Skip to contentSkip to conversation

syscalls/brk: change to unsigned long to avoid incr overflow

PATCH New Li Zhijian 2 participants 4 messages Oct 25, 2017 – Dec 12, 2017

lore
Share & tools
lore

Li Zhijian

author
#0 lore raw

PATCH 1/2 syscalls/brk: change to unsigned long to avoid incr overflow

Previously, incr is possible be overflowed at
81 incr = (Max_brk_byte_size - Beg_brk_val) / (MAX_SIZE_LC / 2);
103 nbrkpt = cur_brk_val + (2 * incr);

---
 testcases/kernel/syscalls/brk/brk01.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
testcases/kernel/syscalls/brk/brk01.c +1 -1
index 9a36431..b470ee7 100644
@@ -65,7 +65,7 @@ uintptr_t Beg_brk_val;
 int main(int ac, char **av)
 {
 	int lc;
-	int incr;
+	unsigned long incr;
 	uintptr_t nbrkpt;		/* new brk point value */
 	uintptr_t cur_brk_val;	/* current size returned by sbrk */
 	uintptr_t aft_brk_val;	/* current size returned by sbrk */
Signature · 1 line
2.7.4
author
#1 lore raw

PATCH 2/2 syscalls/brk: limit the largest requesting memory to UINT_MAX

sometimes(some platforms), sbrk(0) will return a huge address(e.g Beg_brk_val=94392102215680), it will lead to the request a huge memory by brk(size>1T) which beyonds most host memory size

---
 testcases/kernel/syscalls/brk/brk01.c | 4 ++++
 1 file changed, 4 insertions(+)
testcases/kernel/syscalls/brk/brk01.c +4 -0
index b470ee7..22b9662 100644
@@ -53,6 +53,7 @@ void setup();
 void cleanup();
 
 #define MAX_SIZE_LC	1000	/* loop count test will reach max size */
+#define MAX_INCR	(UINT_MAX / 2)
 
 char *TCID = "brk01";
 int TST_TOTAL = 1;
@@ -83,6 +84,9 @@ int main(int ac, char **av)
 	if ((incr * 2) < 4096)	/* make sure that process will grow */
 		incr += 4096 / 2;
 
+	// limit the requesting memory
+	incr = MIN(MAX_INCR, incr);
+
 	for (lc = 0; TEST_LOOPING(lc); lc++) {
 
 		tst_count = 0;
Signature · 1 line
2.7.4
#2 lore raw

PATCH 2/2 syscalls/brk: limit the largest requesting memory to UINT_MAX

Hi!

Quoted 3 lines

sometimes(some platforms), sbrk(0) will return a huge address(e.g Beg_brk_val=94392102215680), it will lead to the request a huge memory by brk(size>1T) which beyonds most host memory size

I think that the code in the setup that determines the Max_brk_byte_size does not make any sense to me, it seems to just multiply random value (the initial break addres) by 4 and uses that as a base for increment. I guess that it would be much better if we just choosen some multiple of page size for the test.

Also the test should be running several iterations but we run only one by default.

All in all I think that it would be much better if we rewrote the test from scratch using the new test library instead of applying band aids to problems that are broken by design.

In short, do you want to take on rewriting the test or should I do that?

Signature · 2 lines
Cyril Hrubis
[email protected]
author
#3 lore raw

PATCH 2/2 syscalls/brk: limit the largest requesting memory to UINT_MAX

Quoted 9 lines · Cyril Hrubis

Hi!

Quoted 3 lines

sometimes(some platforms), sbrk(0) will return a huge address(e.g Beg_brk_val=94392102215680), it will lead to the request a huge memory by brk(size>1T) which beyonds most host memory size

I think that the code in the setup that determines the Max_brk_byte_size does not make any sense to me, it seems to just multiply random value (the initial break addres) by 4 and uses that as a base for increment. I guess that it would be much better if we just choosen some multiple of page size for the test.

agree

Quoted 9 lines

Also the test should be running several iterations but we run only one by default.

All in all I think that it would be much better if we rewrote the test from scratch using the new test library instead of applying band aids to problems that are broken by design.

In short, do you want to take on rewriting the test or should I do that?

it's great if you can help to rewrite it. :)

Thanks

Quoted 1 line