1 /*- 2 * Copyright (c) 2009 Simon L. Nielsen <simon@FreeBSD.org>, 3 * Bjoern A. Zeeb <bz@FreeBSD.org> 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 * 26 * $FreeBSD$ 27 */ 28 29 #include <sys/param.h> 30 #include <sys/mman.h> 31 #include <sys/sysctl.h> 32 33 #include <atf-c.h> 34 #include <errno.h> 35 #include <fcntl.h> 36 #include <stdarg.h> 37 #include <stdio.h> 38 #include <stdlib.h> 39 40 static const struct { 41 void *addr; 42 int ok[2]; /* Depending on security.bsd.map_at_zero {0, !=0}. */ 43 } map_at_zero_tests[] = { 44 { (void *)0, { 0, 1 } }, /* Test sysctl. */ 45 { (void *)1, { 0, 0 } }, 46 { (void *)(PAGE_SIZE - 1), { 0, 0 } }, 47 { (void *)PAGE_SIZE, { 1, 1 } }, 48 { (void *)-1, { 0, 0 } }, 49 { (void *)(-PAGE_SIZE), { 0, 0 } }, 50 { (void *)(-1 - PAGE_SIZE), { 0, 0 } }, 51 { (void *)(-1 - PAGE_SIZE - 1), { 0, 0 } }, 52 { (void *)(0x1000 * PAGE_SIZE), { 1, 1 } }, 53 }; 54 55 #define MAP_AT_ZERO "security.bsd.map_at_zero" 56 57 ATF_TC_WITHOUT_HEAD(mmap__map_at_zero); 58 ATF_TC_BODY(mmap__map_at_zero, tc) 59 { 60 void *p; 61 size_t len; 62 unsigned int i; 63 int map_at_zero; 64 65 len = sizeof(map_at_zero); 66 if (sysctlbyname(MAP_AT_ZERO, &map_at_zero, &len, NULL, 0) == -1) { 67 atf_tc_skip("sysctl for %s failed: %s\n", MAP_AT_ZERO, 68 strerror(errno)); 69 return; 70 } 71 72 /* Normalize to 0 or 1 for array access. */ 73 map_at_zero = !!map_at_zero; 74 75 for (i = 0; i < nitems(map_at_zero_tests); i++) { 76 p = mmap((void *)map_at_zero_tests[i].addr, PAGE_SIZE, 77 PROT_READ | PROT_WRITE | PROT_EXEC, MAP_ANON | MAP_FIXED, 78 -1, 0); 79 if (p == MAP_FAILED) { 80 ATF_CHECK_MSG(map_at_zero_tests[i].ok[map_at_zero] == 0, 81 "mmap(%p, ...) failed", map_at_zero_tests[i].addr); 82 } else { 83 ATF_CHECK_MSG(map_at_zero_tests[i].ok[map_at_zero] == 1, 84 "mmap(%p, ...) succeeded: p=%p\n", 85 map_at_zero_tests[i].addr, p); 86 } 87 } 88 } 89 90 static void 91 checked_mmap(int prot, int flags, int fd, int error, const char *msg) 92 { 93 void *p; 94 int pagesize; 95 96 ATF_REQUIRE((pagesize = getpagesize()) > 0); 97 p = mmap(NULL, pagesize, prot, flags, fd, 0); 98 if (p == MAP_FAILED) { 99 if (error == 0) 100 ATF_CHECK_MSG(0, "%s failed with errno %d", msg, 101 errno); 102 else 103 ATF_CHECK_EQ_MSG(error, errno, 104 "%s failed with wrong errno %d (expected %d)", msg, 105 errno, error); 106 } else { 107 ATF_CHECK_MSG(error == 0, "%s succeeded", msg); 108 munmap(p, pagesize); 109 } 110 } 111 112 ATF_TC_WITHOUT_HEAD(mmap__bad_arguments); 113 ATF_TC_BODY(mmap__bad_arguments, tc) 114 { 115 int devstatfd, pagesize, shmfd, zerofd; 116 117 ATF_REQUIRE((pagesize = getpagesize()) > 0); 118 