1 /* $NetBSD: t_mmap.c,v 1.2 2011/07/14 11:08:45 jruoho Exp $ */ 2 3 /*- 4 * Copyright (c) 2011 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Jukka Ruohonen. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /*- 33 * Copyright (c)2004 YAMAMOTO Takashi, 34 * All rights reserved. 35 * 36 * Redistribution and use in source and binary forms, with or without 37 * modification, are permitted provided that the following conditions 38 * are met: 39 * 1. Redistributions of source code must retain the above copyright 40 * notice, this list of conditions and the following disclaimer. 41 * 2. Redistributions in binary form must reproduce the above copyright 42 * notice, this list of conditions and the following disclaimer in the 43 * documentation and/or other materials provided with the distribution. 44 * 45 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 46 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 47 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 48 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 49 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 50 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 51 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 52 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 53 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 54 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 55 * SUCH DAMAGE. 56 */ 57 #include <sys/cdefs.h> 58 __RCSID("$NetBSD: t_mmap.c,v 1.2 2011/07/14 11:08:45 jruoho Exp $"); 59 60 #include <sys/param.h> 61 #include <sys/mman.h> 62 #include <sys/socket.h> 63 #include <sys/sysctl.h> 64 #include <sys/wait.h> 65 66 #include <atf-c.h> 67 #include <errno.h> 68 #include <fcntl.h> 69 #include <signal.h> 70 #include <stdlib.h> 71 #include <string.h> 72 #include <unistd.h> 73 74 static long page = 0; 75 static char path[] = "mmap"; 76 static void map_check(void *, int); 77 static void map_sighandler(int); 78 static void testloan(void *, void *, char, int); 79 80 #define BUFSIZE (32 * 1024) /* enough size to trigger sosend_loan */ 81 82 static void 83 map_check(void *map, int flag) 84 { 85 86 if (flag != 0) { 87 ATF_REQUIRE(map == MAP_FAILED); 88 return; 89 } 90 91 ATF_REQUIRE(map != MAP_FAILED); 92 ATF_REQUIRE(munmap(map, page) == 0); 93 } 94 95 void 96 testloan(void *vp, void *vp2, char pat, int docheck) 97 { 98 char buf[BUFSIZE]; 99 char backup[BUFSIZE]; 100 ssize_t nwritten; 101 ssize_t nread; 102 int fds[2]; 103 int val; 104 105 val = BUFSIZE; 106 107 if (docheck != 0) 108 (void)memcpy(backup, vp, BUFSIZE); 109 110 if (socketpair(AF_LOCAL, SOCK_STREAM, PF_UNSPEC, fds) != 0) 111 atf_tc_fail("socketpair() failed"); 112 113 val = BUFSIZE; 114 115 if (setsockopt(fds[1], SOL_SOCKET, SO_RCVBUF, &val, sizeof(val)) != 0) 116 atf_tc_fail("setsockopt() failed, SO_RCVBUF"); 117 118 val = BUFSIZE; 119 120 if (setsockopt(fds[0], SOL_SOCKET, SO_SNDBUF, &val, sizeof(val)) != 0) 121 atf_tc_fail("setsockopt() failed, SO_SNDBUF"); 122 123 if (fcntl(fds[0], F_SETFL, O_NONBLOCK) != 0) 124 atf_tc_fail("fcntl() failed"); 125 126 nwritten = write(fds[0], (char *)vp + page, BUFSIZE - page); 127 128 if (nwritten == -1) 129 atf_tc_fail("write() failed"); 130 131 /* Break loan. */ 132 (void)memset(vp2, pat, BUFSIZE); 133 134 nread = read(fds[1], buf + page, BUFSIZE - page); 135 136 if (nread == -1) 137 atf_tc_fail("read() failed"); 138 139 if (nread != nwritten) 140 atf_tc_fail("too short read"); 141 142 if (docheck != 0 && memcmp(backup, buf + page, nread) != 0) 143 atf_tc_fail("data mismatch"); 144 145 ATF_REQUIRE(close(fds[0]) == 0); 146 ATF_REQUIRE(close(fds[1]) == 0); 147 } 148 149 