[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] Re: linux-user issues
From: |
malc |
Subject: |
[Qemu-devel] Re: linux-user issues |
Date: |
Sun, 14 Mar 2010 18:36:42 +0300 (MSK) |
User-agent: |
Alpine 2.00 (LNX 1167 2008-08-23) |
On Sun, 14 Mar 2010, Paul Brook wrote:
> > On Sat, 13 Mar 2010, Paul Brook wrote:
> > > > a) elfload.c:859
> > > >
> > > > #define TARGET_ELF_PAGESTART(_v) ((_v) & ~(unsigned
> > > > long)(TARGET_ELF_EXEC_PAGESIZE-1))
> > > >
> > > > This means that for 64bit guest on a 32bit host the _v's value is
> > > > silently reduced to 32bit, the cast should be abi_ulong.
> > > >
> > > > b) mmap.c:428
> > > >
> > > > real_start = start & qemu_host_page_mask;
> > > >
> > > > Same thing basically qemu_host_page_mask is unsigned long and so
> > > > the upper bits are sliently cleared. Again qemu_host_page_mask
> > > > should probably be abi_ulong.
> > > >
> > > > The above two make elf binary with one of the segments above 4G load
> > > > and run on 32bit guest only to fail well into execution and without
> > > > any indication that it shouldn't have been allowed to run in the first
> > > > place.
> > >
> > > I'd be amazed if these are the only two issues, and expect 64-bit guests
> > > on 32-bit hosts to be generally unsafe.
> >
> > These are the two issues i've been bitten by while trying to solve
> > x86_64's far jumps, if you are okay with code silently misbehaving
> > fine by me.
>
> I never said this was ok behavior. Only that you've probably only discovered
> the tip of the iceberg.
Even on this path (mmap one) it's indeed not, further bellow there are
yet more truncations due to improperly sized and's. Furthermore the
abi_ulong sized `start' argument is passed to mmap without ever
checking if it fits 32bit, question is what to do about it.
--
mailto:address@hidden