diff options
Diffstat (limited to 'mailinglist/output_launchpad/1701808')
| -rw-r--r-- | mailinglist/output_launchpad/1701808 | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/mailinglist/output_launchpad/1701808 b/mailinglist/output_launchpad/1701808 new file mode 100644 index 00000000..c3f705d5 --- /dev/null +++ b/mailinglist/output_launchpad/1701808 @@ -0,0 +1,39 @@ +stack smashing in or after recvmsg system call in aarch64 user mode + +A program that invokes recvmsg aborts with "*** stack smashing detected ***" when run in qemu-aarch64 (user mode), but works fine when running on native aarch64 hardware. + +How to reproduce: +$ aarch64-linux-gnu-gcc-5 -O -Wall /media/develdata/devel/qemu-bug/testpassfd.c -static -DEXTRA_SPACE=0 +$ QEMU_LD_PREFIX=/usr/aarch64-linux-gnu ~/inst-qemu/2.9.0/bin/qemu-aarch64 ./a.out +*** stack smashing detected ***: ./a.out terminated +qemu: uncaught target signal 6 (Aborted) - core dumped + +On native aarch64 hardware: +$ ./a.out +$ echo $? +0 + +The parameter EXTRA_SPACE can be used to add additional space to the array that receives the recvmsg data. With -DEXTRA_SPACE=9 (or larger), the program runs fine. Which suggests that recvmsg is storing up to 9 bytes more than allowed in memory. + + + + + +Likewise for 32-bit arm: +$ ~/inst-qemu/2.9.0/bin/qemu-arm ./a.arm +*** stack smashing detected ***: ./a.arm terminated +qemu: uncaught target signal 6 (Aborted) - core dumped + + +The behaviour in qemu-2.10 is the same as in qemu-2.9. + +The behaviour in qemu-2.11 is the same as in qemu-2.9. + +This should be fixed by http://patchwork.ozlabs.org/patch/849170/ I think. + + +Patch has been included here: +https://git.qemu.org/?p=qemu.git;a=commitdiff;h=7174970a94df10ee84143 + +Confirmed: It's fixed in qemu-2.12. + |