linux-kernel - Re: [BUG] Invalid return address of mmap() followed by mbind() in multithreaded context

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4DFE8962.3060305@cslab.ece.ntua.gr>
Date:	Mon, 20 Jun 2011 02:42:26 +0300
From:	Vasileios Karakasis <bkk@...ab.ece.ntua.gr>
To:	Andi Kleen <andi@...stfloor.org>
CC:	linux-kernel@...r.kernel.org, linux-mm@...ck.org,
	linux-numa@...r.kernel.org
Subject: Re: [BUG] Invalid return address of mmap() followed by mbind() in
 multithreaded context

I'm sending you a slightly modified version that actually makes clear
how libnuma is affected. If you compile with -DUSE_LIBNUMA, you will get
an EFAULT from mbind() and then crash.

This is the gdb output where the address passed to mbind() is invalid.

(gdb) r
Starting program: a.out
[Thread debugging using libthread_db enabled]
[New Thread 0x7ffff7633700 (LWP 17977)]
a.out: mmap-bug.c:29: thread_func: Assertion `0 && "mbind() failed"' failed.

Program received signal SIGABRT, Aborted.
0x00007ffff7667a75 in *__GI_raise (sig=<value optimized out>)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64	../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
	in ../nptl/sysdeps/unix/sysv/linux/raise.c
(gdb) f 3
#3  0x00000000004007b8 in thread_func (args=0x0) at mmap-bug.c:29
29	            assert(0 && "mbind() failed");
(gdb) p addr
$1 = (unsigned char *) 0x7ffff5c27000 <Address 0x7ffff5c27000 out of bounds>


#include <assert.h>
#include <sys/mman.h>
#include <pthread.h>
#include <numa.h>
#include <numaif.h>

#define NR_ITER 10240
#define PAGE_SIZE 4096

void *thread_func(void *args)
{
    unsigned char *addr;
    int err, i;
    unsigned long node = 0x1;

    for (i = 0; i < NR_ITER; i++) {
#ifdef USE_LIBNUMA
        addr = numa_alloc_onnode(PAGE_SIZE, 0);
#else
        addr = mmap(0, PAGE_SIZE, PROT_READ | PROT_WRITE,
                    MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
        if (addr == (void *) -1)
            assert(0 && "mmap() failed");

        err = mbind(addr, PAGE_SIZE, MPOL_BIND, &node, sizeof(node), 0);
        if (err < 0)
            assert(0 && "mbind() failed");
#endif
        *addr = 0;
    }

    return (void *) 0;
}

int main(void)
{
    pthread_t thread;
    pthread_create(&thread, NULL, thread_func, NULL);
    thread_func(NULL);
    pthread_join(thread, NULL);
    return 0;
}



On 06/18/2011 09:41 PM, Vasileios Karakasis wrote:
> That's right, but what I want to demonstrate is that the address
> returned by mmap() is invalid and the dereference crashes the program,
> while it shouldn't. I could equally omit this statement, in which case
> mbind() would fail with EFAULT.
> 
> On 06/18/2011 09:12 PM, Andi Kleen wrote:
>>
>> mbind() can be only done before the first touch. you're not actually testing 
>> numa policy.
>>
>> -andi
> 

-- 
V.K.


Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)