From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:33898) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZgWC4-0005jr-4z for qemu-devel@nongnu.org; Mon, 28 Sep 2015 07:02:05 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZgWBy-00015A-0p for qemu-devel@nongnu.org; Mon, 28 Sep 2015 07:02:04 -0400 Received: from mx1.redhat.com ([209.132.183.28]:48262) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZgWBx-00014G-Sn for qemu-devel@nongnu.org; Mon, 28 Sep 2015 07:01:57 -0400 References: <1443348833-22760-1-git-send-email-mst@redhat.com> From: Paolo Bonzini Message-ID: <56091E23.4090409@redhat.com> Date: Mon, 28 Sep 2015 13:01:55 +0200 MIME-Version: 1.0 In-Reply-To: <1443348833-22760-1-git-send-email-mst@redhat.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH repost 0/4] add mitigation against buffer overflows List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Michael S. Tsirkin" , qemu-devel@nongnu.org Cc: Peter Maydell On 27/09/2015 12:14, Michael S. Tsirkin wrote: > Multiple places in QEMU map guest memory, then access it > directly. Unfortunately since we are using C, there's always > a chance that we'll miss a bounds check when we do this. > This has a potential to corrupt QEMU memory. > > As a mitigation strategy against such exploits, > allocate a page in HVA space on top of each RAM chunk > with PROT_NONE protection. > > Buffer overflows will now cause QEMU to crash. > > This is a repost, combining separate patches into a single > series. No changes to patches themselves. > > Michael S. Tsirkin (4): > oslib: rework anonimous RAM allocation > oslib: allocate PROT_NONE pages on top of RAM > exec: allocate PROT_NONE pages on top of RAM > exec: factor out duplicate mmap code > > include/qemu/mmap-alloc.h | 10 +++++++++ > exec.c | 19 ++++++++++++----- > util/mmap-alloc.c | 52 +++++++++++++++++++++++++++++++++++++++++++++++ > util/oslib-posix.c | 20 ++++-------------- > util/Makefile.objs | 2 +- > 5 files changed, 81 insertions(+), 22 deletions(-) > create mode 100644 include/qemu/mmap-alloc.h > create mode 100644 util/mmap-alloc.c > Reviewed-by: Paolo Bonzini Acked-by: Paolo Bonzini Regarding my request to add comments in patch 2, feel free to add them directly in patch 4 instead. Paolo