From patchwork Sat Aug 3 21:07:59 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Richard Henderson X-Patchwork-Id: 170514 Delivered-To: patch@linaro.org Received: by 2002:a92:512:0:0:0:0:0 with SMTP id q18csp2430643ile; Sat, 3 Aug 2019 14:10:13 -0700 (PDT) X-Google-Smtp-Source: APXvYqxgmpC9edV/Mb3p/uz60L9p7ECJKgPW5eXUF6lE3VFAZUjyhPdbruEd+rZY7TDLhHeksCOF X-Received: by 2002:a50:972c:: with SMTP id c41mr127368436edb.153.1564866613707; Sat, 03 Aug 2019 14:10:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1564866613; cv=none; d=google.com; s=arc-20160816; b=m7YCBkejU2/IZShIBXX8Qu0paClXXsWHHriwg2w+AgVxtNAXXfZB2Wbbddsbuc3ywZ Srj+lwh5EOhObzXb+Is8AGvK3NQseNb1z+dgRSltxN23jHLxwEXi0++Cx3LSminogov+ OqEiahNGvZDA2AC5k/dhGUnxfj4qxnqcGWVEy47r3DjvG9mL3vwjqIDxf/ZSiOERPsLq noncc8h84rDaoYLsQOPCbwoaDqwSA9xQoh3UQBcDVYPJGaj+QSv2DlTiHMyrJJu4sE9T dgnZ6GcfAyHTsVgeV78XVHc2TKf9GEHeUX2WxMLQeGMsY13OsjgORheGjiUT0F0oT/rn VOHg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:cc:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:subject:references:in-reply-to :message-id:date:to:from:dkim-signature; bh=iY1rJ5gqOJNqiFkLvVP5dE/pUQCE/8Q8pJZi7hZ3KUU=; b=biRp3woxKwmaLJsmPEP4+34JU+YotKttSeaJEPoVhHKou7stEkpcsDdvlCajcXCFzb yLhoU1WtZOlwqzNIGyK6vJXYZiQnzh6rqnqP/j/nEpg/SCjN+n3qQJIkb1wDl0pxKzj/ 1VwxLbg0VWt1tkEpwEad3ZF975KduvEyC7IlDvjuwJAGHZPOc7yGcyer3GTOQDOIKzcF U7nGy6hqF3j4qyaKQSUmnWVItJd+jdhRVlrD307j+cA/iNb68FQafADZ4UE8YEPbGXHc vyAr6uEPa2QKskgvIQqc+/ryzQiY902Mmjuo2A4OkzxQP0grF+dyNU9G+vSXFtyZNpJ8 3DNw== ARC-Authentication-Results: i=1; mx.google.com; dkim=fail header.i=@linaro.org header.s=google header.b=xME2Bdkw; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id oe22si24868215ejb.79.2019.08.03.14.10.13 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Sat, 03 Aug 2019 14:10:13 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=fail header.i=@linaro.org header.s=google header.b=xME2Bdkw; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1]:42028 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1hu1I4-00057t-LW for patch@linaro.org; Sat, 03 Aug 2019 17:10:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:52049) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1hu1GL-00016L-IS for qemu-devel@nongnu.org; Sat, 03 Aug 2019 17:08:27 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hu1GJ-0005TG-Sy for qemu-devel@nongnu.org; Sat, 03 Aug 2019 17:08:25 -0400 Received: from mail-pg1-x541.google.com ([2607:f8b0:4864:20::541]:36153) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1hu1GH-0005N2-S2 for qemu-devel@nongnu.org; Sat, 03 Aug 2019 17:08:23 -0400 Received: by mail-pg1-x541.google.com with SMTP id l21so37748320pgm.3 for ; Sat, 03 Aug 2019 14:08:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=iY1rJ5gqOJNqiFkLvVP5dE/pUQCE/8Q8pJZi7hZ3KUU=; b=xME2BdkwnU1Jc2XfraqWMVV3Qmp2sp+V1P4tHhNZ400gndzuR1ADIhpaL3MsbeTrSw LeQrslH7jcjGxZ1p7pXhxOXZTP2bYlREQLzGF6Y/kEuvRuA6/rCOxwt5H+octEDGu9/+ EXqaDrSiHtTc4cm0Z83Y1oe0gDhgDPZiA2nkk0Ps2fiiJpXwzvUtVaLffvMBc5lO8p0h zLhr4BtTAYwYgZHyavKTRt5YEk3NdFGbTajOd/L3xwccrz5+xJ3oycljuaqXMZ2/+Iok lKxSG1x57UKCrUxQZuFfmUvh719FIk9y5k+XxOpYE6XfUQRN9G8vRQ43ZnXIIxh5uWdp 2PhQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=iY1rJ5gqOJNqiFkLvVP5dE/pUQCE/8Q8pJZi7hZ3KUU=; b=Wt2Ss0SN2TlSAmj3jM/7xmjoggWqS/7j2KUkgB3RXzHcaiB4jsi7dchPJ4FmGv4X1C HxxBFOuW70ASTHSeIdIHcqlUva5U3YPCzhRSd6R0z5Y44+8Ux/jGj8eXarusSyUA7U/T FmJQQZt6ZoxxjegB2Q9nUOISzIf/1MpK2SR0AKUXjNTs8cZbtXcPZzXMvnDRHd0BYG8v QkHnOe0Wx8Krq52snKP7NRJQfwWCJLtMQ/JS6uiXqGu9THPvyX9xH8xARYPSzMMP0yKN M3wMqp6QPGx0hnZpz++FWNNQmDLYlz3MAhZ0FElxq1ek+w9uQ1uoSauJf2ogStdDVC0u kLdA== X-Gm-Message-State: APjAAAU+tCGUp/lVM4CrGblKVKPdM6DCZkFhjJg5vO1k58C39OjlvcOL ssae6XaDP60GPfRxKkJcw68OsK5dIjo= X-Received: by 2002:a63:4612:: with SMTP id t18mr121646295pga.85.1564866489358; Sat, 03 Aug 2019 14:08:09 -0700 (PDT) Received: from localhost.localdomain (97-113-7-119.tukw.qwest.net. [97.113.7.119]) by smtp.gmail.com with ESMTPSA id x25sm110129644pfa.90.2019.08.03.14.08.08 (version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256); Sat, 03 Aug 2019 14:08:08 -0700 (PDT) From: Richard Henderson To: qemu-devel@nongnu.org Date: Sat, 3 Aug 2019 14:07:59 -0700 Message-Id: <20190803210803.5701-3-richard.henderson@linaro.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190803210803.5701-1-richard.henderson@linaro.org> References: <20190803210803.5701-1-richard.henderson@linaro.org> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2607:f8b0:4864:20::541 Subject: [Qemu-devel] [PATCH v7 2/6] linux-user: Validate mmap/mprotect prot value X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: peter.maydell@linaro.org, qemu-arm@nongnu.org, alex.bennee@linaro.org, Dave.Martin@arm.com Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: "Qemu-devel" The kernel will return -EINVAL for bits set in the prot argument that are unknown or invalid. Previously we were simply cropping out the bits that we care about. Introduce validate_prot_to_pageflags to perform this check in a single place between the two syscalls. Differentiate between the target and host versions of prot. Compute the qemu internal page_flags value at the same time. Signed-off-by: Richard Henderson --- linux-user/mmap.c | 105 ++++++++++++++++++++++++++++++++-------------- 1 file changed, 74 insertions(+), 31 deletions(-) -- 2.17.1 Reviewed-by: Peter Maydell diff --git a/linux-user/mmap.c b/linux-user/mmap.c index 46a6e3a761..c1a188ec0b 100644 --- a/linux-user/mmap.c +++ b/linux-user/mmap.c @@ -60,11 +60,37 @@ void mmap_fork_end(int child) pthread_mutex_unlock(&mmap_mutex); } +/* + * Validate target prot bitmask. + * Return the prot bitmask for the host in *HOST_PROT. + * Return 0 if the target prot bitmask is invalid, otherwise + * the internal qemu page_flags (which will include PAGE_VALID). + */ +static int validate_prot_to_pageflags(int *host_prot, int prot) +{ + int valid = PROT_READ | PROT_WRITE | PROT_EXEC | TARGET_PROT_SEM; + int page_flags = (prot & PAGE_BITS) | PAGE_VALID; + + /* + * While PROT_SEM was added with the initial futex api, and continues + * to be accepted, it is documented as unused on all architectures. + * Moreover, it was never added to glibc so we don't have a definition + * for the host. Follow the kernel and ignore it. + * + * TODO: We do not actually have to map guest pages as executable, + * since they will not be directly executed by the host. We only + * need to remember exec within page_flags. + */ + *host_prot = prot & (PROT_READ | PROT_WRITE | PROT_EXEC); + + return prot & ~valid ? 