php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.2' into PHP-8.3

Browse Source 
* PHP-8.2:
  Fix SELinux mprotect execheap error due to mem adjacent to heap
This commit is contained in:
Ilija Tovilo
2023-12-13 11:26:23 +01:00
parent cd179171cc 7cf1a2ad9d
commit 719236e3ec
2 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@@ -21,6 +21,8 @@ PHP NEWS
- Opcache:
. Fixed oss-fuzz #64727 (JIT undefined array key warning may overwrite DIM
with NULL when DIM is the same var as result). (ilutov)
. Added workaround for SELinux mprotect execheap issue.
See https://bugzilla.kernel.org/show_bug.cgi?id=218258. (ilutov)
07 Dec 2023, PHP 8.3.1RC1

16
ext/opcache/shared_alloc_mmap.c
View File

@@ -65,6 +65,18 @@ static void *find_prefered_mmap_base(size_t requested_size)
}
while (fgets(buffer, MAXPATHLEN, f) && sscanf(buffer, "%lx-%lx", &start, &end) == 2) {
/* Don't place the segment directly before or after the heap segment. Due to an selinux bug,
* a segment directly preceding or following the heap is interpreted as heap memory, which
* will result in an execheap violation for the JIT.
* See https://bugzilla.kernel.org/show_bug.cgi?id=218258. */
bool heap_segment = strstr(buffer, "[heap]") != NULL;
if (heap_segment) {
uintptr_t start_base = start & ~(huge_page_size - 1);
if (last_free_addr + requested_size >= start_base) {
last_free_addr = ZEND_MM_ALIGNED_SIZE_EX(end + huge_page_size, huge_page_size);
continue;
}
}
if ((uintptr_t)execute_ex >= start) {
/* the current segment lays before PHP .text segment or PHP .text segment itself */
/*Search for candidates at the end of the free segment near the .text segment
@@ -98,7 +110,9 @@ static void *find_prefered_mmap_base(size_t requested_size)
}
}
last_free_addr = ZEND_MM_ALIGNED_SIZE_EX(end, huge_page_size);
if (heap_segment) {
last_free_addr += huge_page_size;
}
}
fclose(f);
#elif defined(__FreeBSD__)