From owner-freebsd-hackers  Mon Feb 28 12:50:23 2000
Delivered-To: freebsd-hackers@freebsd.org
Received: from orion.ac.hmc.edu (Orion.AC.HMC.Edu [134.173.32.20])
	by hub.freebsd.org (Postfix) with ESMTP id D479337B98C
	for <freebsd-hackers@freebsd.org>; Mon, 28 Feb 2000 12:50:19 -0800 (PST)
	(envelope-from brdavis@orion.ac.hmc.edu)
Received: (from brdavis@localhost)
	by orion.ac.hmc.edu (8.8.8/8.8.8) id MAA02786
	for freebsd-hackers@freebsd.org; Mon, 28 Feb 2000 12:50:14 -0800 (PST)
Date: Mon, 28 Feb 2000 12:50:13 -0800
From: Brooks Davis <brooks@one-eyed-alien.net>
To: freebsd-hackers@freebsd.org
Subject: mprotect(2) won't make shared memory read-only
Message-ID: <20000228125013.A25992@orion.ac.hmc.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0pre4i
Sender: owner-freebsd-hackers@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

On a -current system as of a week or two ago (as well as a 3.3-RC and a
2.2.8-STABLE box) I've found that mprotect fails with with EACCES when
trying to make a shared memory segment that was created user read/write
read-only.  It works find if I malloc the memory instead and making the
shm segment write-only or inaccessible works fine as well.  Is this
expected behavior?  If so it's pretty weird.

The following program can be used to exercise the bug.  Compiled normally
it will attempt to use SysV shared memory and compiled with -DUSEMALLOC
it will malloc the memory.  The correct behavior is to bus error and
dump core due to a trap on one of the memory accesses following the
mprotect.

--<cut>--
/* Test the mprotect(2) function */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/mman.h>
#include <sys/ipc.h>
#include <sys/shm.h>

#define SIZE 1024*sizeof(int)

int main(int argc, char **argv)
{
	int *array;

#ifdef USEMALLOC
	array = malloc(SIZE);
#else
	int shmid;
	shmid = shmget(IPC_PRIVATE, SIZE, SHM_R|SHM_W);
	array = shmat(shmid, NULL, 0);
	shmctl(shmid, IPC_RMID, NULL);
#endif

	bzero(array, SIZE);

	if(mprotect(array, SIZE, PROT_READ) != 0)
		perror("mprotect(array) failed");

	fprintf(stderr, "array[0] = %d\n", array[0]);

	array[0] = 1;

	return 0;
}
--<cut>--

Thanks,
Brooks

-- 
Any statement of the form "X is the one, true Y" is FALSE.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-hackers" in the body of the message