1 /* $OpenBSD: monitor_mm.c,v 1.16 2009/06/22 05:39:28 dtucker Exp $ */
2 /*
3 * Copyright 2002 Niels Provos <provos@citi.umich.edu>
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27 #include <sys/types.h>
28 #include <sys/mman.h>
29 #include <sys/tree.h>
30 #include <sys/param.h>
31
32 #include <errno.h>
33 #include <stdarg.h>
34 #include <string.h>
35
36 #include "xmalloc.h"
37 #include "ssh.h"
38 #include "log.h"
39 #include "monitor_mm.h"
40
41 static int
mm_compare(struct mm_share * a,struct mm_share * b)42 mm_compare(struct mm_share *a, struct mm_share *b)
43 {
44 long diff = (char *)a->address - (char *)b->address;
45
46 if (diff == 0)
47 return (0);
48 else if (diff < 0)
49 return (-1);
50 else
51 return (1);
52 }
53
RB_GENERATE(mmtree,mm_share,next,mm_compare)54 RB_GENERATE(mmtree, mm_share, next, mm_compare)
55
56 static struct mm_share *
57 mm_make_entry(struct mm_master *mm, struct mmtree *head,
58 void *address, size_t size)
59 {
60 struct mm_share *tmp, *tmp2;
61
62 if (mm->mmalloc == NULL)
63 tmp = xmalloc(sizeof(struct mm_share));
64 else
65 tmp = mm_xmalloc(mm->mmalloc, sizeof(struct mm_share));
66 tmp->address = address;
67 tmp->size = size;
68
69 tmp2 = RB_INSERT(mmtree, head, tmp);
70 if (tmp2 != NULL)
71 fatal("mm_make_entry(%p): double address %p->%p(%lu)",
72 mm, tmp2, address, (u_long)size);
73
74 return (tmp);
75 }
76
77 /* Creates a shared memory area of a certain size */
78
79 struct mm_master *
mm_create(struct mm_master * mmalloc,size_t size)80 mm_create(struct mm_master *mmalloc, size_t size)
81 {
82 void *address;
83 struct mm_master *mm;
84
85 if (mmalloc == NULL)
86 mm = xmalloc(sizeof(struct mm_master));
87 else
88 mm = mm_xmalloc(mmalloc, sizeof(struct mm_master));
89
90 /*
91 * If the memory map has a mm_master it can be completely
92 * shared including authentication between the child
93 * and the client.
94 */
95 mm->mmalloc = mmalloc;
96
97 address = mmap(NULL, size, PROT_WRITE|PROT_READ, MAP_ANON|MAP_SHARED,
98 -1, (off_t)0);
99 if (address == MAP_FAILED)
100 fatal("mmap(%lu): %s", (u_long)size, strerror(errno));
101
102 mm->address = address;
103 mm->size = size;
104
105 RB_INIT(&mm->rb_free);
106 RB_INIT(&mm->rb_allocated);
107
108 mm_make_entry(mm, &mm->rb_free, address, size);
109
110 return (mm);
111 }
112
113 /* Frees either the allocated or the free list */
114
115 static void
mm_freelist(struct mm_master * mmalloc,struct mmtree * head)116 mm_freelist(struct mm_master *mmalloc, struct mmtree *head)
117 {
118 struct mm_share *mms, *next;
119
120 for (mms = RB_ROOT(head); mms; mms = next) {
121 next = RB_NEXT(mmtree, head, mms);
122 RB_REMOVE(mmtree, head, mms);
123 if (mmalloc == NULL)
124 xfree(mms);
125 else
126 mm_free(mmalloc, mms);
127 }
128 }
129
130 /* Destroys a memory mapped area */
131
132 void
mm_destroy(struct mm_master * mm)133 mm_destroy(struct mm_master *mm)
134 {
135 mm_freelist(mm->mmalloc, &mm->rb_free);
