Cygwin: decouple shared mem regions from Cygwin DLL

Another reason ASLR may fail is the coupling of the standard shared
mem regions (global, userinfo, process info, shared console) to the
address of the Cygwin DLL.  They are always placed in fixed addresses
preceeding the Cygwin DLL's address.  With ASLR this is bound to fail.

Use a fixed, unused memory area to place the shared mem regions.
This also allows to simplify the shared memory creation.  There's
no reason anymore to rebase the regions and rather than offsets,
just use the addresses directly.

Signed-off-by: Corinna Vinschen <corinna@vinschen.de>

2 files changed, 18 insertions, 47 deletions

diff --git a/winsup/cygwin/local_includes/memory_layout.h b/winsup/cygwin/local_includes/memory_layout.h
index 639ff2546..22e68b93e 100644
--- a/winsup/cygwin/local_includes/memory_layout.h
+++ b/winsup/cygwin/local_includes/memory_layout.h
@@ -32,6 +32,16 @@ details. */
    dynamicbase is accidentally not set in the PE/COFF header of the DLL. */
 #define CYGWIN_DLL_ADDRESS		0x180040000UL
 
+/* New with ASLR: We need a fixed place for the global shared memory areas.
+   Prior to ASLR, the addresses were relative to the address the Cygwin DLL
+   was loaded to. */
+#define SHARED_REGIONS_ADDRESS_LOW	0x1f0000000UL
+#define CYGWIN_REGION_ADDRESS		0x1f0000000UL
+#define USER_REGION_ADDRESS		0x1f2000000UL
+#define PINFO_REGION_ADDRESS		0x1f4000000UL
+#define SHARED_CONSOLE_REGION_ADDRESS	0x1f6000000UL
+#define SHARED_REGIONS_ADDRESS_HIGH	0x200000000UL
+
 /* Rebased DLLs are located in this 16 Gigs arena.  Will be kept for
    backward compatibility. */
 #define REBASED_DLL_STORAGE_LOW		0x200000000UL
diff --git a/winsup/cygwin/mm/shared.cc b/winsup/cygwin/mm/shared.cc
index c549f5e26..893b20d28 100644
--- a/winsup/cygwin/mm/shared.cc
+++ b/winsup/cygwin/mm/shared.cc
@@ -19,6 +19,7 @@ details. */
 #include "shared_info_magic.h"
 #include "registry.h"
 #include "cygwin_version.h"
+#include "memory_layout.h"
 #include "spinlock.h"
 #include <alloca.h>
 #include <wchar.h>
@@ -112,29 +113,16 @@ shared_name (WCHAR *ret_buf, const WCHAR *str, int num)
 #define page_const ((ptrdiff_t) 65535)
 #define pround(n) ((ptrdiff_t)(((n) + page_const) & ~page_const))
 
-/* The order in offsets is so that the constant blocks shared_info
-   and user_info are right below the cygwin DLL, then the pinfo block
-   which changes with each process.  Below that is the console_state,
-   an optional block which only exists when running in a Windows console
-   window.  Therefore, if we are not running in a console, we have 64K
-   more of contiguous memory below the Cygwin DLL. */
-static ptrdiff_t offsets[] =
+/* FIXME: With ASLR, maybe we should ASLR the shared regions, too? */
+static uintptr_t region_address[] =
 {
-  - pround (sizeof (shared_info)),		/* SH_CYGWIN_SHARED */
-  - pround (sizeof (shared_info))		/* SH_USER_SHARED */
-  - pround (sizeof (user_info)),
-  - pround (sizeof (shared_info))		/* SH_MYSELF */
-  - pround (sizeof (user_info))
-  - pround (sizeof (_pinfo)),
-  - pround (sizeof (shared_info))		/* SH_SHARED_CONSOLE */
-  - pround (sizeof (user_info))
-  - pround (sizeof (_pinfo))
-  - pround (sizeof (fhandler_console::console_state)),
+  CYGWIN_REGION_ADDRESS,		/* SH_CYGWIN_SHARED */
+  USER_REGION_ADDRESS,			/* SH_USER_SHARED */
+  PINFO_REGION_ADDRESS,			/* SH_MYSELF */
+  SHARED_CONSOLE_REGION_ADDRESS,	/* SH_SHARED_CONSOLE */
   0
 };
 
-#define off_addr(x)	((void *)((caddr_t) cygwin_hmodule + offsets[x]))
-
 void *
 open_shared (const WCHAR *name, int n, HANDLE& shared_h, DWORD size,
 	     shared_locations m, PSECURITY_ATTRIBUTES psa, DWORD access)
@@ -152,10 +140,7 @@ open_shared (const WCHAR *name, int n, HANDLE& shared_h, DWORD size,
   if (*m == SH_JUSTCREATE || *m == SH_JUSTOPEN)
     addr = NULL;
   else
-    {
-      addr = off_addr (*m);
-      VirtualFree (addr, 0, MEM_RELEASE);
-    }
+    addr = (void *) region_address[*m];
 
   WCHAR map_buf[MAX_PATH];
   WCHAR *mapname = NULL;
@@ -185,33 +170,9 @@ open_shared (const WCHAR *name, int n, HANDLE& shared_h, DWORD size,
 
   shared = (shared_info *) MapViewOfFileEx (shared_h, access, 0, 0, 0, addr);
 
-  if (!shared && addr)
-    {
-      shared = (shared_info *) MapViewOfFileEx (shared_h,
-				       FILE_MAP_READ|FILE_MAP_WRITE,
-				       0, 0, 0, NULL);
-#ifdef DEBUGGING
-      system_printf ("relocating shared object %W(%d) from %p to %p", name, n, addr, shared);
-#endif
-      offsets[0] = 0;
-    }
-
   if (!shared)
     api_fatal ("MapViewOfFileEx '%W'(%p), %E.  Terminating.", mapname, shared_h);
 
-  if (*m == SH_CYGWIN_SHARED && offsets[0])
-    {
-      /* Reserve subsequent shared memory areas in non-relocated case only.
-	 There's no good reason to reserve the console shmem, because it's
-	 not yet known if we will allocate it at all. */
-      for (int i = SH_USER_SHARED; i < SH_SHARED_CONSOLE; i++)
-	{
-	  DWORD size = offsets[i - 1] - offsets[i];
-	  if (!VirtualAlloc (off_addr (i), size, MEM_RESERVE, PAGE_NOACCESS))
-	    continue;  /* oh well */
-	}
-    }
-
   debug_printf ("name %W, n %d, shared %p (wanted %p), h %p, *m %d",
 		mapname, n, shared, addr, shared_h, *m);