1/* $OpenBSD: t_mmap.c,v 1.4 2021/12/13 16:56:48 deraadt Exp $ */ 2/* $NetBSD: t_mmap.c,v 1.14 2020/06/26 07:50:11 jruoho Exp $ */ 3 4/*- 5 * Copyright (c) 2011 The NetBSD Foundation, Inc. 6 * All rights reserved. 7 * 8 * This code is derived from software contributed to The NetBSD Foundation 9 * by Jukka Ruohonen. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 21 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 24 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33/*- 34 * Copyright (c)2004 YAMAMOTO Takashi, 35 * All rights reserved. 36 * 37 * Redistribution and use in source and binary forms, with or without 38 * modification, are permitted provided that the following conditions 39 * are met: 40 * 1. Redistributions of source code must retain the above copyright 41 * notice, this list of conditions and the following disclaimer. 42 * 2. Redistributions in binary form must reproduce the above copyright 43 * notice, this list of conditions and the following disclaimer in the 44 * documentation and/or other materials provided with the distribution. 45 * 46 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 47 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 48 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 49 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 50 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 51 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 52 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 53 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 54 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 55 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 56 * SUCH DAMAGE. 57 */ 58 59#include "macros.h" 60 61#include <sys/disklabel.h> 62#include <sys/mman.h> 63#include <sys/stat.h> 64#include <sys/socket.h> 65#include <sys/sysctl.h> 66#include <sys/wait.h> 67 68#include "atf-c.h" 69#include <errno.h> 70#include <fcntl.h> 71#include <signal.h> 72#include <stdio.h> 73#include <stdlib.h> 74#include <limits.h> 75#include <string.h> 76#include <unistd.h> 77#include <paths.h> 78 79static long page = 0; 80static char path[] = "mmap"; 81static void map_check(void *, int); 82static void map_sighandler(int); 83static void testloan(void *, void *, char, int); 84 85#define BUFSIZE (32 * 1024) /* enough size to trigger sosend_loan */ 86 87static void 88map_check(void *map, int flag) 89{ 90 91 if (flag != 0) { 92 ATF_REQUIRE(map == MAP_FAILED); 93 return; 94 } 95 96 ATF_REQUIRE(map != MAP_FAILED); 97 ATF_REQUIRE(munmap(map, page) == 0); 98} 99 100void 101testloan(void *vp, void *vp2, char pat, int docheck) 102{ 103 char buf[BUFSIZE]; 104 char backup[BUFSIZE]; 105 ssize_t nwritten; 106 ssize_t nread; 107 int fds[2]; 108 int val; 109 110 val = BUFSIZE; 111 112 if (docheck != 0) 113 (void)memcpy(backup, vp, BUFSIZE); 114 115 if (socketpair(AF_LOCAL, SOCK_STREAM, PF_UNSPEC, fds) != 0) 116 atf_tc_fail("socketpair() failed"); 117 