From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Micay Date: Thu, 10 Oct 2019 22:52:49 -0400 Subject: [PATCH] move pthread_internal_t behind guard page Signed-off-by: anupritaisno1 --- libc/bionic/pthread_create.cpp | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/libc/bionic/pthread_create.cpp b/libc/bionic/pthread_create.cpp index eac53cac8..336e69b59 100644 --- a/libc/bionic/pthread_create.cpp +++ b/libc/bionic/pthread_create.cpp @@ -199,10 +199,13 @@ int __init_thread(pthread_internal_t* thread) { ThreadMapping __allocate_thread_mapping(size_t stack_size, size_t stack_guard_size) { const StaticTlsLayout& layout = __libc_shared_globals()->static_tls_layout; - // Allocate in order: stack guard, stack, guard page, static TLS, guard page. + size_t thread_page_size = __BIONIC_ALIGN(sizeof(pthread_internal_t), PAGE_SIZE); + + // Allocate in order: stack guard, stack, guard page, pthread_internal_t, static TLS, guard page. size_t mmap_size; if (__builtin_add_overflow(stack_size, stack_guard_size, &mmap_size)) return {}; if (__builtin_add_overflow(mmap_size, PTHREAD_GUARD_SIZE, &mmap_size)) return {}; + if (__builtin_add_overflow(mmap_size, thread_page_size, &mmap_size)) return {}; if (__builtin_add_overflow(mmap_size, layout.size(), &mmap_size)) return {}; if (__builtin_add_overflow(mmap_size, PTHREAD_GUARD_SIZE, &mmap_size)) return {}; @@ -231,9 +234,10 @@ ThreadMapping __allocate_thread_mapping(size_t stack_size, size_t stack_guard_si return {}; } - char* const static_tls_space = space + stack_guard_size + stack_size + PTHREAD_GUARD_SIZE; + char* const thread = space + stack_guard_size + stack_size + PTHREAD_GUARD_SIZE; + char* const static_tls_space = thread + thread_page_size; - if (mprotect(static_tls_space, layout.size(), PROT_READ | PROT_WRITE) != 0) { + if (mprotect(thread, thread_page_size + layout.size(), PROT_READ | PROT_WRITE) != 0) { async_safe_format_log(ANDROID_LOG_WARN, "libc", "pthread_create failed: couldn't mprotect R+W %zu-byte static TLS mapping region: %s", layout.size(), strerror(errno)); @@ -278,13 +282,8 @@ static int __allocate_thread(pthread_attr_t* attr, bionic_tcb** tcbp, void** chi stack_top = static_cast(attr->stack_base) + attr->stack_size; } - // Carve out space from the stack for the thread's pthread_internal_t. This - // memory isn't counted in pthread_attr_getstacksize. - - // To safely access the pthread_internal_t and thread stack, we need to find a 16-byte aligned boundary. - stack_top = align_down(stack_top - sizeof(pthread_internal_t), 16); - - pthread_internal_t* thread = reinterpret_cast(stack_top); + pthread_internal_t* thread = reinterpret_cast( + mapping.static_tls - __BIONIC_ALIGN(sizeof(pthread_internal_t), PAGE_SIZE)); if (!stack_clean) { // If thread was not allocated by mmap(), it may not have been cleared to zero. // So assume the worst and zero it.