1 /* $NetBSD: t_mmap.c,v 1.11 2017/01/13 20:43:11 christos Exp $ */ 2 3 /*- 4 * Copyright (c) 2011 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Jukka Ruohonen. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /*- 33 * Copyright (c)2004 YAMAMOTO Takashi, 34 * All rights reserved. 35 * 36 * Redistribution and use in source and binary forms, with or without 37 * modification, are permitted provided that the following conditions 38 * are met: 39 * 1. Redistributions of source code must retain the above copyright 40 * notice, this list of conditions and the following disclaimer. 41 * 2. Redistributions in binary form must reproduce the above copyright 42 * notice, this list of conditions and the following disclaimer in the 43 * documentation and/or other materials provided with the distribution. 44 * 45 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 46 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 47 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 48 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 49 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 50 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 51 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 52 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 53 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 54 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 55 * SUCH DAMAGE. 56 */ 57 #include <sys/cdefs.h> 58 __RCSID("$NetBSD: t_mmap.c,v 1.11 2017/01/13 20:43:11 christos Exp $"); 59 60 #include <sys/param.h> 61 #include <sys/mman.h> 62 #include <sys/stat.h> 63 #include <sys/socket.h> 64 #include <sys/sysctl.h> 65 #include <sys/wait.h> 66 67 #include <atf-c.h> 68 #include <errno.h> 69 #include <fcntl.h> 70 #include <signal.h> 71 #include <stdio.h> 72 #include <stdlib.h> 73 #include <string.h> 74 #include <unistd.h> 75 #include <paths.h> 76 #ifdef __NetBSD__ 77 #include <machine/disklabel.h> 78 #else 79 #include <stdint.h> 80 #include <sys/disklabel.h> 81 #endif 82 83 static long page = 0; 84 static char path[] = "mmap"; 85 static void map_check(void *, int); 86 static void map_sighandler(int); 87 static void testloan(void *, void *, char, int); 88 89 #define BUFSIZE (32 * 1024) /* enough size to trigger sosend_loan */ 90 91 static void 92 map_check(void *map, int flag) 93 { 94 95 if (flag != 0) { 96 ATF_REQUIRE(map == MAP_FAILED); 97 return; 98 } 99 100 ATF_REQUIRE(map != MAP_FAILED); 101 ATF_REQUIRE(munmap(map, page) == 0); 102 } 103 104 void 105 testloan(void *vp, void *vp2, char pat, int docheck) 106 { 107 char buf[BUFSIZE]; 108 char backup[BUFSIZE]; 109 ssize_t nwritten; 110 ssize_t nread; 111 int fds[2]; 112 int val; 113 114 val = BUFSIZE; 115 116 if (docheck != 0) 117 (void)memcpy(backup, vp, BUFSIZE); 118 119 if (socketpair(AF_LOCAL, SOCK_STREAM, PF_UNSPEC, fds) != 0) 120 atf_tc_fail("socketpair() failed"); 121 122 val = BUFSIZE; 123 124 if (setsockopt(fds[1], SOL_SOCKET, SO_RCVBUF, &val, sizeof(val)) != 