ATF_REQUIRE((devstatfd = open("/dev/devstat", O_RDONLY)) >= 0); 119 ATF_REQUIRE((shmfd = shm_open(SHM_ANON, O_RDWR, 0644)) >= 0); 120 ATF_REQUIRE(ftruncate(shmfd, pagesize) == 0); 121 ATF_REQUIRE((zerofd = open("/dev/zero", O_RDONLY)) >= 0); 122 123 /* These should work. */ 124 checked_mmap(PROT_READ | PROT_WRITE, MAP_ANON, -1, 0, 125 "simple MAP_ANON"); 126 checked_mmap(PROT_READ | PROT_WRITE, MAP_SHARED, shmfd, 0, 127 "simple shm fd shared"); 128 checked_mmap(PROT_READ | PROT_WRITE, MAP_PRIVATE, shmfd, 0, 129 "simple shm fd private"); 130 checked_mmap(PROT_READ, MAP_SHARED, zerofd, 0, 131 "simple /dev/zero shared"); 132 checked_mmap(PROT_READ | PROT_WRITE, MAP_PRIVATE, zerofd, 0, 133 "simple /dev/zero private"); 134 checked_mmap(PROT_READ, MAP_SHARED, devstatfd, 0, 135 "simple /dev/devstat shared"); 136 137 /* Extra PROT flags. */ 138 checked_mmap(PROT_READ | PROT_WRITE | 0x100000, MAP_ANON, -1, EINVAL, 139 "MAP_ANON with extra PROT flags"); 140 checked_mmap(0xffff, MAP_SHARED, shmfd, EINVAL, 141 "shm fd with garbage PROT"); 142 143 /* Undefined flag. */ 144 checked_mmap(PROT_READ | PROT_WRITE, MAP_ANON | MAP_RESERVED0080, -1, 145 EINVAL, "Undefined flag"); 146 147 /* Both MAP_SHARED and MAP_PRIVATE */ 148 checked_mmap(PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE | 149 MAP_SHARED, -1, EINVAL, "MAP_ANON with both SHARED and PRIVATE"); 150 checked_mmap(PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_SHARED, shmfd, 151 EINVAL, "shm fd with both SHARED and PRIVATE"); 152 153 /* At least one of MAP_SHARED or MAP_PRIVATE without ANON */ 154 checked_mmap(PROT_READ | PROT_WRITE, 0, shmfd, EINVAL, 155 "shm fd without sharing flag"); 156 157 /* MAP_ANON with either sharing flag (impacts fork). */ 158 checked_mmap(PROT_READ | PROT_WRITE, MAP_ANON | MAP_SHARED, -1, 0, 159 "shared MAP_ANON"); 160 checked_mmap(PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0, 161 "private MAP_ANON"); 162 163 /* MAP_ANON should require an fd of -1. */ 164 checked_mmap(PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, 0, EINVAL, 165 "MAP_ANON with fd != -1"); 166 167 /* Writable MAP_SHARED should fail on read-only descriptors. */ 168 checked_mmap(PROT_READ | PROT_WRITE, MAP_SHARED, zerofd, EACCES, 169 "MAP_SHARED of read-only /dev/zero"); 170 171 /* 172 * Character devices other than /dev/zero do not support private 173 * mappings. 