118 val = BUFSIZE; 119 120 if (setsockopt(fds[1], SOL_SOCKET, SO_RCVBUF, &val, sizeof(val)) != 0) 121 atf_tc_fail("setsockopt() failed, SO_RCVBUF"); 122 123 val = BUFSIZE; 124 125 if (setsockopt(fds[0], SOL_SOCKET, SO_SNDBUF, &val, sizeof(val)) != 0) 126 atf_tc_fail("setsockopt() failed, SO_SNDBUF"); 127 128 if (fcntl(fds[0], F_SETFL, O_NONBLOCK) != 0) 129 atf_tc_fail("fcntl() failed"); 130 131 nwritten = write(fds[0], (char *)vp + page, BUFSIZE - page); 132 133 if (nwritten == -1) 134 atf_tc_fail("write() failed"); 135 136 /* Break loan. */ 137 (void)memset(vp2, pat, BUFSIZE); 138 139 nread = read(fds[1], buf + page, BUFSIZE - page); 140 141 if (nread == -1) 142 atf_tc_fail("read() failed"); 143 144 if (nread != nwritten) 145 atf_tc_fail("too short read"); 146 147 if (docheck != 0 && memcmp(backup, buf + page, nread) != 0) 148 atf_tc_fail("data mismatch"); 149 150 ATF_REQUIRE(close(fds[0]) == 0); 151 ATF_REQUIRE(close(fds[1]) == 0); 152} 153 154static void 155map_sighandler(int signo) 156{ 157 _exit(signo); 158} 159 160ATF_TC(mmap_block); 161ATF_TC_HEAD(mmap_block, tc) 162{ 163 atf_tc_set_md_var(tc, "descr", "Test mmap(2) with a block device"); 164 atf_tc_set_md_var(tc, "require.user", "root"); 165} 166 167ATF_TC_BODY(mmap_block, tc) 168{ 169 static const int mib[] = { CTL_HW, HW_DISKNAMES }; 170 static const unsigned int miblen = __arraycount(mib); 171 char *map, *dk, *drives, dev[PATH_MAX]; 172 size_t len; 173 int fd = -1; 174 175#ifndef __OpenBSD__ 176 /* works for us */ 177 atf_tc_skip("The test case causes a panic " \ 178 "(PR kern/38889, PR kern/46592)"); 179#endif 180 181 ATF_REQUIRE(sysctl(mib, miblen, NULL, &len, NULL, 0) == 0); 182 drives = malloc(len); 183 ATF_REQUIRE(drives != NULL); 184 ATF_REQUIRE(sysctl(mib, miblen, drives, &len, NULL, 0) == 0); 185#ifdef __OpenBSD__ 186 /* devices separated by comma, disk uid by colon */ 187 for (dk = strtok(drives, ",:"); dk != NULL; dk = strtok(NULL, ",:")) { 188#else 189 for (dk = strtok(drives, " "); dk != NULL; dk = strtok(NULL, " ")) { 190#endif 191 if (strncmp(dk, "dk", 2) == 0) 192 snprintf(dev, sizeof(dev), _PATH_DEV "%s", dk); 193 else 194 snprintf(dev, sizeof(dev), _PATH_DEV "%s%c", dk, 195 'a' + RAW_PART); 196 fprintf(stderr, "trying: %s\n", dev); 197 198 if ((fd = open(dev, O_RDONLY)) >= 0) { 199 (void)fprintf(stderr, "using %s\n", dev); 200 break; 201 } else 202 (void)fprintf(stderr, "%s: %s\n", dev, strerror(errno)); 203 } 204 free(drives); 205 206 if (fd < 0) 207 atf_tc_skip("failed to find suitable block device"); 208 209 map = mmap(NULL, 4096, PROT_READ, MAP_FILE, fd, 0); 210 ATF_REQUIRE_MSG(map != MAP_FAILED, "mmap: %s", strerror(errno)); 211 212 (void)fprintf(stderr, "first byte %x\n", *map); 213 ATF_REQUIRE(close(fd) == 0); 214 (void)fprintf(stderr, "first byte %x\n", *map); 215 216 ATF_REQUIRE(munmap(map, 4096) == 0); 217} 218 219ATF_TC(mmap_err); 220ATF_TC_HEAD(mmap_err, tc) 221{ 222 atf_tc_set_md_var(tc, "descr", "Test