static void 150 map_sighandler(int signo) 151 { 152 _exit(signo); 153 } 154 155 ATF_TC(mmap_err); 156 ATF_TC_HEAD(mmap_err, tc) 157 { 158 atf_tc_set_md_var(tc, "descr", "Test error conditions of mmap(2)"); 159 } 160 161 ATF_TC_BODY(mmap_err, tc) 162 { 163 size_t addr = SIZE_MAX; 164 void *map; 165 166 errno = 0; 167 map = mmap(NULL, 3, PROT_READ, MAP_FILE|MAP_PRIVATE, -1, 0); 168 169 ATF_REQUIRE(map == MAP_FAILED); 170 ATF_REQUIRE(errno == EBADF); 171 172 errno = 0; 173 map = mmap(&addr, page, PROT_READ, MAP_FIXED|MAP_PRIVATE, -1, 0); 174 175 ATF_REQUIRE(map == MAP_FAILED); 176 ATF_REQUIRE(errno == EINVAL); 177 178 errno = 0; 179 map = mmap(NULL, page, PROT_READ, MAP_ANON|MAP_PRIVATE, INT_MAX, 0); 180 181 ATF_REQUIRE(map == MAP_FAILED); 182 ATF_REQUIRE(errno == EINVAL); 183 } 184 185 ATF_TC_WITH_CLEANUP(mmap_loan); 186 ATF_TC_HEAD(mmap_loan, tc) 187 { 188 atf_tc_set_md_var(tc, "descr", "Test uvm page loanout with mmap(2)"); 189 } 190 191 ATF_TC_BODY(mmap_loan, tc) 192 { 193 char buf[BUFSIZE]; 194 char *vp, *vp2; 195 int fd; 196 197 fd = open(path, O_RDWR | O_CREAT, 0600); 198 ATF_REQUIRE(fd >= 0); 199 200 (void)memset(buf, 'x', sizeof(buf)); 201 (void)write(fd, buf, sizeof(buf)); 202 203 vp = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE, 204 MAP_FILE | MAP_PRIVATE, fd, 0); 205 206 ATF_REQUIRE(vp != MAP_FAILED); 207 208 vp2 = vp; 209 210 testloan(vp, vp2, 'A', 0); 211 testloan(vp, vp2, 'B', 1); 212 213 ATF_REQUIRE(munmap(vp, BUFSIZE) == 0); 214 215 vp = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE, 216 MAP_FILE | MAP_SHARED, fd, 0); 217 218 vp2 = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE, 219 MAP_FILE | MAP_SHARED, fd, 0); 220 221 ATF_REQUIRE(vp != MAP_FAILED); 222 ATF_REQUIRE(vp2 != MAP_FAILED); 223 224 testloan(vp, vp2, 'E', 1); 225 226 ATF_REQUIRE(munmap(vp, BUFSIZE) == 0); 227 ATF_REQUIRE(munmap(vp2, BUFSIZE) == 0); 228 } 229 230 ATF_TC_CLEANUP(mmap_loan, tc) 231 { 232 (void)unlink(path); 233 } 234 235 ATF_TC_WITH_CLEANUP(mmap_prot_1); 236 ATF_TC_HEAD(mmap_prot_1, tc) 237 { 238 atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #1"); 239 } 240 241 ATF_TC_BODY(mmap_prot_1, tc) 242 { 243 void *map; 244 int fd; 245 246 /* 247 * Open a file write-only and try to 248 * map it read-only. This should fail. 249 */ 250 fd = open(path, O_WRONLY | O_CREAT, 0700); 251 252 if (fd < 0) 253 return; 254 255 ATF_REQUIRE(write(fd, "XXX", 3) == 3); 256 257 map = mmap(NULL, 3, PROT_READ, MAP_FILE|MAP_PRIVATE, fd, 0); 258 map_check(map, 1); 259 260 map = mmap(NULL, 3, PROT_WRITE, MAP_FILE|MAP_PRIVATE, fd, 0); 261 map_check(map, 0); 262 263 ATF_REQUIRE(close(fd) == 0); 264 } 265 266 ATF_TC_CLEANUP(mmap_prot_1, tc) 267 { 268 (void)unlink(path); 269 } 270 271 ATF_TC(mmap_prot_2); 272 ATF_TC_HEAD(mmap_prot_2, tc) 273 { 274 atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #2"); 275 } 276 277 ATF_TC_BODY(mmap_prot_2, tc) 278 { 279 char buf[2]; 280 void *map; 281 pid_t pid; 282 int sta; 283 284 /* 285 * Make a PROT_NONE mapping and try to access it. 286 * If we catch a SIGSEGV, all works as expected. 287 */ 288 map = mmap(NULL, page, PROT_NONE, MAP_ANON|MAP_PRIVATE, -1, 0); 289 ATF_REQUIRE(map != MAP_FAILED); 290 291 pid = fork(); 292 ATF_REQUIRE(pid >= 0); 293 294 if (pid == 0) { 295 ATF_REQUIRE(signal(SIGSEGV, map_sighandler) != SIG_ERR); 296 ATF_REQUIRE(strlcpy(buf, map, sizeof(buf)) != 0); 297 } 298 299 (void)wait(&sta); 300 301 ATF_REQUIRE(WIFEXITED(sta) != 0); 302 ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV); 303 ATF_REQUIRE(munmap(map, page) == 0); 304 } 305 306 ATF_TC_WITH_CLEANUP(mmap_prot_3); 307 ATF_TC_HEAD(mmap_prot_3, tc) 308 { 309 atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #3"); 310 } 311 312 ATF_TC_BODY(mmap_prot_3, tc) 313 { 314 char buf[2]; 315 int fd, sta; 316 void *map; 317 pid_t pid; 318 319 /* 320 * Open a file, change the permissions 321 * to read-only, and try to map it as 322 * PROT_NONE. This should succeed, but 323 * the access should generate SIGSEGV. 