monitor_mm.c

   1 /* $OpenBSD: monitor_mm.c,v 1.14 2006/07/26 02:35:17 stevesk Exp $ */
   2 /*
   3  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in the
  13  *    documentation and/or other materials provided with the distribution.
  14  *
  15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  25  */
  26
  27 #include "includes.h"
  28
  29 #ifdef HAVE_SYS_MMAN_H
  30 #include <sys/mman.h>
  31 #endif
  32 #include <sys/param.h>
  33
  34 #include <errno.h>
  35 #include <string.h>
  36
  37 #include "ssh.h"
  38 #include "xmalloc.h"
  39 #include "log.h"
  40 #include "monitor_mm.h"
  41
  42 static int
  43 mm_compare(struct mm_share *a, struct mm_share *b)
  44 {
  45         long diff = (char *)a->address - (char *)b->address;
  46
  47         if (diff == 0)
  48                 return (0);
  49         else if (diff < 0)
  50                 return (-1);
  51         else
  52                 return (1);
  53 }
  54
  55 RB_GENERATE(mmtree, mm_share, next, mm_compare)
  56
  57 static struct mm_share *
  58 mm_make_entry(struct mm_master *mm, struct mmtree *head,
  59     void *address, size_t size)
  60 {
  61         struct mm_share *tmp, *tmp2;
  62
  63         if (mm->mmalloc == NULL)
  64                 tmp = xmalloc(sizeof(struct mm_share));
  65         else
  66                 tmp = mm_xmalloc(mm->mmalloc, sizeof(struct mm_share));
  67         tmp->address = address;
  68         tmp->size = size;
  69
  70         tmp2 = RB_INSERT(mmtree, head, tmp);
  71         if (tmp2 != NULL)
  72                 fatal("mm_make_entry(%p): double address %p->%p(%lu)",
  73                     mm, tmp2, address, (u_long)size);
  74
  75         return (tmp);
  76 }
  77
  78 /* Creates a shared memory area of a certain size */
  79
  80 struct mm_master *
  81 mm_create(struct mm_master *mmalloc, size_t size)
  82 {
  83         void *address;
  84         struct mm_master *mm;
  85
  86         if (mmalloc == NULL)
  87                 mm = xmalloc(sizeof(struct mm_master));
  88         else
  89                 mm = mm_xmalloc(mmalloc, sizeof(struct mm_master));
  90
  91         /*
  92          * If the memory map has a mm_master it can be completely
  93          * shared including authentication between the child
  94          * and the client.
  95          */
  96         mm->mmalloc = mmalloc;
  97
  98         address = xmmap(size);
  99         if (address == (void *)MAP_FAILED)
 100                 fatal("mmap(%lu): %s", (u_long)size, strerror(errno));
 101
 102         mm->address = address;
 103         mm->size = size;
 104
 105         RB_INIT(&mm->rb_free);
 106         RB_INIT(&mm->rb_allocated);
 107
 108         mm_make_entry(mm, &mm->rb_free, address, size);
 109
 110         return (mm);
 111 }
 112
 113 /* Frees either the allocated or the free list */
 114
 115 static void
 116 mm_freelist(struct mm_master *mmalloc, struct mmtree *head)
 117 {
 118         struct mm_share *mms, *next;
 119
 120         for (mms = RB_ROOT(head); mms; mms = next) {
 121                 next = RB_NEXT(mmtree, head, mms);
 122                 RB_REMOVE(mmtree, head, mms);
 123                 if (mmalloc == NULL)
 124                         xfree(mms);
 125                 else
 126                         mm_free(mmalloc, mms);
 127         }
 128 }
 129
 130 /* Destroys a memory mapped area */
 131
 132 void
 133 mm_destroy(struct mm_master *mm)
 134 {
 135         mm_freelist(mm->mmalloc, &mm->rb_free);
 136         mm_freelist(mm->mmalloc, &mm->rb_allocated);
 137
 138 #ifdef HAVE_MMAP
 139         if (munmap(mm->address, mm->size) == -1)
 140                 fatal("munmap(%p, %lu): %s", mm->address, (u_long)mm->size,
