| Message ID | 20181019125239.GA13884@humpty.home.comstyle.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v3] oslib-posix: Use MAP_STACK in qemu_alloc_stack() on OpenBSD | expand |
ping. On 10/19/2018 8:52 AM, Brad Smith wrote: > Use MAP_STACK in qemu_alloc_stack() on OpenBSD. > > Added to our 6.4 release. > > MAP_STACK Indicate that the mapping is used as a stack. This > flag must be used in combination with MAP_ANON and > MAP_PRIVATE. > > Implement MAP_STACK option for mmap(). Synchronous faults (pagefault and > syscall) confirm the stack register points at MAP_STACK memory, otherwise > SIGSEGV is delivered. sigaltstack() and pthread_attr_setstack() are modified > to create a MAP_STACK sub-region which satisfies alignment requirements. > Observe that MAP_STACK can only be set/cleared by mmap(), which zeroes the > contents of the region -- there is no mprotect() equivalent operation, so > there is no MAP_STACK-adding gadget. > > > Signed-off-by: Brad Smith <brad@comstyle.com> > Reviewed-by: Kamil Rytarowski <n54@gmx.com> > Reviewed-by: Peter Maydell <peter.maydell@linaro.org> > > diff --git a/util/oslib-posix.c b/util/oslib-posix.c > index fbd0dc8c57..c1bee2a581 100644 > --- a/util/oslib-posix.c > +++ b/util/oslib-posix.c > @@ -596,6 +596,7 @@ pid_t qemu_fork(Error **errp) > void *qemu_alloc_stack(size_t *sz) > { > void *ptr, *guardpage; > + int flags; > #ifdef CONFIG_DEBUG_STACK_USAGE > void *ptr2; > #endif > @@ -610,8 +611,18 @@ void *qemu_alloc_stack(size_t *sz) > /* allocate one extra page for the guard page */ > *sz += pagesz; > > - ptr = mmap(NULL, *sz, PROT_READ | PROT_WRITE, > - MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); > + flags = MAP_PRIVATE | MAP_ANONYMOUS; > +#if defined(MAP_STACK) && defined(__OpenBSD__) > + /* Only enable MAP_STACK on OpenBSD. Other OS's such as > + * Linux/FreeBSD/NetBSD have a flag with the same name > + * but have differing functionality. OpenBSD will SEGV > + * if it spots execution with a stack pointer pointing > + * at memory that was not allocated with MAP_STACK. > + */ > + flags |= MAP_STACK; > +#endif > + > + ptr = mmap(NULL, *sz, PROT_READ | PROT_WRITE, flags, -1, 0); > if (ptr == MAP_FAILED) { > perror("failed to allocate memory for stack"); > abort(); >
On 5 November 2018 at 22:44, Brad Smith <brad@comstyle.com> wrote: > ping. > Thanks for the ping, applied to master for rc0. -- PMM
diff --git a/util/oslib-posix.c b/util/oslib-posix.c index fbd0dc8c57..c1bee2a581 100644 --- a/util/oslib-posix.c +++ b/util/oslib-posix.c @@ -596,6 +596,7 @@ pid_t qemu_fork(Error **errp) void *qemu_alloc_stack(size_t *sz) { void *ptr, *guardpage; + int flags; #ifdef CONFIG_DEBUG_STACK_USAGE void *ptr2; #endif @@ -610,8 +611,18 @@ void *qemu_alloc_stack(size_t *sz) /* allocate one extra page for the guard page */ *sz += pagesz; - ptr = mmap(NULL, *sz, PROT_READ | PROT_WRITE, - MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); + flags = MAP_PRIVATE | MAP_ANONYMOUS; +#if defined(MAP_STACK) && defined(__OpenBSD__) + /* Only enable MAP_STACK on OpenBSD. Other OS's such as + * Linux/FreeBSD/NetBSD have a flag with the same name + * but have differing functionality. OpenBSD will SEGV + * if it spots execution with a stack pointer pointing + * at memory that was not allocated with MAP_STACK. + */ + flags |= MAP_STACK; +#endif + + ptr = mmap(NULL, *sz, PROT_READ | PROT_WRITE, flags, -1, 0); if (ptr == MAP_FAILED) { perror("failed to allocate memory for stack"); abort();
Use MAP_STACK in qemu_alloc_stack() on OpenBSD. Added to our 6.4 release. MAP_STACK Indicate that the mapping is used as a stack. This flag must be used in combination with MAP_ANON and MAP_PRIVATE. Implement MAP_STACK option for mmap(). Synchronous faults (pagefault and syscall) confirm the stack register points at MAP_STACK memory, otherwise SIGSEGV is delivered. sigaltstack() and pthread_attr_setstack() are modified to create a MAP_STACK sub-region which satisfies alignment requirements. Observe that MAP_STACK can only be set/cleared by mmap(), which zeroes the contents of the region -- there is no mprotect() equivalent operation, so there is no MAP_STACK-adding gadget. Signed-off-by: Brad Smith <brad@comstyle.com> Reviewed-by: Kamil Rytarowski <n54@gmx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>