Because mremap does not have a MAP_FIXED_NOREPLACE flag, it can destroy
existing mappings. This causes a segfault when regions such as text are
remapped and the permissions are changed.
Verify the requested mremap destination address does not overlap any
existing mappings by using mmap's MAP_FIXED_NOREPLACE flag. Keep
incrementing the destination address until a valid mapping is found or
fail the current test once the max address is reached.
Signed-off-by: Sidhartha Kumar <[email protected]>
---
v2:
-rename remap_region_valid() to is_remap_region_valid().
-change return value of is_remap_region_valid() to bool.
-take out overflow check from is_remap_region_valid() to
inside caller.
-fail just the current test on overflow rather than existing
the program
-fix alignment of mmap calls
-change "can't" to "couldn't" in error message
-increment mremap destination address by dest_alignment
rather than src_alignment
tools/testing/selftests/vm/mremap_test.c | 42 ++++++++++++++++++++++--
1 file changed, 39 insertions(+), 3 deletions(-)
diff --git a/tools/testing/selftests/vm/mremap_test.c b/tools/testing/selftests/vm/mremap_test.c
index 2b3b4f15185f..e3ce33a9954e 100644
--- a/tools/testing/selftests/vm/mremap_test.c
+++ b/tools/testing/selftests/vm/mremap_test.c
@@ -10,6 +10,7 @@
#include <string.h>
#include <sys/mman.h>
#include <time.h>
+#include <stdbool.h>
#include "../kselftest.h"
@@ -65,6 +66,30 @@ enum {
.expect_failure = should_fail \
}
+/*
+ * Returns false if the requested remap region overlaps with an
+ * existing mapping (e.g text, stack) else returns true.
+ */
+static bool is_remap_region_valid(void *addr, unsigned long long size)
+{
+ void *remap_addr = NULL;
+ bool ret = true;
+
+ /* Use MAP_FIXED_NOREPLACE flag to ensure region is not mapped */
+ remap_addr = mmap(addr, size, PROT_READ | PROT_WRITE,
+ MAP_FIXED_NOREPLACE | MAP_ANONYMOUS | MAP_SHARED,
+ -1, 0);
+
+ if (remap_addr == MAP_FAILED) {
+ if (errno == EEXIST)
+ ret = false;
+ } else {
+ munmap(remap_addr, size);
+ }
+
+ return ret;
+}
+
/* Returns mmap_min_addr sysctl tunable from procfs */
static unsigned long long get_mmap_min_addr(void)
{
@@ -112,8 +137,8 @@ static void *get_source_mapping(struct config c)
goto retry;
src_addr = mmap((void *) addr, c.region_size, PROT_READ | PROT_WRITE,
- MAP_FIXED_NOREPLACE | MAP_ANONYMOUS | MAP_SHARED,
- -1, 0);
+ MAP_FIXED_NOREPLACE | MAP_ANONYMOUS | MAP_SHARED,
+ -1, 0);
if (src_addr == MAP_FAILED) {
if (errno == EPERM || errno == EEXIST)
goto retry;
@@ -180,9 +205,20 @@ static long long remap_region(struct config c, unsigned int threshold_mb,
if (!((unsigned long long) addr & c.dest_alignment))
addr = (void *) ((unsigned long long) addr | c.dest_alignment);
+ /* Don't destroy existing mappings unless expected to overlap */
+ while (!is_remap_region_valid(addr, c.region_size) && !c.overlapping) {
+ /* Check for unsigned overflow */
+ if (addr + c.dest_alignment < addr) {
+ ksft_print_msg("Couldn't find a valid region to remap to\n");
+ ret = -1;
+ goto out;
+ }
+ addr += c.dest_alignment;
+ }
+
clock_gettime(CLOCK_MONOTONIC, &t_start);
dest_addr = mremap(src_addr, c.region_size, c.region_size,
- MREMAP_MAYMOVE|MREMAP_FIXED, (char *) addr);
+ MREMAP_MAYMOVE|MREMAP_FIXED, (char *) addr);
clock_gettime(CLOCK_MONOTONIC, &t_end);
if (dest_addr == MAP_FAILED) {
--
2.27.0
On Thu, 21 Apr 2022 13:31:56 -0600 Shuah Khan <[email protected]> wrote:
> Andrew, please let me know if you would like me to take this
> through kselftest tree.
I'm easy. If it turns up in linux-next via your tree, I drop the -mm copy.
On 4/20/22 3:57 PM, Sidhartha Kumar wrote:
> Because mremap does not have a MAP_FIXED_NOREPLACE flag, it can destroy
> existing mappings. This causes a segfault when regions such as text are
> remapped and the permissions are changed.
>
> Verify the requested mremap destination address does not overlap any
> existing mappings by using mmap's MAP_FIXED_NOREPLACE flag. Keep
> incrementing the destination address until a valid mapping is found or
> fail the current test once the max address is reached.
>
> Signed-off-by: Sidhartha Kumar <[email protected]>
> ---
> v2:
> -rename remap_region_valid() to is_remap_region_valid().
> -change return value of is_remap_region_valid() to bool.
> -take out overflow check from is_remap_region_valid() to
> inside caller.
> -fail just the current test on overflow rather than existing
> the program
> -fix alignment of mmap calls
> -change "can't" to "couldn't" in error message
> -increment mremap destination address by dest_alignment
> rather than src_alignment
>
Thank you.
Reviewed-by: Shuah Khan <[email protected]>
Andrew, please let me know if you would like me to take this
through kselftest tree.