1/*	$OpenBSD: t_mmap.c,v 1.4 2021/12/13 16:56:48 deraadt Exp $	*/
2/* $NetBSD: t_mmap.c,v 1.14 2020/06/26 07:50:11 jruoho Exp $ */
3
4/*-
5 * Copyright (c) 2011 The NetBSD Foundation, Inc.
6 * All rights reserved.
7 *
8 * This code is derived from software contributed to The NetBSD Foundation
9 * by Jukka Ruohonen.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 *    notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 *    notice, this list of conditions and the following disclaimer in the
18 *    documentation and/or other materials provided with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30 * POSSIBILITY OF SUCH DAMAGE.
31 */
32
33/*-
34 * Copyright (c)2004 YAMAMOTO Takashi,
35 * All rights reserved.
36 *
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
39 * are met:
40 * 1. Redistributions of source code must retain the above copyright
41 *    notice, this list of conditions and the following disclaimer.
42 * 2. Redistributions in binary form must reproduce the above copyright
43 *    notice, this list of conditions and the following disclaimer in the
44 *    documentation and/or other materials provided with the distribution.
45 *
46 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
47 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
48 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
49 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
50 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
51 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
52 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
53 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
54 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
55 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
56 * SUCH DAMAGE.
57 */
58
59#include "macros.h"
60
61#include <sys/disklabel.h>
62#include <sys/mman.h>
63#include <sys/stat.h>
64#include <sys/socket.h>
65#include <sys/sysctl.h>
66#include <sys/wait.h>
67
68#include "atf-c.h"
69#include <errno.h>
70#include <fcntl.h>
71#include <signal.h>
72#include <stdio.h>
73#include <stdlib.h>
74#include <limits.h>
75#include <string.h>
76#include <unistd.h>
77#include <paths.h>
78
79static long	page = 0;
80static char	path[] = "mmap";
81static void	map_check(void *, int);
82static void	map_sighandler(int);
83static void	testloan(void *, void *, char, int);
84
85#define	BUFSIZE	(32 * 1024)	/* enough size to trigger sosend_loan */
86
87static void
88map_check(void *map, int flag)
89{
90
91	if (flag != 0) {
92		ATF_REQUIRE(map == MAP_FAILED);
93		return;
94	}
95
96	ATF_REQUIRE(map != MAP_FAILED);
97	ATF_REQUIRE(munmap(map, page) == 0);
98}
99
100void
101testloan(void *vp, void *vp2, char pat, int docheck)
102{
103	char buf[BUFSIZE];
104	char backup[BUFSIZE];
105	ssize_t nwritten;
106	ssize_t nread;
107	int fds[2];
108	int val;
109
110	val = BUFSIZE;
111
112	if (docheck != 0)
113		(void)memcpy(backup, vp, BUFSIZE);
114
115	if (socketpair(AF_LOCAL, SOCK_STREAM, PF_UNSPEC, fds) != 0)
116		atf_tc_fail("socketpair() failed");
117
118	val = BUFSIZE;
119
120	if (setsockopt(fds[1], SOL_SOCKET, SO_RCVBUF, &val, sizeof(val)) != 0)
121		atf_tc_fail("setsockopt() failed, SO_RCVBUF");
122
123	val = BUFSIZE;
124
125	if (setsockopt(fds[0], SOL_SOCKET, SO_SNDBUF, &val, sizeof(val)) != 0)
