linux-kernel - Re: [PATCH bpf-next v2] bpf: fix segmentation fault of test

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEf4BzbYFDBXNwE-3B4vc6oZvbDbSTbwf4xgUeUpkwJ2FCQY+w@mail.gmail.com>
Date:   Mon, 10 Aug 2020 17:23:59 -0700
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Jianlin Lv <Jianlin.Lv@....com>
Cc:     bpf <bpf@...r.kernel.org>, "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Yonghong Song <yhs@...com>,
        open list <linux-kernel@...r.kernel.org>,
        Networking <netdev@...r.kernel.org>
Subject: Re: [PATCH bpf-next v2] bpf: fix segmentation fault of test_progs

On Mon, Aug 10, 2020 at 8:40 AM Jianlin Lv <Jianlin.Lv@....com> wrote:
>
> test_progs reports the segmentation fault as below
>
> $ sudo ./test_progs -t mmap --verbose
> test_mmap:PASS:skel_open_and_load 0 nsec
> ......
> test_mmap:PASS:adv_mmap1 0 nsec
> test_mmap:PASS:adv_mmap2 0 nsec
> test_mmap:PASS:adv_mmap3 0 nsec
> test_mmap:PASS:adv_mmap4 0 nsec
> Segmentation fault
>
> This issue was triggered because mmap() and munmap() used inconsistent
> length parameters; mmap() creates a new mapping of 3*page_size, but the
> length parameter set in the subsequent re-map and munmap() functions is
> 4*page_size; this leads to the destruction of the process space.
>
> To fix this issue, first create 4 pages of anonymous mapping,then do all
> the mmap() with MAP_FIXED.
>
> Another issue is that when unmap the second page fails, the length
> parameter to delete tmp1 mappings should be 4*page_size.
>
> Signed-off-by: Jianlin Lv <Jianlin.Lv@....com>
> ---

LGTM, thanks for the fix!

Acked-by: Andrii Nakryiko <andriin@...com>

> v2:
> - Update commit messages
> - Create 4 pages of anonymous mapping that serve the subsequent mmap()
> ---
>  tools/testing/selftests/bpf/prog_tests/mmap.c | 19 +++++++++++++------
>  1 file changed, 13 insertions(+), 6 deletions(-)
>

[...]