1 /* $NetBSD: t_bpf.c,v 1.2 2011/01/03 02:53:15 christos Exp $ */ 2 3 /*- 4 * Copyright (c) 2010 Antti Kantee. All Rights Reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS 16 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 17 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 18 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 21 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 */ 27 28 #include <sys/param.h> 29 #include <sys/ioctl.h> 30 #include <sys/socket.h> 31 #include <sys/mbuf.h> 32 #include <sys/sysctl.h> 33 #include <sys/mman.h> 34 #include <unistd.h> 35 36 #include <net/if.h> 37 #include <net/bpf.h> 38 39 #include <fcntl.h> 40 #include <stdio.h> 41 #include <string.h> 42 43 #include <rump/rump.h> 44 #include <rump/rump_syscalls.h> 45 46 /* XXX: atf-c.h has collisions with mbuf */ 47 #undef m_type 48 #undef m_data 49 #include <atf-c.h> 50 51 #include "../../h_macros.h" 52 #include "../config/netconfig.c" 53 54 ATF_TC(bpfwriteleak); 55 ATF_TC_HEAD(bpfwriteleak, tc) 56 { 57 58 atf_tc_set_md_var(tc, "descr", "Checks that writing to /dev/bpf " 59 "does not leak mbufs"); 60 } 61 62 static int 63 getmtdata(void) 64 { 65 struct mbstat mbstat; 66 size_t mbstatlen = sizeof(mbstat); 67 const int mbstat_mib[] = { CTL_KERN, KERN_MBUF, MBUF_STATS }; 68 69 RL(rump_sys___sysctl(mbstat_mib, __arraycount(mbstat_mib), 70 &mbstat, &mbstatlen, NULL, 0)); 71 return mbstat.m_mtypes[MT_DATA]; 72 } 73 74 ATF_TC_BODY(bpfwriteleak, tc) 75 { 76 char buf[28]; /* sizeof(garbage) > etherhdrlen */ 77 struct ifreq ifr; 78 int ifnum, bpfd; 79 u_int x; 80 81 RZ(rump_init()); 82 RZ(rump_pub_shmif_create(NULL, &ifnum)); 83 sprintf(ifr.ifr_name, "shmif%d", ifnum); 84 85 RL(bpfd = rump_sys_open("/dev/bpf", O_RDWR)); 86 RL(rump_sys_ioctl(bpfd, BIOCSETIF, &ifr)); 87 x = 1; 88 RL(rump_sys_ioctl(bpfd, BIOCSFEEDBACK, &ifr)); 89 90 if (getmtdata() != 0) 91 atf_tc_fail("test precondition failed: MT_DATA mbufs != 0"); 92 93 ATF_REQUIRE_ERRNO(ENETDOWN, rump_sys_write(bpfd, buf, sizeof(buf))==-1); 94 95 atf_tc_expect_fail("PR kern/44196"); 96 ATF_REQUIRE_EQ(getmtdata(), 0); 97 } 98 99 #if (SIZE_MAX > UINT_MAX) 100 ATF_TC(bpfwritetrunc); 101 ATF_TC_HEAD(bpfwritetrunc, tc) 102 { 103 atf_tc_set_md_var(tc, "descr", "Checks that write to /dev/bpf " 104 "does not truncate size_t to int"); 105 } 106 107 ATF_TC_BODY(bpfwritetrunc, tc) 108 { 109 int bpfd; 110 struct ifreq ifr; 111 struct iovec *iov; 112 size_t iovlen, sz; 113 const size_t extra_bytes = 28; 114 const size_t total = extra_bytes + UINT_MAX + 1; 115 long iov_max, vm_page_size; /* round_page wants vm_page_size variable */ 116 117 memset(&ifr, 0, sizeof(ifr)); 118 119 iov_max = sysconf(_SC_IOV_MAX); 120 vm_page_size = sysconf(_SC_PAGE_SIZE); 121 ATF_REQUIRE(iov_max > 1 && vm_page_size > 1); 122 123 /* Minimize memory consumption by using many iovecs 124 * all pointing to one memory region */ 125 iov = calloc(iov_max, sizeof(struct iovec)); 126 ATF_REQUIRE(iov != NULL); 127 128 sz = round_page((total + (iov_max - 1)) / iov_max); 129 130 iov[0].iov_len = sz; 131 iov[0].iov_base = mmap(NULL, sz, PROT_READ, MAP_ANON, -1, 0); 132 ATF_REQUIRE(iov[0].iov_base != MAP_FAILED); 133 134 iovlen = 1; 135 while(sz + iov[0].iov_len <= total) 136 { 137 iov[iovlen].iov_len = iov[0].iov_len; 138 iov[iovlen].iov_base = iov[0].iov_base; 139 sz += iov[0].iov_len; 140 iovlen++; 141 } 142 143 if(sz < total) 144 { 145 iov[iovlen].iov_len = total - sz; 146 iov[iovlen].iov_base = iov[0].iov_base; 147 iovlen++; 148 } 149 150 /* Sanity checks */ 151 ATF_REQUIRE(iovlen >= 1 && iovlen <= (size_t)iov_max); 152 ATF_REQUIRE_EQ(iov[iovlen-1].iov_len, total % iov[0].iov_len); 153 154 RZ(rump_init()); 155 netcfg_rump_makeshmif("bpfwritetrunc", ifr.ifr_name); 156 netcfg_rump_if(ifr.ifr_name, "10.1.1.1", "255.0.0.0"); 157 158 RL(bpfd = rump_sys_open("/dev/bpf", O_RDWR)); 159 RL(rump_sys_ioctl(bpfd, BIOCSETIF, &ifr)); 160 161 ATF_CHECK_ERRNO(EMSGSIZE, rump_sys_writev(bpfd, iov, iovlen) == -1); 162 163 munmap(iov[0].iov_base, iov[0].iov_len); 164 free(iov); 165 } 166 #endif /* #if (SIZE_MAX > UINT_MAX) */ 167 168 ATF_TP_ADD_TCS(tp) 169 { 170 171 ATF_TP_ADD_TC(tp, bpfwriteleak); 172 #if (SIZE_MAX > UINT_MAX) 173 ATF_TP_ADD_TC(tp, bpfwritetrunc); 174 #endif 175 return atf_no_error(); 176 } 177