0 : page_flags; +} + /* NOTE: all the constants are the HOST ones, but addresses are target. */ -int target_mprotect(abi_ulong start, abi_ulong len, int prot) +int target_mprotect(abi_ulong start, abi_ulong len, int target_prot) { abi_ulong end, host_start, host_end, addr; - int prot1, ret; + int prot1, ret, page_flags, host_prot; #ifdef DEBUG_MMAP printf("mprotect: start=0x" TARGET_ABI_FMT_lx @@ -74,56 +100,65 @@ int target_mprotect(abi_ulong start, abi_ulong len, int prot) prot & PROT_EXEC ? 'x' : '-'); #endif - if ((start & ~TARGET_PAGE_MASK) != 0) + if ((start & ~TARGET_PAGE_MASK) != 0) { return -TARGET_EINVAL; + } + page_flags = validate_prot_to_pageflags(&host_prot, target_prot); + if (!page_flags) { + return -TARGET_EINVAL; + } len = TARGET_PAGE_ALIGN(len); end = start + len; if (!guest_range_valid(start, len)) { return -TARGET_ENOMEM; } - prot &= PROT_READ | PROT_WRITE | PROT_EXEC; - if (len == 0) + if (len == 0) { return 0; + } mmap_lock(); host_start = start & qemu_host_page_mask; host_end = HOST_PAGE_ALIGN(end); if (start > host_start) { /* handle host page containing start */ - prot1 = prot; - for(addr = host_start; addr < start; addr += TARGET_PAGE_SIZE) { + prot1 = host_prot; + for (addr = host_start; addr < start; addr += TARGET_PAGE_SIZE) { prot1 |= page_get_flags(addr); } if (host_end == host_start + qemu_host_page_size) { - for(addr = end; addr < host_end; addr += TARGET_PAGE_SIZE) { + for (addr = end; addr < host_end; addr += TARGET_PAGE_SIZE) { prot1 |= page_get_flags(addr); } end = host_end; } - ret = mprotect(g2h(host_start), qemu_host_page_size, prot1 & PAGE_BITS); - if (ret != 0) + ret = mprotect(g2h(host_start), qemu_host_page_size, + prot1 & PAGE_BITS); + if (ret != 0) { goto error; + } host_start += qemu_host_page_size; } if (end < host_end) { - prot1 = prot; - for(addr = end; addr < host_end; addr += TARGET_PAGE_SIZE) { + prot1 = host_prot; + for (addr = end; addr < host_end; addr += TARGET_PAGE_SIZE) { prot1 |= page_get_flags(addr); } - ret = mprotect(g2h(host_end - qemu_host_page_size), qemu_host_page_size, - prot1 & PAGE_BITS); - if (ret != 0) + ret = mprotect(g2h(host_end - qemu_host_page_size), + qemu_host_page_size, prot1 & PAGE_BITS); + if (ret != 0) { goto error; + } host_end -= qemu_host_page_size; } /* handle the pages in the middle */ if (host_start < host_end) { - ret = mprotect(g2h(host_start), host_end - host_start, prot); - if (ret != 0) + ret = mprotect(g2h(host_start), host_end - host_start, host_prot); + if (ret != 0) { goto error; + } } - page_set_flags(start, start + len, prot | PAGE_VALID); + page_set_flags(start, start + len, page_flags); mmap_unlock(); return 0; error: @@ -363,10 +398,11 @@ abi_ulong mmap_find_vma(abi_ulong start, abi_ulong size, abi_ulong align) } /* NOTE: all the constants are the HOST ones */ -abi_long target_mmap(abi_ulong start, abi_ulong len, int prot, +abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot, int