openssh-portable/monitor_mm.c

356 lines
8.5 KiB
C
Raw Normal View History

/* $OpenBSD: monitor_mm.c,v 1.19 2014/01/04 17:50:55 tedu Exp $ */
/*
* Copyright 2002 Niels Provos <provos@citi.umich.edu>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include "includes.h"
- deraadt@cvs.openbsd.org 2006/08/03 03:34:42 [OVERVIEW atomicio.c atomicio.h auth-bsdauth.c auth-chall.c auth-krb5.c] [auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c auth-rhosts.c] [auth-rsa.c auth-skey.c auth.c auth.h auth1.c auth2-chall.c auth2-gss.c] [auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c ] [auth2-pubkey.c auth2.c authfd.c authfd.h authfile.c bufaux.c bufbn.c] [buffer.c buffer.h canohost.c channels.c channels.h cipher-3des1.c] [cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c] [compress.c deattack.c dh.c dispatch.c dns.c dns.h fatal.c groupaccess.c] [groupaccess.h gss-genr.c gss-serv-krb5.c gss-serv.c hostfile.c kex.c] [kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c] [key.h log.c log.h mac.c match.c md-sha256.c misc.c misc.h moduli.c] [monitor.c monitor_fdpass.c monitor_mm.c monitor_mm.h monitor_wrap.c] [monitor_wrap.h msg.c nchan.c packet.c progressmeter.c readconf.c] [readconf.h readpass.c rsa.c scard.c scard.h scp.c servconf.c servconf.h] [serverloop.c session.c session.h sftp-client.c sftp-common.c] [sftp-common.h sftp-glob.c sftp-server.c sftp.c ssh-add.c ssh-agent.c] [ssh-dss.c ssh-gss.h ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rsa.c] [ssh.c ssh.h sshconnect.c sshconnect.h sshconnect1.c sshconnect2.c] [sshd.c sshlogin.c sshlogin.h sshpty.c sshpty.h sshtty.c ttymodes.c] [uidswap.c uidswap.h uuencode.c uuencode.h xmalloc.c xmalloc.h] [loginrec.c loginrec.h openbsd-compat/port-aix.c openbsd-compat/port-tun.h] almost entirely get rid of the culture of ".h files that include .h files" ok djm, sort of ok stevesk makes the pain stop in one easy step NB. portable commit contains everything *except* removing includes.h, as that will take a fair bit more work as we move headers that are required for portability workarounds to defines.h. (also, this step wasn't "easy")
2006-08-05 04:39:39 +02:00
#include <sys/types.h>
#ifdef HAVE_SYS_MMAN_H
#include <sys/mman.h>
#endif
#include <sys/param.h>
- deraadt@cvs.openbsd.org 2006/08/03 03:34:42 [OVERVIEW atomicio.c atomicio.h auth-bsdauth.c auth-chall.c auth-krb5.c] [auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c auth-rhosts.c] [auth-rsa.c auth-skey.c auth.c auth.h auth1.c auth2-chall.c auth2-gss.c] [auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c ] [auth2-pubkey.c auth2.c authfd.c authfd.h authfile.c bufaux.c bufbn.c] [buffer.c buffer.h canohost.c channels.c channels.h cipher-3des1.c] [cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c] [compress.c deattack.c dh.c dispatch.c dns.c dns.h fatal.c groupaccess.c] [groupaccess.h gss-genr.c gss-serv-krb5.c gss-serv.c hostfile.c kex.c] [kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c] [key.h log.c log.h mac.c match.c md-sha256.c misc.c misc.h moduli.c] [monitor.c monitor_fdpass.c monitor_mm.c monitor_mm.h monitor_wrap.c] [monitor_wrap.h msg.c nchan.c packet.c progressmeter.c readconf.c] [readconf.h readpass.c rsa.c scard.c scard.h scp.c servconf.c servconf.h] [serverloop.c session.c session.h sftp-client.c sftp-common.c] [sftp-common.h sftp-glob.c sftp-server.c sftp.c ssh-add.c ssh-agent.c] [ssh-dss.c ssh-gss.h ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rsa.c] [ssh.c ssh.h sshconnect.c sshconnect.h sshconnect1.c sshconnect2.c] [sshd.c sshlogin.c sshlogin.h sshpty.c sshpty.h sshtty.c ttymodes.c] [uidswap.c uidswap.h uuencode.c uuencode.h xmalloc.c xmalloc.h] [loginrec.c loginrec.h openbsd-compat/port-aix.c openbsd-compat/port-tun.h] almost entirely get rid of the culture of ".h files that include .h files" ok djm, sort of ok stevesk makes the pain stop in one easy step NB. portable commit contains everything *except* removing includes.h, as that will take a fair bit more work as we move headers that are required for portability workarounds to defines.h. (also, this step wasn't "easy")
