diff mbox series

[v2,2/4] selftest/vm: verify remap destination address in mremap_test

Message ID 20220420215721.4868-2-sidhartha.kumar@oracle.com (mailing list archive)
State Accepted
Commit 2a144f0926ccff2b2fa5f9cd6c64a308056150a7
Headers show
Series [v2,1/4] selftest/vm: verify mmap addr in mremap_test | expand

Commit Message

Sidhartha Kumar April 20, 2022, 9:57 p.m. UTC
Because mremap does not have a MAP_FIXED_NOREPLACE flag, it can destroy
existing mappings. This causes a segfault when regions such as text are
remapped and the permissions are changed.

Verify the requested mremap destination address does not overlap any
existing mappings by using mmap's MAP_FIXED_NOREPLACE flag. Keep 
incrementing the destination address until a valid mapping is found or
fail the current test once the max address is reached.

Signed-off-by: Sidhartha Kumar <sidhartha.kumar@oracle.com>
---
v2:
-rename remap_region_valid() to is_remap_region_valid().
-change return value of is_remap_region_valid() to bool.
-take out overflow check from is_remap_region_valid() to 
 inside caller.
-fail just the current test on overflow rather than existing 
 the program
-fix alignment of mmap calls
-change "can't" to "couldn't" in error message
-increment mremap destination address by dest_alignment
 rather than src_alignment

 tools/testing/selftests/vm/mremap_test.c | 42 ++++++++++++++++++++++--
 1 file changed, 39 insertions(+), 3 deletions(-)

Comments

Shuah Khan April 21, 2022, 7:31 p.m. UTC | #1
On 4/20/22 3:57 PM, Sidhartha Kumar wrote:
> Because mremap does not have a MAP_FIXED_NOREPLACE flag, it can destroy
> existing mappings. This causes a segfault when regions such as text are
> remapped and the permissions are changed.
> 
> Verify the requested mremap destination address does not overlap any
> existing mappings by using mmap's MAP_FIXED_NOREPLACE flag. Keep
> incrementing the destination address until a valid mapping is found or
> fail the current test once the max address is reached.
> 
> Signed-off-by: Sidhartha Kumar <sidhartha.kumar@oracle.com>
> ---
> v2:
> -rename remap_region_valid() to is_remap_region_valid().
> -change return value of is_remap_region_valid() to bool.
> -take out overflow check from is_remap_region_valid() to
>   inside caller.
> -fail just the current test on overflow rather than existing
>   the program
> -fix alignment of mmap calls
> -change "can't" to "couldn't" in error message
> -increment mremap destination address by dest_alignment
>   rather than src_alignment
> 
Thank you.

Reviewed-by: Shuah Khan <skhan@linuxfoundation.org>

Andrew, please let me know if you would like me to take this
through kselftest tree.
Andrew Morton April 21, 2022, 8:03 p.m. UTC | #2
On Thu, 21 Apr 2022 13:31:56 -0600 Shuah Khan <skhan@linuxfoundation.org> wrote:

> Andrew, please let me know if you would like me to take this
> through kselftest tree.

I'm easy.  If it turns up in linux-next via your tree, I drop the -mm copy.
diff mbox series

Patch

diff --git a/tools/testing/selftests/vm/mremap_test.c b/tools/testing/selftests/vm/mremap_test.c
index 2b3b4f15185f..e3ce33a9954e 100644
--- a/tools/testing/selftests/vm/mremap_test.c
+++ b/tools/testing/selftests/vm/mremap_test.c
@@ -10,6 +10,7 @@ 
 #include <string.h>
 #include <sys/mman.h>
 #include <time.h>
+#include <stdbool.h>
 
 #include "../kselftest.h"
 
@@ -65,6 +66,30 @@  enum {
 	.expect_failure = should_fail				\
 }
 
+/*
+ * Returns false if the requested remap region overlaps with an
+ * existing mapping (e.g text, stack) else returns true.
+ */
+static bool is_remap_region_valid(void *addr, unsigned long long size)
+{
+	void *remap_addr = NULL;
+	bool ret = true;
+
+	/* Use MAP_FIXED_NOREPLACE flag to ensure region is not mapped */
+	remap_addr = mmap(addr, size, PROT_READ | PROT_WRITE,
+					 MAP_FIXED_NOREPLACE | MAP_ANONYMOUS | MAP_SHARED,
+					 -1, 0);
+
+	if (remap_addr == MAP_FAILED) {
+		if (errno == EEXIST)
+			ret = false;
+	} else {
+		munmap(remap_addr, size);
+	}
+
+	return ret;
+}
+
 /* Returns mmap_min_addr sysctl tunable from procfs */
 static unsigned long long get_mmap_min_addr(void)
 {
@@ -112,8 +137,8 @@  static void *get_source_mapping(struct config c)
 		goto retry;
 
 	src_addr = mmap((void *) addr, c.region_size, PROT_READ | PROT_WRITE,
-			MAP_FIXED_NOREPLACE | MAP_ANONYMOUS | MAP_SHARED,
-			-1, 0);
+					MAP_FIXED_NOREPLACE | MAP_ANONYMOUS | MAP_SHARED,
+					-1, 0);
 	if (src_addr == MAP_FAILED) {
 		if (errno == EPERM || errno == EEXIST)
 			goto retry;
@@ -180,9 +205,20 @@  static long long remap_region(struct config c, unsigned int threshold_mb,
 	if (!((unsigned long long) addr & c.dest_alignment))
 		addr = (void *) ((unsigned long long) addr | c.dest_alignment);
 
+	/* Don't destroy existing mappings unless expected to overlap */
+	while (!is_remap_region_valid(addr, c.region_size) && !c.overlapping) {
+		/* Check for unsigned overflow */
+		if (addr + c.dest_alignment < addr) {
+			ksft_print_msg("Couldn't find a valid region to remap to\n");
+			ret = -1;
+			goto out;
+		}
+		addr += c.dest_alignment;
+	}
+
 	clock_gettime(CLOCK_MONOTONIC, &t_start);
 	dest_addr = mremap(src_addr, c.region_size, c.region_size,
-			MREMAP_MAYMOVE|MREMAP_FIXED, (char *) addr);
+					  MREMAP_MAYMOVE|MREMAP_FIXED, (char *) addr);
 	clock_gettime(CLOCK_MONOTONIC, &t_end);
 
 	if (dest_addr == MAP_FAILED) {