Attachment 132291 Details for Bug 101595 – Reproducer that also tries to reopen /proc/<pid>/<fd> with write access

Reproducer that also tries to reopen /proc/<pid>/<fd> with write access

trashkeymapharder.c (text/x-csrc), 2.35 KB, created by Jonas Ådahl on 2017-06-28 02:10:29 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonas Ådahl

Created: 2017-06-28 02:10:29 UTC

Size: 2.35 KB

patch

obsolete

>#include <assert.h>
>#include <fcntl.h>
>#include <stdbool.h>
>#include <stdio.h>
>#include <stdlib.h>
>#include <string.h>
>#include <unistd.h>
>#include <sys/mman.h>
>#include <sys/types.h>
>#include <sys/stat.h>
>#include <unistd.h>
>#include <wayland-client.h>
>
>struct wl_display* display = NULL;
>struct wl_seat* seat = NULL;
>static void
>global_registry_handler(void *data, struct wl_registry *registry, uint32_t id,
>	const char *interface, uint32_t version)
>{
>	if (strcmp(interface, "wl_seat") == 0)
>		seat = wl_registry_bind(registry, id, &wl_seat_interface, 1);
>}
>
>static const struct wl_registry_listener registry_listener = {
>	global_registry_handler,
>	NULL
>};
>
>static void
>keymap_handler(void *data, struct wl_keyboard *keyboard, 
>	       uint32_t format, int32_t fd, uint32_t size)
>{
>	char *keymap;
>
>	keymap = mmap(NULL, size, PROT_READ, MAP_SHARED, fd, 0);
>	if (keymap == MAP_FAILED) {
>		printf("Couldn't map keymap: %m\n");
>		exit(EXIT_FAILURE);
>	}
>	if (keymap[0] == 'a') {
>		printf("Keymap already trashed\n");
>		exit(EXIT_SUCCESS);
>	}
>	munmap(keymap, size);
>
>	printf("Trashing keymap\n");
>	keymap = mmap(NULL, size, PROT_WRITE | PROT_READ, MAP_SHARED, fd, 0);
>
>	if (keymap != MAP_FAILED) {
>		keymap[0] = 'a';
>	} else {
>		int reopened_fd;
>		char path[1024];
>		char *keymap_copy;
>
>		printf("Trying harder to trash keymap\n");
>		memset(path, 0, 1024);
>		snprintf(path, 1024, "/proc/%d/fd/%d", getpid(), fd);
>		reopened_fd = open(path, O_RDWR, 0);
>		if (reopened_fd < 0) {
>			printf("Failed to reopen %s: %m\n", path);
>			exit(EXIT_FAILURE);
>		}
>
>		keymap = mmap(NULL, size, PROT_READ, MAP_SHARED, fd, 0);
>		keymap_copy = malloc(size);
>		memcpy(keymap_copy, keymap, size);
>
>		keymap_copy[0] = 'a';
>
>		if (write(reopened_fd, keymap_copy, size) < size) {
>			printf("Failed to write to reopened fd: %m\n");
>			exit(EXIT_FAILURE);
>		}
>	}
>}
>
>static const struct wl_keyboard_listener keyboard_listener = {
>	keymap_handler,
>	NULL,
>	NULL,
>	NULL,
>	NULL,
>	NULL
>};
>
>
>int main(int argc, char **argv)
>{
>	display = wl_display_connect(NULL);
>	assert(display);
>	struct wl_registry* registry = wl_display_get_registry(display);
>	wl_registry_add_listener(registry, &registry_listener, NULL);
>	assert(registry);
>	wl_display_roundtrip(display);
>
>	assert(seat);
>	struct wl_keyboard* keyboard = wl_seat_get_keyboard(seat);
>	wl_keyboard_add_listener(keyboard, &keyboard_listener, NULL);
>	wl_display_roundtrip(display);
>
>	return 0;
>}

Actions: View

Attachments on bug 101595: 132248 | 132254 | 132291 | 132307 | 132308 | 132327 | 132375

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.