Date: Thu, 23 Nov 2017 12:54:18 +0000 (UTC) From: Peter Holm <pho@FreeBSD.org> To: src-committers@freebsd.org, svn-src-user@freebsd.org Subject: svn commit: r326126 - user/pho/stress2/misc Message-ID: <201711231254.vANCsILU098800@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: pho Date: Thu Nov 23 12:54:18 2017 New Revision: 326126 URL: https://svnweb.freebsd.org/changeset/base/326126 Log: Add a regression test. PR: 223732 Sponsored by: Dell EMC Isilon Added: user/pho/stress2/misc/mmap32.sh (contents, props changed) Added: user/pho/stress2/misc/mmap32.sh ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ user/pho/stress2/misc/mmap32.sh Thu Nov 23 12:54:18 2017 (r326126) @@ -0,0 +1,202 @@ +#!/bin/sh + +# +# Copyright (c) 2017 Dell EMC Isilon +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# +# $FreeBSD$ +# + +# Bug 223732 - mmap(2) causes unkillable denial of service with specific +# flags +# Test scenario inspired by: Arto Pekkanen <aksyom@gmail.com> + +# Fixed by r326098. + +. ../default.cfg + +dir=/tmp +odir=`pwd` +cd $dir +sed '1,/^EOF/d' < $odir/$0 > $dir/mmap32.c +mycc -o mmap32 -Wall -Wextra -O0 -g mmap32.c || exit 1 +rm -f mmap32.c + +$dir/mmap32 +s=$? +[ -f mmap32.core -a $s -eq 0 ] && + { ls -l mmap32.core; mv mmap32.core /tmp; s=1; } + +rm -rf $dir/mmap32 +exit $s + +EOF +#include <sys/param.h> +#include <sys/mman.h> +#include <sys/resource.h> +#include <sys/wait.h> + +#include <err.h> +#include <stdlib.h> +#include <stdio.h> +#include <time.h> +#include <unistd.h> + +#define N 4096 +static uint32_t r[N]; + +static unsigned long +makearg(void) +{ + unsigned int i; + unsigned long val; + + val = arc4random(); + i = arc4random() % 100; + if (i < 20) + val = val & 0xff; + if (i >= 20 && i < 40) + val = val & 0xffff; + if (i >= 40 && i < 60) + val = (unsigned long)(r) | (val & 0xffff); +#if defined(__LP64__) + if (i >= 60) { + val = (val << 32) | arc4random(); + if (i > 80) + val = val & 0x00007fffffffffffUL; + } +#endif + + return(val); +} + +static void +fuzz(int arg, void *addr, size_t len, int prot, int flags, int fd, + off_t offset) +{ + time_t start; + void *vp; + int n; + + setproctitle("arg%d", arg); + n = 0; + start = time(NULL); + while (time(NULL) - start < 10) { + switch (arg) { + case 1: + addr = (void *)makearg(); + break; + case 2: + len = makearg(); + break; + case 3: + prot = makearg(); + break; + case 4: + flags = makearg(); + break; + case 5: + fd = makearg(); + break; + case 6: + offset = makearg() & 0xffff; + break; + case 34: + prot = makearg(); + flags = makearg(); + break; + } + vp = mmap(addr, len, prot, flags, fd, offset); + if (vp != MAP_FAILED) { + munmap(vp, len); + n++; + } + } +#if defined(DEBUG) + if (n == 0 && arg != 5) + fprintf(stderr, "%s(%d) failed\n", __func__, arg); +#endif + exit(0); +} + +int +main(void) +{ + off_t offset; + pid_t pid; + size_t len; + struct rlimit rl; + time_t start; + void *addr, *vp; + int e, flags, fd, i, prot, status; + + e = 0; + + rl.rlim_max = rl.rlim_cur = 0; + if (setrlimit(RLIMIT_CORE, &rl) == -1) + warn("setrlimit"); + addr = 0; + len = PAGE_SIZE; + prot = PROT_READ | PROT_WRITE; + flags = MAP_ANON | MAP_SHARED; + fd = -1; + offset = 0; + vp = mmap(addr, len, prot, flags, fd, offset); + if (vp == MAP_FAILED) + err(1, "initail mmap"); + munmap(vp, len); + + start = time(NULL); + while (time(NULL) - start < 120) { + for (i = 0; i < N; i++) + r[i] = arc4random(); + for (i = 0; i < 6; i++) { + if ((pid = fork()) == 0) + fuzz(i + 1, addr, len, prot, flags, fd, + offset); + if (waitpid(pid, &status, 0) != pid) + err(1, "waitpid %d", pid); + if (status != 0) { + if (WIFSIGNALED(status)) + fprintf(stderr, + "pid %d exit signal %d\n", + pid, WTERMSIG(status)); + } + e += status == 0 ? 0 : 1; + } + if ((pid = fork()) == 0) + fuzz(34, addr, len, prot, flags, fd, offset); + if (waitpid(pid, &status, 0) != pid) + err(1, "waitpid %d", pid); + if (status != 0) { + if (WIFSIGNALED(status)) + fprintf(stderr, + "pid %d exit signal %d\n", + pid, WTERMSIG(status)); + } + e += status == 0 ? 0 : 1; + } + + return (e); +}
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201711231254.vANCsILU098800>