Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19;
From:   Sidhartha Kumar <sidhartha.kumar@oracle.com>
To:     shuah@kernel.org, akpm@linux-foundation.org
Cc:     Sidhartha Kumar <sidhartha.kumar@oracle.com>, linux-mm@kvack.org,
        linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH 2/4] selftest/vm: verify remap destination address in mremap_test
Date:   Thu, 14 Apr 2022 17:15:27 +0000
Message-Id: <20220414171529.62058-3-sidhartha.kumar@oracle.com>
In-Reply-To: <20220414171529.62058-1-sidhartha.kumar@oracle.com>
References: <20220414171529.62058-1-sidhartha.kumar@oracle.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?aVkCTqMhWt4QkIDcNkzUISWR6DjlNgaJgXXH1ebTw1vs8fX4IoBmF3xakAFw?=
 =?us-ascii?Q?jTJG2IsZtcmv+zLFCx55HYz577UgsxdQ2jtYlezgIutgD56Q+seJxkgNlJWk?=
 =?us-ascii?Q?oVk96fOG4BynRW5M1mGbKnekBXbnqw8zpGcei7iMgxXgtBBu+1j5Qy0WLTmi?=
 =?us-ascii?Q?sSwXj5C9lUpQ2HFOMJvk59aXDeZ+6Z9/xZYyX5yDCGKzMhCAuyjQizXFSNX/?=
 =?us-ascii?Q?EvViTQWb3yZ+uVzVwyFipvlb+dkf18bA3NEcC8wnMJPiF41pC6HilwpLgSr5?=
 =?us-ascii?Q?+bButpvBjn1xae6i8iIccGE0pkYUDrPbx+wFpqbOP/h8zW0DtBZLRyF/7b5O?=
 =?us-ascii?Q?ghpET3p3AltNV8oNYRXPbKJs/3RMG0g0eTX/yWPfR34w5rfiLdfInmukE8I7?=
 =?us-ascii?Q?Nci74u+M2Jsa4+3p8HGHI8Y0RLiurowa7t+fT+KeGea45dtaBUzp2QMk44hN?=
 =?us-ascii?Q?SsjprtdsKmcoUuizrrudxmWQ53ss4BIdK2xUoPI5uPjPKr2oUvzwjLOK8wOW?=
 =?us-ascii?Q?xKWFD39sEpqLmsViZzc7i2bIE0RbkaieszPwjG+06gck7Ueqhlq3Yhg2ID9G?=
 =?us-ascii?Q?9w4Nj8y5AXF3SIJZewEdNMwDeS2Fk+24HvjMQdQTh72ZKAnuMEh4/ddS9Mz6?=
 =?us-ascii?Q?wWz02WYw6yhSeKFm6zKrDAXWAdlc+926KNLurM4XZyCXiJEV5+OCMyvsljx9?=
 =?us-ascii?Q?3ZIcMqAaPz4NkZYH9ntAfm82liLmz/b+cEJWvNi+Fpkze0iKI+Erg7/Gn/HT?=
 =?us-ascii?Q?wM5CoLrpgtDNjG6+lgeM9fSIkVXxaekTcksvTKAQBrdbqc5gyKYLZAw43Q3y?=
 =?us-ascii?Q?2hZJfkaeHtu3GrG7Wkzu+XooCBxr5+aUXL4obi2T8pyy2QroezRoKfdxwKdX?=
 =?us-ascii?Q?Xbc4+B7F5WTHdyhBaOJ97uHe3LLOQhm6L+bqDzvGG727ecA8B30DsXjLn9qA?=
 =?us-ascii?Q?oB61v3h1f8xdC7k1CmE5Upo6c/x+rUn9W48vsgIKnaf0ybYr1pPbQUw7rCIZ?=
 =?us-ascii?Q?UCqVqqTq63B7zjMxoSjR1gLm+xdMdbdW4Zs8MyZc+SuF7fp/ye8LjtWmWjdO?=
 =?us-ascii?Q?t2KgqVGQkWgQqSvLSpHrL9WCoUmbIYHC010LbTUx0H6YzJUvkEOq599HUvoo?=
 =?us-ascii?Q?Lb8ZtHTloFKChfs5h5ZKKKfVfNwvc3mP59eTn2PYOK11lFvPKaBxEXvHaJ8D?=
 =?us-ascii?Q?ZI0DAbhQ6W/JqEtZQuOt2E482nm7GVXyIj6qQlAkFtRMEoFgL0okBV0FJVAp?=
 =?us-ascii?Q?AdbQuFXgaB2VqXb4mHEutsKO4No8wEk7D1A1zyiIXAlI6Q+RR7pd7clo/PbV?=
 =?us-ascii?Q?Jlanr6qsTXAkmui4yK3OkDk4rMutoKhFFlxsqX85krMBI1pyRZAuaZP6+ycN?=
 =?us-ascii?Q?J2TOEzdj0Z/56trmGWc7ch7V7PSXjEcmuhydvVmwKKxJQNH/KVO9qpzyhYqB?=
 =?us-ascii?Q?XkfOMEDxbGy7gVsOYBoDI1HrzQTuOAIKGbtbgEVlgHa67znicbUAbTvcO84l?=
 =?us-ascii?Q?ROtTw7jUAwzXFtHxoV6jJ9jjq6gElC5sz1nFlgSomwM3dYljux40d8KnXiQ9?=
 =?us-ascii?Q?cJIAJjU7/aKv9QECd8GgcZdnowHuh2StHOALXWSLjGRu/T5yd/0HorEwFT/y?=
 =?us-ascii?Q?VgqlPlIyrKT3yVxqshuGv9OSp1H0YP7bSoBv9MdS8EfvNuRanPpVApOXLB2d?=
 =?us-ascii?Q?lFINRENzwymoAZn+KEGb0KgWrJns/cqxoclf5ViiFx3TuKU0PR7APTM1nKSM?=
 =?us-ascii?Q?jS82WiG0w84v+GVpFQsXXYrtGMJGtlA=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 0ad12b10-ae26-46a6-0ccd-08da1e3a67d8
X-MS-Exchange-CrossTenant-AuthSource: CH0PR10MB5113.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Apr 2022 17:15:42.6900
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: zJ9COhVnSdhAYplyZrzNq4m5Wr0m8bquTUF76A0Lri299pdTJ0jHtyu1PYD8T4tAmigvcTlgyHLxWVoUz3/ebRWN4GHeAmh9XbbDrVoAYqE=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR1001MB2344
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.486,18.0.858
 definitions=2022-04-14_04:2022-04-14,2022-04-14 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 malwarescore=0 bulkscore=0
 suspectscore=0 mlxlogscore=999 mlxscore=0 spamscore=0 phishscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2202240000
 definitions=main-2204140092
X-Proofpoint-ORIG-GUID: x5R3_Fugc65hwKds1ri1zvaYW1h0CZ_d
X-Proofpoint-GUID: x5R3_Fugc65hwKds1ri1zvaYW1h0CZ_d
X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE
	autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
	lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Because mremap does not have a NOREPLACE flag,
it can destroy existing mappings. This can
cause a segfault if regions such as text are
destroyed. Verify the requested mremap destination
address does not overlap any existing mappings
by using mmap's FIXED_NOREPLACE flag and checking
for the EEXIST error code. Keep incrementing the
destination address until a valid mapping is found
or max address is reached.

