[Qemu-devel] [PATCH] util/mmap-alloc: add comments, assertions

[Qemu-devel] [PATCH] util/mmap-alloc: add comments, assertions

[Michael S. Tsirkin]

Document RAM guard page logic within mmap-alloc.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---

Paolo, can you pls confirm this is what you had in mind?

 util/mmap-alloc.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/util/mmap-alloc.c b/util/mmap-alloc.c
index 05c8b4b..d978399 100644
--- a/util/mmap-alloc.c
+++ b/util/mmap-alloc.c
@@ -12,9 +12,14 @@
 #include <qemu/mmap-alloc.h>
 #include <sys/types.h>
 #include <sys/mman.h>
+#include <assert.h>
 
 void *qemu_ram_mmap(int fd, size_t size, size_t align)
 {
+    /*
+     * Note: this always allocates at least one extra page of virtual address
+     * space, even if size is already aligned.
+     */
     size_t total = size + align;
     void *ptr = mmap(0, total, PROT_NONE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
     size_t offset = QEMU_ALIGN_UP((uintptr_t)ptr, align) - (uintptr_t)ptr;
@@ -24,6 +29,11 @@ void *qemu_ram_mmap(int fd, size_t size, size_t align)
         return NULL;
     }
 
+    /* Make sure align is a power of 2 */
+    assert(!(align & (align - 1)));
+    /* Always align to host page size */
+    assert(align >= getpagesize());
+
     ptr1 = mmap(ptr + offset, size, PROT_READ | PROT_WRITE,
                 MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE, fd, 0);
     if (ptr1 == MAP_FAILED) {
@@ -37,6 +47,11 @@ void *qemu_ram_mmap(int fd, size_t size, size_t align)
     if (offset > 0) {
         munmap(ptr - offset, offset);
     }
+
+    /*
+     * Leave a single PROT_NONE page allocated after the RAM block, to serve as
+     * a guard page guarding against potential buffer overflows.
+     */
     if (total > size + getpagesize()) {
         munmap(ptr + size + getpagesize(), total - size - getpagesize());
     }
@@ -47,6 +62,7 @@ void *qemu_ram_mmap(int fd, size_t size, size_t align)
 void qemu_ram_munmap(void *ptr, size_t size)
 {
     if (ptr) {
+        /* Unmap both the RAM block and the guard page */
         munmap(ptr, size + getpagesize());
     }
 }
-- 
MST

Re: [Qemu-devel] [PATCH] util/mmap-alloc: add comments, assertions

[Paolo Bonzini]

On 29/09/2015 12:51, Michael S. Tsirkin wrote:
> Document RAM guard page logic within mmap-alloc.
> 
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
> ---
> 
> Paolo, can you pls confirm this is what you had in mind?
> 
>  util/mmap-alloc.c | 16 ++++++++++++++++
>  1 file changed, 16 insertions(+)
> 
> diff --git a/util/mmap-alloc.c b/util/mmap-alloc.c
> index 05c8b4b..d978399 100644
> --- a/util/mmap-alloc.c
> +++ b/util/mmap-alloc.c
> @@ -12,9 +12,14 @@
>  #include <qemu/mmap-alloc.h>
>  #include <sys/types.h>
>  #include <sys/mman.h>
> +#include <assert.h>
>  
>  void *qemu_ram_mmap(int fd, size_t size, size_t align)
>  {
> +    /*
> +     * Note: this always allocates at least one extra page of virtual address
> +     * space, even if size is already aligned.
> +     */
>      size_t total = size + align;
>      void *ptr = mmap(0, total, PROT_NONE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
>      size_t offset = QEMU_ALIGN_UP((uintptr_t)ptr, align) - (uintptr_t)ptr;
> @@ -24,6 +29,11 @@ void *qemu_ram_mmap(int fd, size_t size, size_t align)
>          return NULL;
>      }
>  
> +    /* Make sure align is a power of 2 */
> +    assert(!(align & (align - 1)));
> +    /* Always align to host page size */
> +    assert(align >= getpagesize());
> +
>      ptr1 = mmap(ptr + offset, size, PROT_READ | PROT_WRITE,
>                  MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE, fd, 0);
>      if (ptr1 == MAP_FAILED) {
> @@ -37,6 +47,11 @@ void *qemu_ram_mmap(int fd, size_t size, size_t align)
>      if (offset > 0) {
>          munmap(ptr - offset, offset);
>      }
> +
> +    /*
> +     * Leave a single PROT_NONE page allocated after the RAM block, to serve as
> +     * a guard page guarding against potential buffer overflows.
> +     */
>      if (total > size + getpagesize()) {
>          munmap(ptr + size + getpagesize(), total - size - getpagesize());
>      }
> @@ -47,6 +62,7 @@ void *qemu_ram_mmap(int fd, size_t size, size_t align)
>  void qemu_ram_munmap(void *ptr, size_t size)
>  {
>      if (ptr) {
> +        /* Unmap both the RAM block and the guard page */
>          munmap(ptr, size + getpagesize());
>      }
>  }
> 

Yes, thanks!

Paolo