2006-08-05 04:39:39 +02:00
#include "openbsd-compat/sys-tree.h"
#include <errno.h>
- deraadt@cvs.openbsd.org 2006/08/03 03:34:42 [OVERVIEW atomicio.c atomicio.h auth-bsdauth.c auth-chall.c auth-krb5.c] [auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c auth-rhosts.c] [auth-rsa.c auth-skey.c auth.c auth.h auth1.c auth2-chall.c auth2-gss.c] [auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c ] [auth2-pubkey.c auth2.c authfd.c authfd.h authfile.c bufaux.c bufbn.c] [buffer.c buffer.h canohost.c channels.c channels.h cipher-3des1.c] [cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c] [compress.c deattack.c dh.c dispatch.c dns.c dns.h fatal.c groupaccess.c] [groupaccess.h gss-genr.c gss-serv-krb5.c gss-serv.c hostfile.c kex.c] [kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c] [key.h log.c log.h mac.c match.c md-sha256.c misc.c misc.h moduli.c] [monitor.c monitor_fdpass.c monitor_mm.c monitor_mm.h monitor_wrap.c] [monitor_wrap.h msg.c nchan.c packet.c progressmeter.c readconf.c] [readconf.h readpass.c rsa.c scard.c scard.h scp.c servconf.c servconf.h] [serverloop.c session.c session.h sftp-client.c sftp-common.c] [sftp-common.h sftp-glob.c sftp-server.c sftp.c ssh-add.c ssh-agent.c] [ssh-dss.c ssh-gss.h ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rsa.c] [ssh.c ssh.h sshconnect.c sshconnect.h sshconnect1.c sshconnect2.c] [sshd.c sshlogin.c sshlogin.h sshpty.c sshpty.h sshtty.c ttymodes.c] [uidswap.c uidswap.h uuencode.c uuencode.h xmalloc.c xmalloc.h] [loginrec.c loginrec.h openbsd-compat/port-aix.c openbsd-compat/port-tun.h] almost entirely get rid of the culture of ".h files that include .h files" ok djm, sort of ok stevesk makes the pain stop in one easy step NB. portable commit contains everything *except* removing includes.h, as that will take a fair bit more work as we move headers that are required for portability workarounds to defines.h. (also, this step wasn't "easy")
2006-08-05 04:39:39 +02:00
#include <stdarg.h>
#include <stddef.h>
#include <stdlib.h>
#include <string.h>
#include "xmalloc.h"
- deraadt@cvs.openbsd.org 2006/08/03 03:34:42 [OVERVIEW atomicio.c atomicio.h auth-bsdauth.c auth-chall.c auth-krb5.c] [auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c auth-rhosts.c] [auth-rsa.c auth-skey.c auth.c auth.h auth1.c auth2-chall.c auth2-gss.c] [auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c ] [auth2-pubkey.c auth2.c authfd.c authfd.h authfile.c bufaux.c bufbn.c] [buffer.c buffer.h canohost.c channels.c channels.h cipher-3des1.c] [cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c] [compress.c deattack.c dh.c dispatch.c dns.c dns.h fatal.c groupaccess.c] [groupaccess.h gss-genr.c gss-serv-krb5.c gss-serv.c hostfile.c kex.c] [kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c] [key.h log.c log.h mac.c match.c md-sha256.c misc.c misc.h moduli.c] [monitor.c monitor_fdpass.c monitor_mm.c monitor_mm.h monitor_wrap.c] [monitor_wrap.h msg.c nchan.c packet.c progressmeter.c readconf.c] [readconf.h readpass.c rsa.c scard.c scard.h scp.c servconf.c servconf.h] [serverloop.c session.c session.h sftp-client.c sftp-common.c] [sftp-common.h sftp-glob.c sftp-server.c sftp.c ssh-add.c ssh-agent.c] [ssh-dss.c ssh-gss.h ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rsa.c] [ssh.c ssh.h sshconnect.c sshconnect.h sshconnect1.c sshconnect2.c] [sshd.c sshlogin.c sshlogin.h sshpty.c sshpty.h sshtty.c ttymodes.c] [uidswap.c uidswap.h uuencode.c uuencode.h xmalloc.c xmalloc.h] [loginrec.c loginrec.h openbsd-compat/port-aix.c openbsd-compat/port-tun.h] almost entirely get rid of the culture of ".h files that include .h files" ok djm, sort of ok stevesk makes the pain stop in one easy step NB. portable commit contains everything *except* removing includes.h, as that will take a fair bit more work as we move headers that are required for portability workarounds to defines.h. (also, this step wasn't "easy")
2006-08-05 04:39:39 +02:00
#include "ssh.h"
#include "log.h"
#include "monitor_mm.h"
static int
mm_compare(struct mm_share *a, struct mm_share *b)
{
ptrdiff_t diff = (char *)a->address - (char *)b->address;
if (diff == 0)
return (0);
else if (diff < 0)
return (-1);
else
return (1);
}
RB_GENERATE(mmtree, mm_share, next, mm_compare)
static struct mm_share *
mm_make_entry(struct mm_master *mm, struct mmtree *head,
void *address, size_t size)
{
struct mm_share *tmp, *tmp2;
if (mm->mmalloc == NULL)
tmp = xcalloc(1, sizeof(struct mm_share));
else
tmp = mm_xmalloc(mm->mmalloc, sizeof(struct mm_share));
tmp->address = address;
tmp->size = size;
tmp2 = RB_INSERT(mmtree, head, tmp);
if (tmp2 != NULL)
fatal("mm_make_entry(%p): double address %p->%p(%zu)",
mm, tmp2, address, size);
return (tmp);
}
/* Creates a shared memory area of a certain size */
struct mm_master *
mm_create(struct mm_master *mmalloc, size_t size)
{
void *address;
struct mm_master *mm;
if (mmalloc == NULL)
mm = xcalloc(1, sizeof(struct mm_master));
else
mm = mm_xmalloc(mmalloc, sizeof(struct mm_master));
/*
* If the memory map has a mm_master it can be completely
* shared including authentication between the child
* and the client.
*/
mm->mmalloc = mmalloc;
address = xmmap(size);
if (address == (void *)MAP_FAILED)
fatal("mmap(%zu): %s", size, strerror(errno));
mm->address = address;
mm->size = size;
RB_INIT(&mm->rb_free);
RB_INIT(&mm->rb_allocated);
mm_make_entry(mm, &mm->rb_free, address, size);
return (mm);
}
/* Frees either the allocated or the free list */
static void
mm_freelist(struct mm_master *mmalloc, struct mmtree *head)
{
struct mm_share *mms, *next;
for (mms = RB_ROOT(head); mms; mms = next) {
next = RB_NEXT(mmtree, head, mms);
RB_REMOVE(mmtree, head, mms);
if (mmalloc == NULL)
free(mms);
else
mm_free(mmalloc, mms);
}
}
/* Destroys a memory mapped area */
void
mm_destroy(struct mm_master *mm)
{
mm_freelist(mm->mmalloc, &mm->rb_free);
mm_freelist(mm->mmalloc, &mm->rb_allocated);
#ifdef HAVE_MMAP
if (munmap(mm->address, mm->size) == -1)
fatal("munmap(%p, %zu): %s", mm->address, mm->size,
strerror(errno));
#else
fatal("%s: UsePrivilegeSeparation=yes and Compression=yes not supported",
__func__);
#endif
if (mm->mmalloc == NULL)
free(mm);
else
mm_free(mm->mmalloc, mm);
}
void *
mm_xmalloc(struct mm_master *mm, size_t size)
{
void *address;
address = mm_malloc(mm, size);
if (address == NULL)
fatal("%s: mm_malloc(%zu)", __func__, size);
memset(address, 0, size);
return (address);
}
/* Allocates data from a memory mapped area */
void *
mm_malloc(struct mm_master *mm, size_t size)
{
struct mm_share *mms, *tmp;
if (size == 0)
fatal("mm_malloc: try to allocate 0 space");
if (size > SIZE_T_MAX - MM_MINSIZE + 1)
fatal("mm_malloc: size too big");
size = ((size + (MM_MINSIZE - 1)) / MM_MINSIZE) * MM_MINSIZE;
RB_FOREACH(mms, mmtree, &mm->rb_free) {
if (mms->size >= size)
break;
}
if (mms == NULL)
return (NULL);
/* Debug */
memset(mms->address, 0xd0, size);
tmp = mm_make_entry(mm, &mm->rb_allocated, mms->address, size);
