From nobody@FreeBSD.org  Fri Sep  3 21:51:28 2010
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 542FE10656D8
	for <freebsd-gnats-submit@FreeBSD.org>; Fri,  3 Sep 2010 21:51:28 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id 42B0D8FC0A
	for <freebsd-gnats-submit@FreeBSD.org>; Fri,  3 Sep 2010 21:51:28 +0000 (UTC)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.3/8.14.3) with ESMTP id o83LpSWR018534
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 3 Sep 2010 21:51:28 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.3/8.14.3/Submit) id o83LpRd5018533;
	Fri, 3 Sep 2010 21:51:27 GMT
	(envelope-from nobody)
Message-Id: <201009032151.o83LpRd5018533@www.freebsd.org>
Date: Fri, 3 Sep 2010 21:51:27 GMT
From: Ion Gaztaaga <igaztanaga@gmail.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: mmap fails with EPERM (not documented) if read-only shared memory is mmapped with MAP_PRIVATE & PROT_WRITE
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         150260
>Category:       kern
>Synopsis:       [libc] mmap(2) fails with EPERM (not documented) if read-only shared memory is mmapped with MAP_PRIVATE & PROT_WRITE
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    alc
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Sep 03 22:00:13 UTC 2010
>Closed-Date:    Fri Oct 15 03:01:33 UTC 2010
>Last-Modified:  Fri Oct 15 03:10:11 UTC 2010
>Originator:     Ion Gaztaaga
>Release:        8.0-RELEASE-p2
>Organization:
>Environment:
FreeBSD pcbsd-4080 8.0-RELEASE-p2 FreeBSD 8.0-RELEASE-p2 #4: Thu Jan  7 09:20:42 PST 2010     root@build8x32.pcbsd.org:/usr/obj/usr/pcbsd-build80/fbsd-source/8.0-src/sys/PCBSD  i386
>Description:
mmap allows copy on write file/shared memory mapping via MAP_PRIVATE and only requires a read-only file descriptor. This works with files but not with shared memory objects (mmap returns EPERM).
>How-To-Repeat:
Execute the attached c program
>Fix:


Patch attached with submission follows:

#include <sys/types.h>
#include <sys/mman.h>
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>

int main()
{
   shm_unlink("/myshm");
   int fd = shm_open("/myshm", O_CREAT | O_RDWR, 0644);
   if(fd >= 0){
      if(ftruncate(fd, 1000) < 0){
         printf("Error truncating");
	 close(fd);
      }
      else{
         close(fd);
         fd = shm_open("/myshm", O_RDONLY/*O_RDWR*/, 0644);
         if(fd >= 0){
            void *addr = mmap(0, 1000, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
            if (MAP_FAILED == addr){
               printf("mmap failed, errno: %s", strerror(errno));
            }
            else{
               printf("mmap OK");
               munmap(addr, 1000);
            }
            close(fd);
         }
         else{	    
            printf("Error opening shmem");
         }
      }
   }
   else{
      printf("Error creating shmem");
   }
   shm_unlink("/myshm");   
   return 0;
}





>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->alc 
Responsible-Changed-By: arundel 
Responsible-Changed-When: Sun Sep 5 15:21:21 UTC 2010 
Responsible-Changed-Why:  
Alan might have an opinion on this PR. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=150260 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/150260: commit references a PR
Date: Sun, 19 Sep 2010 19:42:11 +0000 (UTC)

 Author: alc
 Date: Sun Sep 19 19:42:04 2010
 New Revision: 212873
 URL: http://svn.freebsd.org/changeset/base/212873
 
 Log:
   Allow a POSIX shared memory object that is opened for read but not for
   write to nonetheless be mapped PROT_WRITE and MAP_PRIVATE, i.e.,
   copy-on-write.
   
   (This is a regression in the new implementation of POSIX shared memory
   objects that is used by HEAD and RELENG_8.  This bug does not exist in
   RELENG_7's user-level, file-based implementation.)
   
   PR:		150260
   MFC after:	3 weeks
 
 Modified:
   head/sys/vm/vm_mmap.c
 
 Modified: head/sys/vm/vm_mmap.c
 ==============================================================================
 --- head/sys/vm/vm_mmap.c	Sun Sep 19 19:18:35 2010	(r212872)
 +++ head/sys/vm/vm_mmap.c	Sun Sep 19 19:42:04 2010	(r212873)
 @@ -1373,7 +1373,8 @@ vm_mmap_shm(struct thread *td, vm_size_t
  {
  	int error;
  
 -	if ((*maxprotp & VM_PROT_WRITE) == 0 &&
 +	if ((*flagsp & MAP_SHARED) != 0 &&
 +	    (*maxprotp & VM_PROT_WRITE) == 0 &&
  	    (prot & PROT_WRITE) != 0)
  		return (EACCES);
  #ifdef MAC
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: open->patched 
State-Changed-By: arundel 
State-Changed-When: Mon Sep 20 14:30:12 UTC 2010 
State-Changed-Why:  
Patch in HEAD (r212873). 
Please note that this issue does not exist in stable/7. After a MFC to stable/8 
this PR can be closed. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=150260 

From: Alexander Best <arundel@freebsd.org>
To: bug-followup@freebsd.org
Cc:  
Subject: Re: kern/150260: [libc] mmap(2) fails with EPERM (not documented) if read-only shared memory is mmapped with MAP_PRIVATE & PROT_WRITE
Date: Mon, 20 Sep 2010 16:50:07 +0000

 --oyUTqETQ0mS9luUI
 Content-Type: text/plain; charset=us-ascii
 Content-Disposition: inline
 
 although this issue has been fixed, the program to trigger it may be useful in
 the future for regression tests e.g. alan noticed some problems with it. this
 version should be used instead of the original code, if somebody wants to
 trigger the problems described in this PR.
 
 cheers.
 alex
 
 -- 
 a13x
 
 --oyUTqETQ0mS9luUI
 Content-Type: text/x-csrc; charset=us-ascii
 Content-Disposition: attachment; filename="mmap_private.c"
 
 #include <sys/types.h>
 #include <sys/mman.h>
 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>
 #include <fcntl.h>
 #include <errno.h>
 
 int main()
 {
    shm_unlink("/myshm");
    int fd = shm_open("/myshm", O_CREAT | O_RDWR, 0644);
    if(fd >= 0){
       if(ftruncate(fd, 1000) < 0){
          printf("Error truncating");
 	 close(fd);
       }
       else{
          close(fd);
          fd = shm_open("/myshm", O_RDONLY/*O_RDWR*/, 0644);
          if(fd >= 0){
             void *addr = mmap(0, 1000, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
             if (MAP_FAILED == addr){
                printf("mmap failed, errno: %s", strerror(errno));
             }
             else{
                printf("mmap OK");
                munmap(addr, 1000);
             }
             close(fd);
          }
          else{
             printf("Error opening shmem");
          }
       }
    }
    else{
       printf("Error creating shmem");
    }
    shm_unlink("/myshm");
    return 0;
 }
 
 
 
 
 
 
 --oyUTqETQ0mS9luUI--
State-Changed-From-To: patched->closed 
State-Changed-By: alc 
State-Changed-When: Fri Oct 15 02:59:50 UTC 2010 
State-Changed-Why:  
Patch applied to FreeBSD 8-STABLE.  (FreeBSD 7-STABLE is not 
affected by this bug.) 

http://www.freebsd.org/cgi/query-pr.cgi?pr=150260 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/150260: commit references a PR
Date: Fri, 15 Oct 2010 02:58:54 +0000 (UTC)

 Author: alc
 Date: Fri Oct 15 02:58:49 2010
 New Revision: 213886
 URL: http://svn.freebsd.org/changeset/base/213886
 
 Log:
   MFC r212873
     Allow a POSIX shared memory object that is opened for read but not for
     write to nonetheless be mapped PROT_WRITE and MAP_PRIVATE, i.e.,
     copy-on-write.
   
   PR:		150260
 
 Modified:
   stable/8/sys/vm/vm_mmap.c
 Directory Properties:
   stable/8/sys/   (props changed)
   stable/8/sys/amd64/include/xen/   (props changed)
   stable/8/sys/cddl/contrib/opensolaris/   (props changed)
   stable/8/sys/contrib/dev/acpica/   (props changed)
   stable/8/sys/contrib/pf/   (props changed)
   stable/8/sys/dev/xen/xenpci/   (props changed)
 
 Modified: stable/8/sys/vm/vm_mmap.c
 ==============================================================================
 --- stable/8/sys/vm/vm_mmap.c	Thu Oct 14 23:38:37 2010	(r213885)
 +++ stable/8/sys/vm/vm_mmap.c	Fri Oct 15 02:58:49 2010	(r213886)
 @@ -1316,7 +1316,8 @@ vm_mmap_shm(struct thread *td, vm_size_t
  {
  	int error;
  
 -	if ((*maxprotp & VM_PROT_WRITE) == 0 &&
 +	if ((*flagsp & MAP_SHARED) != 0 &&
 +	    (*maxprotp & VM_PROT_WRITE) == 0 &&
  	    (prot & PROT_WRITE) != 0)
  		return (EACCES);
  #ifdef MAC
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
>Unformatted:
