Subject: Re: Code on stack (Re: exploit with memcpy())
To: <>
From: Ignatios Souvatzis <ignatios@theory.cs.uni-bonn.de>
List: tech-userlevel
Date: 07/05/2002 11:16:45
--OgqxwSJOaUobr8KG
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Jul 04, 2002 at 05:56:32PM +0100, David Laight wrote:
> > The compiler emits code to sync the I-cache after the trampoline is spit
> > out onto the stack.
> >=20
> > We could change the "sync the I-cache" code to also make a call to
> > mprotect(..., PROT_READ|PROT_WRITE|PROT_EXEC).
> >=20
> > Then, when the pmap is invoked to make the protection change, it could
> > enable execution on the stack if the page being marked for execution is
> > a stack page.
>=20
> ISTM that someones 'little trick' of generating an on-stack
> trampoline has got rather out of control!
> The cost of the I-cache sync must surely overwhelm any instruction
> count benefit of the trampoline?

Not necessarily - depends on CPU architecture. On sane CPUs, this can be
done in userland, so no (pseudo-)system call is needed. And it only affects
a small amount of data, so it isn't too slow. (Unfortunately, m68k needs
a call into the kernel).

Regards,
	-is

--OgqxwSJOaUobr8KG
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: 2.6.i

iQEVAgUBPSVZNjCn4om+4LhpAQG9UAf/fm6vXNhyPO7cIZyxPg6tFgQhWRy0koTK
PRg1U6WkSagoYaZvlLWgXLBfYbFVieY7X50SElxLtOiz+hUDT7Bnluwk97OEUq/+
EwG85v4JaREBrwuRza3jF5V9kBqCqm07RyrcRdv1nBnUvR+a1xSmcBVEn/qca2hP
gWIlabnsWXjbMNmQtTWzL0DvV9BY5OpIeweENq2YA5P092UMjOqg8HisGWZh/osn
d3fNRjsU1vDJ5vvMfQgRDYweDKI6rc57gNIWx9gsNRUZFesGPV5UEX4FB2Kde8ew
nKVAFXD6TN3GGXxpbk5eJDH+j4Xv7abu7xiN9Nj+RWOU1rsvyG1Qfg==
=nsW1
-----END PGP SIGNATURE-----

--OgqxwSJOaUobr8KG--