126		atf_tc_fail("setsockopt() failed, SO_SNDBUF");
127
128	if (fcntl(fds[0], F_SETFL, O_NONBLOCK) != 0)
129		atf_tc_fail("fcntl() failed");
130
131	nwritten = write(fds[0], (char *)vp + page, BUFSIZE - page);
132
133	if (nwritten == -1)
134		atf_tc_fail("write() failed");
135
136	/* Break loan. */
137	(void)memset(vp2, pat, BUFSIZE);
138
139	nread = read(fds[1], buf + page, BUFSIZE - page);
140
141	if (nread == -1)
142		atf_tc_fail("read() failed");
143
144	if (nread != nwritten)
145		atf_tc_fail("too short read");
146
147	if (docheck != 0 && memcmp(backup, buf + page, nread) != 0)
148		atf_tc_fail("data mismatch");
149
150	ATF_REQUIRE(close(fds[0]) == 0);
151	ATF_REQUIRE(close(fds[1]) == 0);
152}
153
154static void
155map_sighandler(int signo)
156{
157	_exit(signo);
158}
159
160ATF_TC(mmap_block);
161ATF_TC_HEAD(mmap_block, tc)
162{
163	atf_tc_set_md_var(tc, "descr", "Test mmap(2) with a block device");
164	atf_tc_set_md_var(tc, "require.user", "root");
165}
166
167ATF_TC_BODY(mmap_block, tc)
168{
169	static const int mib[] = { CTL_HW, HW_DISKNAMES };
170	static const unsigned int miblen = __arraycount(mib);
171	char *map, *dk, *drives, dev[PATH_MAX];
172	size_t len;
173	int fd = -1;
174
175#ifndef __OpenBSD__
176	/* works for us */
177	atf_tc_skip("The test case causes a panic " \
178	    "(PR kern/38889, PR kern/46592)");
179#endif
180
181	ATF_REQUIRE(sysctl(mib, miblen, NULL, &len, NULL, 0) == 0);
182	drives = malloc(len);
183	ATF_REQUIRE(drives != NULL);
184	ATF_REQUIRE(sysctl(mib, miblen, drives, &len, NULL, 0) == 0);
185#ifdef __OpenBSD__
186	/* devices separated by comma, disk uid by colon */
187	for (dk = strtok(drives, ",:"); dk != NULL; dk = strtok(NULL, ",:")) {
188#else
189	for (dk = strtok(drives, " "); dk != NULL; dk = strtok(NULL, " ")) {
190#endif
191		if (strncmp(dk, "dk", 2) == 0)
192			snprintf(dev, sizeof(dev), _PATH_DEV "%s", dk);
193		else
194			snprintf(dev, sizeof(dev), _PATH_DEV "%s%c", dk,
195			    'a' + RAW_PART);
196		fprintf(stderr, "trying: %s\n", dev);
197
198		if ((fd = open(dev, O_RDONLY)) >= 0) {
199			(void)fprintf(stderr, "using %s\n", dev);
200			break;
201		} else
202			(void)fprintf(stderr, "%s: %s\n", dev, strerror(errno));
203	}
204	free(drives);
205
206	if (fd < 0)
207		atf_tc_skip("failed to find suitable block device");
208
209	map = mmap(NULL, 4096, PROT_READ, MAP_FILE, fd, 0);
210	ATF_REQUIRE_MSG(map != MAP_FAILED, "mmap: %s", strerror(errno));
211
212	(void)fprintf(stderr, "first byte %x\n", *map);
213	ATF_REQUIRE(close(fd) == 0);
214	(void)fprintf(stderr, "first byte %x\n", *map);
215
216	ATF_REQUIRE(munmap(map, 4096) == 0);
217}
218
219ATF_TC(mmap_err);
220ATF_TC_HEAD(mmap_err, tc)
221{
222	atf_tc_set_md_var(tc, "descr", "Test error conditions of mmap(2)");
223}
224
225ATF_TC_BODY(mmap_err, tc)
226{
227	size_t addr = SIZE_MAX;
228	void *map;
229
230	errno = 0;
231	map = mmap(NULL, 3, PROT_READ, MAP_FILE|MAP_PRIVATE, -1, 0);
232
233	ATF_REQUIRE(map == MAP_FAILED);
234	ATF_REQUIRE(errno == EBADF);
235
236	errno = 0;
237	map = mmap(&addr, page, PROT_READ, MAP_FIXED|MAP_PRIVATE, -1, 0);
238
239	ATF_REQUIRE(map == MAP_FAILED);
240	ATF_REQUIRE(errno == EINVAL);
241
242	errno = 0;
243	map = mmap(NULL, page, PROT_READ, MAP_ANON|MAP_PRIVATE, INT_MAX, 0);
244
