gh0s7/mckernel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

munmap: Change permission of VMA back to RWX on unmap

Browse Source 
Change-Id: Ic02098e7458dd8fa2961fb03dc32e37fb18c5dc5
Refs: #988
This commit is contained in:
Ken Sato
2019-07-26 09:25:36 +09:00
committed by Masamichi Takagi
parent c371fbf13b
commit 18412616e1
8 changed files with 465 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

128
test/issues/988/C988.c Normal file
View File

@ -0,0 +1,128 @@
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <sys/types.h>
#include <unistd.h>
#include <sys/mman.h>
#define DEF_PROT (PROT_READ | PROT_WRITE | PROT_EXEC)
int main(void)
{
long pgsize = getpagesize();
void *ptr1, *ptr2;
int rc, ret;
printf("*** Check VMA's prot ***\n");
ptr1 = mmap(0, pgsize, PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
if (ptr1 == MAP_FAILED) {
perror("mmap");
ret = -1;
goto out;
}
memset(ptr1, '1', pgsize);
printf("** mmap %p: Succeed\n", ptr1);
// Check default prot
rc = syscall(899, ptr1);
if (rc == PROT_READ | PROT_WRITE | PROT_EXEC) {
printf("[OK] default : %d\n", rc);
}
else {
printf("[NG] default : %d\n", rc);
ret = -1;
goto out;
}
// mprotec PROT_WRITE | PROT_EXEC to ptr1
rc = mprotect(ptr1, pgsize, PROT_NONE);
if (rc != 0) {
perror("mprotect");
ret = -1;
goto out;
}
rc = mprotect(ptr1, pgsize, PROT_WRITE | PROT_EXEC);
if (rc != 0) {
perror("mprotect");
ret = -1;
goto out;
}
printf("** mprotect PROT_WRITE | PROT_EXEC: Succeed\n");
// Check prot after mprotect
rc = syscall(899, ptr1);
if (rc == PROT_WRITE | PROT_EXEC) {
printf("[OK] after mprotect : %d\n", rc);
}
else {
printf("[NG] after mprotect : %d\n", rc);
ret = -1;
goto out;
}
munmap(ptr1, pgsize);
printf("** munmap %p: Done\n", ptr1);
// Check after munmap
rc = syscall(899, ptr1);
if (rc == DEF_PROT) {
printf("[OK] after munmap : %d\n", rc);
}
else {
printf("[NG] after munmap : %d\n", rc);
ret = -1;
goto out;
}
ptr2 = mmap(0, pgsize, PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
if (ptr2 == MAP_FAILED) {
perror("mmap");
ret = -1;
goto out;
}
memset(ptr2, '2', pgsize);
printf("** mmap %p: Succeed\n", ptr2);
// mprotec PROT_NONE to ptr2
rc = mprotect(ptr2, pgsize, PROT_NONE);
if (rc != 0) {
perror("mprotect");
ret = -1;
goto out;
}
printf("** mprotect PROT_NONE: Succeed\n");
// Check prot after mprotect
rc = syscall(899, ptr2);
if (rc != DEF_PROT) {
printf("[OK] after mprotect : %d\n", rc);
}
else {
printf("[NG] after mprotect : %d\n", rc);
ret = -1;
goto out;
}
munmap(ptr2, pgsize);
// Check after munmap
rc = syscall(899, ptr2);
if (rc == DEF_PROT) {
printf("[OK] after munmap : %d\n", rc);
}
else {
printf("[NG] after munmap : %d\n", rc);
ret = -1;
goto out;
}
out:
if (ret != 0) {
printf("TEST_FAILED\n");
}
return ret;
}