324 */ 325 fd = open(path, O_RDWR | O_CREAT, 0700); 326 327 if (fd < 0) 328 return; 329 330 ATF_REQUIRE(write(fd, "XXX", 3) == 3); 331 ATF_REQUIRE(close(fd) == 0); 332 ATF_REQUIRE(chmod(path, 0444) == 0); 333 334 fd = open(path, O_RDONLY); 335 ATF_REQUIRE(fd != -1); 336 337 map = mmap(NULL, 3, PROT_NONE, MAP_FILE | MAP_SHARED, fd, 0); 338 ATF_REQUIRE(map != MAP_FAILED); 339 340 pid = fork(); 341 342 ATF_REQUIRE(pid >= 0); 343 344 if (pid == 0) { 345 ATF_REQUIRE(signal(SIGSEGV, map_sighandler) != SIG_ERR); 346 ATF_REQUIRE(strlcpy(buf, map, sizeof(buf)) != 0); 347 } 348 349 (void)wait(&sta); 350 351 ATF_REQUIRE(WIFEXITED(sta) != 0); 352 ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV); 353 ATF_REQUIRE(munmap(map, 3) == 0); 354 } 355 356 ATF_TC_CLEANUP(mmap_prot_3, tc) 357 { 358 (void)unlink(path); 359 } 360 361 ATF_TC_WITH_CLEANUP(mmap_truncate); 362 ATF_TC_HEAD(mmap_truncate, tc) 363 { 364 atf_tc_set_md_var(tc, "descr", "Test mmap(2) and ftruncate(2)"); 365 } 366 367 ATF_TC_BODY(mmap_truncate, tc) 368 { 369 char *map; 370 long i; 371 int fd; 372 373 fd = open(path, O_RDWR | O_CREAT, 0700); 374 375 if (fd < 0) 376 return; 377 378 /* 379 * See that ftruncate(2) works 380 * while the file is mapped. 381 */ 382 ATF_REQUIRE(ftruncate(fd, page) == 0); 383 384 map = mmap(NULL, page, PROT_READ | PROT_WRITE, MAP_FILE|MAP_PRIVATE, 385 fd, 0); 386 ATF_REQUIRE(map != MAP_FAILED); 387 388 for (i = 0; i < page; i++) 389 map[i] = 'x'; 390 391 ATF_REQUIRE(ftruncate(fd, 0) == 0); 392 ATF_REQUIRE(ftruncate(fd, page / 8) == 0); 393 ATF_REQUIRE(ftruncate(fd, page / 4) == 0); 394 ATF_REQUIRE(ftruncate(fd, page / 2) == 0); 395 ATF_REQUIRE(ftruncate(fd, page / 12) == 0); 396 ATF_REQUIRE(ftruncate(fd, page / 64) == 0); 397 398 ATF_REQUIRE(close(fd) == 0); 399 } 400 401 ATF_TC_CLEANUP(mmap_truncate, tc) 402 { 403 (void)unlink(path); 404 } 405 406 ATF_TC(mmap_va0); 407 ATF_TC_HEAD(mmap_va0, tc) 408 { 409 atf_tc_set_md_var(tc, "descr", "Test mmap(2) and vm.user_va0_disable"); 410 } 411 412 ATF_TC_BODY(mmap_va0, tc) 413 { 414 int flags = MAP_ANON | MAP_FIXED | MAP_PRIVATE; 415 size_t len = sizeof(int); 416 void *map; 417 int val; 418 419 /* 420 * Make an anonymous fixed mapping at zero address. If the address 421 * is restricted as noted in security(7), the syscall should fail. 422 */ 423 if (sysctlbyname("vm.user_va0_disable", &val, &len, NULL, 0) != 0) 424 atf_tc_fail("failed to read vm.user_va0_disable"); 425 426 map = mmap(NULL, page, PROT_EXEC, flags, -1, 0); 427 map_check(map, val); 428 429 map = mmap(NULL, page, PROT_READ, flags, -1, 0); 430 map_check(map, val); 431 432 map = mmap(NULL, page, PROT_WRITE, flags, -1, 0); 433 map_check(map, val); 434 435 map = mmap(NULL, page, PROT_READ|PROT_WRITE, flags, -1, 0); 436 map_check(map, val); 437 438 map = mmap(NULL, page, PROT_EXEC|PROT_READ|PROT_WRITE, flags, -1, 0); 439 map_check(map, val); 440 } 441 442 ATF_TP_ADD_TCS(tp) 443 { 444 page = sysconf(_SC_PAGESIZE); 445 ATF_REQUIRE(page >= 0); 446 447 ATF_TP_ADD_TC(tp, mmap_err); 448 ATF_TP_ADD_TC(tp, mmap_loan); 449 ATF_TP_ADD_TC(tp, mmap_prot_1); 450 ATF_TP_ADD_TC(tp, mmap_prot_2); 451 ATF_TP_ADD_TC(tp, mmap_prot_3); 452 ATF_TP_ADD_TC(tp, mmap_truncate); 453 ATF_TP_ADD_TC(tp, mmap_va0); 454 455 return atf_no_error(); 456 } 457