1 /*
2 * Copyright (c) 2016 Linux Test Project.
3 *
4 * This program is free software: you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, either version 3 of the License, or
7 * (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program. If not, see <http://www.gnu.org/licenses/>.
16 */
17
18 /*
19 * DESCRIPTION
20 *
21 * Total s390 2^31 addr space is 0x80000000.
22 *
23 * 0x80000000 - 0x10000000 = 0x70000000
24 *
25 * 0x70000000 is a valid positive intptr_t and adding it to the current offset
26 * produces a valid uintptr_t without overflow (since the MSB being set is OK),
27 * but that is irrelevant for s390 since it has 31-bit pointers and not 32-bit
28 * pointers. Consequently, the brk syscall behaves incorrectly with the invalid
29 * address and changes the program break to the overflowed address. The glibc
30 * part of the implementation detects this overflow and returns a failure with
31 * ENOMEM, but does not reset the program break.
32 *
33 * So the bug is in sbrk as well as the brk syscall. brk() should validate the
34 * address being passed and return an error. sbrk() should not result in a brk
35 * call at all for an invalid address. One could argue in favour of fixing brk
36 * in glibc, but it should be the kernel since one could call the syscall
37 * directly without using the glibc entry points.
38 *
39 * The kernel part was fixed on v3.15 by commits:
40 * 473a06572fcd (s390/compat: convert system call wrappers to C part 02)
41 *
42 * Note:
43 * The reproducer should be built(gcc -m31) in 32bit on s390 platform
44 *
45 */
46
47 #include <stdio.h>
48 #include <unistd.h>
49 #include "tst_test.h"
50
sbrk_test(void)51 static void sbrk_test(void)
52 {
53 #if defined(__s390__) && __WORDSIZE == 32
54 void *ret1, *ret2;
55
56 /* set bkr to 0x10000000 */
57 tst_res(TINFO, "initial brk: %d", brk((void *)0x10000000));
58
59 /* add 0x10000000, up to total of 0x20000000 */
60 tst_res(TINFO, "sbrk increm: %p", sbrk(0x10000000));
61 ret1 = sbrk(0);
62
63 /* sbrk() returns -1 on s390, but still does overflowed brk() */
64 tst_res(TINFO, "sbrk increm: %p", sbrk(0x70000000));
65 ret2 = sbrk(0);
66
67 if (ret1 != ret2) {
68 tst_res(TFAIL, "Bug! sbrk: %p", ret2);
69 return;
70 }
71
72 tst_res(TPASS, "sbrk verify: %p", ret2);
73 #else
74 tst_res(TCONF, "Only works in 32bit on s390 series system");
75 #endif
76 }
77
78 static struct tst_test test = {
79 .test_all = sbrk_test,
80 };
81