245	ATF_REQUIRE(map == MAP_FAILED);
246	ATF_REQUIRE(errno == EINVAL);
247}
248
249ATF_TC_WITH_CLEANUP(mmap_loan);
250ATF_TC_HEAD(mmap_loan, tc)
251{
252	atf_tc_set_md_var(tc, "descr", "Test uvm page loanout with mmap(2)");
253}
254
255ATF_TC_BODY(mmap_loan, tc)
256{
257	char buf[BUFSIZE];
258	char *vp, *vp2;
259	int fd;
260
261	fd = open(path, O_RDWR | O_CREAT, 0600);
262	ATF_REQUIRE(fd >= 0);
263
264	(void)memset(buf, 'x', sizeof(buf));
265	(void)write(fd, buf, sizeof(buf));
266
267	vp = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE,
268	    MAP_FILE | MAP_PRIVATE, fd, 0);
269
270	ATF_REQUIRE(vp != MAP_FAILED);
271
272	vp2 = vp;
273
274	testloan(vp, vp2, 'A', 0);
275	testloan(vp, vp2, 'B', 1);
276
277	ATF_REQUIRE(munmap(vp, BUFSIZE) == 0);
278
279	vp = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE,
280	    MAP_FILE | MAP_SHARED, fd, 0);
281
282	vp2 = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE,
283	    MAP_FILE | MAP_SHARED, fd, 0);
284
285	ATF_REQUIRE(vp != MAP_FAILED);
286	ATF_REQUIRE(vp2 != MAP_FAILED);
287
288	testloan(vp, vp2, 'E', 1);
289
290	ATF_REQUIRE(munmap(vp, BUFSIZE) == 0);
291	ATF_REQUIRE(munmap(vp2, BUFSIZE) == 0);
292}
293
294ATF_TC_CLEANUP(mmap_loan, tc)
295{
296	(void)unlink(path);
297}
298
299ATF_TC_WITH_CLEANUP(mmap_prot_1);
300ATF_TC_HEAD(mmap_prot_1, tc)
301{
302	atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #1");
303}
304
305ATF_TC_BODY(mmap_prot_1, tc)
306{
307	void *map;
308	int fd;
309
310	/*
311	 * Open a file write-only and try to
312	 * map it read-only. This should fail.
313	 */
314	fd = open(path, O_WRONLY | O_CREAT, 0700);
315
316	if (fd < 0)
317		return;
318
319	ATF_REQUIRE(write(fd, "XXX", 3) == 3);
320
321	map = mmap(NULL, 3, PROT_READ, MAP_FILE|MAP_PRIVATE, fd, 0);
322	map_check(map, 1);
323
324	map = mmap(NULL, 3, PROT_WRITE, MAP_FILE|MAP_PRIVATE, fd, 0);
325	map_check(map, 0);
326
327	ATF_REQUIRE(close(fd) == 0);
328}
329
330ATF_TC_CLEANUP(mmap_prot_1, tc)
331{
332	(void)unlink(path);
333}
334
335ATF_TC(mmap_prot_2);
336ATF_TC_HEAD(mmap_prot_2, tc)
337{
338	atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #2");
339}
340
341ATF_TC_BODY(mmap_prot_2, tc)
342{
343	char buf[2];
344	void *map;
345	pid_t pid;
346	int sta;
347
348	/*
349	 * Make a PROT_NONE mapping and try to access it.
350	 * If we catch a SIGSEGV, all works as expected.
351	 */
352	map = mmap(NULL, page, PROT_NONE, MAP_ANON|MAP_PRIVATE, -1, 0);
353	ATF_REQUIRE(map != MAP_FAILED);
354
355	pid = fork();
356	ATF_REQUIRE(pid >= 0);
357
358	if (pid == 0) {
359		ATF_REQUIRE(signal(SIGSEGV, map_sighandler) != SIG_ERR);
360		ATF_REQUIRE(strlcpy(buf, map, sizeof(buf)) != 0);
361	}
362
363	(void)wait(&sta);
364
365	ATF_REQUIRE(WIFEXITED(sta) != 0);
366	ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV);
367	ATF_REQUIRE(munmap(map, page) == 0);
368}
369
370ATF_TC_WITH_CLEANUP(mmap_prot_3);
371ATF_TC_HEAD(mmap_prot_3, tc)
372{
373	atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #3");
374}
375
376ATF_TC_BODY(mmap_prot_3, tc)
377{
378	char buf[2];
379	int fd, sta;
380	void *map;
381	pid_t pid;
382
383	/*
384	 * Open a file, change the permissions
385	 * to read-only, and try to map it as
386	 * PROT_NONE. This should succeed, but
387	 * the access should generate SIGSEGV.
