CVSROOT:        /cvs
Module name:    src
Changes by:     dera...@cvs.openbsd.org 2018/04/12 11:13:44

Modified files:
        lib/libpthread/man: pthread_attr_setstack.3 
                            pthread_attr_setstackaddr.3 
        sys/arch/alpha/alpha: machdep.c trap.c 
        sys/arch/amd64/amd64: machdep.c trap.c 
        sys/arch/arm/arm: fault.c sig_machdep.c 
        sys/arch/arm64/arm64: ast.c sig_machdep.c trap.c 
        sys/arch/hppa/hppa: machdep.c trap.c 
        sys/arch/i386/i386: machdep.c trap.c 
        sys/arch/m88k/m88k: sig_machdep.c 
        sys/arch/macppc/macppc: machdep.c 
        sys/arch/mips64/mips64: sendsig.c trap.c 
        sys/arch/powerpc/powerpc: trap.c 
        sys/arch/sh/sh : sh_machdep.c 
        sys/arch/socppc/socppc: machdep.c 
        sys/arch/sparc64/sparc64: machdep.c trap.c 
        sys/kern       : exec_subr.c init_main.c kern_sig.c 
        sys/sys        : exec.h proc.h syscall_mi.h 
        sys/uvm        : uvm.h uvm_extern.h uvm_fault.c uvm_map.c 
                         uvm_map.h uvm_mmap.c 

Log message:
Implement MAP_STACK option for mmap().  Synchronous faults (pagefault and
syscall) confirm the stack register points at MAP_STACK memory, otherwise
SIGSEGV is delivered. sigaltstack() and pthread_attr_setstack() are modified
to create a MAP_STACK sub-region which satisfies alignment requirements.
Observe that MAP_STACK can only be set/cleared by mmap(), which zeroes the
contents of the region -- there is no mprotect() equivalent operation, so
there is no MAP_STACK-adding gadget.
This opportunistic software-emulation of a stack protection bit makes
stack-pivot operations during ROPchain fragile (kind of like removing a
tool from the toolbox).
original discussion with tedu, uvm work by stefan, testing by mortimer
ok kettenis

Reply via email to