1 /* $OpenBSD: t_mmap.c,v 1.4 2021/12/13 16:56:48 deraadt Exp $ */
2 /* $NetBSD: t_mmap.c,v 1.14 2020/06/26 07:50:11 jruoho Exp $ */
3
4 /*-
5 * Copyright (c) 2011 The NetBSD Foundation, Inc.
6 * All rights reserved.
7 *
8 * This code is derived from software contributed to The NetBSD Foundation
9 * by Jukka Ruohonen.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in the
18 * documentation and/or other materials provided with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30 * POSSIBILITY OF SUCH DAMAGE.
31 */
32
33 /*-
34 * Copyright (c)2004 YAMAMOTO Takashi,
35 * All rights reserved.
36 *
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
39 * are met:
40 * 1. Redistributions of source code must retain the above copyright
41 * notice, this list of conditions and the following disclaimer.
42 * 2. Redistributions in binary form must reproduce the above copyright
43 * notice, this list of conditions and the following disclaimer in the
44 * documentation and/or other materials provided with the distribution.
45 *
46 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
47 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
48 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
49 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
50 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
51 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
52 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
53 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
54 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
55 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
56 * SUCH DAMAGE.
57 */
58
59 #include "macros.h"
60
61 #include <sys/disklabel.h>
62 #include <sys/mman.h>
63 #include <sys/stat.h>
64 #include <sys/socket.h>
65 #include <sys/sysctl.h>
66 #include <sys/wait.h>
67
68 #include "atf-c.h"
69 #include <errno.h>
70 #include <fcntl.h>
71 #include <signal.h>
72 #include <stdio.h>
73 #include <stdlib.h>
74 #include <limits.h>
75 #include <string.h>
76 #include <unistd.h>
77 #include <paths.h>
78
79 static long page = 0;
80 static char path[] = "mmap";
81 static void map_check(void *, int);
82 static void map_sighandler(int);
83 static void testloan(void *, void *, char, int);
84
85 #define BUFSIZE (32 * 1024) /* enough size to trigger sosend_loan */
86
87 static void
map_check(void * map,int flag)88 map_check(void *map, int flag)
89 {
90
91 if (flag != 0) {
92 ATF_REQUIRE(map == MAP_FAILED);
93 return;
94 }
95
96 ATF_REQUIRE(map != MAP_FAILED);
97 ATF_REQUIRE(munmap(map, page) == 0);
98 }
99
100 void
testloan(void * vp,void * vp2,char pat,int docheck)101 testloan(void *vp, void *vp2, char pat, int docheck)
102 {
103 char buf[BUFSIZE];
104 char backup[BUFSIZE];
105 ssize_t nwritten;
106 ssize_t nread;
107 int fds[2];
108 int val;
109
110 val = BUFSIZE;
111
112 if (docheck != 0)
113 (void)memcpy(backup, vp, BUFSIZE);
114
115 if (socketpair(AF_LOCAL, SOCK_STREAM, PF_UNSPEC, fds) != 0)
116 atf_tc_fail("socketpair() failed");
117
118 val = BUFSIZE;
119
120 if (setsockopt(fds[1], SOL_SOCKET, SO_RCVBUF, &val, sizeof(val)) != 0)
121 atf_tc_fail("setsockopt() failed, SO_RCVBUF");
122
123 val = BUFSIZE;
124
125 if (setsockopt(fds[0], SOL_SOCKET, SO_SNDBUF, &val, sizeof(val)) != 0)
126 atf_tc_fail("setsockopt() failed, SO_SNDBUF");