388	 */
389	fd = open(path, O_RDWR | O_CREAT, 0700);
390
391	if (fd < 0)
392		return;
393
394	ATF_REQUIRE(write(fd, "XXX", 3) == 3);
395	ATF_REQUIRE(close(fd) == 0);
396	ATF_REQUIRE(chmod(path, 0444) == 0);
397
398	fd = open(path, O_RDONLY);
399	ATF_REQUIRE(fd != -1);
400
401	map = mmap(NULL, 3, PROT_NONE, MAP_FILE | MAP_SHARED, fd, 0);
402	ATF_REQUIRE(map != MAP_FAILED);
403
404	pid = fork();
405
406	ATF_REQUIRE(pid >= 0);
407
408	if (pid == 0) {
409		ATF_REQUIRE(signal(SIGSEGV, map_sighandler) != SIG_ERR);
410		ATF_REQUIRE(strlcpy(buf, map, sizeof(buf)) != 0);
411	}
412
413	(void)wait(&sta);
414
415	ATF_REQUIRE(WIFEXITED(sta) != 0);
416	ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV);
417	ATF_REQUIRE(munmap(map, 3) == 0);
418}
419
420ATF_TC_CLEANUP(mmap_prot_3, tc)
421{
422	(void)unlink(path);
423}
424
425ATF_TC_WITH_CLEANUP(mmap_truncate);
426ATF_TC_HEAD(mmap_truncate, tc)
427{
428	atf_tc_set_md_var(tc, "descr", "Test mmap(2) and ftruncate(2)");
429}
430
431ATF_TC_BODY(mmap_truncate, tc)
432{
433	char *map;
434	long i;
435	int fd;
436
437	fd = open(path, O_RDWR | O_CREAT, 0700);
438
439	if (fd < 0)
440		return;
441
442	/*
443	 * See that ftruncate(2) works
444	 * while the file is mapped.
445	 */
446	ATF_REQUIRE(ftruncate(fd, page) == 0);
447
448	map = mmap(NULL, page, PROT_READ | PROT_WRITE, MAP_FILE|MAP_PRIVATE,
449	     fd, 0);
450	ATF_REQUIRE(map != MAP_FAILED);
451
452	for (i = 0; i < page; i++)
453		map[i] = 'x';
454
455	ATF_REQUIRE(ftruncate(fd, 0) == 0);
456	ATF_REQUIRE(ftruncate(fd, page / 8) == 0);
457	ATF_REQUIRE(ftruncate(fd, page / 4) == 0);
458	ATF_REQUIRE(ftruncate(fd, page / 2) == 0);
459	ATF_REQUIRE(ftruncate(fd, page / 12) == 0);
460	ATF_REQUIRE(ftruncate(fd, page / 64) == 0);
461
462	(void)munmap(map, page);
463	ATF_REQUIRE(close(fd) == 0);
464}
465
466ATF_TC_CLEANUP(mmap_truncate, tc)
467{
468	(void)unlink(path);
469}
470
471ATF_TC_WITH_CLEANUP(mmap_truncate_signal);
472ATF_TC_HEAD(mmap_truncate_signal, tc)
473{
474	atf_tc_set_md_var(tc, "descr",
475	    "Test mmap(2) ftruncate(2) causing signal");
476}
477
478ATF_TC_BODY(mmap_truncate_signal, tc)
479{
480	char *map;
481	long i;
482	int fd, sta;
483	pid_t pid;
484
485	fd = open(path, O_RDWR | O_CREAT, 0700);
486
487	if (fd < 0)
488		return;
489
490	ATF_REQUIRE(write(fd, "foo\n", 5) == 5);
491
492	map = mmap(NULL, page, PROT_READ, MAP_FILE|MAP_PRIVATE, fd, 0);
493	ATF_REQUIRE(map != MAP_FAILED);
494
495	sta = 0;
496	for (i = 0; i < 5; i++)
497		sta += map[i];
498	ATF_REQUIRE(sta == 334);
499
