Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[src/trunk]: src/sys/kern Try to decrypt stack size calculation code in execv...
details: https://anonhg.NetBSD.org/src/rev/e7a4340a5e17
branches: trunk
changeset: 795401:e7a4340a5e17
user: uebayasi <uebayasi%NetBSD.org@localhost>
date: Fri Apr 11 11:11:06 2014 +0000
description:
Try to decrypt stack size calculation code in execve_loadvm().
No functional changes. Two potential miscalculations remain.
diffstat:
sys/kern/kern_exec.c | 88 +++++++++++++++++++++++++++++++--------------------
1 files changed, 53 insertions(+), 35 deletions(-)
diffs (183 lines):
diff -r 121b1b2b44de -r e7a4340a5e17 sys/kern/kern_exec.c
--- a/sys/kern/kern_exec.c Fri Apr 11 06:50:26 2014 +0000
+++ b/sys/kern/kern_exec.c Fri Apr 11 11:11:06 2014 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: kern_exec.c,v 1.378 2014/04/11 02:27:20 uebayasi Exp $ */
+/* $NetBSD: kern_exec.c,v 1.379 2014/04/11 11:11:06 uebayasi Exp $ */
/*-
* Copyright (c) 2008 The NetBSD Foundation, Inc.
@@ -59,7 +59,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_exec.c,v 1.378 2014/04/11 02:27:20 uebayasi Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_exec.c,v 1.379 2014/04/11 11:11:06 uebayasi Exp $");
#include "opt_exec.h"
#include "opt_execfmt.h"
@@ -587,7 +587,7 @@
int error;
struct proc *p;
char *dp, *sp;
- size_t i, len;
+ size_t i;
struct exec_fakearg *tmpfap;
u_int modgen;
@@ -694,6 +694,7 @@
while (tmpfap->fa_arg != NULL) {
const char *cp;
+ /* XXX boudary check */
cp = tmpfap->fa_arg;
while (*cp)
*dp++ = *cp++;
@@ -701,7 +702,8 @@
ktrexecarg(tmpfap->fa_arg, cp - tmpfap->fa_arg);
kmem_free(tmpfap->fa_arg, tmpfap->fa_len);
- tmpfap++; data->ed_argc++;
+ tmpfap++;
+ data->ed_argc++;
}
kmem_free(epp->ep_fa, epp->ep_fa_len);
epp->ep_flags &= ~EXEC_HASARGL;
@@ -719,7 +721,9 @@
i++;
while (1) {
- len = data->ed_argp + ARG_MAX - dp;
+ const size_t maxlen = data->ed_argp + ARG_MAX - dp;
+ size_t len;
+
if ((error = (*fetch_element)(args, i, &sp)) != 0) {
DPRINTF(("%s: fetch_element args %d\n",
__func__, error));
@@ -727,7 +731,7 @@
}
if (!sp)
break;
- if ((error = copyinstr(sp, dp, len, &len)) != 0) {
+ if ((error = copyinstr(sp, dp, maxlen, &len)) != 0) {
DPRINTF(("%s: copyinstr args %d\n", __func__, error));
if (error == ENAMETOOLONG)
error = E2BIG;
@@ -744,7 +748,9 @@
if (envs != NULL) {
i = 0;
while (1) {
- len = data->ed_argp + ARG_MAX - dp;
+ const size_t maxlen = data->ed_argp + ARG_MAX - dp;
+ size_t len;
+
if ((error = (*fetch_element)(envs, i, &sp)) != 0) {
DPRINTF(("%s: fetch_element env %d\n",
__func__, error));
@@ -752,7 +758,7 @@
}
if (!sp)
break;
- if ((error = copyinstr(sp, dp, len, &len)) != 0) {
+ if ((error = copyinstr(sp, dp, maxlen, &len)) != 0) {
DPRINTF(("%s: copyinstr env %d\n",
__func__, error));
if (error == ENAMETOOLONG)
@@ -767,11 +773,35 @@
}
}
- dp = (char *) ALIGN(dp);
+ /*
+ * Calculate the new stack size.