40
test/issues/988/C988.sh Executable file
View File

@ -0,0 +1,40 @@
#/bin/sh
USELTP=1
USEOSTEST=0
. ../../common.sh
issue=988
tid=01
tname=`printf "C${issue}T%02d" ${tid}`
echo "*** ${tname} start *******************************"
ng=0
${MCEXEC} ./C988
if [ $? -eq 0 ]; then
echo "*** ${tname} PASSED ******************************"
else
echo "*** ${tname} FAILED ******************************"
fi
let tid++
echo ""
for tp in mmap01 mmap02 mmap03 mmap04 mmap05 mmap06 mmap07 mmap08\
mmap09 mmap12 mmap14 mmap15
do
tname=`printf "C${issue}T%02d" ${tid}`
echo "*** ${tname} start *******************************"
sudo $MCEXEC $LTPBIN/$tp 2>&1 | tee $tp.txt
ok=`grep TPASS $tp.txt | wc -l`
ng=`grep TFAIL $tp.txt | wc -l`
if [ $ng = 0 ]; then
echo "*** ${tname} PASSED ($ok)"
else
echo "*** ${tname} FAILED (ok=$ok ng=%ng)"
fi
let tid++
echo ""
done

11
test/issues/988/Makefile Normal file
View File

@ -0,0 +1,11 @@
CFLAGS=-g
LDFLAGS=
TARGET=C988
all: $(TARGET)
test: all
./C988.sh
clean:
rm -f $(TARGET) *.o *.txt

54
test/issues/988/README Normal file
View File

@ -0,0 +1,54 @@
【Issue#988 動作確認】
□ 前提
・本Issueで修正したmcctrl_clear_pte_range() は、WRITE権限を持つmmap領域を
unmapした場合に呼び出される
なお、WRITE権限を持たない領域のunmapの際には、set_host_vma()によって
パーミッションの初期化が行われる
・McKernelでは、PROT_WRITEを変更しないmprotectを行った場合、
ホスト側のVMAの権限は変更されない
□ テスト内容
1. unmapしたホスト側のVMAの権限がRWX(デフォルト)になっていることを確認
C988T01:
以下の流れでmmap, mprotect, munmapを行い、munmap後のホスト側のVMAの
パーミッションを確認する
1. mmapでメモリ領域を確保
2. 確保した領域のVMAの権限がRWXであることを確認
3. 確保した領域にmprotect(PROT_NONE) -> mprotect(PROT_WRITE | PROT_EXEC)を行う
(McKernelではWRITE属性を変更しないmprotectはvmaを変更しないため、一度NONEを設定する)
4. 確保した領域のVMAの権限が-WXであることを確認
5. 確保した領域をmunmapで解放する
6. 解放後の領域のVMAの権限がRWXであることを確認
7. mmapで再びメモリ領域を確保
8. 確保した領域にmprotect(PROT_NONE)を行う
9. 確保した領域のVMAの権限がRWXでないことを確認
10. 確保した領域をmunmapで解放する
11. 解放後の領域のVMAの権限がRWXであることを確認
2. 以下のLTPを用いて既存のmmap機能に影響が無いことを確認
- mmap01
- mmap02
- mmap03
- mmap04
- mmap05
- mmap06
- mmap07
- mmap08
- mmap09
- mmap12
- mmap14
- mmap15
□ 実行手順
(1) cd <mckernel> && patch -p0 < <mckernel>/test/issues/988/get_vma_prot.patch
(2) McKernelをビルドする
(3) cd <mckernel>/test/issues/988/<arch> && make test
McKernelのインストール先や、OSTEST, LTPの配置場所は、
$HOME/.mck_test_config を参照している
.mck_test_config は、McKernelをビルドした際に生成されるmck_test_config.sample ファイルを
$HOMEにコピーし、適宜編集する
□ 実行結果
result_x86_64.log および result_aarch64.log 参照。
すべての項目をPASSしていることを確認。

