stack growth from setrlimit was never updated to set UVM_ET_STACK on

the entries, so the check-sp-at-system-call check failed.  Quite strange
it took this long to find this.
ok kettenis

diff --git a/sys/kern/exec_subr.c b/sys/kern/exec_subr.c
index ac787ab..0637603 100644 (file)
--- a/sys/kern/exec_subr.c
+++ b/sys/kern/exec_subr.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: exec_subr.c,v 1.62 2022/10/21 20:46:40 deraadt Exp $  */
+/*     $OpenBSD: exec_subr.c,v 1.63 2022/11/17 18:53:12 deraadt Exp $  */
 /*     $NetBSD: exec_subr.c,v 1.9 1994/12/04 03:10:42 mycroft Exp $    */
 
 /*
@@ -262,7 +262,7 @@ vmcmd_map_readvn(struct proc *p, struct exec_vmcmd *cmd)
                 */
                error = (uvm_map_protect(&p->p_vmspace->vm_map,
                    cmd->ev_addr, round_page(cmd->ev_len),
-                   prot, FALSE, TRUE));
+                   prot, 0, FALSE, TRUE));
        }
        if (error == 0) {
                if (cmd->ev_flags & VMCMD_IMMUTABLE)

diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c
index 06a8f67..e92587a 100644 (file)
--- a/sys/kern/kern_exec.c
+++ b/sys/kern/kern_exec.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: kern_exec.c,v 1.238 2022/10/30 17:43:40 guenther Exp $        */
+/*     $OpenBSD: kern_exec.c,v 1.239 2022/11/17 18:53:12 deraadt Exp $ */
 /*     $NetBSD: kern_exec.c,v 1.75 1996/02/09 18:59:28 christos Exp $  */
 
 /*-
@@ -466,13 +466,13 @@ sys_execve(struct proc *p, void *v, register_t *retval)
 #ifdef MACHINE_STACK_GROWS_UP
        pr->ps_strings = (vaddr_t)vm->vm_maxsaddr + sgap;
         if (uvm_map_protect(&vm->vm_map, (vaddr_t)vm->vm_maxsaddr,
-            trunc_page(pr->ps_strings), PROT_NONE, TRUE, FALSE))
+            trunc_page(pr->ps_strings), PROT_NONE, 0, TRUE, FALSE))
                 goto exec_abort;
 #else
        pr->ps_strings = (vaddr_t)vm->vm_minsaddr - sizeof(arginfo) - sgap;
         if (uvm_map_protect(&vm->vm_map,
             round_page(pr->ps_strings + sizeof(arginfo)),
-            (vaddr_t)vm->vm_minsaddr, PROT_NONE, TRUE, FALSE))
+            (vaddr_t)vm->vm_minsaddr, PROT_NONE, 0, TRUE, FALSE))
                 goto exec_abort;
 #endif
 

diff --git a/sys/kern/kern_resource.c b/sys/kern/kern_resource.c
index 38da9b1..456dc08 100644 (file)
--- a/sys/kern/kern_resource.c
+++ b/sys/kern/kern_resource.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: kern_resource.c,v 1.75 2022/10/07 14:59:39 deraadt Exp $      */
+/*     $OpenBSD: kern_resource.c,v 1.76 2022/11/17 18:53:13 deraadt Exp $      */
 /*     $NetBSD: kern_resource.c,v 1.38 1996/10/23 07:19:38 matthias Exp $      */
 
 /*-
@@ -52,6 +52,7 @@
 #include <sys/syscallargs.h>
 
 #include <uvm/uvm_extern.h>
+#include <uvm/uvm.h>
 
 /* Resource usage check interval in msec */
 #define RUCHECK_INTERVAL       1000
@@ -329,7 +330,7 @@ dosetrlimit(struct proc *p, u_int which, struct rlimit *limp)
                        size = round_page(size);
                        KERNEL_LOCK();
                        (void) uvm_map_protect(&vm->vm_map, addr,
-                           addr+size, prot, FALSE, FALSE);
+                           addr+size, prot, UVM_ET_STACK, FALSE, FALSE);
                        KERNEL_UNLOCK();
                }
        }

diff --git a/sys/uvm/uvm_extern.h b/sys/uvm/uvm_extern.h
index ca34d99..6f4ddc5 100644 (file)
--- a/sys/uvm/uvm_extern.h
+++ b/sys/uvm/uvm_extern.h
@@ -1,4 +1,4 @@
-/*     $OpenBSD: uvm_extern.h,v 1.165 2022/10/16 16:16:37 deraadt Exp $        */
+/*     $OpenBSD: uvm_extern.h,v 1.166 2022/11/17 18:53:05 deraadt Exp $        */
 /*     $NetBSD: uvm_extern.h,v 1.57 2001/03/09 01:02:12 chs Exp $      */
 
