1 /* $NetBSD: t_mmap.c,v 1.3 2012/03/06 11:02:55 jruoho Exp $ */ 2 3 /*- 4 * Copyright (c) 2011 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Jukka Ruohonen. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /*- 33 * Copyright (c)2004 YAMAMOTO Takashi, 34 * All rights reserved. 35 * 36 * Redistribution and use in source and binary forms, with or without 37 * modification, are permitted provided that the following conditions 38 * are met: 39 * 1. Redistributions of source code must retain the above copyright 40 * notice, this list of conditions and the following disclaimer. 41 * 2. Redistributions in binary form must reproduce the above copyright 42 * notice, this list of conditions and the following disclaimer in the 43 * documentation and/or other materials provided with the distribution. 44 * 45 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 46 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 47 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 48 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 49 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 50 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 51 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 52 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 53 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 54 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 55 * SUCH DAMAGE. 56 */ 57 #include <sys/cdefs.h> 58 __RCSID("$NetBSD: t_mmap.c,v 1.3 2012/03/06 11:02:55 jruoho Exp $"); 59 60 #include <sys/param.h> 61 #include <sys/mman.h> 62 #include <sys/socket.h> 63 #include <sys/sysctl.h> 64 #include <sys/wait.h> 65 66 #include <atf-c.h> 67 #include <errno.h> 68 #include <fcntl.h> 69 #include <signal.h> 70 #include <stdio.h> 71 #include <stdlib.h> 72 #include <string.h> 73 #include <unistd.h> 74 75 static long page = 0; 76 static char path[] = "mmap"; 77 static void map_check(void *, int); 78 static void map_sighandler(int); 79 static void testloan(void *, void *, char, int); 80 81 #define BUFSIZE (32 * 1024) /* enough size to trigger sosend_loan */ 82 83 static void 84 map_check(void *map, int flag) 85 { 86 87 if (flag != 0) { 88 ATF_REQUIRE(map == MAP_FAILED); 89 return; 90 } 91 92 ATF_REQUIRE(map != MAP_FAILED); 93 ATF_REQUIRE(munmap(map, page) == 0); 94 } 95 96 void 97 testloan(void *vp, void *vp2, char pat, int docheck) 98 { 99 char buf[BUFSIZE]; 100 char backup[BUFSIZE]; 101 ssize_t nwritten; 102 ssize_t nread; 103 int fds[2]; 104 int val; 105 106 val = BUFSIZE; 107 108 if (docheck != 0) 109 (void)memcpy(backup, vp, BUFSIZE); 110 111 if (socketpair(AF_LOCAL, SOCK_STREAM, PF_UNSPEC, fds) != 0) 112 atf_tc_fail("socketpair() failed"); 113 114 val = BUFSIZE; 115 116 if (setsockopt(fds[1], SOL_SOCKET, SO_RCVBUF, &val, sizeof(val)) != 0) 117 atf_tc_fail("setsockopt() failed, SO_RCVBUF"); 118 119 val = BUFSIZE; 120 121 if (setsockopt(fds[0], SOL_SOCKET, SO_SNDBUF, &val, sizeof(val)) != 0) 122 