diff options
Diffstat (limited to 'results/classifier/108/none/1701808')
| -rw-r--r-- | results/classifier/108/none/1701808 | 54 |
1 files changed, 54 insertions, 0 deletions
diff --git a/results/classifier/108/none/1701808 b/results/classifier/108/none/1701808 new file mode 100644 index 000000000..1a2327bab --- /dev/null +++ b/results/classifier/108/none/1701808 @@ -0,0 +1,54 @@ +graphic: 0.232 +semantic: 0.225 +device: 0.116 +PID: 0.097 +performance: 0.058 +vnc: 0.050 +network: 0.046 +other: 0.043 +debug: 0.035 +socket: 0.034 +permissions: 0.032 +boot: 0.020 +KVM: 0.018 +files: 0.016 + +stack smashing in or after recvmsg system call in aarch64 user mode + +A program that invokes recvmsg aborts with "*** stack smashing detected ***" when run in qemu-aarch64 (user mode), but works fine when running on native aarch64 hardware. + +How to reproduce: +$ aarch64-linux-gnu-gcc-5 -O -Wall /media/develdata/devel/qemu-bug/testpassfd.c -static -DEXTRA_SPACE=0 +$ QEMU_LD_PREFIX=/usr/aarch64-linux-gnu ~/inst-qemu/2.9.0/bin/qemu-aarch64 ./a.out +*** stack smashing detected ***: ./a.out terminated +qemu: uncaught target signal 6 (Aborted) - core dumped + +On native aarch64 hardware: +$ ./a.out +$ echo $? +0 + +The parameter EXTRA_SPACE can be used to add additional space to the array that receives the recvmsg data. With -DEXTRA_SPACE=9 (or larger), the program runs fine. Which suggests that recvmsg is storing up to 9 bytes more than allowed in memory. + + + + + +Likewise for 32-bit arm: +$ ~/inst-qemu/2.9.0/bin/qemu-arm ./a.arm +*** stack smashing detected ***: ./a.arm terminated +qemu: uncaught target signal 6 (Aborted) - core dumped + + +The behaviour in qemu-2.10 is the same as in qemu-2.9. + +The behaviour in qemu-2.11 is the same as in qemu-2.9. + +This should be fixed by http://patchwork.ozlabs.org/patch/849170/ I think. + + +Patch has been included here: +https://git.qemu.org/?p=qemu.git;a=commitdiff;h=7174970a94df10ee84143 + +Confirmed: It's fixed in qemu-2.12. + |