Subject: Re: 2.0RC4: defeating non-exec stack
To: None <tech-kern@netbsd.org>
From: Christos Zoulas <christos@zoulas.com>
List: tech-kern
Date: 11/08/2004 23:24:12
In article <20041108230757.34D151C05E@coconut.itojun.org>,
 <itojun@iijlab.net> wrote:
>
>
>>At $DAYJOB, I'm working with a box with a "hardware" (firmware, really)
>>RAID array a bit over 1TB.  1.6.2 can't handle that; 2.0_RC4 (the most
>>recent i386 kernel I found on ftp.netbsd.org) can.
>>
>>So I was booting the 2.0_RC4 kernel with a fully 1.6.2 userland.  And
>>one of my tools started coredumping on me.  On investigation, this
>>proves to happen exactly when it tries to enter the stack trampoline
>>that implements a nested function.
>>
>>Now, I think I understand why non-executable stack is seen as a good
>>thing.  And presumably the 2.0RC4 compiler does whatever tapdancing is
>>necessary to make nested functions work.  But this breaking of backward
>>compatability is a problem.  How do I disable this misfeature so I can
>>run my 1.6.2 executables?  I did a little sysctl -a | grep searching
>>and found nothing; perhaps I just didn't try the right grep pattern -
>>or perhaps it's that I was using the 1.6.2 sysctl, though a machine I
>>can get a shell on running 2.0_BETA didn't have anything
>>helpful-looking in its sysctl -a output.
>>
>>Note that I don't have a 2.0 build environment, so anything that
>>involves recompiling (eg) the kernel is not workable.  The kernel is
>>the GENERIC_DIAGNOSTIC kernel from
>>/pub/NetBSD-daily/netbsd-2-0/200410160000/i386 on ftp.netbsd.org.
>
>	COMPAT_16?  see src/UPDATING 20030906.

That is different I think. The note you mention allows the in-kernel
pre-siginfo signal trampoline code to work. COMPAT_16 is on by
default on 2.0_RC4 so that should not be it. Maybe edit exec_subr.c
and add PROT_EXEC to exec_setup_stack()?

christos