From patchwork Wed Mar 7 06:36:51 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Max Filippov X-Patchwork-Id: 882443 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=2001:4830:134:3::11; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="vRh//gql"; dkim-atps=neutral Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3zx3q36PjFz9sfc for ; Wed, 7 Mar 2018 17:37:34 +1100 (AEDT) Received: from localhost ([::1]:59917 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1etShg-0004uJ-5u for incoming@patchwork.ozlabs.org; Wed, 07 Mar 2018 01:37:32 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56933) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1etShK-0004tz-6E for qemu-devel@nongnu.org; Wed, 07 Mar 2018 01:37:11 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1etShI-0003wz-On for qemu-devel@nongnu.org; Wed, 07 Mar 2018 01:37:10 -0500 Received: from mail-lf0-x244.google.com ([2a00:1450:4010:c07::244]:39520) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1etShI-0003w8-CS; Wed, 07 Mar 2018 01:37:08 -0500 Received: by mail-lf0-x244.google.com with SMTP id f75-v6so1589601lfg.6; Tue, 06 Mar 2018 22:37:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=i+YjO1ErPx7RjFy2lnMnVJR0qfgIi7qFbP9HB6vZyko=; b=vRh//gql6t2+jdrDiD/DojkcDvvZwjLwWVeSgF/90gJCOMo478aCqMpTLkMcVxYOor gF0zUPv1ApWbIOvUXOMAu6Cc6CDvl6Hq5sWFfLM+RPr4vSbRwEo1ldR6gWVWh/ylvzhl ArU4c+Uco2FE1xlsP62jWEeTOBlnqk0eTBhsEeopPLhP9M9Pzx6R0regbUhdaNCyTe0p cAsMXvzg7DkbjSmMdbq2dyhvewwAz0fuccbdNeNQG65RKPn6EEugXVcIYrtPRyCXeG5G z5r4HCyc7/bLlR3A4M3u2PaIYT0Q835FyRN27aHTKzrr9a0zosmTrbKnhcysYCyj8Lb4 YqSA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=i+YjO1ErPx7RjFy2lnMnVJR0qfgIi7qFbP9HB6vZyko=; b=dj37nhyfuAKKg/8UHFJnL/ikkEUSP8Bn4DflZXvK/sQhPF5rzHZ8zPicPnWtyEL5+b oCvfeOnKOUjXQ3JFH3S48zTq0zuEOJB1yA3h6hL5kqRPY1Ie4pOUcNyLII8sLQe9ZD3q iRzuY+TAMfHdvoL759j/YBxEJDh7/0Hj5PgBEj4bwcWOqQlZfngwvJa9R5M7b7QyDrNQ 8Dg8qQiLtUnaZOf3VAPfZ8lFxsMzycILhHx0dzsCSta/5qRL4kOyYxn9PUrbHhaj82LM oS9lDknxt7yJ6x9K4eUWgffEZxbKlqsOncUgtLaBF7qIEvEf4b00t6M9IeP6cztqN5ks ijMQ== X-Gm-Message-State: AElRT7FLWarA9V0fcd5LwbVD9dhyuKwmsxhi8RFLefVlbG2zdszY4PJq Z6iqQyAqnPz5lCXVbieXHYP5OQ== X-Google-Smtp-Source: AG47ELuUEBWZts8Hy7yJV5mxfr4SZgG2R4zTRbiYaOAz6tENfwK30naORq9YOu1cmNInryJwFAs9fw== X-Received: by 10.46.104.26 with SMTP id c26mr2992466lja.43.1520404626558; Tue, 06 Mar 2018 22:37:06 -0800 (PST) Received: from octofox.hsd1.ca.comcast.net. (jcmvbkbc-1-pt.tunnel.tserv24.sto1.ipv6.he.net. [2001:470:27:1fa::2]) by smtp.gmail.com with ESMTPSA id o132sm3549262lfe.91.2018.03.06.22.37.03 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 06 Mar 2018 22:37:05 -0800 (PST) From: Max Filippov To: qemu-devel@nongnu.org Date: Tue, 6 Mar 2018 22:36:51 -0800 Message-Id: <20180307063651.4421-1-jcmvbkbc@gmail.com> X-Mailer: git-send-email 2.11.0 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2a00:1450:4010:c07::244 Subject: [Qemu-devel] [PATCH v5 05/11] linux-user: fix mmap/munmap/mprotect/mremap/shmat X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Max Filippov , Riku Voipio , qemu-stable@nongnu.org, Laurent Vivier Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" In linux-user QEMU that runs for a target with TARGET_ABI_BITS bigger than L1_MAP_ADDR_SPACE_BITS an assertion in page_set_flags fires when mmap, munmap, mprotect, mremap or shmat is called for an address outside the guest address space. mmap and mprotect should return ENOMEM in such case. Change definition of GUEST_ADDR_MAX to always be the last valid guest address. Account for this change in open_self_maps. Add macro guest_addr_valid that verifies if the guest address is valid. Add function guest_range_valid that verifies if address range is within guest address space and does not wrap around. Use that macro in mmap/munmap/mprotect/mremap/shmat for error checking. Cc: qemu-stable@nongnu.org Cc: Riku Voipio Cc: Laurent Vivier Signed-off-by: Max Filippov --- Changes v4->v5: - change definition of GUEST_ADDR_MAX to always be the last valid guest address. Account for this change in guest_addr_valid and open_self_maps. - turn guest_range_valid into a function. Changes v3->v4: - change GUEST_ADDR_MAX and h2g_valid