127
128 if (fcntl(fds[0], F_SETFL, O_NONBLOCK) != 0)
129 atf_tc_fail("fcntl() failed");
130
131 nwritten = write(fds[0], (char *)vp + page, BUFSIZE - page);
132
133 if (nwritten == -1)
134 atf_tc_fail("write() failed");
135
136 /* Break loan. */
137 (void)memset(vp2, pat, BUFSIZE);
138
139 nread = read(fds[1], buf + page, BUFSIZE - page);
140
141 if (nread == -1)
142 atf_tc_fail("read() failed");
143
144 if (nread != nwritten)
145 atf_tc_fail("too short read");
146
147 if (docheck != 0 && memcmp(backup, buf + page, nread) != 0)
148 atf_tc_fail("data mismatch");
149
150 ATF_REQUIRE(close(fds[0]) == 0);
151 ATF_REQUIRE(close(fds[1]) == 0);
152 }
153
154 static void
map_sighandler(int signo)155 map_sighandler(int signo)
156 {
157 _exit(signo);
158 }
159
160 ATF_TC(mmap_block);
ATF_TC_HEAD(mmap_block,tc)161 ATF_TC_HEAD(mmap_block, tc)
162 {
163 atf_tc_set_md_var(tc, "descr", "Test mmap(2) with a block device");
164 atf_tc_set_md_var(tc, "require.user", "root");
165 }
166
ATF_TC_BODY(mmap_block,tc)167 ATF_TC_BODY(mmap_block, tc)
168 {
169 static const int mib[] = { CTL_HW, HW_DISKNAMES };
170 static const unsigned int miblen = __arraycount(mib);
171 char *map, *dk, *drives, dev[PATH_MAX];
172 size_t len;
173 int fd = -1;
174
175 #ifndef __OpenBSD__
176 /* works for us */
177 atf_tc_skip("The test case causes a panic " \
178 "(PR kern/38889, PR kern/46592)");
179 #endif
180
181 ATF_REQUIRE(sysctl(mib, miblen, NULL, &len, NULL, 0) == 0);
182 drives = malloc(len);
183 ATF_REQUIRE(drives != NULL);
184 ATF_REQUIRE(sysctl(mib, miblen, drives, &len, NULL, 0) == 0);
185 #ifdef __OpenBSD__
186 /* devices separated by comma, disk uid by colon */
187 for (dk = strtok(drives, ",:"); dk != NULL; dk = strtok(NULL, ",:")) {
188 #else
189 for (dk = strtok(drives, " "); dk != NULL; dk = strtok(NULL, " ")) {
190 #endif
191 if (strncmp(dk, "dk", 2) == 0)
192 snprintf(dev, sizeof(dev), _PATH_DEV "%s", dk);
193 else
194 snprintf(dev, sizeof(dev), _PATH_DEV "%s%c", dk,
195 'a' + RAW_PART);
196 fprintf(stderr, "trying: %s\n", dev);
197
198 if ((fd = open(dev, O_RDONLY)) >= 0) {
199 (void)fprintf(stderr, "using %s\n", dev);
200 break;
201 } else
202 (void)fprintf(stderr, "%s: %s\n", dev, strerror(errno));
203 }
204 free(drives);
205
206 if (fd < 0)
207 atf_tc_skip("failed to find suitable block device");
208
209 map = mmap(NULL, 4096, PROT_READ, MAP_FILE, fd, 0);
210 ATF_REQUIRE_MSG(map != MAP_FAILED, "mmap: %s", strerror(errno));
211
212 (void)fprintf(stderr, "first byte %x\n", *map);
213 ATF_REQUIRE(close(fd) == 0);
214 (void)fprintf(stderr, "first byte %x\n", *map);
215
216 ATF_REQUIRE(munmap(map, 4096) == 0);
217 }
218
219 ATF_TC(mmap_err);
220 ATF_TC_HEAD(mmap_err, tc)
221 {
222 atf_tc_set_md_var(tc, "descr", "Test error conditions of mmap(2)");
223 }
224
225 ATF_TC_BODY(mmap_err, tc)
226 {
227 size_t addr = SIZE_MAX;
228 void *map;
229
230 errno = 0;
231 map = mmap(NULL, 3, PROT_READ, MAP_FILE|MAP_PRIVATE, -1, 0);
232
233 ATF_REQUIRE(map == MAP_FAILED);
234 ATF_REQUIRE(errno == EBADF);
235
236 errno = 0;
237 map = mmap(&addr, page, PROT_READ, MAP_FIXED|MAP_PRIVATE, -1, 0);
238
239 ATF_REQUIRE(map == MAP_FAILED);
240 ATF_REQUIRE(errno == EINVAL);
241
242 errno = 0;
243 map = mmap(NULL, page, PROT_READ, MAP_ANON|MAP_PRIVATE, INT_MAX, 0);