174 */ 175 checked_mmap(PROT_READ, MAP_PRIVATE, devstatfd, EINVAL, 176 "MAP_PRIVATE of /dev/devstat"); 177 178 close(devstatfd); 179 close(shmfd); 180 close(zerofd); 181 } 182 183 ATF_TC_WITHOUT_HEAD(mmap__dev_zero_private); 184 ATF_TC_BODY(mmap__dev_zero_private, tc) 185 { 186 char *p1, *p2, *p3; 187 int fd, i, pagesize; 188 189 ATF_REQUIRE((pagesize = getpagesize()) > 0); 190 ATF_REQUIRE((fd = open("/dev/zero", O_RDONLY)) >= 0); 191 192 p1 = mmap(NULL, pagesize, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0); 193 ATF_REQUIRE(p1 != MAP_FAILED); 194 195 p2 = mmap(NULL, pagesize, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0); 196 ATF_REQUIRE(p2 != MAP_FAILED); 197 198 for (i = 0; i < pagesize; i++) 199 ATF_REQUIRE_EQ_MSG(0, p1[i], "byte at p1[%d] is %x", i, p1[i]); 200 201 ATF_REQUIRE(memcmp(p1, p2, pagesize) == 0); 202 203 p1[0] = 1; 204 205 ATF_REQUIRE(p2[0] == 0); 206 207 p2[0] = 2; 208 209 ATF_REQUIRE(p1[0] == 1); 210 211 p3 = mmap(NULL, pagesize, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0); 212 ATF_REQUIRE(p3 != MAP_FAILED); 213 214 ATF_REQUIRE(p3[0] == 0); 215 216 munmap(p1, pagesize); 217 munmap(p2, pagesize); 218 munmap(p3, pagesize); 219 close(fd); 220 } 221 222 ATF_TC_WITHOUT_HEAD(mmap__dev_zero_shared); 223 ATF_TC_BODY(mmap__dev_zero_shared, tc) 224 { 225 char *p1, *p2, *p3; 226 int fd, i, pagesize; 227 228 ATF_REQUIRE((pagesize = getpagesize()) > 0); 229 ATF_REQUIRE((fd = open("/dev/zero", O_RDWR)) >= 0); 230 231 p1 = mmap(NULL, pagesize, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); 232 ATF_REQUIRE(p1 != MAP_FAILED); 233 234 p2 = mmap(NULL, pagesize, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); 235 ATF_REQUIRE(p2 != MAP_FAILED); 236 237 for (i = 0; i < pagesize; i++) 238 ATF_REQUIRE_EQ_MSG(0, p1[i], "byte at p1[%d] is %x", i, p1[i]); 239 240 ATF_REQUIRE(memcmp(p1, p2, pagesize) == 0); 241 242 p1[0] = 1; 243 244 ATF_REQUIRE(p2[0] == 0); 245 246 p2[0] = 2; 247 248 ATF_REQUIRE(p1[0] == 1); 249 250 p3 = mmap(NULL, pagesize, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 251 0); 252 ATF_REQUIRE(p3 != MAP_FAILED); 253 254 ATF_REQUIRE(p3[0] == 0); 255 256 munmap(p1, pagesize); 257 munmap(p2, pagesize); 258 munmap(p3, pagesize); 259 close(fd); 260 } 261 262 ATF_TC_WITHOUT_HEAD(mmap__write_only); 263 ATF_TC_BODY(mmap__write_only, tc) 264 { 265 void *p; 266 int pagesize; 267 268 ATF_REQUIRE((pagesize = getpagesize()) > 0); 269 p = mmap(NULL, pagesize, PROT_WRITE, MAP_ANON, -1, 0); 270 ATF_REQUIRE(p != MAP_FAILED); 271 272 *(volatile uint32_t *)p = 0x12345678; 273 274 munmap(p, pagesize); 275 } 276 277 ATF_TP_ADD_TCS(tp) 278 { 279 280 ATF_TP_ADD_TC(tp, mmap__map_at_zero); 281 ATF_TP_ADD_TC(tp, mmap__bad_arguments); 282 ATF_TP_ADD_TC(tp, mmap__dev_zero_private); 283 ATF_TP_ADD_TC(tp, mmap__dev_zero_shared); 284 ATF_TP_ADD_TC(tp, mmap__write_only); 285 286 return (atf_no_error()); 287 } 288