1/*
2 * Copyright (C) 2012 Red Hat, Inc.
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of version 2 of the GNU General Public
6 * License as published by the Free Software Foundation.
7 *
8 * This program is distributed in the hope that it would be useful,
9 * but WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
11 *
12 * Further, this software is distributed without any warranty that it
13 * is free of the rightful claim of any third person regarding
14 * infringement or the like.  Any license provided herein, whether
15 * implied or otherwise, applies only to this software file.  Patent
16 * licenses, if any, provided herein do not apply to combinations of
17 * this program with other software, or any other product whatsoever.
18 *
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write the Free Software
21 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
22 * 02110-1301, USA.
23 */
24/*
25 * This is a reproducer for CVE-2011-2496.
26 *
27 * The normal mmap paths all avoid creating a mapping where the pgoff
28 * inside the mapping could wrap around due to overflow.  However, an
29 * expanding mremap() can take such a non-wrapping mapping and make it
30 * bigger and cause a wrapping condition. There is also another case
31 * where we expand mappings hiding in plain sight: the automatic stack
32 * expansion.
33 *
34 * This program tries to remap a mapping with a new size that would
35 * wrap pgoff. Notice that it only works on 32-bit arch for now.
36 */
37
38#define _GNU_SOURCE
39#include "config.h"
40#include <sys/types.h>
41#include <sys/mman.h>
42#include <sys/stat.h>
43#include <sys/syscall.h>
44#include <errno.h>
45#include <fcntl.h>
46#include <limits.h>
47#include <stdio.h>
48#include <stdlib.h>
49#include <unistd.h>
50
51#include "test.h"
52
53char *TCID = "vma03";
54int TST_TOTAL = 1;
55
56#ifdef __NR_mmap2
57#define TESTFILE "testfile"
58
59static size_t pgsz;
60static int fd;
61
62static void *mmap2(void *addr, size_t length, int prot,
63		   int flags, int fd, off_t pgoffset);
64static void setup(void);
65static void cleanup(void);
66
67int main(int argc, char *argv[])
68{
69	int lc;
70	void *map, *remap;
71	off_t pgoff;
72
73#if __WORDSIZE != 32
74	tst_brkm(TCONF, NULL, "test is designed for 32-bit system only.");
75#endif
76	tst_parse_opts(argc, argv, NULL, NULL);
77
78	pgsz = sysconf(_SC_PAGE_SIZE);
79	setup();
80
81	for (lc = 0; TEST_LOOPING(lc); lc++) {
82		tst_count = 0;
83
84		fd = open(TESTFILE, O_RDWR);
85		if (fd == -1)
86			tst_brkm(TBROK | TERRNO, NULL, "open %s", TESTFILE);
87
88		pgoff = ULONG_MAX - 1;
89		map = mmap2(NULL, pgsz, PROT_READ | PROT_WRITE, MAP_PRIVATE,
90			    fd, pgoff);
91		if (map == MAP_FAILED)
92			tst_brkm(TBROK | TERRNO, cleanup, "mmap2");
93
94		remap = mremap(map, pgsz, 2 * pgsz, 0);
95		if (remap == MAP_FAILED) {
96			if (errno == EINVAL)
97				tst_resm(TPASS, "mremap failed as expected.");
98			else
99				tst_resm(TFAIL | TERRNO, "mremap");
100			munmap(map, pgsz);
101		} else {
102			tst_resm(TFAIL, "mremap succeeded unexpectedly.");
103			munmap(remap, 2 * pgsz);
104		}
105
106		close(fd);
107	}
108
109	cleanup();
110	tst_exit();
111}
112
113static void *mmap2(void *addr, size_t length, int prot,
114		   int flags, int fd, off_t pgoffset)
115{
116	return (void *)syscall(SYS_mmap2, addr, length, prot,
117			       flags, fd, pgoffset);
118}
119
120static void setup(void)
121{
122	tst_sig(FORK, DEF_HANDLER, cleanup);
123
124	tst_tmpdir();
125
126	fd = creat(TESTFILE, 0644);
127	if (fd == -1)
128		tst_brkm(TBROK | TERRNO, NULL, "creat %s", TESTFILE);
129	close(fd);
130
131	TEST_PAUSE;
132}
133
134static void cleanup(void)
135{
136	tst_rmdir();
137}
138#else /* __NR_mmap2 */
139int main(int argc, char *argv[])
140{
141	tst_brkm(TCONF, NULL, "__NR_mmap2 is not defined on your system");
142}
143#endif
144