error conditions of mmap(2)"); 223} 224 225ATF_TC_BODY(mmap_err, tc) 226{ 227 size_t addr = SIZE_MAX; 228 void *map; 229 230 errno = 0; 231 map = mmap(NULL, 3, PROT_READ, MAP_FILE|MAP_PRIVATE, -1, 0); 232 233 ATF_REQUIRE(map == MAP_FAILED); 234 ATF_REQUIRE(errno == EBADF); 235 236 errno = 0; 237 map = mmap(&addr, page, PROT_READ, MAP_FIXED|MAP_PRIVATE, -1, 0); 238 239 ATF_REQUIRE(map == MAP_FAILED); 240 ATF_REQUIRE(errno == EINVAL); 241 242 errno = 0; 243 map = mmap(NULL, page, PROT_READ, MAP_ANON|MAP_PRIVATE, INT_MAX, 0); 244 245 ATF_REQUIRE(map == MAP_FAILED); 246 ATF_REQUIRE(errno == EINVAL); 247} 248 249ATF_TC_WITH_CLEANUP(mmap_loan); 250ATF_TC_HEAD(mmap_loan, tc) 251{ 252 atf_tc_set_md_var(tc, "descr", "Test uvm page loanout with mmap(2)"); 253} 254 255ATF_TC_BODY(mmap_loan, tc) 256{ 257 char buf[BUFSIZE]; 258 char *vp, *vp2; 259 int fd; 260 261 fd = open(path, O_RDWR | O_CREAT, 0600); 262 ATF_REQUIRE(fd >= 0); 263 264 (void)memset(buf, 'x', sizeof(buf)); 265 (void)write(fd, buf, sizeof(buf)); 266 267 vp = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE, 268 MAP_FILE | MAP_PRIVATE, fd, 0); 269 270 ATF_REQUIRE(vp != MAP_FAILED); 271 272 vp2 = vp; 273 274 testloan(vp, vp2, 'A', 0); 275 testloan(vp, vp2, 'B', 1); 276 277 ATF_REQUIRE(munmap(vp, BUFSIZE) == 0); 278 279 vp = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE, 280 MAP_FILE | MAP_SHARED, fd, 0); 281 282 vp2 = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE, 283 MAP_FILE | MAP_SHARED, fd, 0); 284 285 ATF_REQUIRE(vp != MAP_FAILED); 286 ATF_REQUIRE(vp2 != MAP_FAILED); 287 288 testloan(vp, vp2, 'E', 1); 289 290 ATF_REQUIRE(munmap(vp, BUFSIZE) == 0); 291 ATF_REQUIRE(munmap(vp2, BUFSIZE) == 0); 292} 293 294ATF_TC_CLEANUP(mmap_loan, tc) 295{ 296 (void)unlink(path); 297} 298 299ATF_TC_WITH_CLEANUP(mmap_prot_1); 300ATF_TC_HEAD(mmap_prot_1, tc) 301{ 302 atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #1"); 303} 304 305ATF_TC_BODY(mmap_prot_1, tc) 306{ 307 void *map; 308 int fd; 309 310 /* 311 * Open a file write-only and try to 312 * map it read-only. This should fail. 313 */ 314 fd = open(path, O_WRONLY | O_CREAT, 0700); 315 316 if (fd < 0) 317 return; 318 319 ATF_REQUIRE(write(fd, "XXX", 3) == 3); 320 321 map = mmap(NULL, 3, PROT_READ, MAP_FILE|MAP_PRIVATE, fd, 0); 322 map_check(map, 1); 323 324 map = mmap(NULL, 3, PROT_WRITE, MAP_FILE|MAP_PRIVATE, fd, 0); 325 map_check(map, 0); 326 327 ATF_REQUIRE(close(fd) == 0); 328} 329 330ATF_TC_CLEANUP(mmap_prot_1, tc) 331{ 332 (void)unlink(path); 333} 334 335ATF_TC(mmap_prot_2); 336ATF_TC_HEAD(mmap_prot_2, tc) 337{ 338 atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #2"); 339} 340 341ATF_TC_BODY(mmap_prot_2, tc) 342{ 343 char buf[2]; 344 void *map; 345 pid_t pid; 346 int sta; 347 348 /* 349 * Make a PROT_NONE mapping and try to access it. 350 * If we catch a SIGSEGV, all works as expected. 