From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <sourceware-bugzilla@sourceware.org>
Received: by sourceware.org (Postfix, from userid 48)
	id 68E383858415; Fri,  8 Dec 2023 03:22:31 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 68E383858415
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org;
	s=default; t=1702005751;
	bh=1O7s8yr4iwXxYF0GufE1inO2Mujic2sZMvPdOj0R3JI=;
	h=From:To:Subject:Date:In-Reply-To:References:From;
	b=Y2+eSFcVF32zZ4d03FIueLJoVOp4WuZI82rGCn3Ku/GuEdJ95G3iU5OMo5CdDiTNX
	 j8VL11SOYvRuwUmVvWR2adVcyLpZ/r6qpEwOSDvO+9JHU/6FzCi/uX2ZxIzzmoFpsH
	 pWCv/hDN4bgEur66SLzSDymo4W3xgL0iMvgbAyBw=
From: "i at maskray dot me" <sourceware-bugzilla@sourceware.org>
To: glibc-bugs@sourceware.org
Subject: [Bug dynamic-link/31076] Extra struct vm_area_struct with ---p
 created when PAGE_SIZE < max-page-size
Date: Fri, 08 Dec 2023 03:22:29 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: glibc
X-Bugzilla-Component: dynamic-link
X-Bugzilla-Version: unspecified
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: i at maskray dot me
X-Bugzilla-Status: NEW
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: unassigned at sourceware dot org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: security-
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-31076-131-SXDQvQrcJa@http.sourceware.org/bugzilla/>
In-Reply-To: <bug-31076-131@http.sourceware.org/bugzilla/>
References: <bug-31076-131@http.sourceware.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://sourceware.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <glibc-bugs.sourceware.org>

https://sourceware.org/bugzilla/show_bug.cgi?id=3D31076

--- Comment #21 from Fangrui Song <i at maskray dot me> ---
(In reply to Florian Weimer from comment #20)
> (In reply to Fangrui Song from comment #19)
> > (In reply to Florian Weimer from comment #18)
> > > (In reply to Kalesh Singh from comment #15)
> > > > AIUI if the runtime-page-size equals the max-page-size, the holes a=
re also
> > > > mapped in as part of the segment mapping and share the same permiss=
ions.
> > > > Does this mean that on such systems, any protection it offers becom=
es void?
> > >=20
> > > That's my understanding. The current behavior gives programmers the *=
option*
> > > to avoid mapping extra code on small-page systems, while maintaining
> > > compatibility with large-page systems. The proposed change to over-ma=
p to
> > > the next load-segment, to fill the gap, would take away that option.
> >=20
> > Can you elaborate what the option (and "functionality" below) is? Since
> > 22930c9bf21ea15d0da1477a379029e2de259b69 (1996) rtld just calls `mprote=
ct`
> > (one
> > extra `struct vm_area_struct` instance, see `sudo grep vm_area_struct
> > /proc/slabinfo`), and the user has no option to control this behavior.
>=20
> The developer can produce a binary with a LOAD segment that does not need
> that mprotect call.

This is described by "## Solution 2 - Modify the static linker" in comment =
1. I
find the approach intrusive.
("Moreover, a PT_LOAD whose end isn't backed by a section is unusual." in
comment 17.)

A loader alternative is "3. Extend the map end to cover the gap" in comment=
 17.
Instead of=20

    mmap(l->l_addr+c->mapstart, c->mapend - c->mapstart, c->prot,
MAP_FIXED|MAP_COPY|MAP_FILE, fd, c->mapoff)

increase the map length

    mmap(l->l_addr+c->mapstart, c[1].mapstart - c->mapstart, c->prot,
MAP_FIXED|MAP_COPY|MAP_FILE, fd, c->mapoff)

The existing mprotect in glibc/elf/dl-map-segments.h will not be touched.

--=20
You are receiving this mail because:
You are on the CC list for the bug.=