0) 125 atf_tc_fail("setsockopt() failed, SO_RCVBUF"); 126 127 val = BUFSIZE; 128 129 if (setsockopt(fds[0], SOL_SOCKET, SO_SNDBUF, &val, sizeof(val)) != 0) 130 atf_tc_fail("setsockopt() failed, SO_SNDBUF"); 131 132 if (fcntl(fds[0], F_SETFL, O_NONBLOCK) != 0) 133 atf_tc_fail("fcntl() failed"); 134 135 nwritten = write(fds[0], (char *)vp + page, BUFSIZE - page); 136 137 if (nwritten == -1) 138 atf_tc_fail("write() failed"); 139 140 /* Break loan. */ 141 (void)memset(vp2, pat, BUFSIZE); 142 143 nread = read(fds[1], buf + page, BUFSIZE - page); 144 145 if (nread == -1) 146 atf_tc_fail("read() failed"); 147 148 if (nread != nwritten) 149 atf_tc_fail("too short read"); 150 151 if (docheck != 0 && memcmp(backup, buf + page, nread) != 0) 152 atf_tc_fail("data mismatch"); 153 154 ATF_REQUIRE(close(fds[0]) == 0); 155 ATF_REQUIRE(close(fds[1]) == 0); 156 } 157 158 static void 159 map_sighandler(int signo) 160 { 161 _exit(signo); 162 } 163 164 #ifdef __NetBSD__ 165 ATF_TC(mmap_block); 166 ATF_TC_HEAD(mmap_block, tc) 167 { 168 atf_tc_set_md_var(tc, "descr", "Test mmap(2) with a block device"); 169 atf_tc_set_md_var(tc, "require.user", "root"); 170 } 171 172 ATF_TC_BODY(mmap_block, tc) 173 { 174 static const int mib[] = { CTL_HW, HW_DISKNAMES }; 175 static const unsigned int miblen = __arraycount(mib); 176 char *map, *dk, *drives, dev[PATH_MAX]; 177 size_t len; 178 int fd = -1; 179 180 atf_tc_skip("The test case causes a panic (PR kern/38889, kern/46592)"); 181 182 ATF_REQUIRE(sysctl(mib, miblen, NULL, &len, NULL, 0) == 0); 183 drives = malloc(len); 184 ATF_REQUIRE(drives != NULL); 185 ATF_REQUIRE(sysctl(mib, miblen, drives, &len, NULL, 0) == 0); 186 for (dk = strtok(drives, " "); dk != NULL; dk = strtok(NULL, " ")) { 187 sprintf(dev, _PATH_DEV "%s%c", dk, 'a'+RAW_PART); 188 fprintf(stderr, "trying: %s\n", dev); 189 190 if ((fd = open(dev, O_RDONLY)) >= 0) { 191 (void)fprintf(stderr, "using %s\n", dev); 192 break; 193 } 194 } 195 free(drives); 196 197 if (fd < 0) 198 atf_tc_skip("failed to find suitable block device"); 199 200 map = mmap(NULL, 4096, PROT_READ, MAP_FILE, fd, 0); 201 ATF_REQUIRE(map != MAP_FAILED); 202 203 (void)fprintf(stderr, "first byte %x\n", *map); 204 ATF_REQUIRE(close(fd) == 0); 205 (void)fprintf(stderr, "first byte %x\n", *map); 206 207 ATF_REQUIRE(munmap(map, 4096) == 0); 208 } 209 #endif 210 211 ATF_TC(mmap_err); 212 ATF_TC_HEAD(mmap_err, tc) 213 { 214 atf_tc_set_md_var(tc, "descr", "Test error conditions of mmap(2)"); 215 } 216 217 ATF_TC_BODY(mmap_err, tc) 218 { 219 size_t addr = SIZE_MAX; 220 void *map; 221 222 errno = 0; 223 map = mmap(NULL, 3, PROT_READ, MAP_FILE|MAP_PRIVATE, -1, 0); 224 225 ATF_REQUIRE(map == MAP_FAILED); 226 ATF_REQUIRE(errno == EBADF); 227 228 errno = 0; 229 map = mmap(&addr, page, PROT_READ, MAP_FIXED|MAP_PRIVATE, -1, 0); 230 231 ATF_REQUIRE(map == MAP_FAILED); 232 ATF_REQUIRE(errno == EINVAL); 233 234 errno = 0; 235 map = mmap(NULL, page, PROT_READ, MAP_ANON|MAP_PRIVATE, INT_MAX, 0); 236 237 ATF_REQUIRE(map == MAP_FAILED); 238 ATF_REQUIRE(errno == EINVAL); 239 } 240 241 ATF_TC_WITH_CLEANUP(mmap_loan); 242 ATF_TC_HEAD(mmap_loan, tc) 243 { 244 atf_tc_set_md_var(tc, "descr", "Test uvm page loanout with mmap(2)"); 245 } 246 247 ATF_TC_BODY(mmap_loan, tc) 248 { 249 char buf[BUFSIZE]; 250 char *vp, *vp2; 251 int fd; 252 253 fd = open(path, O_RDWR | O_CREAT, 0600); 254 ATF_REQUIRE(fd >= 0); 255 256 (void)memset(buf, 'x', sizeof(buf)); 257 (void)write(fd, buf, sizeof(buf)); 258 259 vp = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE, 260 MAP_FILE | MAP_PRIVATE, fd, 0); 261 262 ATF_REQUIRE(vp != MAP_FAILED); 263 264 vp2 = vp; 265 266 testloan(vp, vp2, 'A', 0); 267 testloan(vp, vp2, 'B', 1); 268 269 ATF_REQUIRE(munmap(vp, BUFSIZE) == 0); 270 271 vp = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE, 272 MAP_FILE | MAP_SHARED, fd, 0); 273 274 vp2 = mmap(NULL, BUFSIZE, PROT_READ | PROT_WRITE, 275 MAP_FILE | MAP_SHARED, fd, 0); 276 277 ATF_REQUIRE(vp != MAP_FAILED); 278 ATF_REQUIRE(vp2 != MAP_FAILED); 279 280 testloan(vp, vp2, 'E', 1); 281 282 ATF_REQUIRE(munmap(vp, BUFSIZE) == 0); 283 ATF_REQUIRE(munmap(vp2, BUFSIZE) == 0); 284 } 285 286 ATF_TC_CLEANUP(mmap_loan, tc) 287 { 288 (void)unlink(path); 289 } 290 291 ATF_TC_WITH_CLEANUP(mmap_prot_1); 292 ATF_TC_HEAD(mmap_prot_1, tc) 293 { 294 atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #1"); 295 } 296 297 ATF_TC_BODY(mmap_prot_1, tc) 298 { 299 void *map; 300 int fd; 301 302 /* 303 * Open a file write-only and try to 304 * map it read-only. This should fail. 305 */ 306 fd = open(path, O_WRONLY | O_CREAT, 0700); 307 308 if (fd < 0) 309 return; 310 311 ATF_REQUIRE(write(fd, "XXX", 3) == 3); 312 313 map = mmap(NULL, 3, PROT_READ, MAP_FILE|MAP_PRIVATE, fd, 0); 314 map_check(map, 1); 315 316 map = mmap(NULL, 3, PROT_WRITE, MAP_FILE|MAP_PRIVATE, fd, 0); 317 map_check(map, 0); 318 319 ATF_REQUIRE(close(fd) == 0); 320 } 321 322 ATF_TC_CLEANUP(mmap_prot_1, tc) 323 { 324 (void)unlink(path); 325 } 326 327 ATF_TC(mmap_prot_2); 328 ATF_TC_HEAD(mmap_prot_2, tc) 329 { 330 atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #2"); 331 } 332 333 ATF_TC_BODY(mmap_prot_2, tc) 334 { 335 char buf[2]; 336 void *map; 337 pid_t pid; 338 int sta; 339 340 /* 341 * Make a PROT_NONE mapping and try to access it. 342 * If we catch a SIGSEGV, all works as expected. 343 */ 344 map = mmap(NULL, page, PROT_NONE, MAP_ANON|MAP_PRIVATE, -1, 0); 345 ATF_REQUIRE(map != MAP_FAILED); 346 347 pid = fork(); 348 ATF_REQUIRE(pid >= 0); 349 350 if (pid == 0) { 351 ATF_REQUIRE(signal(SIGSEGV, map_sighandler) != SIG_ERR); 352 ATF_REQUIRE(strlcpy(buf, map, sizeof(buf)) != 0); 353 } 354 355 (void)wait(&sta); 356 357 ATF_REQUIRE(WIFEXITED(sta) != 0); 358 ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV); 359 ATF_REQUIRE(munmap(map, page) == 0); 360 } 361 362 ATF_TC_WITH_CLEANUP(mmap_prot_3); 363 ATF_TC_HEAD(mmap_prot_3, tc) 364 { 365 atf_tc_set_md_var(tc, "descr", "Test mmap(2) protections, #3"); 366 } 367 368 ATF_TC_BODY(mmap_prot_3, tc) 369 { 370 char buf[2]; 371 int fd, sta; 372 void *map; 373 pid_t pid; 374 375 /* 376 * Open a file, change the permissions 377 * to read-only, and try to map it as 378 * PROT_NONE. This should succeed, but 379 * the access should generate SIGSEGV. 