Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Umbra x86-64 fails to handle large stack rlimits #1916

Open
derekbruening opened this issue Sep 7, 2016 · 0 comments
Open

Umbra x86-64 fails to handle large stack rlimits #1916

derekbruening opened this issue Sep 7, 2016 · 0 comments

Comments

@derekbruening
Copy link
Contributor

Xref #1889

The mmap range for rlimit(RLIMIT_STACK) == RLIM_INFINITY is:

[0x2aaa'aaaaa000, 0x2baa'aaaaa000)

But that's just the base: the endpoint can go well beyond that.

Technically with different stack rlimits mmap can go anywhere from the
MAX_GAP base (the 0x1455' one) up to 0x7fff', which is a problem b/c
Umbra's mask is 0xfff' and we can easily become indistinguishable from the
low app region.

# ulimit -S -s 17179869184
# for ((i=0; i<5; i++)); do /tmp/mmap; done
mmap is 0x6f86498ae000-0x6f86518ae000
mmap is 0x6f13c0b86000-0x6f13c8b86000
mmap is 0x6f6d859f1000-0x6f6d8d9f1000
mmap is 0x6ff7d3415000-0x6ff7db415000
mmap is 0x6f10dcf06000-0x6f10e4f06000
# ulimit -S -s 1717986918400
# for ((i=0; i<5; i++)); do /tmp/mmap; done
mmap is 0x154a5db2d000-0x154a65b2d000
mmap is 0x145bcdaed000-0x145bd5aed000
mmap is 0x15128a83c000-0x15129283c000
mmap is 0x146b439e6000-0x146b4b9e6000
mmap is 0x150708103000-0x150710103000

So if we assume nobody will set the stack limit to anything between 16GB
and unlimited, we just need to handle 0x2aaa' - 0x2baa' (as the base: a
large mmap could extend well beyond there: but again if we assume no single
mmap will be over 256GB or sthg).

The solution taken for EfficiencySanitizer is similar to that used by ThreadSanitizer: if the stack rlimit is beyond what is easy to support, re-exec the process with a smaller rlimit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant