[BUG] Initial stack materialization accepts addresses outside the ordinary user domain #31
Labels
No labels
bug
ci
docs
duplicate
enhancement
help wanted
invalid
performance
phase-6
question
refactor
security
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
erix/kernel#31
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
First-start stack preparation could allocate anonymous backing outside the ordinary userspace address domain. A separate direct bootstrap write path also relied on a numeric high-address threshold without resolving writable registered backing. The correction constrains ordinary materialization and retains explicit registered backing under the owning VSpace lock for direct bootstrap writes. The observed original failure is host-side anonymous materialization; no original CPL3 exploit or high-address dereference is claimed.
Reproduction
At signed Kernel
df769a763ccc2c0d758f756ce85a8a06b42a6d93, production sources remain unchanged while a test-only module and declaration add four controls. Noncanonical, Kernel-half and recursive-window stack tops each return successful preparation and readable newly tracked return-slot backing, contrary to the expected refusal. All three negative controls fail; the valid ordinary-stack control passes. Cargo exits 101 with warning-free compilation and successful cleanup. Original sources, hashes, test additions and process output are retained. The exact same four controls pass against the signed correction.Expected and actual behavior
A numeric stack address must not authorize allocation or writable access outside the existing ordinary mapping domain. Lower canonical stacks use tracked backing; direct bootstrap writes require explicit writable registered ranges spanning the complete admission interval under the live VSpace lock. Partial stack preparation retains every allocated page in its existing mapping inventory, without publishing a resume pointer or consuming startup arguments.
Initial register frames now use separately owned Kernel arrays. Directory capacity and the initialized array are prepared before user-stack effects. Successful publication precedes argument consumption; failure releases the unpublished frame. User stacks receive only their synthetic return slot after complete red-zone/return-span admission. The obsolete saved-frame user overlay and directory scan are removed. This does not establish complete external start-context admission or remove the separate bootstrap code/stack overlay.
Environment and identity
Host controls use Linux x86_64, Rust 1.97.1, warning-denied builds and original pinned dependencies. The host page-entry capture returns its existing scalar zero entry; these controls observe actual shadow backing without activating or dereferencing the selected high virtual address. The coordinated catalog selects the exact signed Kernel for maintained native scenarios under their original grants and 60/120-second deadlines.
Evidence and prior checks
Eleven new host controls cover register ownership, user-stack mutation, generation refusal, allocation failures, stack rollback, all three scheduler selection paths, distinct VSpaces at the same VA and exact terminal cleanup including a failed release. Four strict Kernel configurations pass 807/831 tests with three existing ignored cases. Sixteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. All 172 maintained Integration helpers pass.
Six native executions satisfy seven contracts: lifetime, invocation, mapping and sparse checks sharing the same runtime configuration, both allocator scenarios and ordinary exec-successor across all 73 components. In the new lifetime check, two actual user programs overwrite their red zones before syscall capture; the observer checks the changed bytes and all original initial register words in their separately owned Kernel arrays. Prior markers, grants and deadlines remain. Exact source signatures and retained packaged artifacts are verified, with no image warnings or QEMU stderr. Native ownership observation is distinct from the original host stack-domain reproduction.
The technical manual passes 45 tests, complete 2,433-page generation, all 451,642 word bounds and four changed-page visual reviews without final warnings or overflow. An obsolete paragraph found during the first visual review was corrected before accepting the rebuilt manual.
Publication CI: Kernel 656/657 and Docs 1021/1022 pass. Eight complete original logs (1,600,791 bytes) confirm Kernel 807/831 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration 1737/1738 remains queued and has no completed acceptance. Complete corrected CI review remains required before closing this report; every original failure remains retained.
Tracking
Related owned address-space design, Kernel compatibility, Kernel audit, Kernel review, Integration review and Phase 6 completion. Private VSpace population, CR3 activation, CPU residency, live-root reclamation and complete guest rebuilding remain open. Earlier ext4 CI deadline failures remain unresolved.