244
245 ATF_REQUIRE(map == MAP_FAILED);
246 ATF_REQUIRE(errno == EINVAL);
247 }
248
249 ATF_TC_WITH_CLEANUP(mmap_loan);
250 ATF_TC_HEAD(mmap_loan, tc)
251 {
252 atf_tc_set_md_var(tc, "descr", "Test uvm page loanout with mmap(2)");
253 }
254
255 ATF_TC_BODY(mmap_loan, tc)
256 {
257 char buf[BUFSIZE];
258 char *vp, *vp2;
259 int fd;
260
261 fd = open(path, O_RDWR | O_CREAT, 0600);
262 ATF_REQUIRE(fd >= 0);
263
264 (void)memset(buf, 'x', sizeof(buf));
265 (void)write(fd, buf, sizeof(buf));
266
267 vp = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE,
268 MAP_FILE | MAP_PRIVATE, fd, 0);
269
270 ATF_REQUIRE(vp != MAP_FAILED);
271
272 vp2 = vp;
273
274 testloan(vp, vp2, 'A', 0);
275 testloan(vp, vp2, 'B', 1);
276
277 ATF_REQUIRE(munmap(vp, BUFSIZE) == 0);
278
279 vp = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE,
280 MAP_FILE | MAP_SHARED, fd, 0);
281
282 vp2 = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE,
283 MAP_FILE | MAP_SHARED, fd, 0);
284
285 ATF_REQUIRE(vp != MAP_FAILED);
286 ATF_REQUIRE(vp2 != MAP_FAILED);
287
288 testloan(vp, vp2, 'E', 1);
289
290 ATF_REQUIRE(munmap(vp, BUFSIZE) == 0);
291 ATF_REQUIRE(munmap(vp2, BUFSIZE) == 0);
292 }
293
294 ATF_TC_CLEANUP(mmap_loan, tc)
295 {
296 (void)unlink(path);
297 }
298
299 ATF_TC_WITH_CLEANUP(mmap_prot_1);
300 ATF_TC_HEAD(mmap_prot_1, tc)
301 {
302 atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #1");
303 }
304
305 ATF_TC_BODY(mmap_prot_1, tc)
306 {
307 void *map;
308 int fd;
309
310 /*
311 * Open a file write-only and try to
312 * map it read-only. This should fail.
313 */
314 fd = open(path, O_WRONLY | O_CREAT, 0700);
315
316 if (fd < 0)
317 return;
318
319 ATF_REQUIRE(write(fd, "XXX", 3) == 3);
320
321 map = mmap(NULL, 3, PROT_READ, MAP_FILE|MAP_PRIVATE, fd, 0);
322 map_check(map, 1);
323
324 map = mmap(NULL, 3, PROT_WRITE, MAP_FILE|MAP_PRIVATE, fd, 0);
325 map_check(map, 0);
326
327 ATF_REQUIRE(close(fd) == 0);
328 }
329
330 ATF_TC_CLEANUP(mmap_prot_1, tc)
331 {
332 (void)unlink(path);
333 }
334
335 ATF_TC(mmap_prot_2);
336 ATF_TC_HEAD(mmap_prot_2, tc)
337 {
338 atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #2");
339 }
340
341 ATF_TC_BODY(mmap_prot_2, tc)
342 {
343 char buf[2];
344 void *map;
345 pid_t pid;
346 int sta;
347
348 /*
349 * Make a PROT_NONE mapping and try to access it.
350 * If we catch a SIGSEGV, all works as expected.
351 */
352 map = mmap(NULL, page, PROT_NONE, MAP_ANON|MAP_PRIVATE, -1, 0);
353 ATF_REQUIRE(map != MAP_FAILED);
354
355 pid = fork();
356 ATF_REQUIRE(pid >= 0);
357
358 if (pid == 0) {
359 ATF_REQUIRE(signal(SIGSEGV, map_sighandler) != SIG_ERR);
360 ATF_REQUIRE(strlcpy(buf, map, sizeof(buf)) != 0);
361 }
362
363 (void)wait(&sta);
364
365 ATF_REQUIRE(WIFEXITED(sta) != 0);
366 ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV);
367 ATF_REQUIRE(munmap(map, page) == 0);
368 }
369
370 ATF_TC_WITH_CLEANUP(mmap_prot_3);
371 ATF_TC_HEAD(mmap_prot_3, tc)
372 {
373 atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #3");
374 }
375
376 ATF_TC_BODY(mmap_prot_3, tc)
377 {
378 char buf[2];
379 int fd, sta;
380 void *map;
381 pid_t pid;
382
383 /*
384 * Open a file, change the permissions
385 * to read-only, and try to map it as
386 * PROT_NONE. This should succeed, but
387 * the access should generate SIGSEGV.
