From: Fabrice Bellard <fabrice@bellard.org>
To: qemu-devel@nongnu.org
Subject: Re: [Qemu-devel] bug report : kqemu and self-writing code
Date: Mon, 01 May 2006 23:29:54 +0200 [thread overview]
Message-ID: <44567DD2.8040708@bellard.org> (raw)
In-Reply-To: <200605012153.51699.even.rouault@mines-paris.org>
Are you sure that the bug is really in kqemu ? It is possible that your
guest kernel implements a security system which prevents self modifying
code using segment limits which QEMU does not check (but kqemu checks
them !).
Regards,
Fabrice.
Even Rouault wrote:
> Guest OS : Linux 2.6.15-1.2054_FC5 i686 (Fedora Core 5 i386)
> Host OS: Linux 2.6.12-10-amd64-k8 #1 x86_64 (Ubuntu 5.10 amd64)
> QEMU Version : today CVS compiled with kqemu support
> KQEMU : 1.3.0pre6
> Binary used : qemu-system-x86-64 (so kqemu user-mode is used)
>
> I'm running the simple C code attached. With kqemu user-mode, this fails
> (sigsegv) with the following warning in dmesg :
>
> audit(1146505373.813:12): avc: denied { execheap } for pid=1860
> comm="selfmodifying scontext=user_u:system_r:unconfined_t:s0
> tcontext=user_u:system_r:unconfined_t:s0 tclass=process
> Erreur de segmentation
>
> Without kqemu enabled, it runs fine.
>
>
>
> ------------------------------------------------------------------------
>
> #define _XOPEN_SOURCE 600
> #include <sys/mman.h>
> #include <unistd.h>
> #include <stdlib.h>
> #include <stdio.h>
>
> int main(int argc, char** argv)
> {
> int pagesize = getpagesize();
> unsigned char* addr = NULL;
> posix_memalign((void**)&addr, pagesize, pagesize);
> mprotect(addr, pagesize, PROT_WRITE | PROT_READ | PROT_EXEC);
> addr[0] = 0x8b; addr[1] = 0x44; addr[2] = 0x24; addr[3] = 0x04; /* mov 0x4(%esp),%eax */
> addr[4] = 0x83; addr[5] = 0xc0; addr[6] = 0x01; /* add $0x1,%eax */
> addr[7] = 0xc3; /* ret */
>
> printf("10+1=%d\n", ((int (*)(int))addr)(10));
> free(addr);
> return 0;
> }
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Qemu-devel mailing list
> Qemu-devel@nongnu.org
> http://lists.nongnu.org/mailman/listinfo/qemu-devel
next prev parent reply other threads:[~2006-05-01 21:30 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-05-01 19:53 [Qemu-devel] bug report : kqemu and self-writing code Even Rouault
2006-05-01 21:29 ` Fabrice Bellard [this message]
2006-05-01 22:08 ` Even Rouault
2006-05-02 6:55 ` Kevin F. Quinn
2006-05-02 9:13 ` G Portokalidis
2006-05-02 21:04 ` Fabrice Bellard
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=44567DD2.8040708@bellard.org \
--to=fabrice@bellard.org \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).