atf_tc_fail("setsockopt() failed, SO_SNDBUF"); 123 124 if (fcntl(fds[0], F_SETFL, O_NONBLOCK) != 0) 125 atf_tc_fail("fcntl() failed"); 126 127 nwritten = write(fds[0], (char *)vp + page, BUFSIZE - page); 128 129 if (nwritten == -1) 130 atf_tc_fail("write() failed"); 131 132 /* Break loan. */ 133 (void)memset(vp2, pat, BUFSIZE); 134 135 nread = read(fds[1], buf + page, BUFSIZE - page); 136 137 if (nread == -1) 138 atf_tc_fail("read() failed"); 139 140 if (nread != nwritten) 141 atf_tc_fail("too short read"); 142 143 if (docheck != 0 && memcmp(backup, buf + page, nread) != 0) 144 atf_tc_fail("data mismatch"); 145 146 ATF_REQUIRE(close(fds[0]) == 0); 147 ATF_REQUIRE(close(fds[1]) == 0); 148 } 149 150 static void 151 map_sighandler(int signo) 152 { 153 _exit(signo); 154 } 155 156 ATF_TC(mmap_block); 157 ATF_TC_HEAD(mmap_block, tc) 158 { 159 atf_tc_set_md_var(tc, "descr", "Test mmap(2) with a block device"); 160 } 161 162 ATF_TC_BODY(mmap_block, tc) 163 { 164 static const char *dev[] = { "/dev/wd0c", "/dev/wd0d", "/dev/wd0g" }; 165 char *map; 166 size_t i; 167 int fd; 168 169 atf_tc_skip("The test case causes a panic (PR kern/38889)"); 170 171 for (i = 0; i < __arraycount(dev); i++) { 172 173 if ((fd = open(dev[i], O_RDONLY)) >= 0) { 174 (void)fprintf(stderr, "using %s\n", dev[i]); 175 break; 176 } 177 } 178 179 if (i == __arraycount(dev)) /* Skip. */ 180 return; 181 182 map = mmap(NULL, 4096, PROT_READ, MAP_FILE, fd, 0); 183 ATF_REQUIRE(map != MAP_FAILED); 184 185 (void)fprintf(stderr, "first byte %x\n", *map); 186 ATF_REQUIRE(close(fd) == 0); 187 (void)fprintf(stderr, "first byte %x\n", *map); 188 189 ATF_REQUIRE(munmap(map, 4096) == 0); 190 } 191 192 ATF_TC(mmap_err); 193 ATF_TC_HEAD(mmap_err, tc) 194 { 195 atf_tc_set_md_var(tc, "descr", "Test error conditions of mmap(2)"); 196 } 197 198 ATF_TC_BODY(mmap_err, tc) 199 { 200 size_t addr = SIZE_MAX; 201 void *map; 202 203 errno = 0; 204 map = mmap(NULL, 3, PROT_READ, MAP_FILE|MAP_PRIVATE, -1, 0); 205 206 ATF_REQUIRE(map == MAP_FAILED); 207 ATF_REQUIRE(errno == EBADF); 208 209 errno = 0; 210 map = mmap(&addr, page, PROT_READ, MAP_FIXED|MAP_PRIVATE, -1, 0); 211 212 ATF_REQUIRE(map == MAP_FAILED); 213 ATF_REQUIRE(errno == EINVAL); 214 215 errno = 0; 216 map = mmap(NULL, page, PROT_READ, MAP_ANON|MAP_PRIVATE, INT_MAX, 0); 217 218 ATF_REQUIRE(map == MAP_FAILED); 219 ATF_REQUIRE(errno == EINVAL); 220 } 221 222 ATF_TC_WITH_CLEANUP(mmap_loan); 223 ATF_TC_HEAD(mmap_loan, tc) 224 { 225 atf_tc_set_md_var(tc, "descr", "Test uvm page loanout with mmap(2)"); 226 } 227 228 ATF_TC_BODY(mmap_loan, tc) 229 { 230 char buf[BUFSIZE]; 231 char *vp, *vp2; 232 int fd; 233 234 fd = open(path, O_RDWR | O_CREAT, 0600); 235 ATF_REQUIRE(fd >= 0); 236 237 (void)memset(buf, 'x', sizeof(buf)); 238 (void)write(fd, buf, sizeof(buf)); 239 240 vp = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE, 241 MAP_FILE | MAP_PRIVATE, fd, 0); 242 243 ATF_REQUIRE(vp != MAP_FAILED); 244 245 vp2 = vp; 246 247 