d/numam-dpdk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

mem: fix crash on hugepage mapping error

Browse Source 
In ASLR-enabled system, it is possible that selected
virtual space is occupied by program segments. Therefore,
error path should not blindly unmap all memmory segments
but only those already mapped.

Steps that lead to crash:
1. memeseg 0 in secondary process overlaps with libc.so
2. mmap of /dev/zero fails for virtual space of memseg 0
3. munmap of memseg 0 leads to unmapping libc.so itself
4. app gets SIGSEGV after returning from syscall to libc

Fixes: ea329d7f8e34 ("mem: fix leak after mapping failure")

Signed-off-by: Maciej Czekaj <maciej.czekaj@caviumnetworks.com>
This commit is contained in:
Maciej Czekaj 2016-09-28 12:52:57 +02:00 committed by Thomas Monjalon
parent 016a23a81e
commit c00ae961ff
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
lib/librte_eal/linuxapp/eal/eal_memory.c
View File

@ -1278,6 +1278,7 @@ rte_eal_hugepage_attach(void)
struct hugepage_file *hp = NULL;
unsigned num_hp = 0;
unsigned i, s = 0; /* s used to track the segment number */
unsigned max_seg = RTE_MAX_MEMSEG;
off_t size;
int fd, fd_zero = -1, fd_hugepage = -1;
@ -1336,6 +1337,9 @@ rte_eal_hugepage_attach(void)
"in /dev/zero to requested address [%p]: '%s'\n",
(unsigned long long)mcfg->memseg[s].len,
mcfg->memseg[s].addr, strerror(errno));
max_seg = s;
if (base_addr != MAP_FAILED)
munmap(base_addr, mcfg->memseg[s].len);
if (aslr_enabled() > 0) {
RTE_LOG(ERR, EAL, "It is recommended to "
"disable ASLR in the kernel "
@ -1404,11 +1408,8 @@ rte_eal_hugepage_attach(void)
return 0;
error:
s = 0;
while (s < RTE_MAX_MEMSEG && mcfg->memseg[s].len > 0) {
munmap(mcfg->memseg[s].addr, mcfg->memseg[s].len);
s++;
}
for (i = 0; i < max_seg && mcfg->memseg[i].len > 0; i++)
munmap(mcfg->memseg[i].addr, mcfg->memseg[i].len);
if (hp != NULL && hp != MAP_FAILED)
munmap(hp, size);
if (fd_zero >= 0)