500	ATF_REQUIRE(ftruncate(fd, 0) == 0);
501	pid = fork();
502	ATF_REQUIRE(pid >= 0);
503
504	if (pid == 0) {
505		ATF_REQUIRE(signal(SIGBUS, map_sighandler) != SIG_ERR);
506		ATF_REQUIRE(signal(SIGSEGV, map_sighandler) != SIG_ERR);
507		sta = 0;
508		for (i = 0; i < page; i++)
509			sta += map[i];
510		/* child never will get this far, but the compiler will
511		   not know, so better use the values calculated to
512		   prevent the access to be optimized out */
513		ATF_REQUIRE(i == 0);
514		ATF_REQUIRE(sta == 0);
515		(void)munmap(map, page);
516		(void)close(fd);
517		return;
518	}
519
520	(void)wait(&sta);
521
522	ATF_REQUIRE(WIFEXITED(sta) != 0);
523	if (WEXITSTATUS(sta) == SIGSEGV)
524		atf_tc_fail("child process got SIGSEGV instead of SIGBUS");
525	ATF_REQUIRE(WEXITSTATUS(sta) == SIGBUS);
526	ATF_REQUIRE(munmap(map, page) == 0);
527	ATF_REQUIRE(close(fd) == 0);
528}
529
530ATF_TC_CLEANUP(mmap_truncate_signal, tc)
531{
532	(void)unlink(path);
533}
534
535ATF_TC(mmap_va0);
536ATF_TC_HEAD(mmap_va0, tc)
537{
538	atf_tc_set_md_var(tc, "descr", "Test mmap(2) and vm.user_va0_disable");
539}
540
541ATF_TC_BODY(mmap_va0, tc)
542{
543	int flags = MAP_ANON | MAP_FIXED | MAP_PRIVATE;
544	size_t len = sizeof(int);
545	void *map;
546	int val;
547
548	/*
549	 * Make an anonymous fixed mapping at zero address. If the address
550	 * is restricted as noted in security(7), the syscall should fail.
551	 */
552	if (sysctlbyname("vm.user_va0_disable", &val, &len, NULL, 0) != 0)
553		atf_tc_fail("failed to read vm.user_va0_disable");
554
555	map = mmap(NULL, page, PROT_EXEC, flags, -1, 0);
556	map_check(map, val);
557
558	map = mmap(NULL, page, PROT_READ, flags, -1, 0);
559	map_check(map, val);
560
561	map = mmap(NULL, page, PROT_WRITE, flags, -1, 0);
562	map_check(map, val);
563
564	map = mmap(NULL, page, PROT_READ|PROT_WRITE, flags, -1, 0);
565	map_check(map, val);
566
567	map = mmap(NULL, page, PROT_EXEC|PROT_READ|PROT_WRITE, flags, -1, 0);
568	map_check(map, val);
569}
570
571ATF_TP_ADD_TCS(tp)
572{
573	page = sysconf(_SC_PAGESIZE);
574	ATF_REQUIRE(page >= 0);
575
576	ATF_TP_ADD_TC(tp, mmap_block);
577	ATF_TP_ADD_TC(tp, mmap_err);
578	ATF_TP_ADD_TC(tp, mmap_loan);
579	ATF_TP_ADD_TC(tp, mmap_prot_1);
580	ATF_TP_ADD_TC(tp, mmap_prot_2);
581	ATF_TP_ADD_TC(tp, mmap_prot_3);
582	ATF_TP_ADD_TC(tp, mmap_truncate);
583	ATF_TP_ADD_TC(tp, mmap_truncate_signal);
584#ifndef __OpenBSD__
585	/* sysctl vm.user_va0_disable not available */
586	ATF_TP_ADD_TC(tp, mmap_va0);
587#endif
588
589	return atf_no_error();
590}
591