351 */ 352 map = mmap(NULL, page, PROT_NONE, MAP_ANON|MAP_PRIVATE, -1, 0); 353 ATF_REQUIRE(map != MAP_FAILED); 354 355 pid = fork(); 356 ATF_REQUIRE(pid >= 0); 357 358 if (pid == 0) { 359 ATF_REQUIRE(signal(SIGSEGV, map_sighandler) != SIG_ERR); 360 ATF_REQUIRE(strlcpy(buf, map, sizeof(buf)) != 0); 361 } 362 363 (void)wait(&sta); 364 365 ATF_REQUIRE(WIFEXITED(sta) != 0); 366 ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV); 367 ATF_REQUIRE(munmap(map, page) == 0); 368} 369 370ATF_TC_WITH_CLEANUP(mmap_prot_3); 371ATF_TC_HEAD(mmap_prot_3, tc) 372{ 373 atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #3"); 374} 375 376ATF_TC_BODY(mmap_prot_3, tc) 377{ 378 char buf[2]; 379 int fd, sta; 380 void *map; 381 pid_t pid; 382 383 /* 384 * Open a file, change the permissions 385 * to read-only, and try to map it as 386 * PROT_NONE. This should succeed, but 387 * the access should generate SIGSEGV. 388 */ 389 fd = open(path, O_RDWR | O_CREAT, 0700); 390 391 if (fd < 0) 392 return; 393 394 ATF_REQUIRE(write(fd, "XXX", 3) == 3); 395 ATF_REQUIRE(close(fd) == 0); 396 ATF_REQUIRE(chmod(path, 0444) == 0); 397 398 fd = open(path, O_RDONLY); 399 ATF_REQUIRE(fd != -1); 400 401 map = mmap(NULL, 3, PROT_NONE, MAP_FILE | MAP_SHARED, fd, 0); 402 ATF_REQUIRE(map != MAP_FAILED); 403 404 pid = fork(); 405 406 ATF_REQUIRE(pid >= 0); 407 408 if (pid == 0) { 409 ATF_REQUIRE(signal(SIGSEGV, map_sighandler) != SIG_ERR); 410 ATF_REQUIRE(strlcpy(buf, map, sizeof(buf)) != 0); 411 } 412 413 (void)wait(&sta); 414 415 ATF_REQUIRE(WIFEXITED(sta) != 0); 416 ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV); 417 ATF_REQUIRE(munmap(map, 3) == 0); 418} 419 420ATF_TC_CLEANUP(mmap_prot_3, tc) 421{ 422 (void)unlink(path); 423} 424 425ATF_TC_WITH_CLEANUP(mmap_truncate); 426ATF_TC_HEAD(mmap_truncate, tc) 427{ 428 atf_tc_set_md_var(tc, "descr", "Test mmap(2) and ftruncate(2)"); 429} 430 431ATF_TC_BODY(mmap_truncate, tc) 432{ 433 char *map; 434 long i; 435 int fd; 436 437 fd = open(path, O_RDWR | O_CREAT, 0700); 438 439 if (fd < 0) 440 return; 441 442 /* 443 * See that ftruncate(2) works 444 * while the file is mapped. 445 */ 446 ATF_REQUIRE(ftruncate(fd, page) == 0); 447 448 map = mmap(NULL, page, PROT_READ | PROT_WRITE, MAP_FILE|MAP_PRIVATE, 449 fd, 0); 450 ATF_REQUIRE(map != MAP_FAILED); 451 452 for (i = 0; i < page; i++) 453 map[i] = 'x'; 454 455 ATF_REQUIRE(ftruncate(fd, 0) == 0); 456 ATF_REQUIRE(ftruncate(fd, page / 8) == 0); 457 ATF_REQUIRE(ftruncate(fd, page / 4) == 0); 458 ATF_REQUIRE(ftruncate(fd, page / 2) == 0); 459 ATF_REQUIRE(ftruncate(fd, page / 12) == 0); 460 ATF_REQUIRE(ftruncate(fd, page / 64) == 0); 461 462 (void)munmap(map, page); 463 ATF_REQUIRE(close(fd) == 0); 464} 465 466ATF_TC_CLEANUP(mmap_truncate, tc) 467{ 468 (void)unlink(path); 469} 470 471ATF_TC_WITH_CLEANUP(mmap_truncate_signal); 472ATF_TC_HEAD(mmap_truncate_signal, tc) 473{ 474 atf_tc_set_md_var(tc, "descr", 475 "Test mmap(2) ftruncate(2) causing signal"); 476} 477 