Signed-off-by: Sidhartha Kumar <sidhartha.kumar@oracle.com>
---
 tools/testing/selftests/vm/mremap_test.c | 36 ++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/tools/testing/selftests/vm/mremap_test.c b/tools/testing/selftests/vm/mremap_test.c
index 58600fee4b81..98e9cff34aa7 100644
--- a/tools/testing/selftests/vm/mremap_test.c
+++ b/tools/testing/selftests/vm/mremap_test.c
@@ -10,6 +10,7 @@
 #include <string.h>
 #include <sys/mman.h>
 #include <time.h>
+#include <limits.h>
 
 #include "../kselftest.h"
 
@@ -65,6 +66,34 @@ enum {
 	.expect_failure = should_fail				\
 }
 
+/*
+ * Returns 0 if the requested remap region overlaps with an
+ * existing mapping (e.g text, stack) else returns 1.
+ */
+static int remap_region_valid(void *addr, unsigned long long size)
+{
+	void *remap_addr = NULL;
+	int ret = 1;
+
+	if ((unsigned long long) addr > ULLONG_MAX - size) {
+		ksft_print_msg("Can't find a valid region to remap to\n");
+		exit(KSFT_SKIP);
+	}
+
+	/* Use MAP_FIXED_NOREPLACE flag to ensure region is not mapped */
+	remap_addr = mmap(addr, size, PROT_READ | PROT_WRITE,
+			MAP_FIXED_NOREPLACE | MAP_ANONYMOUS | MAP_SHARED,
+			-1, 0);
+	if (remap_addr == MAP_FAILED) {
+		if (errno == EEXIST)
+			ret = 0;
+	} else {
+		munmap(remap_addr, size);
+	}
+
+	return ret;
+}
+
 /* Returns mmap_min_addr sysctl */
 static unsigned long long get_mmap_min_addr(void)
 {
@@ -180,6 +209,13 @@ static long long remap_region(struct config c, unsigned int threshold_mb,
 	if (!((unsigned long long) addr & c.dest_alignment))
 		addr = (void *) ((unsigned long long) addr | c.dest_alignment);
 
+	/* Don't destroy existing mappings unless expected to overlap */
+	while (!remap_region_valid(addr, c.region_size)) {
+		if (c.overlapping)
+			break;
+		addr += c.src_alignment;
+	}
+
 	clock_gettime(CLOCK_MONOTONIC, &t_start);
 	dest_addr = mremap(src_addr, c.region_size, c.region_size,
 			MREMAP_MAYMOVE|MREMAP_FIXED, (char *) addr);
-- 
2.27.0