+ */
+
+ const size_t psstrauxlen =
+ data->ed_argc + /* char *argv[] */
+ 1 + /* \0 */
+ data->ed_envc + /* char *env[] */
+ 1 + /* \0 */
+ epp->ep_esch->es_arglen; /* auxinfo */
+
+ const size_t ptrsz = (epp->ep_flags & EXEC_32) ?
+ sizeof(int) : sizeof(char *);
+
+ const size_t argenvstrlen = (char *)ALIGN(dp) - data->ed_argp;
data->ed_szsigcode = epp->ep_esch->es_emul->e_esigcode -
epp->ep_esch->es_emul->e_sigcode;
+ data->ed_ps_strings_sz = (epp->ep_flags & EXEC_32) ?
+ sizeof(struct ps_strings32) : sizeof(struct ps_strings);
+
+ const size_t aslrgap =
+#ifdef PAX_ASLR
+ pax_aslr_active(l) ? (cprng_fast32() % PAGE_SIZE) : 0;
+#else
+ 0;
+#endif
+
#ifdef __MACHINE_STACK_GROWS_UP
/* See big comment lower down */
#define RTLD_GAP 32
@@ -779,38 +809,26 @@
#define RTLD_GAP 0
#endif
- /* Now check if args & environ fit into new stack */
- if (epp->ep_flags & EXEC_32) {
- data->ed_ps_strings_sz = sizeof(struct ps_strings32);
- len = ((data->ed_argc + data->ed_envc + 2 +
- epp->ep_esch->es_arglen) *
- sizeof(int) + sizeof(int) + dp + RTLD_GAP +
- data->ed_szsigcode + data->ed_ps_strings_sz + STACK_PTHREADSPACE)
- - data->ed_argp;
- } else {
- data->ed_ps_strings_sz = sizeof(struct ps_strings);
- len = ((data->ed_argc + data->ed_envc + 2 +
- epp->ep_esch->es_arglen) *
- sizeof(char *) + sizeof(int) + dp + RTLD_GAP +
- data->ed_szsigcode + data->ed_ps_strings_sz + STACK_PTHREADSPACE)
- - data->ed_argp;
- }
-
-#ifdef PAX_ASLR
- if (pax_aslr_active(l))
- len += (cprng_fast32() % PAGE_SIZE);
-#endif /* PAX_ASLR */
+ const size_t stacklen =
+ sizeof(int) + /* XXX argc in stack is long, not int */
+ (psstrauxlen * ptrsz) + /* XXX auxinfo multiplied by ptr size? */
+ argenvstrlen +
+ aslrgap +
+ RTLD_GAP +
+ data->ed_szsigcode +
+ data->ed_ps_strings_sz +
+ STACK_PTHREADSPACE;
/* make the stack "safely" aligned */
- len = STACK_LEN_ALIGN(len, STACK_ALIGNBYTES);
+ const size_t aligned_stacklen = STACK_LEN_ALIGN(stacklen, STACK_ALIGNBYTES);
- if (len > epp->ep_ssize) {
+ if (aligned_stacklen > epp->ep_ssize) {
/* in effect, compare to initial limit */
- DPRINTF(("%s: stack limit exceeded %zu\n", __func__, len));
+ DPRINTF(("%s: stack limit exceeded %zu\n", __func__, aligned_stacklen));
goto bad;
}
/* adjust "active stack depth" for process VSZ */
- epp->ep_ssize = len;
+ epp->ep_ssize = aligned_stacklen;
return 0;
@@ -1498,7 +1516,7 @@
return error;
}
- dp = (char *) (cpp + argc + envc + 2 + pack->ep_esch->es_arglen);
+ dp = (char *)(cpp + argc + envc + 2 + pack->ep_esch->es_arglen);
sp = argp;
/* XXX don't copy them out, remap them! */
Home |
Main Index |
Thread Index |
Old Index