[PATCH v6 08/14] aarch64: enable BTI at runtime
Richard Henderson
rth@twiddle.net
Mon Jul 13 16:55:54 GMT 2020
On 7/13/20 6:28 AM, Szabolcs Nagy wrote:
> The 07/13/2020 14:14, Szabolcs Nagy wrote:
>> The 07/11/2020 08:58, Richard Henderson wrote:
>>> On 7/1/20 7:39 AM, Szabolcs Nagy wrote:
>>>> + unsigned prot = PROT_READ | PROT_EXEC | PROT_BTI;
>>>> +
>>>> + for (phdr = map->l_phdr; phdr < &map->l_phdr[map->l_phnum]; ++phdr)
>>>> + if (phdr->p_type == PT_LOAD && (phdr->p_flags & PF_X))
>>>> + {
>>>> + ElfW(Addr) start = phdr->p_vaddr + map->l_addr;
>>>> + ElfW(Addr) len = phdr->p_memsz;
>>>> + if (__mprotect ((void *) start, len, prot) < 0)
>>>
>>> Spend an extra cycle or two and honor the exact set of p_flags?
>>>
>>> If I construct an executable but non-readable PT_LOAD segment, that should be
>>> fine. RWX with BTI would undoubtedly be an unusual case, but perhaps not
>>> implausible in the context of a JIT with a statically allocated buffer.
>>
>> i will commit the attached fix tomorrow
>> unless there are comments on it.
Thanks. LGTM, modulo the naming typo.
r~
>>
>
>> From ee5765a839f6a40a61960264ed46393dc5d6c534 Mon Sep 17 00:00:00 2001
>> From: Szabolcs Nagy <szabolcs.nagy@arm.com>
>> Date: Mon, 13 Jul 2020 11:28:18 +0100
>> Subject: [PATCH] aarch64: Respect p_flags when protecting code with PROT_BTI
>>
>> Use PROT_READ and PROT_WRITE according to the load segment p_flags
>> when adding PROT_BTI.
>>
>> This is before processing relocations which may drop PROT_BTI in
>> case of textrels. Executable stacks are not protected via PROT_BTI
>> either. PROT_BTI is hardening in case memory corruption happened,
>> it's value is reduced if there is writable and executable memory
>> available so missing it on such memory is fine, but we should
>> respect the p_flags and should not drop PROT_WRITE.
>> ---
>> sysdeps/aarch64/dl-bti.c | 9 ++++++++-
>> 1 file changed, 8 insertions(+), 1 deletion(-)
>>
>> diff --git a/sysdeps/aarch64/dl-bti.c b/sysdeps/aarch64/dl-bti.c
>> index 965ddcc732..01ffb69a4a 100644
>> --- a/sysdeps/aarch64/dl-bti.c
>> +++ b/sysdeps/aarch64/dl-bti.c
>> @@ -24,13 +24,20 @@ static int
>> enable_bti (struct link_map *map, const char *program)
>> {
>> const ElfW(Phdr) *phdr;
>> - unsigned prot = PROT_READ | PROT_EXEC | PROT_BTI;
>> + unsigned prot;
>>
>> for (phdr = map->l_phdr; phdr < &map->l_phdr[map->l_phnum]; ++phdr)
>> if (phdr->p_type == PT_LOAD && (phdr->p_flags & PF_X))
>> {
>> void *start = (void *) (phdr->p_vaddr + map->l_addr);
>> size_t len = phdr->p_memsz;
>> +
>> + prot = PROT_EXEC | PROT_BTI;
>> + if (ph->p_flags & PF_R)
>
> should be phdr-> instead of ph->
>
> and i will have to wait for the tests to finish too which
> takes about 40h.
>
>> + prot |= PROT_READ;
>> + if (ph->p_flags & PF_W)
>> + prot |= PROT_WRITE;
>> +
>> if (__mprotect (start, len, prot) < 0)
>> {
>> if (program)
>> --
>> 2.17.1
>>
More information about the Libc-alpha
mailing list