/* Does not change order in RB tree */
mms->size -= size;
mms->address = (char *)mms->address + size;
if (mms->size == 0) {
RB_REMOVE(mmtree, &mm->rb_free, mms);
if (mm->mmalloc == NULL)
free(mms);
else
mm_free(mm->mmalloc, mms);
}
return (tmp->address);
}
/* Frees memory in a memory mapped area */
void
mm_free(struct mm_master *mm, void *address)
{
struct mm_share *mms, *prev, tmp;
tmp.address = address;
mms = RB_FIND(mmtree, &mm->rb_allocated, &tmp);
if (mms == NULL)
fatal("mm_free(%p): can not find %p", mm, address);
/* Debug */
memset(mms->address, 0xd0, mms->size);
/* Remove from allocated list and insert in free list */
RB_REMOVE(mmtree, &mm->rb_allocated, mms);
if (RB_INSERT(mmtree, &mm->rb_free, mms) != NULL)
fatal("mm_free(%p): double address %p", mm, address);
/* Find previous entry */
prev = mms;
if (RB_LEFT(prev, next)) {
prev = RB_LEFT(prev, next);
while (RB_RIGHT(prev, next))
prev = RB_RIGHT(prev, next);
} else {
if (RB_PARENT(prev, next) &&
(prev == RB_RIGHT(RB_PARENT(prev, next), next)))
prev = RB_PARENT(prev, next);
else {
while (RB_PARENT(prev, next) &&
(prev == RB_LEFT(RB_PARENT(prev, next), next)))
prev = RB_PARENT(prev, next);
prev = RB_PARENT(prev, next);
}
}
/* Check if range does not overlap */
if (prev != NULL && MM_ADDRESS_END(prev) > address)
fatal("mm_free: memory corruption: %p(%zu) > %p",
prev->address, prev->size, address);
/* See if we can merge backwards */
if (prev != NULL && MM_ADDRESS_END(prev) == address) {
prev->size += mms->size;
RB_REMOVE(mmtree, &mm->rb_free, mms);
if (mm->mmalloc == NULL)
free(mms);
else
mm_free(mm->mmalloc, mms);
} else
prev = mms;
if (prev == NULL)
return;
/* Check if we can merge forwards */
mms = RB_NEXT(mmtree, &mm->rb_free, prev);
if (mms == NULL)
return;
if (MM_ADDRESS_END(prev) > mms->address)
fatal("mm_free: memory corruption: %p < %p(%zu)",
mms->address, prev->address, prev->size);
if (MM_ADDRESS_END(prev) != mms->address)
return;
prev->size += mms->size;
RB_REMOVE(mmtree, &mm->rb_free, mms);
if (mm->mmalloc == NULL)
free(mms);
else
mm_free(mm->mmalloc, mms);
}
static void
mm_sync_list(struct mmtree *oldtree, struct mmtree *newtree,
struct mm_master *mm, struct mm_master *mmold)
{
struct mm_master *mmalloc = mm->mmalloc;
struct mm_share *mms, *new;
/* Sync free list */
RB_FOREACH(mms, mmtree, oldtree) {
/* Check the values */
mm_memvalid(mmold, mms, sizeof(struct mm_share));
mm_memvalid(mm, mms->address, mms->size);
new = mm_xmalloc(mmalloc, sizeof(struct mm_share));
memcpy(new, mms, sizeof(struct mm_share));
RB_INSERT(mmtree, newtree, new);
}
}
void
mm_share_sync(struct mm_master **pmm, struct mm_master **pmmalloc)
{
struct mm_master *mm;
struct mm_master *mmalloc;
struct mm_master *mmold;
struct mmtree rb_free, rb_allocated;
debug3("%s: Share sync", __func__);
mm = *pmm;
mmold = mm->mmalloc;
mm_memvalid(mmold, mm, sizeof(*mm));
mmalloc = mm_create(NULL, mm->size);
mm = mm_xmalloc(mmalloc, sizeof(struct mm_master));
memcpy(mm, *pmm, sizeof(struct mm_master));
mm->mmalloc = mmalloc;
rb_free = mm->rb_free;
rb_allocated = mm->rb_allocated;
RB_INIT(&mm->rb_free);
RB_INIT(&mm->rb_allocated);
mm_sync_list(&rb_free, &mm->rb_free, mm, mmold);
mm_sync_list(&rb_allocated, &mm->rb_allocated, mm, mmold);
mm_destroy(mmold);
*pmm = mm;
*pmmalloc = mmalloc;
debug3("%s: Share sync end", __func__);
}
void
mm_memvalid(struct mm_master *mm, void *address, size_t size)
{
void *end = (char *)address + size;
if (address < mm->address)
fatal("mm_memvalid: address too small: %p", address);
if (end < address)
fatal("mm_memvalid: end < address: %p < %p", end, address);
if (end > MM_ADDRESS_END(mm))
fatal("mm_memvalid: address too large: %p", address);
}