From fad5a6c66e73d3df20846906121d52159e1f6bf4 Mon Sep 17 00:00:00 2001
From: Michal Schmidt <mschmidt@redhat.com>
Date: Fri, 12 Dec 2014 17:57:22 +0100
Subject: journal: add debug mode for mmap-cache (--enable-debug=mmap-cache)

This is useful for exposing unsafe access to mmapped objects after
the context that they were mapped in was already moved.

For example:
journal_file_move_to_object(f1, OBJECT_DATA, p1, &o1);
journal_file_move_to_object(f2, OBJECT_DATA, p2, &o2);
t = o1->object.type; /* this usually works, but is unsafe */
---
 configure.ac             | 10 ++++++++--
 src/journal/mmap-cache.c | 14 +++++++++++++-
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/configure.ac b/configure.ac
index ea74fcd16..e14f3cfe6 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1328,9 +1328,9 @@ AC_ARG_ENABLE(tests,
 AM_CONDITIONAL(ENABLE_TESTS, [test x$enable_tests = xyes])
 
 AC_ARG_ENABLE(debug,
-        [AC_HELP_STRING([--enable-debug@<:@=LIST@:>@], [enable extra debugging (hashmap)])],
+        [AC_HELP_STRING([--enable-debug@<:@=LIST@:>@], [enable extra debugging (hashmap,mmap-cache)])],
         [if test "x$enableval" = "xyes"; then
-                enableval="hashmap"
+                enableval="hashmap,mmap-cache"
         fi
         saved_ifs="$IFS"
         IFS="$IFS$PATH_SEPARATOR,"
@@ -1339,6 +1339,9 @@ AC_ARG_ENABLE(debug,
                 hashmap)
                         enable_debug_hashmap=yes
                         ;;
+                mmap-cache)
+                        enable_debug_mmap_cache=yes
+                        ;;
                 esac
         done
         IFS="$saved_ifs"],[])
@@ -1348,6 +1351,9 @@ AS_IF([test x$enable_debug_hashmap = xyes], [
         AC_DEFINE(ENABLE_DEBUG_HASHMAP, 1, [Define if hashmap debugging is to be enabled])
         enable_debug="hashmap $enable_debug"
 ])
+AS_IF([test x$enable_debug_mmap_cache = xyes], [
+        AC_DEFINE(ENABLE_DEBUG_MMAP_CACHE, 1, [Define if mmap cache debugging is to be enabled])
+        enable_debug="mmap-cache $enable_debug"
 ])
 test -z "$enable_debug" && enable_debug="none"
 
diff --git a/src/journal/mmap-cache.c b/src/journal/mmap-cache.c
index b7db6f1da..c57c1623c 100644
--- a/src/journal/mmap-cache.c
+++ b/src/journal/mmap-cache.c
@@ -83,7 +83,13 @@ struct MMapCache {
 };
 
 #define WINDOWS_MIN 64
-#define WINDOW_SIZE (8ULL*1024ULL*1024ULL)
+
+#ifdef ENABLE_DEBUG_MMAP_CACHE
+/* Tiny windows increase mmap activity and the chance of exposing unsafe use. */
+# define WINDOW_SIZE (page_size())
+#else
+# define WINDOW_SIZE (8ULL*1024ULL*1024ULL)
+#endif
 
 MMapCache* mmap_cache_new(void) {
         MMapCache *m;
@@ -187,11 +193,17 @@ static void context_detach_window(Context *c) {
 
         if (!w->contexts && w->keep_always == 0) {
                 /* Not used anymore? */
+#ifdef ENABLE_DEBUG_MMAP_CACHE
+                /* Unmap unused windows immediately to expose use-after-unmap
+                 * by SIGSEGV. */
+                window_free(w);
+#else
                 LIST_PREPEND(unused, c->cache->unused, w);
                 if (!c->cache->last_unused)
                         c->cache->last_unused = w;
 
                 w->in_unused = true;
+#endif
         }
 }
 
-- 
cgit v1.2.3