 /*
@@ -400,7 +400,7 @@ int                 uvm_map_pageable_all(vm_map_t, int, vsize_t);
 boolean_t              uvm_map_checkprot(vm_map_t, vaddr_t,
                            vaddr_t, vm_prot_t);
 int                    uvm_map_protect(vm_map_t, vaddr_t, 
-                           vaddr_t, vm_prot_t, boolean_t, boolean_t);
+                           vaddr_t, vm_prot_t, int etype, boolean_t, boolean_t);
 struct vmspace         *uvmspace_alloc(vaddr_t, vaddr_t,
                            boolean_t, boolean_t);
 void                   uvmspace_init(struct vmspace *, struct pmap *,

diff --git a/sys/uvm/uvm_map.c b/sys/uvm/uvm_map.c
index 9ee1fbd..e6849ba 100644 (file)
--- a/sys/uvm/uvm_map.c
+++ b/sys/uvm/uvm_map.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: uvm_map.c,v 1.303 2022/11/04 09:36:44 mpi Exp $       */
+/*     $OpenBSD: uvm_map.c,v 1.304 2022/11/17 18:53:05 deraadt Exp $   */
 /*     $NetBSD: uvm_map.c,v 1.86 2000/11/27 08:40:03 chs Exp $ */
 
 /*
@@ -3120,7 +3120,7 @@ uvm_page_printit(struct vm_page *pg, boolean_t full,
  */
 int
 uvm_map_protect(struct vm_map *map, vaddr_t start, vaddr_t end,
-    vm_prot_t new_prot, boolean_t set_max, boolean_t checkimmutable)
+    vm_prot_t new_prot, int etype, boolean_t set_max, boolean_t checkimmutable)
 {
        struct vm_map_entry *first, *iter;
        vm_prot_t old_prot;
@@ -3128,6 +3128,8 @@ uvm_map_protect(struct vm_map *map, vaddr_t start, vaddr_t end,
        vsize_t dused;
        int error;
 
+       KASSERT((etype & ~UVM_ET_STACK) == 0);  /* only UVM_ET_STACK allowed */
+
        if (start > end)
                return EINVAL;
        start = MAX(start, map->min_offset);
@@ -3196,6 +3198,10 @@ uvm_map_protect(struct vm_map *map, vaddr_t start, vaddr_t end,
                }
        }
 
+       /* only apply UVM_ET_STACK on a mapping changing to RW */
+       if (etype && new_prot != (PROT_READ|PROT_WRITE))
+               etype = 0;
+
        /* Fix protections.  */
        for (iter = first; iter != NULL && iter->start < end;
            iter = RBT_NEXT(uvm_map_addr, iter)) {
@@ -3226,6 +3232,7 @@ uvm_map_protect(struct vm_map *map, vaddr_t start, vaddr_t end,
                        iter->protection &= new_prot;
                } else
                        iter->protection = new_prot;
+               iter->etype |= etype;   /* potentially add UVM_ET_STACK */
 
                /*
                 * update physical map if necessary.  worry about copy-on-write
@@ -3306,6 +3313,8 @@ uvm_map_protect(struct vm_map *map, vaddr_t start, vaddr_t end,
        pmap_update(map->pmap);
 
 out:
+       if (etype & UVM_ET_STACK)
+               map->sserial++;
        vm_map_unlock(map);
        return error;
 }

diff --git a/sys/uvm/uvm_mmap.c b/sys/uvm/uvm_mmap.c
index 1b4ad16..0074415 100644 (file)
--- a/sys/uvm/uvm_mmap.c
+++ b/sys/uvm/uvm_mmap.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: uvm_mmap.c,v 1.174 2022/10/21 19:13:33 deraadt Exp $  */
+/*     $OpenBSD: uvm_mmap.c,v 1.175 2022/11/17 18:53:05 deraadt Exp $  */
 /*     $NetBSD: uvm_mmap.c,v 1.49 2001/02/18 21:19:08 chs Exp $        */
 
 /*
@@ -623,7 +623,7 @@ sys_mprotect(struct proc *p, void *v, register_t *retval)
                return EINVAL;          /* disallow wrap-around. */
 
        return (uvm_map_protect(&p->p_vmspace->vm_map, addr, addr+size,
-           prot, FALSE, TRUE));
+           prot, 0, FALSE, TRUE));
 }
 
 /*