definitions as suggested by Laurent Vivier. Changes v2->v3: - fix comparison in guest_valid: it must be 'less' to preserve the existing functionality, not 'less or equal'. - fix guest_range_valid: it may not use guest_valid, because single range that occupies all of the guest address space is valid. include/exec/cpu-all.h | 6 +++++- include/exec/cpu_ldst.h | 19 ++++++++++--------- linux-user/mmap.c | 20 +++++++++++++++----- linux-user/syscall.c | 5 ++++- 4 files changed, 34 insertions(+), 16 deletions(-) diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h index 0b141683f095..f4fa94e9669d 100644 --- a/include/exec/cpu-all.h +++ b/include/exec/cpu-all.h @@ -159,8 +159,12 @@ extern unsigned long guest_base; extern int have_guest_base; extern unsigned long reserved_va; -#define GUEST_ADDR_MAX (reserved_va ? reserved_va : \ +#if HOST_LONG_BITS <= TARGET_VIRT_ADDR_SPACE_BITS +#define GUEST_ADDR_MAX (~0ul) +#else +#define GUEST_ADDR_MAX (reserved_va ? reserved_va - 1 : \ (1ul << TARGET_VIRT_ADDR_SPACE_BITS) - 1) +#endif #else #include "exec/hwaddr.h" diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h index 191f2e962a3c..313664e9dae8 100644 --- a/include/exec/cpu_ldst.h +++ b/include/exec/cpu_ldst.h @@ -51,15 +51,16 @@ /* All direct uses of g2h and h2g need to go away for usermode softmmu. */ #define g2h(x) ((void *)((unsigned long)(target_ulong)(x) + guest_base)) -#if HOST_LONG_BITS <= TARGET_VIRT_ADDR_SPACE_BITS -#define h2g_valid(x) 1 -#else -#define h2g_valid(x) ({ \ - unsigned long __guest = (unsigned long)(x) - guest_base; \ - (__guest < (1ul << TARGET_VIRT_ADDR_SPACE_BITS)) && \ - (!reserved_va || (__guest < reserved_va)); \ -}) -#endif +#define guest_addr_valid(x) ((x) <= GUEST_ADDR_MAX) +#define h2g_valid(x) guest_addr_valid((unsigned long)(x) - guest_base) + +static inline int guest_range_valid(unsigned long start, unsigned long len) +{ + if (len) + return guest_addr_valid(len - 1) && start <= GUEST_ADDR_MAX - len + 1; + else + return guest_addr_valid(start); +} #define h2g_nocheck(x) ({ \ unsigned long __ret = (unsigned long)(x) - guest_base; \ diff --git a/linux-user/mmap.c b/linux-user/mmap.c index 0fbfd6dff20d..df81f9b803b6 100644 --- a/linux-user/mmap.c +++ b/linux-user/mmap.c @@ -80,8 +80,9 @@ int target_mprotect(abi_ulong start, abi_ulong len, int prot) return -EINVAL; len = TARGET_PAGE_ALIGN(len); end = start + len; - if (end < start) - return -EINVAL; + if (!guest_range_valid(start, len)) { + return -ENOMEM; + } prot &= PROT_READ | PROT_WRITE | PROT_EXEC; if (len == 0) return 0; @@ -481,8 +482,8 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot, * It can fail only on 64-bit host with 32-bit target. * On any other target/host host mmap() handles this error correctly. */ - if ((unsigned long)start + len - 1 > (abi_ulong) -1) { - errno = EINVAL; + if (!guest_range_valid(start, len)) { + errno = ENOMEM; goto fail; } @@ -622,8 +623,10 @@ int target_munmap(abi_ulong start, abi_ulong len) if (start & ~TARGET_PAGE_MASK) return -EINVAL; len = TARGET_PAGE_ALIGN(len); - if (len == 0) + if (len == 0 || !guest_range_valid(start, len)) { return -EINVAL; + } + mmap_lock(); end = start + len; real_start = start & qemu_host_page_mask; @@ -678,6 +681,13 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size, int prot; void *host_addr; + if (!guest_range_valid(old_addr, old_size) || + ((flags & MREMAP_FIXED) && + !guest_range_valid(new_addr, new_size))) { + errno = ENOMEM; + return -1; + } + mmap_lock(); if (flags & MREMAP_FIXED) { diff --git a/linux-user/syscall.c b/linux-user/syscall.c index e24f43c4a259..809644742aff 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -4900,6 +4900,9 @@ static inline abi_ulong do_shmat(CPUArchState *cpu_env, return -TARGET_EINVAL; } } + if (!guest_range_valid(shmaddr, shm_info.shm_segsz)) { + return -TARGET_EINVAL; + } mmap_lock(); @@ -7468,7 +7471,7 @@ static int open_self_maps(void *cpu_env, int fd) } if (h2g_valid(min)) { int flags = page_get_flags(h2g(min)); - max = h2g_valid(max - 1) ? max : (uintptr_t)g2h(GUEST_ADDR_MAX); + max = h2g_valid(max - 1) ? max : (uintptr_t)g2h(GUEST_ADDR_MAX) + 1; if (page_check_range(h2g(min), max - min, flags) == -1) { continue; }