478ATF_TC_BODY(mmap_truncate_signal, tc) 479{ 480 char *map; 481 long i; 482 int fd, sta; 483 pid_t pid; 484 485 fd = open(path, O_RDWR | O_CREAT, 0700); 486 487 if (fd < 0) 488 return; 489 490 ATF_REQUIRE(write(fd, "foo\n", 5) == 5); 491 492 map = mmap(NULL, page, PROT_READ, MAP_FILE|MAP_PRIVATE, fd, 0); 493 ATF_REQUIRE(map != MAP_FAILED); 494 495 sta = 0; 496 for (i = 0; i < 5; i++) 497 sta += map[i]; 498 ATF_REQUIRE(sta == 334); 499 500 ATF_REQUIRE(ftruncate(fd, 0) == 0); 501 pid = fork(); 502 ATF_REQUIRE(pid >= 0); 503 504 if (pid == 0) { 505 ATF_REQUIRE(signal(SIGBUS, map_sighandler) != SIG_ERR); 506 ATF_REQUIRE(signal(SIGSEGV, map_sighandler) != SIG_ERR); 507 sta = 0; 508 for (i = 0; i < page; i++) 509 sta += map[i]; 510 /* child never will get this far, but the compiler will 511 not know, so better use the values calculated to 512 prevent the access to be optimized out */ 513 ATF_REQUIRE(i == 0); 514 ATF_REQUIRE(sta == 0); 515 (void)munmap(map, page); 516 (void)close(fd); 517 return; 518 } 519 520 (void)wait(&sta); 521 522 ATF_REQUIRE(WIFEXITED(sta) != 0); 523 if (WEXITSTATUS(sta) == SIGSEGV) 524 atf_tc_fail("child process got SIGSEGV instead of SIGBUS"); 525 ATF_REQUIRE(WEXITSTATUS(sta) == SIGBUS); 526 ATF_REQUIRE(munmap(map, page) == 0); 527 ATF_REQUIRE(close(fd) == 0); 528} 529 530ATF_TC_CLEANUP(mmap_truncate_signal, tc) 531{ 532 (void)unlink(path); 533} 534 535ATF_TC(mmap_va0); 536ATF_TC_HEAD(mmap_va0, tc) 537{ 538 atf_tc_set_md_var(tc, "descr", "Test mmap(2) and vm.user_va0_disable"); 539} 540 541ATF_TC_BODY(mmap_va0, tc) 542{ 543 int flags = MAP_ANON | MAP_FIXED | MAP_PRIVATE; 544 size_t len = sizeof(int); 545 void *map; 546 int val; 547 548 /* 549 * Make an anonymous fixed mapping at zero address. If the address 550 * is restricted as noted in security(7), the syscall should fail. 551 */ 552 if (sysctlbyname("vm.user_va0_disable", &val, &len, NULL, 0) != 0) 553 atf_tc_fail("failed to read vm.user_va0_disable"); 554 555 map = mmap(NULL, page, PROT_EXEC, flags, -1, 0); 556 map_check(map, val); 557 558 map = mmap(NULL, page, PROT_READ, flags, -1, 0); 559 map_check(map, val); 560 561 map = mmap(NULL, page, PROT_WRITE, flags, -1, 0); 562 map_check(map, val); 563 564 map = mmap(NULL, page, PROT_READ|PROT_WRITE, flags, -1, 0); 565 map_check(map, val); 566 567 map = mmap(NULL, page, PROT_EXEC|PROT_READ|PROT_WRITE, flags, -1, 0); 568 map_check(map, val); 569} 570 571ATF_TP_ADD_TCS(tp) 572{ 573 page = sysconf(_SC_PAGESIZE); 574 ATF_REQUIRE(page >= 0); 575 576 ATF_TP_ADD_TC(tp, mmap_block); 577 ATF_TP_ADD_TC(tp, mmap_err); 578 ATF_TP_ADD_TC(tp, mmap_loan); 579 ATF_TP_ADD_TC(tp, mmap_prot_1); 580 ATF_TP_ADD_TC(tp, mmap_prot_2); 581 ATF_TP_ADD_TC(tp, mmap_prot_3); 582 ATF_TP_ADD_TC(tp, mmap_truncate); 583 ATF_TP_ADD_TC(tp, mmap_truncate_signal); 584#ifndef __OpenBSD__ 585 /* sysctl vm.user_va0_disable not available */ 586 ATF_TP_ADD_TC(tp, mmap_va0); 587#endif 588 589 return atf_no_error(); 590} 591