testloan(vp, vp2, 'A', 0); 248 testloan(vp, vp2, 'B', 1); 249 250 ATF_REQUIRE(munmap(vp, BUFSIZE) == 0); 251 252 vp = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE, 253 MAP_FILE | MAP_SHARED, fd, 0); 254 255 vp2 = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE, 256 MAP_FILE | MAP_SHARED, fd, 0); 257 258 ATF_REQUIRE(vp != MAP_FAILED); 259 ATF_REQUIRE(vp2 != MAP_FAILED); 260 261 testloan(vp, vp2, 'E', 1); 262 263 ATF_REQUIRE(munmap(vp, BUFSIZE) == 0); 264 ATF_REQUIRE(munmap(vp2, BUFSIZE) == 0); 265 } 266 267 ATF_TC_CLEANUP(mmap_loan, tc) 268 { 269 (void)unlink(path); 270 } 271 272 ATF_TC_WITH_CLEANUP(mmap_prot_1); 273 ATF_TC_HEAD(mmap_prot_1, tc) 274 { 275 atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #1"); 276 } 277 278 ATF_TC_BODY(mmap_prot_1, tc) 279 { 280 void *map; 281 int fd; 282 283 /* 284 * Open a file write-only and try to 285 * map it read-only. This should fail. 286 */ 287 fd = open(path, O_WRONLY | O_CREAT, 0700); 288 289 if (fd < 0) 290 return; 291 292 ATF_REQUIRE(write(fd, "XXX", 3) == 3); 293 294 map = mmap(NULL, 3, PROT_READ, MAP_FILE|MAP_PRIVATE, fd, 0); 295 map_check(map, 1); 296 297 map = mmap(NULL, 3, PROT_WRITE, MAP_FILE|MAP_PRIVATE, fd, 0); 298 map_check(map, 0); 299 300 ATF_REQUIRE(close(fd) == 0); 301 } 302 303 ATF_TC_CLEANUP(mmap_prot_1, tc) 304 { 305 (void)unlink(path); 306 } 307 308 ATF_TC(mmap_prot_2); 309 ATF_TC_HEAD(mmap_prot_2, tc) 310 { 311 atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #2"); 312 } 313 314 ATF_TC_BODY(mmap_prot_2, tc) 315 { 316 char buf[2]; 317 void *map; 318 pid_t pid; 319 int sta; 320 321 /* 322 * Make a PROT_NONE mapping and try to access it. 323 * If we catch a SIGSEGV, all works as expected. 324 */ 325 map = mmap(NULL, page, PROT_NONE, MAP_ANON|MAP_PRIVATE, -1, 0); 326 ATF_REQUIRE(map != MAP_FAILED); 327 328 pid = fork(); 329 ATF_REQUIRE(pid >= 0); 330 331 if (pid == 0) { 332 ATF_REQUIRE(signal(SIGSEGV, map_sighandler) != SIG_ERR); 333 ATF_REQUIRE(strlcpy(buf, map, sizeof(buf)) != 0); 334 } 335 336 (void)wait(&sta); 337 338 ATF_REQUIRE(WIFEXITED(sta) != 0); 339 ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV); 340 ATF_REQUIRE(munmap(map, page) == 0); 341 } 342 343 ATF_TC_WITH_CLEANUP(mmap_prot_3); 344 ATF_TC_HEAD(mmap_prot_3, tc) 345 { 346 atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #3"); 347 } 348 349 ATF_TC_BODY(mmap_prot_3, tc) 350 { 351 char buf[2]; 352 int fd, sta; 353 void *map; 354 pid_t pid; 355 356 /* 357 * Open a file, change the permissions 358 * to read-only, and try to map it as 359 * PROT_NONE. This should succeed, but 360 * the access should generate SIGSEGV. 