Re: PowerPC paxtest results w/ gcc-4.1

On 8/12/06, Paul Mackerras [off-list ref] wrote:

Albert Cahalan writes:

quoted

VM_STACK_DEFAULT_FLAGS32 is wrong. A fail-safe
default is important for security. If gcc on PowerPC ever
does generate code which puts trampolines on the stack,
then that can be fixed by converting to legal C code or
by adding the fragile marking to the defective executables.
Did gcc ever generate such code on PowerPC? If not,
then there is no reason to ever allow an executable stack.

I believe it did for nested procedures in C.

I just disassembled libgcc. You're right. Eeeeeew.
I filed a bug describing two better methods for this.

Now that we have the VDSO and use it for signal trampolines, we
probably could change the default stack protections.

Heh. I though i386 was the only one to ever do that.
The obvious method is to set the return address to
be a special value which will fault, like -3.

quoted

No. Look in the segment registers. The granularity
isn't great, but the stack can be protected at least.

No, ld.so tends to go just below the stack:

f7fe6000-f7fff000 r-xp 00000000 08:05 17069          /lib/ld-2.3.6.so
f800e000-f800f000 r--p 00018000 08:05 17069          /lib/ld-2.3.6.so
f800f000-f8010000 rwxp 00019000 08:05 17069          /lib/ld-2.3.6.so
ffe67000-ffe7c000 rw-p ffe67000 00:00 0              [stack]

That looks like a 64-bit system, which doesn't have
the granularity problem anyway. 32-bit powerpc seems
to be decent. The heap shares with the executable
itself, and of course there is the yucky 2 GB limit.

$ cat /proc/self/maps
00100000-00103000 r-xp 00100000 00:00 0
0fe8b000-0ffd4000 r-xp 00000000 03:0d 2081203    /lib/tls/libc-2.3.6.so
0ffd4000-0ffe3000 ---p 00149000 03:0d 2081203    /lib/tls/libc-2.3.6.so
0ffe3000-0ffea000 r--p 00148000 03:0d 2081203    /lib/tls/libc-2.3.6.so
0ffea000-0ffee000 rwxp 0014f000 03:0d 2081203    /lib/tls/libc-2.3.6.so
0ffee000-0fff0000 rwxp 0ffee000 00:00 0
10000000-10005000 r-xp 00000000 03:0d 1327891    /bin/cat
10014000-10015000 rwxp 00004000 03:0d 1327891    /bin/cat
10015000-10036000 rwxp 10015000 00:00 0          [heap]
30000000-30019000 r-xp 00000000 03:0d 2080939    /lib/ld-2.3.6.so
30019000-3001b000 rw-p 30019000 00:00 0
30028000-30029000 r--p 00018000 03:0d 2080939    /lib/ld-2.3.6.so
30029000-3002a000 rwxp 00019000 03:0d 2080939    /lib/ld-2.3.6.so
7fa45000-7fa5a000 rw-p 7fa45000 00:00 0          [stack]