Bug 1297748 - [RFE] Allocate guard pages after guest RAM to protect against buffer overflows
Summary: [RFE] Allocate guard pages after guest RAM to protect against buffer overflows
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: qemu-kvm-rhev
Version: 7.3
Hardware: All
OS: All
medium
medium
Target Milestone: rc
: ---
Assignee: Victor Kaplansky
QA Contact: Yumei Huang
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-01-12 11:28 UTC by Prasad Pandit
Modified: 2018-12-04 18:25 UTC (History)
13 users (show)

Fixed In Version: Qemu-2.5
Doc Type: Enhancement
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-11-07 20:54:17 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:2673 0 normal SHIPPED_LIVE qemu-kvm-rhev bug fix and enhancement update 2016-11-08 01:06:13 UTC

Description Prasad Pandit 2016-01-12 11:28:39 UTC 
Description of problem:

 * Latest Qemu version 2.5 has enabled insertion of Guard Pages after the Guest RAM. This is to protect against any guest triggered buffer overflow issues.

 * http://wiki.qemu.org/ChangeLog/2.5#System_emulation
 * git.qemu.org/?p=qemu.git;a=commit;h=f293709c6af7a65a9bcec09cdba7a60183657a3e


It'd be real good to back-port this feature to current RHEL qemu-kvm packages.
Comment 2 Prasad Pandit 2016-06-17 04:38:20 UTC 
Patch set
  -> https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg06894.html
Comment 10 Yumei Huang 2016-09-22 09:10:38 UTC 
QE has verified this bug by checking mmap from output of strace. 

Steps:
1. boot guest with strace
#strace -e mmap -o mmap.log  /usr/libexec/qemu-kvm -m 4G,slots=256,maxmem=40G\ 

-numa node -drive file=win2012r2.qcow2,if=none,cache=none,format=qcow2,id=drive0 -device ide-drive,drive=drive0,id=ide-drive  \

-usb -device usb-tablet,id=input0 -netdev tap,id=hostnet1 -device virtio-net-pci,mac=42:ce:a9:d2:4d:d9,id=idlbq7eA,netdev=hostnet1 -vga qxl \

-spice port=5901,addr=0.0.0.0,disable-ticketing,image-compression=off,seamless-migration=on -monitor stdio

2. check the output of strace
# grep PROT_NONE mmap.log


With qemu-kvm-rhev-2.3.0-31.el7, there is no output in step 2.

With qemu-kvm-rhev-2.6.0-26.el7, below is the output:

mmap(NULL, 4297064448, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd038843000
mmap(NULL, 2359296, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd0387c0000
mmap(NULL, 2228224, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd0385e0000
mmap(NULL, 69206016, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd034400000
mmap(NULL, 2105344, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd0341fe000
mmap(NULL, 69206016, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd030000000
mmap(NULL, 2162688, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd02f5ef000
mmap(NULL, 2359296, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd02f3c0000
mmap(NULL, 4194304, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd02f000000
mmap(NULL, 2101248, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd02edff000
mmap(NULL, 2101248, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd02ebff000
Comment 13 errata-xmlrpc 2016-11-07 20:54:17 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2673.html
Note You need to log in before you can comment on or make changes to this bug.