71
test/issues/988/aarch64_result.log Normal file
View File

@ -0,0 +1,71 @@
*** C988T01 start *******************************
*** Check VMA's prot ***
** mmap 0x1000001e0000: Succeed
[OK] default : 7
** mprotect PROT_WRITE | PROT_EXEC: Succeed
[OK] after mprotect : 6
** munmap 0x1000001e0000: Done
[OK] after munmap : 7
** mmap 0x1000001f0000: Succeed
** mprotect PROT_NONE: Succeed
[OK] after mprotect : 4
[OK] after munmap : 7
*** C988T01 PASSED ******************************
*** C988T02 start *******************************
mmap01 1 TPASS : Functionality of mmap() successful
*** C988T02 PASSED (1)
*** C988T03 start *******************************
mmap02 1 TPASS : Functionality of mmap() successful
*** C988T03 PASSED (1)
*** C988T04 start *******************************
mmap03 1 TPASS : mmap() functionality is correct
*** C988T04 PASSED (1)
*** C988T05 start *******************************
mmap04 1 TPASS : Functionality of mmap() successful
*** C988T05 PASSED (1)
*** C988T06 start *******************************
mmap05 1 TPASS : Got SIGSEGV as expected
*** C988T06 PASSED (1)
*** C988T07 start *******************************
mmap06 1 TPASS : mmap failed with EACCES
*** C988T07 PASSED (1)
*** C988T08 start *******************************
mmap07 1 TPASS : mmap failed with EACCES
*** C988T08 PASSED (1)
*** C988T09 start *******************************
mmap08 1 TPASS : mmap failed with EBADF
*** C988T09 PASSED (1)
*** C988T10 start *******************************
mmap09 1 TPASS : ftruncate mmaped file to a smaller size
mmap09 2 TPASS : ftruncate mmaped file to a larger size
mmap09 3 TPASS : ftruncate mmaped file to 0 size
*** C988T10 PASSED (3)
*** C988T11 start *******************************
tst_test.c:1096: INFO: Timeout per run is 0h 05m 00s
mmap12.c:103: INFO: All pages are present
mmap12.c:127: PASS: File mapped properly
Summary:
passed 1
failed 0
skipped 0
warnings 0
*** C988T11 PASSED (0)
*** C988T12 start *******************************
mmap14 1 TPASS : Functionality of mmap() successful
*** C988T12 PASSED (1)
*** C988T13 start *******************************
mmap15 1 TPASS : mmap into high region failed as expected: errno=ENOMEM(12): Cannot allocate memory
*** C988T13 PASSED (1)

86
test/issues/988/get_vma_prot.patch Normal file
View File

@ -0,0 +1,86 @@
diff --git arch/arm64/kernel/include/syscall_list.h arch/arm64/kernel/include/syscall_list.h
index 5dd6243..cef0005 100644
--- arch/arm64/kernel/include/syscall_list.h
+++ arch/arm64/kernel/include/syscall_list.h
@@ -134,6 +134,7 @@ SYSCALL_HANDLED(802, linux_mlock)
SYSCALL_HANDLED(803, suspend_threads)
SYSCALL_HANDLED(804, resume_threads)
SYSCALL_HANDLED(811, linux_spawn)
+SYSCALL_HANDLED(899, get_vma_prot)
SYSCALL_DELEGATED(1024, open)
SYSCALL_DELEGATED(1035, readlink)
diff --git arch/x86_64/kernel/include/syscall_list.h arch/x86_64/kernel/include/syscall_list.h
index 8ef9bd0..f130dbb 100644
--- arch/x86_64/kernel/include/syscall_list.h
+++ arch/x86_64/kernel/include/syscall_list.h
@@ -176,4 +176,5 @@ SYSCALL_HANDLED(802, linux_mlock)
SYSCALL_HANDLED(803, suspend_threads)
SYSCALL_HANDLED(804, resume_threads)
SYSCALL_HANDLED(811, linux_spawn)
+SYSCALL_HANDLED(899, get_vma_prot)
/**** End of File ****/
diff --git executer/kernel/mcctrl/syscall.c executer/kernel/mcctrl/syscall.c
index d742875..02fc0ef 100644
--- executer/kernel/mcctrl/syscall.c
+++ executer/kernel/mcctrl/syscall.c
@@ -1777,6 +1777,28 @@ void __return_syscall(ihk_os_t os, struct ikc_scd_packet *packet,
ihk_device_unmap_memory(ihk_os_to_dev(os), phys, sizeof(*res));
}
+static int get_vma_prot(uintptr_t rva)
+{
+ struct mm_struct *mm = current->mm;
+ struct vm_area_struct *vma;
+ int prot;
+
+ down_write(&mm->mmap_sem);
+ vma = find_vma(mm, rva);
+ if (!vma || (rva < vma->vm_start)) {
+ printk("%s: find_vma failed.\n", __func__);
+ prot = -1;
+ goto out;
+ }
+
+ prot = (int)(vma->vm_flags & (VM_READ | VM_WRITE | VM_EXEC));
+
+out:
+ up_write(&mm->mmap_sem);
+
+ return prot;
+}
+
static int remap_user_space(uintptr_t rva, size_t len, int prot)
{
struct mm_struct *mm = current->mm;
@@ -2080,6 +2102,10 @@ int __do_in_kernel_syscall(ihk_os_t os, struct ikc_scd_packet *packet)
dprintk("%s: system call: %lx\n", __FUNCTION__, sc->args[0]);
switch (sc->number) {
+ case 899:
+ ret = get_vma_prot(sc->args[0]);
+ break;
+
case __NR_mmap:
ret = pager_call(os, sc);
break;
diff --git kernel/syscall.c kernel/syscall.c
index 6517f84..a27c6b6 100644
--- kernel/syscall.c
+++ kernel/syscall.c
@@ -2021,6 +2021,15 @@ out:
return error;
}
+SYSCALL_DECLARE(get_vma_prot)
+{
+ ihk_mc_user_context_t ctx0;
+ const unsigned long vaddr = ihk_mc_syscall_arg0(ctx);
+
+ ihk_mc_syscall_arg0(&ctx0) = vaddr;
+ return syscall_generic_forwarding(899, &ctx0);
+}
+
SYSCALL_DECLARE(mprotect)
{
const intptr_t start = ihk_mc_syscall_arg0(ctx);

