1/* 2 * Copyright (C) 2012 Red Hat, Inc. 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of version 2 of the GNU General Public 6 * License as published by the Free Software Foundation. 7 * 8 * This program is distributed in the hope that it would be useful, 9 * but WITHOUT ANY WARRANTY; without even the implied warranty of 10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 11 * 12 * Further, this software is distributed without any warranty that it 13 * is free of the rightful claim of any third person regarding 14 * infringement or the like. Any license provided herein, whether 15 * implied or otherwise, applies only to this software file. Patent 16 * licenses, if any, provided herein do not apply to combinations of 17 * this program with other software, or any other product whatsoever. 18 * 19 * You should have received a copy of the GNU General Public License 20 * along with this program; if not, write the Free Software 21 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 22 * 02110-1301, USA. 23 */ 24/* 25 * This is a reproducer for CVE-2011-2496. 26 * 27 * The normal mmap paths all avoid creating a mapping where the pgoff 28 * inside the mapping could wrap around due to overflow. However, an 29 * expanding mremap() can take such a non-wrapping mapping and make it 30 * bigger and cause a wrapping condition. There is also another case 31 * where we expand mappings hiding in plain sight: the automatic stack 32 * expansion. 33 * 34 * This program tries to remap a mapping with a new size that would 35 * wrap pgoff. Notice that it only works on 32-bit arch for now. 36 */ 37 38#define _GNU_SOURCE 39#include "config.h" 40#include <sys/types.h> 41#include <sys/mman.h> 42#include <sys/stat.h> 43#include <sys/syscall.h> 44#include <errno.h> 45#include <fcntl.h> 46#include <limits.h> 47#include <stdio.h> 48#include <stdlib.h> 49#include <unistd.h> 50 51#include "test.h" 52 53char *TCID = "vma03"; 54int TST_TOTAL = 1; 55 56#ifdef __NR_mmap2 57#define TESTFILE "testfile" 58 59static size_t pgsz; 60static int fd; 61 62static void *mmap2(void *addr, size_t length, int prot, 63 int flags, int fd, off_t pgoffset); 64static void setup(void); 65static void cleanup(void); 66 67int main(int argc, char *argv[]) 68{ 69 int lc; 70 void *map, *remap; 71 off_t pgoff; 72 73#if __WORDSIZE != 32 74 tst_brkm(TCONF, NULL, "test is designed for 32-bit system only."); 75#endif 76 tst_parse_opts(argc, argv, NULL, NULL); 77 78 pgsz = sysconf(_SC_PAGE_SIZE); 79 setup(); 80 81 for (lc = 0; TEST_LOOPING(lc); lc++) { 82 tst_count = 0; 83 84 fd = open(TESTFILE, O_RDWR); 85 if (fd == -1) 86 tst_brkm(TBROK | TERRNO, NULL, "open %s", TESTFILE); 87 88 pgoff = ULONG_MAX - 1; 89 map = mmap2(NULL, pgsz, PROT_READ | PROT_WRITE, MAP_PRIVATE, 90 fd, pgoff); 91 if (map == MAP_FAILED) 92 tst_brkm(TBROK | TERRNO, cleanup, "mmap2"); 93 94 remap = mremap(map, pgsz, 2 * pgsz, 0); 95 if (remap == MAP_FAILED) { 96 if (errno == EINVAL) 97 tst_resm(TPASS, "mremap failed as expected."); 98 else 99 tst_resm(TFAIL | TERRNO, "mremap"); 100 munmap(map, pgsz); 101 } else { 102 tst_resm(TFAIL, "mremap succeeded unexpectedly."); 103 munmap(remap, 2 * pgsz); 104 } 105 106 close(fd); 107 } 108 109 cleanup(); 110 tst_exit(); 111} 112 113static void *mmap2(void *addr, size_t length, int prot, 114 int flags, int fd, off_t pgoffset) 115{ 116 return (void *)syscall(SYS_mmap2, addr, length, prot, 117 flags, fd, pgoffset); 118} 119 120static void setup(void) 121{ 122 tst_sig(FORK, DEF_HANDLER, cleanup); 123 124 tst_tmpdir(); 125 126 fd = creat(TESTFILE, 0644); 127 if (fd == -1) 128 tst_brkm(TBROK | TERRNO, NULL, "creat %s", TESTFILE); 129 close(fd); 130 131 TEST_PAUSE; 132} 133 134static void cleanup(void) 135{ 136 tst_rmdir(); 137} 138#else /* __NR_mmap2 */ 139int main(int argc, char *argv[]) 140{ 141 tst_brkm(TCONF, NULL, "__NR_mmap2 is not defined on your system"); 142} 143#endif 144