qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-05 20:06:10 -07:00
Code Releases Activity

runtime: avoid overflow in markrootBlock

Browse Source 
In a position independent executable the data or BSS may be located
close to the end of memory. If it is placed closer than
rootBlockBytes, then the calculations in markrootBlock would overflow,
and the test that ensures that n is not larger than n0 would fail.
This would then cause scanblock to scan data that it shouldn't,
using an effectively random ptrmask, leading to program crashes.

No test because the only way to test it is to build a PIE and convince
the kernel to put the data section near the end of memory, and I don't
know how to do that. Or perhaps we could use a linker script, but that
is painful.

The new code is algebraically identical to the original code, but
avoids the potential overflow of b+rootBlockBytes.

Change-Id: Ieb4e5465174bb762b063d2491caeaa745017345e
Reviewed-on: https://go-review.googlesource.com/c/go/+/195717
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Austin Clements <austin@google.com>
This commit is contained in:
Ian Lance Taylor 2019-09-16 12:35:15 -07:00
parent e2cbb7f629
commit 66e562cc52
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/runtime/mgcmark.go
View File

@ -237,14 +237,18 @@ func markrootBlock(b0, n0 uintptr, ptrmask0 *uint8, gcw *gcWork, shard int) {
throw("rootBlockBytes must be a multiple of 8*ptrSize") throw("rootBlockBytes must be a multiple of 8*ptrSize")
} }
b := b0 + uintptr(shard)*rootBlockBytes // Note that if b0 is toward the end of the address space,
if b >= b0+n0 { // then b0 + rootBlockBytes might wrap around.
// These tests are written to avoid any possible overflow.
off := uintptr(shard) * rootBlockBytes
if off >= n0 {
return return
} }
b := b0 + off
ptrmask := (*uint8)(add(unsafe.Pointer(ptrmask0), uintptr(shard)*(rootBlockBytes/(8*sys.PtrSize)))) ptrmask := (*uint8)(add(unsafe.Pointer(ptrmask0), uintptr(shard)*(rootBlockBytes/(8*sys.PtrSize))))
n := uintptr(rootBlockBytes) n := uintptr(rootBlockBytes)
if b+n > b0+n0 { if off+n > n0 {
n = b0 + n0 - b n = n0 - off
} }
// Scan this shard. // Scan this shard.