136 mm_freelist(mm->mmalloc, &mm->rb_allocated);
137
138 if (munmap(mm->address, mm->size) == -1)
139 fatal("munmap(%p, %lu): %s", mm->address, (u_long)mm->size,
140 strerror(errno));
141 if (mm->mmalloc == NULL)
142 xfree(mm);
143 else
144 mm_free(mm->mmalloc, mm);
145 }
146
147 void *
mm_xmalloc(struct mm_master * mm,size_t size)148 mm_xmalloc(struct mm_master *mm, size_t size)
149 {
150 void *address;
151
152 address = mm_malloc(mm, size);
153 if (address == NULL)
154 fatal("%s: mm_malloc(%lu)", __func__, (u_long)size);
155 return (address);
156 }
157
158
159 /* Allocates data from a memory mapped area */
160
161 void *
mm_malloc(struct mm_master * mm,size_t size)162 mm_malloc(struct mm_master *mm, size_t size)
163 {
164 struct mm_share *mms, *tmp;
165
166 if (size == 0)
167 fatal("mm_malloc: try to allocate 0 space");
168 if (size > SIZE_T_MAX - MM_MINSIZE + 1)
169 fatal("mm_malloc: size too big");
170
171 size = ((size + (MM_MINSIZE - 1)) / MM_MINSIZE) * MM_MINSIZE;
172
173 RB_FOREACH(mms, mmtree, &mm->rb_free) {
174 if (mms->size >= size)
175 break;
176 }
177
178 if (mms == NULL)
179 return (NULL);
180
181 /* Debug */
182 memset(mms->address, 0xd0, size);
183
184 tmp = mm_make_entry(mm, &mm->rb_allocated, mms->address, size);
185
186 /* Does not change order in RB tree */
187 mms->size -= size;
188 mms->address = (u_char *)mms->address + size;
189
190 if (mms->size == 0) {
191 RB_REMOVE(mmtree, &mm->rb_free, mms);
192 if (mm->mmalloc == NULL)
193 xfree(mms);
194 else
195 mm_free(mm->mmalloc, mms);
196 }
197
198 return (tmp->address);
199 }
200
201 /* Frees memory in a memory mapped area */
202
203 void
mm_free(struct mm_master * mm,void * address)204 mm_free(struct mm_master *mm, void *address)
205 {
206 struct mm_share *mms, *prev, tmp;
207
208 tmp.address = address;
209 mms = RB_FIND(mmtree, &mm->rb_allocated, &tmp);
210 if (mms == NULL)
211 fatal("mm_free(%p): can not find %p", mm, address);
212
213 /* Debug */
214 memset(mms->address, 0xd0, mms->size);
215
216 /* Remove from allocated list and insert in free list */
217 RB_REMOVE(mmtree, &mm->rb_allocated, mms);
218 if (RB_INSERT(mmtree, &mm->rb_free, mms) != NULL)
219 fatal("mm_free(%p): double address %p", mm, address);
220
221 /* Find previous entry */
222 prev = mms;
223 if (RB_LEFT(prev, next)) {
224 prev = RB_LEFT(prev, next);
225 while (RB_RIGHT(prev, next))
226 prev = RB_RIGHT(prev, next);
227 } else {
228 if (RB_PARENT(prev, next) &&
229 (prev == RB_RIGHT(RB_PARENT(prev, next), next)))
230 prev = RB_PARENT(prev, next);
231 else {
232 while (RB_PARENT(prev, next) &&
233 (prev == RB_LEFT(RB_PARENT(prev, next), next)))
234 prev = RB_PARENT(prev, next);
235 prev = RB_PARENT(prev, next);
236 }
237 }
238
239 /* Check if range does not overlap */
240 if (prev != NULL && MM_ADDRESS_END(prev) > address)
241 fatal("mm_free: memory corruption: %p(%lu) > %p",
242 prev->address, (u_long)prev->size, address);
243
244 /* See if we can merge backwards */