 141                     strerror(errno));
 142 #else
 143         fatal("%s: UsePrivilegeSeparation=yes and Compression=yes not supported",
 144             __func__);
 145 #endif
 146         if (mm->mmalloc == NULL)
 147                 xfree(mm);
 148         else
 149                 mm_free(mm->mmalloc, mm);
 150 }
 151
 152 void *
 153 mm_xmalloc(struct mm_master *mm, size_t size)
 154 {
 155         void *address;
 156
 157         address = mm_malloc(mm, size);
 158         if (address == NULL)
 159                 fatal("%s: mm_malloc(%lu)", __func__, (u_long)size);
 160         return (address);
 161 }
 162
 163
 164 /* Allocates data from a memory mapped area */
 165
 166 void *
 167 mm_malloc(struct mm_master *mm, size_t size)
 168 {
 169         struct mm_share *mms, *tmp;
 170
 171         if (size == 0)
 172                 fatal("mm_malloc: try to allocate 0 space");
 173         if (size > SIZE_T_MAX - MM_MINSIZE + 1)
 174                 fatal("mm_malloc: size too big");
 175
 176         size = ((size + (MM_MINSIZE - 1)) / MM_MINSIZE) * MM_MINSIZE;
 177
 178         RB_FOREACH(mms, mmtree, &mm->rb_free) {
 179                 if (mms->size >= size)
 180                         break;
 181         }
 182
 183         if (mms == NULL)
 184                 return (NULL);
 185
 186         /* Debug */
 187         memset(mms->address, 0xd0, size);
 188
 189         tmp = mm_make_entry(mm, &mm->rb_allocated, mms->address, size);
 190
 191         /* Does not change order in RB tree */
 192         mms->size -= size;
 193         mms->address = (u_char *)mms->address + size;
 194
 195         if (mms->size == 0) {
 196                 RB_REMOVE(mmtree, &mm->rb_free, mms);
 197                 if (mm->mmalloc == NULL)
 198                         xfree(mms);
 199                 else
 200                         mm_free(mm->mmalloc, mms);
 201         }
 202
 203         return (tmp->address);
 204 }
 205
 206 /* Frees memory in a memory mapped area */
 207
 208 void
 209 mm_free(struct mm_master *mm, void *address)
 210 {
 211         struct mm_share *mms, *prev, tmp;
 212
 213         tmp.address = address;
 214         mms = RB_FIND(mmtree, &mm->rb_allocated, &tmp);
 215         if (mms == NULL)
 216                 fatal("mm_free(%p): can not find %p", mm, address);
 217
 218         /* Debug */
 219         memset(mms->address, 0xd0, mms->size);
 220
 221         /* Remove from allocated list and insert in free list */
 222         RB_REMOVE(mmtree, &mm->rb_allocated, mms);
 223         if (RB_INSERT(mmtree, &mm->rb_free, mms) != NULL)
 224                 fatal("mm_free(%p): double address %p", mm, address);
 225
 226         /* Find previous entry */
 227         prev = mms;
 228         if (RB_LEFT(prev, next)) {
 229                 prev = RB_LEFT(prev, next);
 230                 while (RB_RIGHT(prev, next))
 231                         prev = RB_RIGHT(prev, next);
 232         } else {
 233                 if (RB_PARENT(prev, next) &&
 234                     (prev == RB_RIGHT(RB_PARENT(prev, next), next)))
 235                         prev = RB_PARENT(prev, next);
 236                 else {
 237                         while (RB_PARENT(prev, next) &&
 238                             (prev == RB_LEFT(RB_PARENT(prev, next), next)))
 239                                 prev = RB_PARENT(prev, next);
 240                         prev = RB_PARENT(prev, next);
 241                 }
 242         }
 243
 244         /* Check if range does not overlap */
 245         if (prev != NULL && MM_ADDRESS_END(prev) > address)
 246                 fatal("mm_free: memory corruption: %p(%lu) > %p",