flags, int fd, abi_ulong offset) { abi_ulong ret, end, real_start, real_end, retaddr, host_offset, host_len; + int page_flags, host_prot; mmap_lock(); #ifdef DEBUG_MMAP @@ -401,6 +437,12 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot, goto fail; } + page_flags = validate_prot_to_pageflags(&host_prot, target_prot); + if (!page_flags) { + errno = EINVAL; + goto fail; + } + /* Also check for overflows... */ len = TARGET_PAGE_ALIGN(len); if (!len) { @@ -466,14 +508,15 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot, /* Note: we prefer to control the mapping address. It is especially important if qemu_host_page_size > qemu_real_host_page_size */ - p = mmap(g2h(start), host_len, prot, + p = mmap(g2h(start), host_len, host_prot, flags | MAP_FIXED | MAP_ANONYMOUS, -1, 0); - if (p == MAP_FAILED) + if (p == MAP_FAILED) { goto fail; + } /* update start so that it points to the file position at 'offset' */ host_start = (unsigned long)p; if (!(flags & MAP_ANONYMOUS)) { - p = mmap(g2h(start), len, prot, + p = mmap(g2h(start), len, host_prot, flags | MAP_FIXED, fd, host_offset); if (p == MAP_FAILED) { munmap(g2h(start), host_len); @@ -507,19 +550,19 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot, /* msync() won't work here, so we return an error if write is possible while it is a shared mapping */ if ((flags & MAP_TYPE) == MAP_SHARED && - (prot & PROT_WRITE)) { + (host_prot & PROT_WRITE)) { errno = EINVAL; goto fail; } - retaddr = target_mmap(start, len, prot | PROT_WRITE, + retaddr = target_mmap(start, len, target_prot | PROT_WRITE, MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if (retaddr == -1) goto fail; if (pread(fd, g2h(start), len, offset) == -1) goto fail; - if (!(prot & PROT_WRITE)) { - ret = target_mprotect(start, len, prot); + if (!(host_prot & PROT_WRITE)) { + ret = target_mprotect(start, len, target_prot); assert(ret == 0); } goto the_end; @@ -530,13 +573,13 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot, if (real_end == real_start + qemu_host_page_size) { /* one single host page */ ret = mmap_frag(real_start, start, end, - prot, flags, fd, offset); + host_prot, flags, fd, offset); if (ret == -1) goto fail; goto the_end1; } ret = mmap_frag(real_start, start, real_start + qemu_host_page_size, - prot, flags, fd, offset); + host_prot, flags, fd, offset); if (ret == -1) goto fail; real_start += qemu_host_page_size; @@ -545,7 +588,7 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot, if (end < real_end) { ret = mmap_frag(real_end - qemu_host_page_size, real_end - qemu_host_page_size, end, - prot, flags, fd, + host_prot, flags, fd, offset + real_end - qemu_host_page_size - start); if (ret == -1) goto fail; @@ -561,13 +604,13 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot, else offset1 = offset + real_start - start; p = mmap(g2h(real_start), real_end - real_start, - prot, flags, fd, offset1); + host_prot, flags, fd, offset1); if (p == MAP_FAILED) goto fail; } } the_end1: - page_set_flags(start, start + len, prot | PAGE_VALID); + page_set_flags(start, start + len, page_flags); the_end: #ifdef DEBUG_MMAP printf("ret=0x" TARGET_ABI_FMT_lx "\n", start);