CVSROOT: /cvs
Module name: src
Changes by: dera...@cvs.openbsd.org 2023/01/31 08:18:56
Modified files:
sys/arch/alpha/alpha: fp_complete.c locore.s trap.c
sys/arch/alpha/include: cpu.h pmap.h
sys/arch/amd64/amd64: copy.S
sys/arch/amd64/include: pmap.h
sys/arch/arm/arm: bcopyinout.S copystr.S
sys/arch/arm/include: pmap.h
sys/arch/hppa/hppa: db_disasm.c
sys/arch/hppa/include: cpu.h
sys/arch/i386/i386: locore.s
sys/arch/i386/include: pmap.h
sys/arch/m88k/include: cpu.h
sys/arch/m88k/m88k: m88110_fp.c subr.S trap.c
sys/arch/mips64/include: pmap.h
sys/arch/mips64/mips64: lcore_access.S
sys/arch/powerpc/include: pmap.h
sys/arch/powerpc/powerpc: pmap.c
sys/arch/sh/include: pmap.h
sys/arch/sh/sh : locore_subr.S
sys/arch/sparc64/include: pmap.h
sys/arch/sparc64/sparc64: db_interface.c locore.s
sys/uvm : uvm_map.c uvm_map.h
sys/kern : exec_subr.c kern_sig.c kern_subr.c
sys/sys : systm.h
Log message:
On systems without xonly mmu hardware-enforcement, we can still mitigate
against classic BROP with a range-checking wrapper in front of copyin() and
copyinstr() which ensures the userland source doesn't overlap the main program
text, ld.so text, signal tramp text (it's mapping is hard to distinguish
so it comes along for the ride), or libc.so text. ld.so tells the kernel
libc.so text range with msyscall(2). The range checking for 2-4 elements is
done without locking (because all 4 ranges are immutable!) and is inexpensive.
write(sock, &open, 400) now fails with EFAULT. No programs have been
discovered which require reading their own text segments with a system call.
On a machine without mmu enforcement, a test program reports the following:
userland kernel
ld.so readable unreadable
mmap xz unreadable unreadable
mmap x readable readable
mmap nrx readable readable
mmap nwx readable readable
mmap xnwx readable readable
main readable unreadable
libc unmapped? readable unreadable
libc mapped readable unreadable
ok kettenis, additional help from miod
