From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1NqpsM-0001zK-Lb
	for qemu-devel@nongnu.org; Sun, 14 Mar 2010 11:37:10 -0400
Received: from [199.232.76.173] (port=36762 helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1NqpsM-0001z2-34
	for qemu-devel@nongnu.org; Sun, 14 Mar 2010 11:37:10 -0400
Received: from Debian-exim by monty-python.gnu.org with spam-scanned (Exim
	4.60) (envelope-from <av1474@comtv.ru>) id 1NqpsI-0007h9-1t
	for qemu-devel@nongnu.org; Sun, 14 Mar 2010 11:37:09 -0400
Received: from fe01x03-cgp.akado.ru ([77.232.31.164]:53196 helo=akado.ru)
	by monty-python.gnu.org with esmtp (Exim 4.60)
	(envelope-from <av1474@comtv.ru>) id 1NqpsH-0007gL-Mj
	for qemu-devel@nongnu.org; Sun, 14 Mar 2010 11:37:05 -0400
Date: Sun, 14 Mar 2010 18:36:42 +0300 (MSK)
From: malc <av1474@comtv.ru>
In-Reply-To: <201003141511.31253.paul@codesourcery.com>
Message-ID: <alpine.LNX.2.00.1003141833180.1425@linmac>
References: <alpine.LNX.2.00.1003130314190.6704@linmac>
	<201003130045.22664.paul@codesourcery.com>
	<alpine.LNX.2.00.1003130504460.1405@linmac>
	<201003141511.31253.paul@codesourcery.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Subject: [Qemu-devel] Re: linux-user issues
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Paul Brook <paul@codesourcery.com>
Cc: qemu-devel@nongnu.org, Aurelien Jarno <aurelien@aurel32.net>

On Sun, 14 Mar 2010, Paul Brook wrote:

> > On Sat, 13 Mar 2010, Paul Brook wrote:
> > > > a) elfload.c:859
> > > >
> > > >    #define TARGET_ELF_PAGESTART(_v) ((_v) & ~(unsigned
> > > >  long)(TARGET_ELF_EXEC_PAGESIZE-1))
> > > >
> > > >    This means that for 64bit guest on a 32bit host the _v's value is
> > > >    silently reduced to 32bit, the cast should be abi_ulong.
> > > >
> > > > b) mmap.c:428
> > > >
> > > >    real_start = start & qemu_host_page_mask;
> > > >
> > > >    Same thing basically qemu_host_page_mask is unsigned long and so
> > > >    the upper bits are sliently cleared. Again qemu_host_page_mask
> > > >    should probably be abi_ulong.
> > > >
> > > > The above two make elf binary with one of the segments above 4G load
> > > > and run on 32bit guest only to fail well into execution and without
> > > > any indication that it shouldn't have been allowed to run in the first
> > > > place.
> > >
> > > I'd be amazed if these are the only two issues, and expect 64-bit guests
> > > on 32-bit hosts to be generally unsafe.
> > 
> > These are the two issues i've been bitten by while trying to solve
> > x86_64's far jumps, if you are okay with code silently misbehaving
> > fine by me.
> 
> I never said this was ok behavior. Only that you've probably only discovered 
> the tip of the iceberg.

Even on this path (mmap one) it's indeed not, further bellow there are
yet more truncations due to improperly sized and's. Furthermore the
abi_ulong sized `start' argument is passed to mmap without ever
checking if it fits 32bit, question is what to do about it.

-- 
mailto:av1474@comtv.ru