git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 2/3] t/helper/test-delta: segfault on OOB access

From
Jeff King <peff@peff.net>
Date
Aug 29, 2018, 21:46 UTC
Message-ID
<20180829214621.GD29880@sigill.intra.peff.net>
In-Reply-To
<CAG48ez2BL1fgP_FkUi=6EYAuA+ja3ujZFFqKkPQN50tRCEUJiQ@mail.gmail.com>
On Wed, Aug 29, 2018 at 11:40:41PM +0200, Jann Horn wrote:
Show 22 quoted lines
> > If we want to detect this kind of thing in tests, we should probably be
> > relying on tools like ASan, which would cover all mmaps.
> >
> > It would be nice if there was a low-cost way to detect this in
> > production use, but it looks like this replaces mmap with
> > read_in_full(), which I think is a non-starter for most uses.
> 
> I think even with ASAN, you'd still need read_in_full() or an mmap()
> wrapper that fiddles with the ASAN shadow, because mmap() always maps
> whole pages:
> 
> $ cat mmap-read-asan-blah.c
> #include <sys/mman.h>
> #include <stdlib.h>
> int main(void) {
>   volatile char *p = mmap(NULL, 1, PROT_READ|PROT_WRITE,
> MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
>   p[200] = 1;
> }
> $ gcc -o mmap-read-asan-blah mmap-read-asan-blah.c -fsanitize=address
> $ ./mmap-read-asan-blah
> $

Yeah, I was just trying to run your tests with ASan and couldn't convince it to complain. I also tried MSan, but no luck.

> But that aside, you do have a point about having some custom hack for
> a single patch.

I'm also not sure how portable it is. Looks like we have a Windows wrapper for getpagesize(), but I don't see any other uses of mprotect().

-Peff
Previous: Jann HornNext: Jeff King
Message 5 of 31 in “patch-delta: fix oob read”
  1. 1/3 patch-delta: fix oob readJann Horn, Aug 29, 2018
  2. 2/3 t/helper/test-delta: segfault on OOB accessJann Horn, Aug 29, 2018
  3. Jeff KingAug 29, 2018
  4. Jann HornAug 29, 2018
  5. Jeff KingAug 29, 2018
  6. Jeff KingAug 29, 2018
  7. 3/3 t5303: add tests for corrupted deltasJann Horn, Aug 29, 2018
  8. Jeff KingAug 29, 2018
  9. Jeff KingAug 29, 2018
  10. Jeff KingAug 29, 2018
  11. Jeff KingAug 29, 2018
  12. 0/5 handle corruption in patch-deltaJeff King, Aug 30, 2018
  13. 1/5 test-delta: read input into a heap bufferJeff King, Aug 30, 2018
  14. 2/5 t5303: test some corrupt deltasJeff King, Aug 30, 2018
  15. Junio C HamanoAug 30, 2018
  16. Jeff KingAug 30, 2018
  17. Jeff KingAug 30, 2018
  18. Junio C HamanoAug 30, 2018
  19. Jeff KingAug 30, 2018
  20. Johannes SchindelinAug 31, 2018
  21. Junio C HamanoAug 31, 2018
  22. Jeff KingAug 31, 2018
  23. Junio C HamanoAug 31, 2018
  24. Johannes SchindelinAug 31, 2018
  25. Jeff KingAug 31, 2018
  26. Junio C HamanoAug 31, 2018
  27. 3/5 patch-delta: fix oob readJeff King, Aug 30, 2018
  28. 4/5 patch-delta: consistently report corruptionJeff King, Aug 30, 2018
  29. 5/5 patch-delta: handle truncated copy parametersJeff King, Aug 30, 2018
  30. Jann HornAug 30, 2018
  31. Nicolas PitreAug 30, 2018

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.