Implement MAP_STACK option for mmap(). Synchronous faults (pagefault and

syscall) confirm the stack register points at MAP_STACK memory, otherwise
SIGSEGV is delivered. sigaltstack() and pthread_attr_setstack() are modified
to create a MAP_STACK sub-region which satisfies alignment requirements.
Observe that MAP_STACK can only be set/cleared by mmap(), which zeroes the
contents of the region -- there is no mprotect() equivalent operation, so
there is no MAP_STACK-adding gadget.
This opportunistic software-emulation of a stack protection bit makes
stack-pivot operations during ROPchain fragile (kind of like removing a
tool from the toolbox).
original discussion with tedu, uvm work by stefan, testing by mortimer
ok kettenis

1 files changed, 14 insertions, 2 deletions

diff --git a/lib/libpthread/man/pthread_attr_setstack.3 b/lib/libpthread/man/pthread_attr_setstack.3
index 306dbdae8fd..ea622633cfb 100644
--- a/lib/libpthread/man/pthread_attr_setstack.3
+++ b/lib/libpthread/man/pthread_attr_setstack.3
@@ -1,9 +1,9 @@
-.\" $OpenBSD: pthread_attr_setstack.3,v 1.4 2013/06/05 03:44:50 tedu Exp $
+.\" $OpenBSD: pthread_attr_setstack.3,v 1.5 2018/04/12 17:13:34 deraadt Exp $
 .\" Manual page derived from TOG's UNIX98 documentation.
 .\"
 .\"  David Leonard, 2000. Public Domain.
 .\"
-.Dd $Mdocdate: June 5 2013 $
+.Dd $Mdocdate: April 12 2018 $
 .Dt PTHREAD_ATTR_SETSTACK 3
 .Os
 .Sh NAME
@@ -39,6 +39,18 @@ and the size of the storage shall be
 bytes.
 The stacksize shall be at least
 .Dv PTHREAD_STACK_MIN .
+.Pp
+On
+.Ox
+the provided stack must be page-aligned.
+It will be replaced (meaning zeroed) with a new
+.Ar MAP_ANON | Ar MAP_STACK
+mapping.
+It is recommended that the initial mapping be allocated using
+an allocator which has a matching deallocator that discards whole
+pages, to clear the
+.Ar MAP_STACK
+attribute afterwards.
 .Sh RETURN VALUES
 Upon successful completion,
 .Fn pthread_attr_setstack