如果ASLR被禁用，mmap是确定性的吗？ [英] Is mmap deterministic if ASLR is disabled?

问题描述

如果地址空间布局随机化（ASLR）被禁用，我们是否有确定性的 mmap ？通过确定性，我的意思是说，如果我使用相同的输入一次又一次运行相同的应用程序，我是否会获得由 mmap 返回的相同地址？我最感兴趣的是匿名mmap。

，我们会有一个确定性的mmap吗？如果您的应用程序在第i个mmap时刻的内存布局完全相同（就虚拟地址空间的哪些页面而言映射和哪些不是）;那么mmap应该在Linux内核中是确定性的。

有些奇怪的情况可能会改变内存布局。例如，附加的命令行参数可以将堆栈转换为较低的地址。有很多文件在m运行时（例如语言环境）中进行缩放，并且如果某些文件的大小已从上一次开始更改，那么内存布局也会发生更改。即使堆栈消耗可能会影响它。

如果通过malloc您的应用程序内存分配（大小和分配顺序）发生更改，mmap将不确定。所以，如果你的应用程序是线程的;它应该修复malloc调用的顺序或限制所有malloc到主线程。

mm / mmap.c：arch_get_unmapped_area - 默认非固定mmap地址解析器是确定性IIF VMA树是一样的，并且以前的mmap的历史是相同的（在调用mmap之间有一个缓存 mm-> free_area_cache

If Address Space Layout Randomization (ASLR) is disabled, would we have a deterministic mmap? By deterministic, I mean that If I run the same application again and again with the same inputs, will I get the same addresses returned by mmap? I am mostly interested in anonymous mmaps.

解决方案

If Address Space Layout Randomization (ASLR) is disabled, would we have a deterministic mmap?

If your application has exactly the same memory layout at moment of i-th mmap (in terms of which pages of virtual address space are mapped and which are not); then mmap should be deterministic in Linux kernel.

There are some strange situations possible, which can change memory layout. For example, additional command line arguments can shift stack to lower address. There are a lot of files, mmaped in c runtime (e.g. locales) and if some files have their size changed from previous start, the memory layout will be changed too. Even stack consumption may affect it.

If your application memory allocation (both sizes and order of allocations) via malloc changed, mmap will be not deterministic. So, if your application is threaded; it should fix order of malloc calls or limit all mallocs to main thread.

mm/mmap.c: arch_get_unmapped_area - default non-fixed mmap address resolver is deterministic IIF the VMA tree is the same AND history of previous mmap is same (there is a cache mm->free_area_cache which is live between calls to mmap.

这篇关于如果ASLR被禁用，mmap是确定性的吗？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！