On Thu, Mar 13, 2025 at 10:23 PM Collin Funk <collin.fu...@gmail.com> wrote:
>
> On Haiku, test-vma-prot fails with the following:
>
>     ../../gltests/test-vma-prot.c:68: assertion 'prot == (VMA_PROT_READ | 
> VMA_PROT_WRITE)' failed
>     Abort
>     FAIL test-vma-prot (exit status: 149)
>
> At this point, the following instead is true:
>
>     prot == (VMA_PROT_READ | VMA_PROT_WRITE | VMA_PROT_EXECUTE)
>
> I guess when the original code here was written:
>
>        if (info.protection & B_READ_AREA)
>          flags |= VMA_PROT_READ | VMA_PROT_EXECUTE;
>
> the assumption was that readable memory was also executable?

For modern Linux, I believe the preferred state is written as W^X,
meaning the page is either WRITE or EXEC, but not both. It is a
defense for attacks like buffer overflows and heap spraying.

Linux used to set READ, WRITE and/or EXEC by default on memory, but it
changed to W^X back around 2010 or 2012 or so.

I think setting both READ and EXEC by default is probably an
architectural bug on Haiku.

> The only documentation I could find for this BeOS/Haiku API only
> mentions B_READ_AREA and B_WRITE_AREA [1].
>
> But I see that when mmap was added in 2008 to Haiku it also sets
> B_EXECUTE_AREA [2]. Therefore, I applied the attached patch to vma-iter
> that fixes the test.
>
> [1] https://www.haiku-os.org/legacy-docs/bebook/TheKernelKit_Areas.html
> [2] 
> https://github.com/haiku/haiku/blame/b989960b81e5826d54acad82a2c4a3e685984f8a/src/system/libroot/posix/sys/mman.cpp#L132

Jeff

Reply via email to