blob: 358450c6fc23c3c0d261d744b0050591ec3aff44 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
graphic: 0.232
semantic: 0.225
device: 0.116
mistranslation: 0.107
instruction: 0.064
vnc: 0.050
network: 0.046
assembly: 0.045
other: 0.043
socket: 0.034
boot: 0.020
KVM: 0.018
stack smashing in or after recvmsg system call in aarch64 user mode
A program that invokes recvmsg aborts with "*** stack smashing detected ***" when run in qemu-aarch64 (user mode), but works fine when running on native aarch64 hardware.
How to reproduce:
$ aarch64-linux-gnu-gcc-5 -O -Wall /media/develdata/devel/qemu-bug/testpassfd.c -static -DEXTRA_SPACE=0
$ QEMU_LD_PREFIX=/usr/aarch64-linux-gnu ~/inst-qemu/2.9.0/bin/qemu-aarch64 ./a.out
*** stack smashing detected ***: ./a.out terminated
qemu: uncaught target signal 6 (Aborted) - core dumped
On native aarch64 hardware:
$ ./a.out
$ echo $?
0
The parameter EXTRA_SPACE can be used to add additional space to the array that receives the recvmsg data. With -DEXTRA_SPACE=9 (or larger), the program runs fine. Which suggests that recvmsg is storing up to 9 bytes more than allowed in memory.
Likewise for 32-bit arm:
$ ~/inst-qemu/2.9.0/bin/qemu-arm ./a.arm
*** stack smashing detected ***: ./a.arm terminated
qemu: uncaught target signal 6 (Aborted) - core dumped
The behaviour in qemu-2.10 is the same as in qemu-2.9.
The behaviour in qemu-2.11 is the same as in qemu-2.9.
This should be fixed by http://patchwork.ozlabs.org/patch/849170/ I think.
Patch has been included here:
https://git.qemu.org/?p=qemu.git;a=commitdiff;h=7174970a94df10ee84143
Confirmed: It's fixed in qemu-2.12.
|