380 */ 381 fd = open(path, O_RDWR | O_CREAT, 0700); 382 if (fd < 0) 383 #ifdef __FreeBSD__ 384 atf_tc_skip("opening %s failed; skipping testcase: %s", 385 path, strerror(errno)); 386 #else 387 return; 388 #endif 389 390 ATF_REQUIRE(write(fd, "XXX", 3) == 3); 391 ATF_REQUIRE(close(fd) == 0); 392 ATF_REQUIRE(chmod(path, 0444) == 0); 393 394 fd = open(path, O_RDONLY); 395 ATF_REQUIRE(fd != -1); 396 397 map = mmap(NULL, 3, PROT_NONE, MAP_FILE | MAP_SHARED, fd, 0); 398 ATF_REQUIRE(map != MAP_FAILED); 399 400 pid = fork(); 401 402 ATF_REQUIRE(pid >= 0); 403 404 if (pid == 0) { 405 ATF_REQUIRE(signal(SIGSEGV, map_sighandler) != SIG_ERR); 406 ATF_REQUIRE(strlcpy(buf, map, sizeof(buf)) != 0); 407 } 408 409 (void)wait(&sta); 410 411 ATF_REQUIRE(WIFEXITED(sta) != 0); 412 ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV); 413 ATF_REQUIRE(munmap(map, 3) == 0); 414 #ifdef __FreeBSD__ 415 (void)close(fd); 416 #endif 417 } 418 419 ATF_TC_CLEANUP(mmap_prot_3, tc) 420 { 421 (void)unlink(path); 422 } 423 424 ATF_TC_WITH_CLEANUP(mmap_truncate); 425 ATF_TC_HEAD(mmap_truncate, tc) 426 { 427 atf_tc_set_md_var(tc, "descr", "Test mmap(2) and ftruncate(2)"); 428 } 429 430 ATF_TC_BODY(mmap_truncate, tc) 431 { 432 char *map; 433 long i; 434 int fd; 435 436 fd = open(path, O_RDWR | O_CREAT, 0700); 437 438 if (fd < 0) 439 return; 440 441 /* 442 * See that ftruncate(2) works 443 * while the file is mapped. 444 */ 445 ATF_REQUIRE(ftruncate(fd, page) == 0); 446 447 map = mmap(NULL, page, PROT_READ | PROT_WRITE, MAP_FILE|MAP_PRIVATE, 448 fd, 0); 449 ATF_REQUIRE(map != MAP_FAILED); 450 451 for (i = 0; i < page; i++) 452 map[i] = 'x'; 453 454 ATF_REQUIRE(ftruncate(fd, 0) == 0); 455 ATF_REQUIRE(ftruncate(fd, page / 8) == 0); 456 ATF_REQUIRE(ftruncate(fd, page / 4) == 0); 457 ATF_REQUIRE(ftruncate(fd, page / 2) == 0); 458 ATF_REQUIRE(ftruncate(fd, page / 12) == 0); 459 ATF_REQUIRE(ftruncate(fd, page / 64) == 0); 460 461 (void)munmap(map, page); 462 ATF_REQUIRE(close(fd) == 0); 463 } 464 465 ATF_TC_CLEANUP(mmap_truncate, tc) 466 { 467 (void)unlink(path); 468 } 469 470 ATF_TC_WITH_CLEANUP(mmap_truncate_signal); 471 ATF_TC_HEAD(mmap_truncate_signal, tc) 472 { 473 atf_tc_set_md_var(tc, "descr", 474 "Test mmap(2) ftruncate(2) causing signal"); 475 } 476 477 ATF_TC_BODY(mmap_truncate_signal, tc) 478 { 479 char *map; 480 long i; 481 int fd, sta; 482 pid_t pid; 483 484 #ifdef __FreeBSD__ 485 atf_tc_expect_fail("testcase fails with SIGSEGV on FreeBSD; bug # 211924"); 486 #endif 487 488 fd = open(path, O_RDWR | O_CREAT, 0700); 489 490 if (fd < 0) 491 return; 492 493 ATF_REQUIRE(write(fd, "foo\n", 