Re: [Qemu-stable] [PATCH v4 05/11] linux-user: fix mmap/munmap/mprotect/mremap/shmat

[Laurent Vivier]

Le 06/03/2018 à 20:34, Max Filippov a écrit :
> In linux-user QEMU that runs for a target with TARGET_ABI_BITS bigger
> than L1_MAP_ADDR_SPACE_BITS an assertion in page_set_flags fires when
> mmap, munmap, mprotect, mremap or shmat is called for an address outside
> the guest address space. mmap and mprotect should return ENOMEM in such
> case.
> 
> Introduce macro guest_range_valid that verifies if address range is
> within guest address space and does not wrap around. Use that macro in
> mmap/munmap/mprotect/mremap/shmat for error checking.
> 
> Cc: address@hidden
> Cc: Riku Voipio <address@hidden>
> Cc: Laurent Vivier <address@hidden>
> Signed-off-by: Max Filippov <address@hidden>
> ---
> Changes v3->v4:
> - change GUEST_ADDR_MAX and h2g_valid definitions as suggested by Laurent
>   Vivier.
> 
> Changes v2->v3:
> - fix comparison in guest_valid: it must be 'less' to preserve the existing
>   functionality, not 'less or equal'.
> - fix guest_range_valid: it may not use guest_valid, because single range
>   that occupies all of the guest address space is valid.
> 
>  include/exec/cpu-all.h  |  4 ++++
>  include/exec/cpu_ldst.h | 14 ++++++++------
>  linux-user/mmap.c       | 20 +++++++++++++++-----
>  linux-user/syscall.c    |  3 +++
>  4 files changed, 30 insertions(+), 11 deletions(-)
> 
> diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
> index 0b141683f095..6304cfa7e171 100644
> --- a/include/exec/cpu-all.h
> +++ b/include/exec/cpu-all.h
> @@ -159,8 +159,12 @@ extern unsigned long guest_base;
>  extern int have_guest_base;
>  extern unsigned long reserved_va;
>  
> +#if HOST_LONG_BITS <= TARGET_VIRT_ADDR_SPACE_BITS
> +#define GUEST_ADDR_MAX (reserved_va ? reserved_va : ~0ul)

In fact, below, for h2g_valid(), reserved_va is ignored in this case, so
it should be:

#define GUEST_ADDR_MAX (~0ul)

[I know, my bad]

> +#else
>  #define GUEST_ADDR_MAX (reserved_va ? reserved_va : \

I think it should become "reserved_va ? reserved_va - 1 : \"
as "reserved_va" is a size but GUEST_ADDR_MAX is the maximum value
available. See below.

>                                      (1ul << TARGET_VIRT_ADDR_SPACE_BITS) - 1)
> +#endif
>  #else
>  
>  #include "exec/hwaddr.h"
> diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
> index 191f2e962a3c..22f5df9c8a92 100644
> --- a/include/exec/cpu_ldst.h
> +++ b/include/exec/cpu_ldst.h
> @@ -52,15 +52,17 @@
>  #define g2h(x) ((void *)((unsigned long)(target_ulong)(x) + guest_base))
>  
>  #if HOST_LONG_BITS <= TARGET_VIRT_ADDR_SPACE_BITS
> -#define h2g_valid(x) 1
> +#define guest_valid(x) 1
>  #else
> -#define h2g_valid(x) ({ \
> -    unsigned long __guest = (unsigned long)(x) - guest_base; \
> -    (__guest < (1ul << TARGET_VIRT_ADDR_SPACE_BITS)) && \
> -    (!reserved_va || (__guest < reserved_va)); \
> -})
> +#define guest_valid(x) ((x) < GUEST_ADDR_MAX)

I think it should be ((x) <= GUEST_ADDR_MAX), because

    (__guest < (1ul << TARGET_VIRT_ADDR_SPACE_BITS))
->  (__guest <= ((1ul << TARGET_VIRT_ADDR_SPACE_BITS) - 1)
->  (__guest <= GUEST_ADDR_MAX)

To work with reserved_va, it has also to be defined as "reserved_va -
1". And in open_self_maps() we should have "max = ... :
(uintptr_t)g2h(GUEST_ADDR_MAX) + 1;" and then we have a "h2g(max - 1)"
that will correctly return GUEST_ADDR_MAX.

Then you don't need the "#if" because if "HOST_LONG_BITS <=
TARGET_VIRT_ADDR_SPACE_BITS", x is 32bit and GUEST_ADDR_MAX) is ~0uk,
and then ((x) <= GUEST_ADDR_MAX) is always true.

>  #endif
>  
> +#define h2g_valid(x) guest_valid((unsigned long)(x) - guest_base)
> +
> +#define guest_range_valid(start, len) \
> +    ({unsigned long l = (len); \
> +     l <= GUEST_ADDR_MAX && (start) <= GUEST_ADDR_MAX - l; })
> +
>  #define h2g_nocheck(x) ({ \
>      unsigned long __ret = (unsigned long)(x) - guest_base; \
>      (abi_ulong)__ret; \
...
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index e24f43c4a259..79245e73784f 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -4900,6 +4900,9 @@ static inline abi_ulong do_shmat(CPUArchState *cpu_env,
>              return -TARGET_EINVAL;
>          }
>      }
> +    if (!guest_range_valid(shmaddr, shm_info.shm_segsz)) {

if shmaddr is NULL, "the system chooses a suitable (unused) address" so
you can't check this as is.

Thanks,
Laurent