd = open(path, O_RDONLY); 402 ATF_REQUIRE(fd != -1); 403 404 map = mmap(NULL, 3, PROT_NONE, MAP_FILE | MAP_SHARED, fd, 0); 405 ATF_REQUIRE(map != MAP_FAILED); 406 407 pid = fork(); 408 409 ATF_REQUIRE(pid >= 0); 410 411 if (pid == 0) { 412 ATF_REQUIRE(signal(SIGSEGV, map_sighandler) != SIG_ERR); 413 ATF_REQUIRE(strlcpy(buf, map, sizeof(buf)) != 0); 414 } 415 416 (void)wait(&sta); 417 418 ATF_REQUIRE(WIFEXITED(sta) != 0); 419 ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV); 420 ATF_REQUIRE(munmap(map, 3) == 0); 421 } 422 423 ATF_TC_CLEANUP(mmap_prot_3, tc) 424 { 425 (void)unlink(path); 426 } 427 428 ATF_TC_WITH_CLEANUP(mmap_truncate); 429 ATF_TC_HEAD(mmap_truncate, tc) 430 { 431 atf_tc_set_md_var(tc, "descr", "Test mmap(2) and ftruncate(2)"); 432 } 433 434 ATF_TC_BODY(mmap_truncate, tc) 435 { 436 char *map; 437 long i; 438 int fd; 439 440 fd = open(path, O_RDWR | O_CREAT, 0700); 441 442 if (fd < 0) 443 return; 444 445 /* 446 * See that ftruncate(2) works 447 * while the file is mapped. 448 */ 449 ATF_REQUIRE(ftruncate(fd, page) == 0); 450 451 map = mmap(NULL, page, PROT_READ | PROT_WRITE, MAP_FILE|MAP_PRIVATE, 452 fd, 0); 453 ATF_REQUIRE(map != MAP_FAILED); 454 455 for (i = 0; i < page; i++) 456 map[i] = 'x'; 457 458 ATF_REQUIRE(ftruncate(fd, 0) == 0); 459 ATF_REQUIRE(ftruncate(fd, page / 8) == 0); 460 ATF_REQUIRE(ftruncate(fd, page / 4) == 0); 461 ATF_REQUIRE(ftruncate(fd, page / 2) == 0); 462 ATF_REQUIRE(ftruncate(fd, page / 12) == 0); 463 ATF_REQUIRE(ftruncate(fd, page / 64) == 0); 464 465 (void)munmap(map, page); 466 ATF_REQUIRE(close(fd) == 0); 467 } 468 469 ATF_TC_CLEANUP(mmap_truncate, tc) 470 { 471 (void)unlink(path); 472 } 473 474 ATF_TC_WITH_CLEANUP(mmap_truncate_signal); 475 ATF_TC_HEAD(mmap_truncate_signal, tc) 476 { 477 atf_tc_set_md_var(tc, "descr", 478 "Test mmap(2) ftruncate(2) causing signal"); 479 } 480 481 ATF_TC_BODY(mmap_truncate_signal, tc) 482 { 483 char *map; 484 long i; 485 int fd, sta; 486 pid_t pid; 487 488 fd = open(path, O_RDWR | O_CREAT, 0700); 489 490 if (fd < 0) 491 return; 492 493 ATF_REQUIRE(write(fd, "foo\n", 5) == 5); 494 495 map = mmap(NULL, page, PROT_READ, MAP_FILE|MAP_PRIVATE, fd, 0); 496 ATF_REQUIRE(map != MAP_FAILED); 497 498 sta = 0; 499 for (i = 0; i < 5; i++) 500 sta += map[i]; 501 ATF_REQUIRE(sta == 334); 502 503 ATF_REQUIRE(ftruncate(fd, 0) == 0); 504 pid = fork(); 505 ATF_REQUIRE(pid >= 0); 506 507 if (pid == 0) { 508 ATF_REQUIRE(signal(SIGBUS, map_sighandler) != SIG_ERR); 509 ATF_REQUIRE(signal(SIGSEGV, map_sighandler) != SIG_ERR); 510 sta = 0; 511 for (i = 0; i < page; i++) 512 sta += map[i]; 513 /* child never will get this far, but the compiler will 514 not know, so better use the values calculated to 515 prevent the access to be optimized out */ 516 ATF_REQUIRE(i == 0); 517 ATF_REQUIRE(sta == 0); 518 (void)munmap(map, page); 519 (void)close(fd); 520 return; 521 } 522 523 (void)wait(&sta); 524 525 ATF_REQUIRE(WIFEXITED(sta) != 0); 526 if (WEXITSTATUS(sta) == SIGSEGV) 527 atf_tc_fail("child process got SIGSEGV instead of SIGBUS"); 528 ATF_REQUIRE(WEXITSTATUS(sta) == SIGBUS); 529 ATF_REQUIRE(munmap(map, page) == 0); 530 ATF_REQUIRE(close(fd) == 0); 531 } 532 533 ATF_TC_CLEANUP(mmap_truncate_signal, tc) 534 { 535 (void)unlink(path); 536 } 537 538 ATF_TC(mmap_va0); 539 ATF_TC_HEAD(mmap_va0, tc) 540 { 541 atf_tc_set_md_var(tc, "descr", "Test mmap(2) and vm.user_va0_disable"); 542 } 543 544 ATF_TC_BODY(mmap_va0, tc) 545 { 546 int flags = MAP_ANON | MAP_FIXED | MAP_PRIVATE; 547 size_t len = sizeof(int); 548 void *map; 549 int val; 550 551 /* 552 * Make an anonymous fixed mapping at zero address. If the address 553 * is restricted as noted in security(7), the syscall should fail. 554 */ 555 if (sysctlbyname("vm.user_va0_disable", &val, &len, NULL, 0) != 0) 556 atf_tc_fail("failed to read vm.user_va0_disable"); 557 558 map = mmap(NULL, page, PROT_EXEC, flags, -1, 0); 559 map_check(map, val); 560 561 map = mmap(NULL, page, PROT_READ, flags, -1, 0); 562 map_check(map, val); 563 564 map = mmap(NULL, page, PROT_WRITE, flags, -1, 0); 565 map_check(map, val); 566 567 map = mmap(NULL, page, PROT_READ|PROT_WRITE, flags, -1, 0); 568 map_check(map, val); 569 570 map = mmap(NULL, page, PROT_EXEC|PROT_READ|PROT_WRITE, flags, -1, 0); 571 map_check(map, val); 572 } 573 574 ATF_TP_ADD_TCS(tp) 575 { 576 page = sysconf(_SC_PAGESIZE); 577 ATF_REQUIRE(page >= 0); 578 579 ATF_TP_ADD_TC(tp, mmap_block); 580 ATF_TP_ADD_TC(tp, mmap_err); 581 ATF_TP_ADD_TC(tp, mmap_loan); 582 ATF_TP_ADD_TC(tp, mmap_prot_1); 583 ATF_TP_ADD_TC(tp, mmap_prot_2); 584 ATF_TP_ADD_TC(tp, mmap_prot_3); 585 ATF_TP_ADD_TC(tp, mmap_truncate); 586 ATF_TP_ADD_TC(tp, mmap_truncate_signal); 587 #ifndef __OpenBSD__ 588 /* sysctl vm.user_va0_disable not available */ 589 ATF_TP_ADD_TC(tp, mmap_va0); 590 #endif 591 592 return atf_no_error(); 593 } 594