From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:45897) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TOUSY-00007r-GO for qemu-devel@nongnu.org; Wed, 17 Oct 2012 10:19:02 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TOUSO-0006EB-RD for qemu-devel@nongnu.org; Wed, 17 Oct 2012 10:18:58 -0400 Received: from mail-wg0-f41.google.com ([74.125.82.41]:38589) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TOUSO-0006Dz-Kd for qemu-devel@nongnu.org; Wed, 17 Oct 2012 10:18:48 -0400 Received: by mail-wg0-f41.google.com with SMTP id ds1so346107wgb.4 for ; Wed, 17 Oct 2012 07:18:47 -0700 (PDT) Sender: Alex Barcelo From: Alex Barcelo Date: Wed, 17 Oct 2012 16:18:36 +0200 Message-Id: <1350483518-5789-1-git-send-email-abarcelo@ac.upc.edu> Subject: [Qemu-devel] [PATCHv2 0/2] Preparing safe sigprocmask wrapper on qemu-user List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Riku Voipio , Alex Barcelo qemu-user needs SIGSEGV (at least) for some internal use. If the guest application masks it and does unsafe sigprocmask, then the application crashes. Problems happen in applications with self-modifying code (who also change the signal mask). Other guest applications may have related problems if they use the SIGSEGV. A way to be more safe is adding a wrapper for all sigprocmask calls from the guest. The wrapper proposed here is quite simple, but the code can be improved, here I try to ensure that the wrapper is set up properly. Here, a test case where qemu-user goes wrong: //////////// #include #include #include #include #include #include unsigned char *testfun; int main ( void ) { unsigned int ra; testfun=memalign(getpagesize(),1024); // We block the SIGSEGV signal, used by qemu-user sigset_t set; sigemptyset(&set); sigaddset(&set, 11); sigprocmask(SIG_BLOCK, &set, NULL); mprotect(testfun, 1024, PROT_READ|PROT_EXEC|PROT_WRITE); //400687: b8 0d 00 00 00 mov $0xd,%eax //40068d: c3 retq testfun[ 0]=0xb8; testfun[ 1]=0x0d; testfun[ 2]=0x00; testfun[ 3]=0x00; testfun[ 4]=0x00; testfun[ 5]=0xc3; printf ( "0x%02X\n", ((unsigned int (*)())testfun)() ); //400687: b8 20 00 00 00 mov $0x20,%eax //40068d: c3 retq // This self-modifying code will break because of the sigsegv signal block testfun[ 1]=0x20; printf ( "0x%02X\n", ((unsigned int (*)())testfun)() ); } //////////// On an i386 native host: 0x0D 0x20 On a non-patched qemu-i386: 0x0D Segmentation fault Alex Barcelo (2): signal: added a wrapper for sigprocmask function signal: sigsegv protection on do_sigprocmask linux-user/qemu.h | 1 + linux-user/signal.c | 27 +++++++++++++++++++++++++++ linux-user/syscall.c | 14 +++++++------- 3 files changed, 35 insertions(+), 7 deletions(-) -- 1.7.5.4