5) == 5); 494 495 map = mmap(NULL, page, PROT_READ, MAP_FILE|MAP_PRIVATE, fd, 0); 496 ATF_REQUIRE(map != MAP_FAILED); 497 498 sta = 0; 499 for (i = 0; i < 5; i++) 500 sta += map[i]; 501 ATF_REQUIRE(sta == 334); 502 503 ATF_REQUIRE(ftruncate(fd, 0) == 0); 504 pid = fork(); 505 ATF_REQUIRE(pid >= 0); 506 507 if (pid == 0) { 508 ATF_REQUIRE(signal(SIGBUS, map_sighandler) != SIG_ERR); 509 ATF_REQUIRE(signal(SIGSEGV, map_sighandler) != SIG_ERR); 510 sta = 0; 511 for (i = 0; i < page; i++) 512 sta += map[i]; 513 /* child never will get this far, but the compiler will 514 not know, so better use the values calculated to 515 prevent the access to be optimized out */ 516 ATF_REQUIRE(i == 0); 517 ATF_REQUIRE(sta == 0); 518 (void)munmap(map, page); 519 (void)close(fd); 520 return; 521 } 522 523 (void)wait(&sta); 524 525 ATF_REQUIRE(WIFEXITED(sta) != 0); 526 if (WEXITSTATUS(sta) == SIGSEGV) 527 atf_tc_fail("child process got SIGSEGV instead of SIGBUS"); 528 ATF_REQUIRE(WEXITSTATUS(sta) == SIGBUS); 529 ATF_REQUIRE(munmap(map, page) == 0); 530 ATF_REQUIRE(close(fd) == 0); 531 } 532 533 ATF_TC_CLEANUP(mmap_truncate_signal, tc) 534 { 535 (void)unlink(path); 536 } 537 538 ATF_TC(mmap_va0); 539 ATF_TC_HEAD(mmap_va0, tc) 540 { 541 atf_tc_set_md_var(tc, "descr", "Test mmap(2) and vm.user_va0_disable"); 542 } 543 544 ATF_TC_BODY(mmap_va0, tc) 545 { 546 int flags = MAP_ANON | MAP_FIXED | MAP_PRIVATE; 547 size_t len = sizeof(int); 548 void *map; 549 int val; 550 551 /* 552 * Make an anonymous fixed mapping at zero address. If the address 553 * is restricted as noted in security(7), the syscall should fail. 554 */ 555 #ifdef __FreeBSD__ 556 if (sysctlbyname("security.bsd.map_at_zero", &val, &len, NULL, 0) != 0) 557 atf_tc_fail("failed to read security.bsd.map_at_zero"); 558 val = !val; /* 1 == enable map at zero */ 559 #endif 560 #ifdef __NetBSD__ 561 if (sysctlbyname("vm.user_va0_disable", &val, &len, NULL, 0) != 0) 562 atf_tc_fail("failed to read vm.user_va0_disable"); 563 #endif 564 565 map = mmap(NULL, page, PROT_EXEC, flags, -1, 0); 566 map_check(map, val); 567 568 map = mmap(NULL, page, PROT_READ, flags, -1, 0); 569 map_check(map, val); 570 571 map = mmap(NULL, page, PROT_WRITE, flags, -1, 0); 572 map_check(map, val); 573 574 map = mmap(NULL, page, PROT_READ|PROT_WRITE, flags, -1, 0); 575 map_check(map, val); 576 577 map = mmap(NULL, page, PROT_EXEC|PROT_READ|PROT_WRITE, flags, -1, 0); 578 map_check(map, val); 579 } 580 581 ATF_TP_ADD_TCS(tp) 582 { 583 page = sysconf(_SC_PAGESIZE); 584 ATF_REQUIRE(page >= 0); 585 586 #ifdef __NetBSD__ 587 ATF_TP_ADD_TC(tp, mmap_block); 588 #endif 589 ATF_TP_ADD_TC(tp, mmap_err); 590 ATF_TP_ADD_TC(tp, mmap_loan); 591 ATF_TP_ADD_TC(tp, mmap_prot_1); 592 ATF_TP_ADD_TC(tp, mmap_prot_2); 593 ATF_TP_ADD_TC(tp, mmap_prot_3); 594 ATF_TP_ADD_TC(tp, mmap_truncate); 595 ATF_TP_ADD_TC(tp, mmap_truncate_signal); 596 ATF_TP_ADD_TC(tp, mmap_va0); 597 598 return atf_no_error(); 599 } 600