245 if (prev != NULL && MM_ADDRESS_END(prev) == address) {
246 prev->size += mms->size;
247 RB_REMOVE(mmtree, &mm->rb_free, mms);
248 if (mm->mmalloc == NULL)
249 xfree(mms);
250 else
251 mm_free(mm->mmalloc, mms);
252 } else
253 prev = mms;
254
255 if (prev == NULL)
256 return;
257
258 /* Check if we can merge forwards */
259 mms = RB_NEXT(mmtree, &mm->rb_free, prev);
260 if (mms == NULL)
261 return;
262
263 if (MM_ADDRESS_END(prev) > mms->address)
264 fatal("mm_free: memory corruption: %p < %p(%lu)",
265 mms->address, prev->address, (u_long)prev->size);
266 if (MM_ADDRESS_END(prev) != mms->address)
267 return;
268
269 prev->size += mms->size;
270 RB_REMOVE(mmtree, &mm->rb_free, mms);
271
272 if (mm->mmalloc == NULL)
273 xfree(mms);
274 else
275 mm_free(mm->mmalloc, mms);
276 }
277
278 static void
mm_sync_list(struct mmtree * oldtree,struct mmtree * newtree,struct mm_master * mm,struct mm_master * mmold)279 mm_sync_list(struct mmtree *oldtree, struct mmtree *newtree,
280 struct mm_master *mm, struct mm_master *mmold)
281 {
282 struct mm_master *mmalloc = mm->mmalloc;
283 struct mm_share *mms, *new;
284
285 /* Sync free list */
286 RB_FOREACH(mms, mmtree, oldtree) {
287 /* Check the values */
288 mm_memvalid(mmold, mms, sizeof(struct mm_share));
289 mm_memvalid(mm, mms->address, mms->size);
290
291 new = mm_xmalloc(mmalloc, sizeof(struct mm_share));
292 memcpy(new, mms, sizeof(struct mm_share));
293 RB_INSERT(mmtree, newtree, new);
294 }
295 }
296
297 void
mm_share_sync(struct mm_master ** pmm,struct mm_master ** pmmalloc)298 mm_share_sync(struct mm_master **pmm, struct mm_master **pmmalloc)
299 {
300 struct mm_master *mm;
301 struct mm_master *mmalloc;
302 struct mm_master *mmold;
303 struct mmtree rb_free, rb_allocated;
304
305 debug3("%s: Share sync", __func__);
306
307 mm = *pmm;
308 mmold = mm->mmalloc;
309 mm_memvalid(mmold, mm, sizeof(*mm));
310
311 mmalloc = mm_create(NULL, mm->size);
312 mm = mm_xmalloc(mmalloc, sizeof(struct mm_master));
313 memcpy(mm, *pmm, sizeof(struct mm_master));
314 mm->mmalloc = mmalloc;
315
316 rb_free = mm->rb_free;
317 rb_allocated = mm->rb_allocated;
318
319 RB_INIT(&mm->rb_free);
320 RB_INIT(&mm->rb_allocated);
321
322 mm_sync_list(&rb_free, &mm->rb_free, mm, mmold);
323 mm_sync_list(&rb_allocated, &mm->rb_allocated, mm, mmold);
324
325 mm_destroy(mmold);
326
327 *pmm = mm;
328 *pmmalloc = mmalloc;
329
330 debug3("%s: Share sync end", __func__);
331 }
332
333 void
mm_memvalid(struct mm_master * mm,void * address,size_t size)334 mm_memvalid(struct mm_master *mm, void *address, size_t size)
335 {
336 void *end = (u_char *)address + size;
337
338 if (address < mm->address)
339 fatal("mm_memvalid: address too small: %p", address);
340 if (end < address)
341 fatal("mm_memvalid: end < address: %p < %p", end, address);
342 if (end > (void *)((u_char *)mm->address + mm->size))
343 fatal("mm_memvalid: address too large: %p", address);
344 }
345