71
test/issues/988/x86_64_result.log Normal file
View File

@ -0,0 +1,71 @@
*** C988T01 start *******************************
*** Check VMA's prot ***
** mmap 0x2aaaaadea000: Succeed
[OK] default : 7
** mprotect PROT_WRITE | PROT_EXEC: Succeed
[OK] after mprotect : 6
** munmap 0x2aaaaadea000: Done
[OK] after munmap : 7
** mmap 0x2aaaaadeb000: Succeed
** mprotect PROT_WRITE: Succeed
[OK] after mprotect : 0
[OK] after munmap : 7
*** C988T01 PASSED ******************************
*** C988T02 start *******************************
mmap01 1 TPASS : Functionality of mmap() successful
*** C988T02 PASSED (1)
*** C988T03 start *******************************
mmap02 1 TPASS : Functionality of mmap() successful
*** C988T03 PASSED (1)
*** C988T04 start *******************************
mmap03 1 TPASS : mmap() functionality is correct
*** C988T04 PASSED (1)
*** C988T05 start *******************************
mmap04 1 TPASS : Functionality of mmap() successful
*** C988T05 PASSED (1)
*** C988T06 start *******************************
mmap05 1 TPASS : Got SIGSEGV as expected
*** C988T06 PASSED (1)
*** C988T07 start *******************************
mmap06 1 TPASS : mmap failed with EACCES
*** C988T07 PASSED (1)
*** C988T08 start *******************************
mmap07 1 TPASS : mmap failed with EACCES
*** C988T08 PASSED (1)
*** C988T09 start *******************************
mmap08 1 TPASS : mmap failed with EBADF
*** C988T09 PASSED (1)
*** C988T10 start *******************************
mmap09 1 TPASS : ftruncate mmaped file to a smaller size
mmap09 2 TPASS : ftruncate mmaped file to a larger size
mmap09 3 TPASS : ftruncate mmaped file to 0 size
*** C988T10 PASSED (3)
*** C988T11 start *******************************
tst_test.c:934: INFO: Timeout per run is 0h 05m 00s
mmap12.c:103: INFO: All pages are present
mmap12.c:127: PASS: File mapped properly
Summary:
passed 1
failed 0
skipped 0
warnings 0
*** C988T11 PASSED (0)
*** C988T12 start *******************************
mmap14 1 TPASS : Functionality of mmap() successful
*** C988T12 PASSED (1)
*** C988T13 start *******************************
mmap15 1 TPASS : mmap into high region failed as expected: errno=ENOMEM(12): Cannot allocate memory
*** C988T13 PASSED (1)