aboutsummaryrefslogtreecommitdiff
path: root/util/oslib-posix.c
diff options
context:
space:
mode:
authorMichael S. Tsirkin <mst@redhat.com>2015-09-10 16:41:17 +0300
committerMichael S. Tsirkin <mst@redhat.com>2015-10-01 16:16:52 +0300
commit9fac18f03a9040b67ec38e14d3e1ed34db9c7e06 (patch)
tree0a2b3aef43106edfbf64a788d07d69874ff64bda /util/oslib-posix.c
parentc2dfc5ba3fb3a1b7278c99bfd3bf350202169434 (diff)
downloadqemu-9fac18f03a9040b67ec38e14d3e1ed34db9c7e06.zip
qemu-9fac18f03a9040b67ec38e14d3e1ed34db9c7e06.tar.gz
qemu-9fac18f03a9040b67ec38e14d3e1ed34db9c7e06.tar.bz2
oslib: allocate PROT_NONE pages on top of RAM
This inserts a read and write protected page between RAM and QEMU memory. This makes it harder to exploit QEMU bugs resulting from buffer overflows in devices using variants of cpu_physical_memory_map, dma_memory_map etc. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'util/oslib-posix.c')
-rw-r--r--util/oslib-posix.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/util/oslib-posix.c b/util/oslib-posix.c
index 27972d4..a0fcdc2 100644
--- a/util/oslib-posix.c
+++ b/util/oslib-posix.c
@@ -128,7 +128,7 @@ void *qemu_memalign(size_t alignment, size_t size)
void *qemu_anon_ram_alloc(size_t size, uint64_t *alignment)
{
size_t align = QEMU_VMALLOC_ALIGN;
- size_t total = size + align - getpagesize();
+ size_t total = size + align;
void *ptr = mmap(0, total, PROT_NONE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
size_t offset = QEMU_ALIGN_UP((uintptr_t)ptr, align) - (uintptr_t)ptr;
void *ptr1;
@@ -154,8 +154,8 @@ void *qemu_anon_ram_alloc(size_t size, uint64_t *alignment)
if (offset > 0) {
munmap(ptr - offset, offset);
}
- if (total > size) {
- munmap(ptr + size, total - size);
+ if (total > size + getpagesize()) {
+ munmap(ptr + size + getpagesize(), total - size - getpagesize());
}
trace_qemu_anon_ram_alloc(size, ptr);
@@ -172,7 +172,7 @@ void qemu_anon_ram_free(void *ptr, size_t size)
{
trace_qemu_anon_ram_free(ptr, size);
if (ptr) {
- munmap(ptr, size);
+ munmap(ptr, size + getpagesize());
}
}