diff options
| author | Richard Henderson <richard.henderson@linaro.org> | 2020-07-24 14:23:14 -0700 |
|---|---|---|
| committer | Laurent Vivier <laurent@vivier.eu> | 2020-07-27 22:02:40 +0200 |
| commit | c9f8066697e0d3e77b97f6df423e9d6540b693be (patch) | |
| tree | b29b36e7cc438e1403ccf09ba99be4b9db678169 | |
| parent | 9303ecb658a0194560d1eecde165a1511223c2d8 (diff) | |
| download | qemu-c9f8066697e0d3e77b97f6df423e9d6540b693be.zip qemu-c9f8066697e0d3e77b97f6df423e9d6540b693be.tar.gz qemu-c9f8066697e0d3e77b97f6df423e9d6540b693be.tar.bz2 | |
linux-user: Ensure mmap_min_addr is non-zero
When the chroot does not have /proc mounted, we can read neither
/proc/sys/vm/mmap_min_addr nor /proc/sys/maps.
The enforcement of mmap_min_addr in the host kernel is done by
the security module, and so does not apply to processes owned
by root. Which leads pgd_find_hole_fallback to succeed in probing
a reservation at address 0. Which confuses pgb_reserved_va to
believe that guest_base has not actually been initialized.
We don't actually want NULL addresses to become accessible, so
make sure that mmap_min_addr is initialized with a non-zero value.
Buglink: https://bugs.launchpad.net/qemu/+bug/1888728
Reported-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Acked-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20200724212314.545877-1-richard.henderson@linaro.org>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
| -rw-r--r-- | linux-user/main.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/linux-user/main.c b/linux-user/main.c index 3597e99..75c9785 100644 --- a/linux-user/main.c +++ b/linux-user/main.c @@ -758,15 +758,27 @@ int main(int argc, char **argv, char **envp) if ((fp = fopen("/proc/sys/vm/mmap_min_addr", "r")) != NULL) { unsigned long tmp; - if (fscanf(fp, "%lu", &tmp) == 1) { + if (fscanf(fp, "%lu", &tmp) == 1 && tmp != 0) { mmap_min_addr = tmp; - qemu_log_mask(CPU_LOG_PAGE, "host mmap_min_addr=0x%lx\n", mmap_min_addr); + qemu_log_mask(CPU_LOG_PAGE, "host mmap_min_addr=0x%lx\n", + mmap_min_addr); } fclose(fp); } } /* + * We prefer to not make NULL pointers accessible to QEMU. + * If we're in a chroot with no /proc, fall back to 1 page. + */ + if (mmap_min_addr == 0) { + mmap_min_addr = qemu_host_page_size; + qemu_log_mask(CPU_LOG_PAGE, + "host mmap_min_addr=0x%lx (fallback)\n", + mmap_min_addr); + } + + /* * Prepare copy of argv vector for target. */ target_argc = argc - optind; |