388 */
389 fd = open(path, O_RDWR | O_CREAT, 0700);
390
391 if (fd < 0)
392 return;
393
394 ATF_REQUIRE(write(fd, "XXX", 3) == 3);
395 ATF_REQUIRE(close(fd) == 0);
396 ATF_REQUIRE(chmod(path, 0444) == 0);
397
398 fd = open(path, O_RDONLY);
399 ATF_REQUIRE(fd != -1);
400
401 map = mmap(NULL, 3, PROT_NONE, MAP_FILE | MAP_SHARED, fd, 0);
402 ATF_REQUIRE(map != MAP_FAILED);
403
404 pid = fork();
405
406 ATF_REQUIRE(pid >= 0);
407
408 if (pid == 0) {
409 ATF_REQUIRE(signal(SIGSEGV, map_sighandler) != SIG_ERR);
410 ATF_REQUIRE(strlcpy(buf, map, sizeof(buf)) != 0);
411 }
412
413 (void)wait(&sta);
414
415 ATF_REQUIRE(WIFEXITED(sta) != 0);
416 ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV);
417 ATF_REQUIRE(munmap(map, 3) == 0);
418 }
419
420 ATF_TC_CLEANUP(mmap_prot_3, tc)
421 {
422 (void)unlink(path);
423 }
424
425 ATF_TC_WITH_CLEANUP(mmap_truncate);
426 ATF_TC_HEAD(mmap_truncate, tc)
427 {
428 atf_tc_set_md_var(tc, "descr", "Test mmap(2) and ftruncate(2)");
429 }
430
431 ATF_TC_BODY(mmap_truncate, tc)
432 {
433 char *map;
434 long i;
435 int fd;
436
437 fd = open(path, O_RDWR | O_CREAT, 0700);
438
439 if (fd < 0)
440 return;
441
442 /*
443 * See that ftruncate(2) works
444 * while the file is mapped.
445 */
446 ATF_REQUIRE(ftruncate(fd, page) == 0);
447
448 map = mmap(NULL, page, PROT_READ | PROT_WRITE, MAP_FILE|MAP_PRIVATE,
449 fd, 0);
450 ATF_REQUIRE(map != MAP_FAILED);
451
452 for (i = 0; i < page; i++)
453 map[i] = 'x';
454
455 ATF_REQUIRE(ftruncate(fd, 0) == 0);
456 ATF_REQUIRE(ftruncate(fd, page / 8) == 0);
457 ATF_REQUIRE(ftruncate(fd, page / 4) == 0);
458 ATF_REQUIRE(ftruncate(fd, page / 2) == 0);
459 ATF_REQUIRE(ftruncate(fd, page / 12) == 0);
460 ATF_REQUIRE(ftruncate(fd, page / 64) == 0);
461
462 (void)munmap(map, page);
463 ATF_REQUIRE(close(fd) == 0);
464 }
465
466 ATF_TC_CLEANUP(mmap_truncate, tc)
467 {
468 (void)unlink(path);
469 }
470
471 ATF_TC_WITH_CLEANUP(mmap_truncate_signal);
472 ATF_TC_HEAD(mmap_truncate_signal, tc)
473 {
474 atf_tc_set_md_var(tc, "descr",
475 "Test mmap(2) ftruncate(2) causing signal");
476 }
477
478 ATF_TC_BODY(mmap_truncate_signal, tc)
479 {
480 char *map;
481 long i;
482 int fd, sta;
483 pid_t pid;
484
485 fd = open(path, O_RDWR | O_CREAT, 0700);
486
487 if (fd < 0)
488 return;
489
490 ATF_REQUIRE(write(fd, "foo\n", 5) == 5);
491
492 map = mmap(NULL, page, PROT_READ, MAP_FILE|MAP_PRIVATE, fd, 0);
493 ATF_REQUIRE(map != MAP_FAILED);
494
495 sta = 0;
496 for (i = 0; i < 5; i++)
497 sta += map[i];
498 ATF_REQUIRE(sta == 334);
499
