DynamoRIO / DynamoRIO/drmemory

Umbra x86-64 fails to handle large stack rlimits

Open
#1,916 0 comments 0 reactions 0 assignees View on GitHub
Component-Framework Hotlist-Release OpSys-Linux OpSys-x64
Dominant language
C
Stars
2.7k
Forks
290
PR merge metrics
No merged PRs in 30d

Description

Xref #1889

The mmap range for rlimit(RLIMIT_STACK) == RLIM_INFINITY is:

```
[0x2aaa'aaaaa000, 0x2baa'aaaaa000)
```

But that's just the base: the endpoint can go well beyond that.

Technically with different stack rlimits mmap can go anywhere from the
MAX_GAP base (the 0x1455' one) up to 0x7fff', which is a problem b/c
Umbra's mask is 0xfff' and we can easily become indistinguishable from the
low app region.

```
# ulimit -S -s 17179869184
# for ((i=0; i<5; i++)); do /tmp/mmap; done
mmap is 0x6f86498ae000-0x6f86518ae000
mmap is 0x6f13c0b86000-0x6f13c8b86000
mmap is 0x6f6d859f1000-0x6f6d8d9f1000
mmap is 0x6ff7d3415000-0x6ff7db415000
mmap is 0x6f10dcf06000-0x6f10e4f06000
# ulimit -S -s 1717986918400
# for ((i=0; i<5; i++)); do /tmp/mmap; done
mmap is 0x154a5db2d000-0x154a65b2d000
mmap is 0x145bcdaed000-0x145bd5aed000
mmap is 0x15128a83c000-0x15129283c000
mmap is 0x146b439e6000-0x146b4b9e6000
mmap is 0x150708103000-0x150710103000
```

So if we assume nobody will set the stack limit to anything between 16GB
and unlimited, we just need to handle 0x2aaa' - 0x2baa' (as the base: a
large mmap could extend well beyond there: but again if we assume no single
mmap will be over 256GB or sthg).

The solution taken for EfficiencySanitizer is similar to that used by ThreadSanitizer: if the stack rlimit is beyond what is easy to support, re-exec the process with a smaller rlimit.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.