 247                     prev->address, (u_long)prev->size, address);
 248
 249         /* See if we can merge backwards */
 250         if (prev != NULL && MM_ADDRESS_END(prev) == address) {
 251                 prev->size += mms->size;
 252                 RB_REMOVE(mmtree, &mm->rb_free, mms);
 253                 if (mm->mmalloc == NULL)
 254                         xfree(mms);
 255                 else
 256                         mm_free(mm->mmalloc, mms);
 257         } else
 258                 prev = mms;
 259
 260         if (prev == NULL)
 261                 return;
 262
 263         /* Check if we can merge forwards */
 264         mms = RB_NEXT(mmtree, &mm->rb_free, prev);
 265         if (mms == NULL)
 266                 return;
 267
 268         if (MM_ADDRESS_END(prev) > mms->address)
 269                 fatal("mm_free: memory corruption: %p < %p(%lu)",
 270                     mms->address, prev->address, (u_long)prev->size);
 271         if (MM_ADDRESS_END(prev) != mms->address)
 272                 return;
 273
 274         prev->size += mms->size;
 275         RB_REMOVE(mmtree, &mm->rb_free, mms);
 276
 277         if (mm->mmalloc == NULL)
 278                 xfree(mms);
 279         else
 280                 mm_free(mm->mmalloc, mms);
 281 }
 282
 283 static void
 284 mm_sync_list(struct mmtree *oldtree, struct mmtree *newtree,
 285     struct mm_master *mm, struct mm_master *mmold)
 286 {
 287         struct mm_master *mmalloc = mm->mmalloc;
 288         struct mm_share *mms, *new;
 289
 290         /* Sync free list */
 291         RB_FOREACH(mms, mmtree, oldtree) {
 292                 /* Check the values */
 293                 mm_memvalid(mmold, mms, sizeof(struct mm_share));
 294                 mm_memvalid(mm, mms->address, mms->size);
 295
 296                 new = mm_xmalloc(mmalloc, sizeof(struct mm_share));
 297                 memcpy(new, mms, sizeof(struct mm_share));
 298                 RB_INSERT(mmtree, newtree, new);
 299         }
 300 }
 301
 302 void
 303 mm_share_sync(struct mm_master **pmm, struct mm_master **pmmalloc)
 304 {
 305         struct mm_master *mm;
 306         struct mm_master *mmalloc;
 307         struct mm_master *mmold;
 308         struct mmtree rb_free, rb_allocated;
 309
 310         debug3("%s: Share sync", __func__);
 311
 312         mm = *pmm;
 313         mmold = mm->mmalloc;
 314         mm_memvalid(mmold, mm, sizeof(*mm));
 315
 316         mmalloc = mm_create(NULL, mm->size);
 317         mm = mm_xmalloc(mmalloc, sizeof(struct mm_master));
 318         memcpy(mm, *pmm, sizeof(struct mm_master));
 319         mm->mmalloc = mmalloc;
 320
 321         rb_free = mm->rb_free;
 322         rb_allocated = mm->rb_allocated;
 323
 324         RB_INIT(&mm->rb_free);
 325         RB_INIT(&mm->rb_allocated);
 326
 327         mm_sync_list(&rb_free, &mm->rb_free, mm, mmold);
 328         mm_sync_list(&rb_allocated, &mm->rb_allocated, mm, mmold);
 329
 330         mm_destroy(mmold);
 331
 332         *pmm = mm;
 333         *pmmalloc = mmalloc;
 334
 335         debug3("%s: Share sync end", __func__);
 336 }
 337
 338 void
 339 mm_memvalid(struct mm_master *mm, void *address, size_t size)
 340 {
 341         void *end = (u_char *)address + size;
 342
 343         if (address < mm->address)
 344                 fatal("mm_memvalid: address too small: %p", address);
 345         if (end < address)
 346                 fatal("mm_memvalid: end < address: %p < %p", end, address);
 347         if (end > (void *)((u_char *)mm->address + mm->size))
 348                 fatal("mm_memvalid: address too large: %p", address);
 349 }