361 */ 362 fd = open(path, O_RDWR | O_CREAT, 0700); 363 364 if (fd < 0) 365 return; 366 367 ATF_REQUIRE(write(fd, "XXX", 3) == 3); 368 ATF_REQUIRE(close(fd) == 0); 369 ATF_REQUIRE(chmod(path, 0444) == 0); 370 371 fd = open(path, O_RDONLY); 372 ATF_REQUIRE(fd != -1); 373 374 map = mmap(NULL, 3, PROT_NONE, MAP_FILE | MAP_SHARED, fd, 0); 375 ATF_REQUIRE(map != MAP_FAILED); 376 377 pid = fork(); 378 379 ATF_REQUIRE(pid >= 0); 380 381 if (pid == 0) { 382 ATF_REQUIRE(signal(SIGSEGV, map_sighandler) != SIG_ERR); 383 ATF_REQUIRE(strlcpy(buf, map, sizeof(buf)) != 0); 384 } 385 386 (void)wait(&sta); 387 388 ATF_REQUIRE(WIFEXITED(sta) != 0); 389 ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV); 390 ATF_REQUIRE(munmap(map, 3) == 0); 391 } 392 393 ATF_TC_CLEANUP(mmap_prot_3, tc) 394 { 395 (void)unlink(path); 396 } 397 398 ATF_TC_WITH_CLEANUP(mmap_truncate); 399 ATF_TC_HEAD(mmap_truncate, tc) 400 { 401 atf_tc_set_md_var(tc, "descr", "Test mmap(2) and ftruncate(2)"); 402 } 403 404 ATF_TC_BODY(mmap_truncate, tc) 405 { 406 char *map; 407 long i; 408 int fd; 409 410 fd = open(path, O_RDWR | O_CREAT, 0700); 411 412 if (fd < 0) 413 return; 414 415 /* 416 * See that ftruncate(2) works 417 * while the file is mapped. 418 */ 419 ATF_REQUIRE(ftruncate(fd, page) == 0); 420 421 map = mmap(NULL, page, PROT_READ | PROT_WRITE, MAP_FILE|MAP_PRIVATE, 422 fd, 0); 423 ATF_REQUIRE(map != MAP_FAILED); 424 425 for (i = 0; i < page; i++) 426 map[i] = 'x'; 427 428 ATF_REQUIRE(ftruncate(fd, 0) == 0); 429 ATF_REQUIRE(ftruncate(fd, page / 8) == 0); 430 ATF_REQUIRE(ftruncate(fd, page / 4) == 0); 431 ATF_REQUIRE(ftruncate(fd, page / 2) == 0); 432 ATF_REQUIRE(ftruncate(fd, page / 12) == 0); 433 ATF_REQUIRE(ftruncate(fd, page / 64) == 0); 434 435 ATF_REQUIRE(close(fd) == 0); 436 } 437 438 ATF_TC_CLEANUP(mmap_truncate, tc) 439 { 440 (void)unlink(path); 441 } 442 443 ATF_TC(mmap_va0); 444 ATF_TC_HEAD(mmap_va0, tc) 445 { 446 atf_tc_set_md_var(tc, "descr", "Test mmap(2) and vm.user_va0_disable"); 447 } 448 449 ATF_TC_BODY(mmap_va0, tc) 450 { 451 int flags = MAP_ANON | MAP_FIXED | MAP_PRIVATE; 452 size_t len = sizeof(int); 453 void *map; 454 int val; 455 456 /* 457 * Make an anonymous fixed mapping at zero address. If the address 458 * is restricted as noted in security(7), the syscall should fail. 459 */ 460 if (sysctlbyname("vm.user_va0_disable", &val, &len, NULL, 0) != 0) 461 atf_tc_fail("failed to read vm.user_va0_disable"); 462 463 map = mmap(NULL, page, PROT_EXEC, flags, -1, 0); 464 map_check(map, val); 465 466 map = mmap(NULL, page, PROT_READ, flags, -1, 0); 467 map_check(map, val); 468 469 map = mmap(NULL, page, PROT_WRITE, flags, -1, 0); 470 map_check(map, val); 471 472 map = mmap(NULL, page, PROT_READ|PROT_WRITE, flags, -1, 0); 473 map_check(map, val); 474 475 map = mmap(NULL, page, PROT_EXEC|PROT_READ|PROT_WRITE, flags, -1, 0); 476 map_check(map, val); 477 } 478 479 ATF_TP_ADD_TCS(tp) 480 { 481 page = sysconf(_SC_PAGESIZE); 482 ATF_REQUIRE(page >= 0); 483 484 ATF_TP_ADD_TC(tp, mmap_block); 485 ATF_TP_ADD_TC(tp, mmap_err); 486 ATF_TP_ADD_TC(tp, mmap_loan); 487 ATF_TP_ADD_TC(tp, mmap_prot_1); 488 ATF_TP_ADD_TC(tp, mmap_prot_2); 489 ATF_TP_ADD_TC(tp, mmap_prot_3); 490 ATF_TP_ADD_TC(tp, mmap_truncate); 491 ATF_TP_ADD_TC(tp, mmap_va0); 492 493 return atf_no_error(); 494 } 495