From owner-svn-src-user@freebsd.org Thu Nov 23 12:54:19 2017 Return-Path: Delivered-To: svn-src-user@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id B9947DEC228 for ; Thu, 23 Nov 2017 12:54:19 +0000 (UTC) (envelope-from pho@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 911B86A271; Thu, 23 Nov 2017 12:54:19 +0000 (UTC) (envelope-from pho@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id vANCsIu0098801; Thu, 23 Nov 2017 12:54:18 GMT (envelope-from pho@FreeBSD.org) Received: (from pho@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id vANCsILU098800; Thu, 23 Nov 2017 12:54:18 GMT (envelope-from pho@FreeBSD.org) Message-Id: <201711231254.vANCsILU098800@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: pho set sender to pho@FreeBSD.org using -f From: Peter Holm Date: Thu, 23 Nov 2017 12:54:18 +0000 (UTC) To: src-committers@freebsd.org, svn-src-user@freebsd.org Subject: svn commit: r326126 - user/pho/stress2/misc X-SVN-Group: user X-SVN-Commit-Author: pho X-SVN-Commit-Paths: user/pho/stress2/misc X-SVN-Commit-Revision: 326126 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-user@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: "SVN commit messages for the experimental " user" src tree" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Nov 2017 12:54:19 -0000 Author: pho Date: Thu Nov 23 12:54:18 2017 New Revision: 326126 URL: https://svnweb.freebsd.org/changeset/base/326126 Log: Add a regression test. PR: 223732 Sponsored by: Dell EMC Isilon Added: user/pho/stress2/misc/mmap32.sh (contents, props changed) Added: user/pho/stress2/misc/mmap32.sh ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ user/pho/stress2/misc/mmap32.sh Thu Nov 23 12:54:18 2017 (r326126) @@ -0,0 +1,202 @@ +#!/bin/sh + +# +# Copyright (c) 2017 Dell EMC Isilon +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# +# $FreeBSD$ +# + +# Bug 223732 - mmap(2) causes unkillable denial of service with specific +# flags +# Test scenario inspired by: Arto Pekkanen + +# Fixed by r326098. + +. ../default.cfg + +dir=/tmp +odir=`pwd` +cd $dir +sed '1,/^EOF/d' < $odir/$0 > $dir/mmap32.c +mycc -o mmap32 -Wall -Wextra -O0 -g mmap32.c || exit 1 +rm -f mmap32.c + +$dir/mmap32 +s=$? +[ -f mmap32.core -a $s -eq 0 ] && + { ls -l mmap32.core; mv mmap32.core /tmp; s=1; } + +rm -rf $dir/mmap32 +exit $s + +EOF +#include +#include +#include +#include + +#include +#include +#include +#include +#include + +#define N 4096 +static uint32_t r[N]; + +static unsigned long +makearg(void) +{ + unsigned int i; + unsigned long val; + + val = arc4random(); + i = arc4random() % 100; + if (i < 20) + val = val & 0xff; + if (i >= 20 && i < 40) + val = val & 0xffff; + if (i >= 40 && i < 60) + val = (unsigned long)(r) | (val & 0xffff); +#if defined(__LP64__) + if (i >= 60) { + val = (val << 32) | arc4random(); + if (i > 80) + val = val & 0x00007fffffffffffUL; + } +#endif + + return(val); +} + +static void +fuzz(int arg, void *addr, size_t len, int prot, int flags, int fd, + off_t offset) +{ + time_t start; + void *vp; + int n; + + setproctitle("arg%d", arg); + n = 0; + start = time(NULL); + while (time(NULL) - start < 10) { + switch (arg) { + case 1: + addr = (void *)makearg(); + break; + case 2: + len = makearg(); + break; + case 3: + prot = makearg(); + break; + case 4: + flags = makearg(); + break; + case 5: + fd = makearg(); + break; + case 6: + offset = makearg() & 0xffff; + break; + case 34: + prot = makearg(); + flags = makearg(); + break; + } + vp = mmap(addr, len, prot, flags, fd, offset); + if (vp != MAP_FAILED) { + munmap(vp, len); + n++; + } + } +#if defined(DEBUG) + if (n == 0 && arg != 5) + fprintf(stderr, "%s(%d) failed\n", __func__, arg); +#endif + exit(0); +} + +int +main(void) +{ + off_t offset; + pid_t pid; + size_t len; + struct rlimit rl; + time_t start; + void *addr, *vp; + int e, flags, fd, i, prot, status; + + e = 0; + + rl.rlim_max = rl.rlim_cur = 0; + if (setrlimit(RLIMIT_CORE, &rl) == -1) + warn("setrlimit"); + addr = 0; + len = PAGE_SIZE; + prot = PROT_READ | PROT_WRITE; + flags = MAP_ANON | MAP_SHARED; + fd = -1; + offset = 0; + vp = mmap(addr, len, prot, flags, fd, offset); + if (vp == MAP_FAILED) + err(1, "initail mmap"); + munmap(vp, len); + + start = time(NULL); + while (time(NULL) - start < 120) { + for (i = 0; i < N; i++) + r[i] = arc4random(); + for (i = 0; i < 6; i++) { + if ((pid = fork()) == 0) + fuzz(i + 1, addr, len, prot, flags, fd, + offset); + if (waitpid(pid, &status, 0) != pid) + err(1, "waitpid %d", pid); + if (status != 0) { + if (WIFSIGNALED(status)) + fprintf(stderr, + "pid %d exit signal %d\n", + pid, WTERMSIG(status)); + } + e += status == 0 ? 0 : 1; + } + if ((pid = fork()) == 0) + fuzz(34, addr, len, prot, flags, fd, offset); + if (waitpid(pid, &status, 0) != pid) + err(1, "waitpid %d", pid); + if (status != 0) { + if (WIFSIGNALED(status)) + fprintf(stderr, + "pid %d exit signal %d\n", + pid, WTERMSIG(status)); + } + e += status == 0 ? 0 : 1; + } + + return (e); +}