From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49599) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Zg8yY-0003WA-6l for qemu-devel@nongnu.org; Sun, 27 Sep 2015 06:14:35 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Zg8yV-0002xt-0f for qemu-devel@nongnu.org; Sun, 27 Sep 2015 06:14:34 -0400 Received: from mx1.redhat.com ([209.132.183.28]:44010) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Zg8yU-0002xO-SJ for qemu-devel@nongnu.org; Sun, 27 Sep 2015 06:14:30 -0400 Date: Sun, 27 Sep 2015 13:14:27 +0300 From: "Michael S. Tsirkin" Message-ID: <1443348833-22760-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Subject: [Qemu-devel] [PATCH repost 0/4] add mitigation against buffer overflows List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , Paolo Bonzini Multiple places in QEMU map guest memory, then access it directly. Unfortunately since we are using C, there's always a chance that we'll miss a bounds check when we do this. This has a potential to corrupt QEMU memory. As a mitigation strategy against such exploits, allocate a page in HVA space on top of each RAM chunk with PROT_NONE protection. Buffer overflows will now cause QEMU to crash. This is a repost, combining separate patches into a single series. No changes to patches themselves. Michael S. Tsirkin (4): oslib: rework anonimous RAM allocation oslib: allocate PROT_NONE pages on top of RAM exec: allocate PROT_NONE pages on top of RAM exec: factor out duplicate mmap code include/qemu/mmap-alloc.h | 10 +++++++++ exec.c | 19 ++++++++++++----- util/mmap-alloc.c | 52 +++++++++++++++++++++++++++++++++++++++++++++++ util/oslib-posix.c | 20 ++++-------------- util/Makefile.objs | 2 +- 5 files changed, 81 insertions(+), 22 deletions(-) create mode 100644 include/qemu/mmap-alloc.h create mode 100644 util/mmap-alloc.c -- MST