Date: Wed, 10 Jun 2020 22:16:35 +0200 From: Michael Tuexen <tuexen@freebsd.org> To: Damjan Jovanovic <damjan.jov@gmail.com> Cc: Mark Johnston <markj@freebsd.org>, "freebsd-current@FreeBSD.org" <freebsd-current@freebsd.org> Subject: Re: gcc versus clang issue for 32-bit binaries Message-ID: <55C26C30-15C3-46E2-A449-6A0416D86798@freebsd.org> In-Reply-To: <CAJm2B-nh_cR1jwocahFuagcXGgkr0G1VfvxMDMLbKwGJMmcu8g@mail.gmail.com> References: <128AB51F-0950-448F-8463-12C573C1AA38@freebsd.org> <20200610165908.GA81346@raichu> <0281EB7A-B5DE-4D52-96DF-C7A2D6DC805C@freebsd.org> <CAJm2B-nh_cR1jwocahFuagcXGgkr0G1VfvxMDMLbKwGJMmcu8g@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
> On 10. Jun 2020, at 20:30, Damjan Jovanovic <damjan.jov@gmail.com> =
wrote:
>=20
> MAP_FIXED is generally bad news, as it overwrites any prior mappings =
within the range of addresses being mapped to.
>=20
> They should use MAP_FIXED | MAP_EXCL instead, which will fail if any =
mappings already exist in the range, and then maybe retry with another =
range if it fails. Linux and NetBSD have MAP_TRYFIXED instead, which =
does the retrying internally. Or at the very least, run mincore() on =
every page in the range to verify that nothing is mapped before using =
mmap() with MAP_FIXED.
It is used in syzkaller. Some go code generates C include files... So =
right now I might want
to stick with a value.
>=20
> If there is no other way but to use a single hardcoded value, check =
/proc/<pid>/map for a number of different processes, 32 and 64 bit, and =
find an address range that isn't used often.
Thanks for the hint. I tried to find one. Let's see how good this guess =
is.
Best regards
Michael
>=20
> Damjan
>=20
>=20
> On Wed, Jun 10, 2020 at 7:40 PM Michael Tuexen <tuexen@freebsd.org> =
wrote:
> > On 10. Jun 2020, at 18:59, Mark Johnston <markj@FreeBSD.org> wrote:
> >=20
> > On Wed, Jun 10, 2020 at 06:41:50PM +0200, Michael Tuexen wrote:
> >> Dear all,
> >>=20
> >> consider the following program test.c:
> >>=20
> >> #include <sys/mman.h>
> >> #include <stdio.h>
> >>=20
> >> int=20
> >> main(void)
> >> {
> >> void *p;
> >> =20
> >> p =3D mmap((void *)0x20000000, 0x1000000, PROT_READ | =
PROT_WRITE | PROT_EXEC, MAP_ANON | MAP_PRIVATE | MAP_FIXED, -1, 0);
> >> printf("p=3D %p\n", p);
> >> return (0);
> >> }
> >>=20
> >> On i386 the following happens:
> >> * when compiling it with cc and running it, it crashes.
> >> * when compiling it with gcc it runs fine.
> >>=20
> >> On amd64 the following happens:
> >> * when compiling it with cc -m64 it runs fine.
> >> * when compiling it with cc -m32 is crashes.
> >> * when compiling it with gcc -m64 it runs fine.
> >> * when compiling it with gcc -m32 it runs fine.
> >>=20
> >> So why does the above program crash when compiled for 32-bit when =
using clang, but runs fine when compiled with gcc.
> >=20
> > The difference is between ld.bfd and ld.lld, which emit executables =
with
> > different entry point addresses. cc -m32 -fuse-ld=3Dbfd gives an
> > executable that does not crash.
> >=20
> > When linked with lld, libc and ld-elf get mapped into the region
> > [0x20000000,0x21000000], so the program crashes when the libc.so =
mapping
> > is overwritten with that created by the mmap() call and the program
> > calls printf().
> >=20
> >> I'm testing this on 32-bit and 64-bit head systems. gcc is from =
ports.
> >>=20
> >> The reason I'm looking into it is that I want to get syzkaller =
working on 32-bit with clang.
> >=20
> > Do you know why SYZ_DATA_OFFSET is hard-coded the way it is? It =
looks
> > like it works more or less by accident, but at a glance I don't see =
why
> > it has to be a fixed mapping.
> I don't know, it comes from:
> =
https://github.com/google/syzkaller/blob/master/sys/targets/targets.go#L45=
0
>=20
> Do you have a value which can be used on FreeBSD? Then we can just =
change it...
>=20
> Best regards
> Michael
>=20
> _______________________________________________
> freebsd-current@freebsd.org mailing list
> https://lists.freebsd.org/mailman/listinfo/freebsd-current
> To unsubscribe, send any mail to =
"freebsd-current-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?55C26C30-15C3-46E2-A449-6A0416D86798>