Bug 150260

Summary: [libc] mmap(2) fails with EPERM (not documented) if read-only shared memory is mmapped with MAP_PRIVATE & PROT_WRITE
Product: Base System Reporter: Ion Gaztañaga <igaztanaga>
Component: kernAssignee: Alan Cox <alc>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: 8.0-RELEASE   
Hardware: Any   
OS: Any   
Attachments:
Description Flags
file.txt
none
mmap_private.c none

Description Ion Gaztañaga 2010-09-03 23:00:13 UTC 
mmap allows copy on write file/shared memory mapping via MAP_PRIVATE and only requires a read-only file descriptor. This works with files but not with shared memory objects (mmap returns EPERM).

Fix: Patch attached with submission follows:
How-To-Repeat: Execute the attached c program
Comment 1 Alexander Best freebsd_committer freebsd_triage 2010-09-05 16:21:21 UTC 
Responsible Changed
From-To: freebsd-bugs->alc

Alan might have an opinion on this PR.
Comment 2 dfilter service freebsd_committer freebsd_triage 2010-09-19 20:42:11 UTC 
Author: alc
Date: Sun Sep 19 19:42:04 2010
New Revision: 212873
URL: http://svn.freebsd.org/changeset/base/212873

Log:
  Allow a POSIX shared memory object that is opened for read but not for
  write to nonetheless be mapped PROT_WRITE and MAP_PRIVATE, i.e.,
  copy-on-write.
  
  (This is a regression in the new implementation of POSIX shared memory
  objects that is used by HEAD and RELENG_8.  This bug does not exist in
  RELENG_7's user-level, file-based implementation.)
  
  PR:		150260
  MFC after:	3 weeks

Modified:
  head/sys/vm/vm_mmap.c

Modified: head/sys/vm/vm_mmap.c
==============================================================================
--- head/sys/vm/vm_mmap.c	Sun Sep 19 19:18:35 2010	(r212872)
+++ head/sys/vm/vm_mmap.c	Sun Sep 19 19:42:04 2010	(r212873)
@@ -1373,7 +1373,8 @@ vm_mmap_shm(struct thread *td, vm_size_t
 {
 	int error;
 
-	if ((*maxprotp & VM_PROT_WRITE) == 0 &&
+	if ((*flagsp & MAP_SHARED) != 0 &&
+	    (*maxprotp & VM_PROT_WRITE) == 0 &&
 	    (prot & PROT_WRITE) != 0)
 		return (EACCES);
 #ifdef MAC
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
Comment 3 Alexander Best freebsd_committer freebsd_triage 2010-09-20 15:30:12 UTC 
State Changed
From-To: open->patched

Patch in HEAD (r212873). 
Please note that this issue does not exist in stable/7. After a MFC to stable/8 
this PR can be closed.
Comment 4 Alexander Best freebsd_committer freebsd_triage 2010-09-20 17:50:07 UTC 
although this issue has been fixed, the program to trigger it may be useful in
the future for regression tests e.g. alan noticed some problems with it. this
version should be used instead of the original code, if somebody wants to
trigger the problems described in this PR.

cheers.
alex

-- 
a13x
Comment 5 dfilter service freebsd_committer freebsd_triage 2010-10-15 03:58:54 UTC 
Author: alc
Date: Fri Oct 15 02:58:49 2010
New Revision: 213886
URL: http://svn.freebsd.org/changeset/base/213886

Log:
  MFC r212873
    Allow a POSIX shared memory object that is opened for read but not for
    write to nonetheless be mapped PROT_WRITE and MAP_PRIVATE, i.e.,
    copy-on-write.
  
  PR:		150260

Modified:
  stable/8/sys/vm/vm_mmap.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/amd64/include/xen/   (props changed)
  stable/8/sys/cddl/contrib/opensolaris/   (props changed)
  stable/8/sys/contrib/dev/acpica/   (props changed)
  stable/8/sys/contrib/pf/   (props changed)
  stable/8/sys/dev/xen/xenpci/   (props changed)

Modified: stable/8/sys/vm/vm_mmap.c
==============================================================================
--- stable/8/sys/vm/vm_mmap.c	Thu Oct 14 23:38:37 2010	(r213885)
+++ stable/8/sys/vm/vm_mmap.c	Fri Oct 15 02:58:49 2010	(r213886)
@@ -1316,7 +1316,8 @@ vm_mmap_shm(struct thread *td, vm_size_t
 {
 	int error;
 
-	if ((*maxprotp & VM_PROT_WRITE) == 0 &&
+	if ((*flagsp & MAP_SHARED) != 0 &&
+	    (*maxprotp & VM_PROT_WRITE) == 0 &&
 	    (prot & PROT_WRITE) != 0)
 		return (EACCES);
 #ifdef MAC
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
Comment 6 Alan Cox freebsd_committer freebsd_triage 2010-10-15 03:59:50 UTC 
State Changed
From-To: patched->closed

Patch applied to FreeBSD 8-STABLE.  (FreeBSD 7-STABLE is not 
affected by this bug.)