500 ATF_REQUIRE(ftruncate(fd, 0) == 0);
501 pid = fork();
502 ATF_REQUIRE(pid >= 0);
503
504 if (pid == 0) {
505 ATF_REQUIRE(signal(SIGBUS, map_sighandler) != SIG_ERR);
506 ATF_REQUIRE(signal(SIGSEGV, map_sighandler) != SIG_ERR);
507 sta = 0;
508 for (i = 0; i < page; i++)
509 sta += map[i];
510 /* child never will get this far, but the compiler will
511 not know, so better use the values calculated to
512 prevent the access to be optimized out */
513 ATF_REQUIRE(i == 0);
514 ATF_REQUIRE(sta == 0);
515 (void)munmap(map, page);
516 (void)close(fd);
517 return;
518 }
519
520 (void)wait(&sta);
521
522 ATF_REQUIRE(WIFEXITED(sta) != 0);
523 if (WEXITSTATUS(sta) == SIGSEGV)
524 atf_tc_fail("child process got SIGSEGV instead of SIGBUS");
525 ATF_REQUIRE(WEXITSTATUS(sta) == SIGBUS);
526 ATF_REQUIRE(munmap(map, page) == 0);
527 ATF_REQUIRE(close(fd) == 0);
528 }
529
530 ATF_TC_CLEANUP(mmap_truncate_signal, tc)
531 {
532 (void)unlink(path);
533 }
534
535 ATF_TC(mmap_va0);
536 ATF_TC_HEAD(mmap_va0, tc)
537 {
538 atf_tc_set_md_var(tc, "descr", "Test mmap(2) and vm.user_va0_disable");
539 }
540
541 ATF_TC_BODY(mmap_va0, tc)
542 {
543 int flags = MAP_ANON | MAP_FIXED | MAP_PRIVATE;
544 size_t len = sizeof(int);
545 void *map;
546 int val;
547
548 /*
549 * Make an anonymous fixed mapping at zero address. If the address
550 * is restricted as noted in security(7), the syscall should fail.
551 */
552 if (sysctlbyname("vm.user_va0_disable", &val, &len, NULL, 0) != 0)
553 atf_tc_fail("failed to read vm.user_va0_disable");
554
555 map = mmap(NULL, page, PROT_EXEC, flags, -1, 0);
556 map_check(map, val);
557
558 map = mmap(NULL, page, PROT_READ, flags, -1, 0);
559 map_check(map, val);
560
561 map = mmap(NULL, page, PROT_WRITE, flags, -1, 0);
562 map_check(map, val);
563
564 map = mmap(NULL, page, PROT_READ|PROT_WRITE, flags, -1, 0);
565 map_check(map, val);
566
567 map = mmap(NULL, page, PROT_EXEC|PROT_READ|PROT_WRITE, flags, -1, 0);
568 map_check(map, val);
569 }
570
571 ATF_TP_ADD_TCS(tp)
572 {
573 page = sysconf(_SC_PAGESIZE);
574 ATF_REQUIRE(page >= 0);
575
576 ATF_TP_ADD_TC(tp, mmap_block);
577 ATF_TP_ADD_TC(tp, mmap_err);
578 ATF_TP_ADD_TC(tp, mmap_loan);
579 ATF_TP_ADD_TC(tp, mmap_prot_1);
580 ATF_TP_ADD_TC(tp, mmap_prot_2);
581 ATF_TP_ADD_TC(tp, mmap_prot_3);
582 ATF_TP_ADD_TC(tp, mmap_truncate);
583 ATF_TP_ADD_TC(tp, mmap_truncate_signal);
584 #ifndef __OpenBSD__
585 /* sysctl vm.user_va0_disable not available */
586 ATF_TP_ADD_TC(tp, mmap_va0);
587 #endif
588
589 return atf_no_error();
590 }
591