qemu linux-user requires read permissions on memory passed to syscalls that should only need write access
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Expired
|
Undecided
|
Unassigned |
Bug Description
When read() function takes an mmap'ed address as output buffer, it returns EFAULT. The expected behavior is it should just work.
The following code works for qemu-system-arm, but not for qemu-arm-static.
QEMU version affected: latest release 2.12.0.
Steps to reproduce (please substitute /path/to/
# First register binfmt_misc
[hidden]$ docker run --rm --privileged multiarch/
# Compile the code and run
[hidden]$ docker run --rm -it -v /tmp/a.
ofd=3
ftruncate=0
mmap=0xff3f5000
fd=4
0xff3f5023 -1 14
The expected result in qemu-system-arm as well as natively on x86_64 host:
hidden$ ./a.out
ofd=3
ftruncate=0
mmap=0xb6fb7000
fd=4
0xb6fb7023 5 0
tags: | added: arm |
tags: | added: linux-user |
tags: | added: qemu |
tags: | removed: qemu |
The problem here is not the mmap(), it is that you are mapping it as only PROT_WRITE and not also PROT_READ. With the native kernel, syscalls which only write to a buffer and do not read from it (like read(2)) only require write permissions on that memory. QEMU's implementation requires both write and read permission.
This is a QEMU bug, but not a major one, because in practice no guest binaries set up memory that is only writable and can't be read (what would they do with the data that they wrote into that memory?). You can work around it in your test program by using mmap(..., PROT_READ | PROT_WRITE, ...), which will allow it to work in QEMU.
(Technical QEMU internal notes for other developers: the issue here is that we do permissions checks in syscall.c using lock_user( VERIFY_ WRITE, ...) etc, but in access_ok() we treat VERIFY_WRITE as "implies read access" when we're choosing the permissions flags to pass to page_check_range(). To fix this we would have to check all the places we use VERIFY_WRITE to identify which should be "only need write" and which are "need both read and write".)