Stop initializing code pages with RWX permissions

Stop initializing code pages with RWX permissions

We shouldn't need to execute the code pages until after we're done
writing to them, so we can drop the initial execute bit.  Without
this, part of a mapping can sit in a freelist with RWX permissions
indefinitely, which makes for an easier target under certain
exploits.

BUG=
R=asiva@google.com

Committed: https://github.com/dart-lang/sdk/commit/ca85ec7955095f3565b1b18bd43775191ac6ee4b

[Todd Eisenberger, 2016-01-27 22:32:57]

Description was changed from

==========
Stop initializing code pages with RWX permissions

We shouldn't need to execute the code pages until after we're done
writing to them, so we can drop the initial execute bit.  Without
this, part of a mapping can sit in a freelist with RWX permissions
indefinitely, which makes for an easier target under certain
exploits.

BUG=
==========

to

==========
Stop initializing code pages with RWX permissions

We shouldn't need to execute the code pages until after we're done
writing to them, so we can drop the initial execute bit.  Without
this, part of a mapping can sit in a freelist with RWX permissions
indefinitely, which makes for an easier target under certain
exploits.

BUG=
==========

[Todd Eisenberger, 2016-01-27 22:32:57]

teisenbe@chromium.org changed reviewers:
+ asiva@google.com

[Todd Eisenberger, 2016-01-27 23:03:30]

This is the patch I mentioned earlier that gets rid of dangling RWX pages

[Todd Eisenberger, 2016-01-27 23:18:39]

teisenbe@chromium.org changed reviewers:
+ iposva@google.com

[siva, 2016-01-28 00:10:16]

https://codereview.chromium.org/1635343002/diff/20001/runtime/vm/pages.cc
File runtime/vm/pages.cc (right):

https://codereview.chromium.org/1635343002/diff/20001/runtime/vm/pages.cc#new...
runtime/vm/pages.cc:54: bool create_executable = !FLAG_write_protect_code;
Shouldn't this be

bool create_executable = !FLAG_write_protect_code && is_executable;

otherwise you end up creating executable pages even not asked for when the flag
is not set.

[Todd Eisenberger, 2016-01-28 00:21:05]

https://codereview.chromium.org/1635343002/diff/20001/runtime/vm/pages.cc
File runtime/vm/pages.cc (right):

https://codereview.chromium.org/1635343002/diff/20001/runtime/vm/pages.cc#new...
runtime/vm/pages.cc:54: bool create_executable = !FLAG_write_protect_code;
On 2016/01/28 00:10:16, siva wrote:
> Shouldn't this be
> 
> bool create_executable = !FLAG_write_protect_code && is_executable;
> 
> otherwise you end up creating executable pages even not asked for when the
flag
> is not set.

Good catch; got caught up with finding the RWX leak that I forgot about the non
protected case.

[siva, 2016-01-29 00:22:29]

lgtm

[Todd Eisenberger, 2016-01-29 19:21:16]

Description was changed from

==========
Stop initializing code pages with RWX permissions

We shouldn't need to execute the code pages until after we're done
writing to them, so we can drop the initial execute bit.  Without
this, part of a mapping can sit in a freelist with RWX permissions
indefinitely, which makes for an easier target under certain
exploits.

BUG=
==========

to

==========
Stop initializing code pages with RWX permissions

We shouldn't need to execute the code pages until after we're done
writing to them, so we can drop the initial execute bit.  Without
this, part of a mapping can sit in a freelist with RWX permissions
indefinitely, which makes for an easier target under certain
exploits.

BUG=
R=asiva@google.com

Committed:
https://github.com/dart-lang/sdk/commit/ca85ec7955095f3565b1b18bd43775191ac6ee4b
==========

[Todd Eisenberger, 2016-01-29 19:21:17]

Committed patchset #3 (id:40001) manually as
ca85ec7955095f3565b1b18bd43775191ac6ee4b (presubmit successful).