1 /* 2 * Test a fork/munmap vm_object shadow chain race 3 * 4 * Written by "Samuel J. Greear" <sjg@evilcode.net> 5 */ 6 #include <stdio.h> 7 #include <string.h> 8 #include <err.h> 9 #include <sysexits.h> 10 #include <unistd.h> 11 12 #include <sys/types.h> 13 #include <sys/mman.h> 14 #include <sys/param.h> 15 #include <sys/wait.h> 16 17 #define MAPPING_PAGES 4096 18 19 int 20 main(int argc, char *argv[]) 21 { 22 unsigned int i, size; 23 int status; 24 pid_t pid; 25 void *mapping; 26 char tmp[100]; 27 28 for (i = 1; i < MAPPING_PAGES; ++i) { 29 size = PAGE_SIZE * i; 30 mapping = mmap(0, size, PROT_READ|PROT_WRITE, MAP_ANON|MAP_SHARED, 31 -1, 0); 32 if (mapping == MAP_FAILED) 33 errx(EX_OSERR, "mmap() failed"); 34 35 memset(mapping, 'x', 10); 36 printf(" %d", i); 37 fflush(stdout); 38 39 pid = fork(); 40 if (pid == 0) { 41 memcpy(&tmp, mapping, 12); 42 return (0); 43 } else if (pid != -1) { 44 if (munmap(mapping, PAGE_SIZE * i) != 0) { 45 printf("munmap failed\n"); 46 return (0); 47 } 48 waitpid(pid, &status, 0); 49 if (status == 10) { 50 printf("child sig10 at %d pages\n", i); 51 return (0); 52 } 53 } else { 54 printf("fork failed\n"); 55 } 56 } 57 58 return (0); 59 } 60