From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:53622) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Zi0eP-0002yb-MI for qemu-devel@nongnu.org; Fri, 02 Oct 2015 09:45:34 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Zi0eL-0000Fj-J2 for qemu-devel@nongnu.org; Fri, 02 Oct 2015 09:45:29 -0400 Received: from mx1.redhat.com ([209.132.183.28]:60635) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Zi0eL-0000FX-EM for qemu-devel@nongnu.org; Fri, 02 Oct 2015 09:45:25 -0400 Date: Fri, 2 Oct 2015 16:45:19 +0300 From: "Michael S. Tsirkin" Message-ID: <1443793405-15190-6-git-send-email-mst@redhat.com> References: <1443793405-15190-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1443793405-15190-1-git-send-email-mst@redhat.com> Subject: [Qemu-devel] [PULL 05/15] oslib: allocate PROT_NONE pages on top of RAM List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , Michael Tokarev , Paolo Bonzini This inserts a read and write protected page between RAM and QEMU memory. This makes it harder to exploit QEMU bugs resulting from buffer overflows in devices using variants of cpu_physical_memory_map, dma_memory_map etc. Signed-off-by: Michael S. Tsirkin Reviewed-by: Paolo Bonzini Acked-by: Paolo Bonzini --- util/oslib-posix.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/util/oslib-posix.c b/util/oslib-posix.c index 27972d4..a0fcdc2 100644 --- a/util/oslib-posix.c +++ b/util/oslib-posix.c @@ -128,7 +128,7 @@ void *qemu_memalign(size_t alignment, size_t size) void *qemu_anon_ram_alloc(size_t size, uint64_t *alignment) { size_t align = QEMU_VMALLOC_ALIGN; - size_t total = size + align - getpagesize(); + size_t total = size + align; void *ptr = mmap(0, total, PROT_NONE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); size_t offset = QEMU_ALIGN_UP((uintptr_t)ptr, align) - (uintptr_t)ptr; void *ptr1; @@ -154,8 +154,8 @@ void *qemu_anon_ram_alloc(size_t size, uint64_t *alignment) if (offset > 0) { munmap(ptr - offset, offset); } - if (total > size) { - munmap(ptr + size, total - size); + if (total > size + getpagesize()) { + munmap(ptr + size + getpagesize(), total - size - getpagesize()); } trace_qemu_anon_ram_alloc(size, ptr); @@ -172,7 +172,7 @@ void qemu_anon_ram_free(void *ptr, size_t size) { trace_qemu_anon_ram_free(ptr, size); if (ptr) { - munmap(ptr, size); + munmap(ptr, size + getpagesize()); } } -- MST