[PATCH 0/2] MIPS memory space randomization

[PATCH 0/2] MIPS memory space randomization

[David Daney]

x86, PPC and SPARC will randomize the application heap and library
load addresses depending on the value of randomize_va_space.  This
patch set implements address space randomization for MIPS.

Tested with a 64-bit kernel (OCTEON) and verified, for all three ABIs,
that the result of 'cat /proc/self/maps' gives different values for
[heap] and shared libraries with each invocation.  The stack was
already randomized and also gets a different value for each
invocation.

Someone may want to test it on a 32-bit kernel, but it should work
there as well.

I will reply with the two patches.


David Daney (2):
  MIPS: Randomize mmap if randomize_va_space is set
  MIPS: Enable heap randomization.

 arch/mips/include/asm/elf.h       |    5 ++++
 arch/mips/include/asm/processor.h |   11 ++++++++
 arch/mips/kernel/syscall.c        |   49 ++++++++++++++++++++++++++++++++++++-
 3 files changed, 64 insertions(+), 1 deletions(-)

[PATCH 1/2] MIPS: Randomize mmap if randomize_va_space is set

[David Daney]

Fairly straight forward: For 32-bit address spaces randomize within a
16MB space, for 64-bit within a 256MB space.

Signed-off-by: David Daney <ddaney@caviumnetworks.com>
---
 arch/mips/include/asm/processor.h |   11 +++++++++++
 arch/mips/kernel/syscall.c        |   21 ++++++++++++++++++++-
 2 files changed, 31 insertions(+), 1 deletions(-)

diff --git a/arch/mips/include/asm/processor.h b/arch/mips/include/asm/processor.h
index 5d33b72..24d91f8 100644
--- a/arch/mips/include/asm/processor.h
+++ b/arch/mips/include/asm/processor.h
@@ -34,6 +34,11 @@ extern void (*cpu_wait)(void);
 extern unsigned int vced_count, vcei_count;
 
 /*
+ * MIPS does have an arch_pick_mmap_layout()
+ */
+#define HAVE_ARCH_PICK_MMAP_LAYOUT 1
+
+/*
  * A special page (the vdso) is mapped into all processes at the very
  * top of the virtual memory space.
  */
@@ -52,6 +57,9 @@ extern unsigned int vced_count, vcei_count;
  * space during mmap's.
  */
 #define TASK_UNMAPPED_BASE	((TASK_SIZE / 3) & ~(PAGE_SIZE))
+
+#define TASK_IS_32BIT_ADDR 1
+
 #endif
 
 #ifdef CONFIG_64BIT
@@ -77,6 +85,9 @@ extern unsigned int vced_count, vcei_count;
 		PAGE_ALIGN(TASK_SIZE32 / 3) : PAGE_ALIGN(TASK_SIZE / 3))
 #define TASK_SIZE_OF(tsk)						\
 	(test_tsk_thread_flag(tsk, TIF_32BIT_ADDR) ? TASK_SIZE32 : TASK_SIZE)
+
+#define TASK_IS_32BIT_ADDR test_thread_flag(TIF_32BIT_ADDR)
+
 #endif
 
 #ifdef __KERNEL__
diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
index dd81b0f..9824a82 100644
--- a/arch/mips/kernel/syscall.c
+++ b/arch/mips/kernel/syscall.c
@@ -29,6 +29,7 @@
 #include <linux/ipc.h>
 #include <linux/uaccess.h>
 #include <linux/slab.h>
+#include <linux/random.h>
 
 #include <asm/asm.h>
 #include <asm/branch.h>
@@ -116,7 +117,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
 		    (!vmm || addr + len <= vmm->vm_start))
 			return addr;
 	}
-	addr = TASK_UNMAPPED_BASE;
+	addr = current->mm->mmap_base;
 	if (do_color_align)
 		addr = COLOUR_ALIGN(addr, pgoff);
 	else
@@ -134,6 +135,24 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
 	}
 }
 
+void arch_pick_mmap_layout(struct mm_struct *mm)
+{
+	unsigned long random_factor = 0UL;
+
+	if (current->flags & PF_RANDOMIZE) {
+		random_factor = get_random_int();
+		random_factor = random_factor << PAGE_SHIFT;
+		if (TASK_IS_32BIT_ADDR)
+			random_factor &= 0xfffffful;
+		else
+			random_factor &= 0xffffffful;
+	}
+
+	mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
+	mm->get_unmapped_area = arch_get_unmapped_area;
+	mm->unmap_area = arch_unmap_area;
+}
+
 SYSCALL_DEFINE6(mips_mmap, unsigned long, addr, unsigned long, len,
 	unsigned long, prot, unsigned long, flags, unsigned long,
 	fd, off_t, offset)
-- 
1.7.1.1

[PATCH 2/2] MIPS: Enable heap randomization.

[David Daney]

Based somewhat on the PPC implementation.

32-bit processes have the heap randomized in an 8MB space, 256MB for
64-bit processes.

Signed-off-by: David Daney <ddaney@caviumnetworks.com>
---
 arch/mips/include/asm/elf.h |    5 +++++
 arch/mips/kernel/syscall.c  |   28 ++++++++++++++++++++++++++++
 2 files changed, 33 insertions(+), 0 deletions(-)

diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
index ea77a42..fd1d39e 100644
--- a/arch/mips/include/asm/elf.h
+++ b/arch/mips/include/asm/elf.h
@@ -372,4 +372,9 @@ extern const char *__elf_platform;
 struct linux_binprm;
 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
 				       int uses_interp);
+
+struct mm_struct;
+extern unsigned long arch_randomize_brk(struct mm_struct *mm);
+#define arch_randomize_brk arch_randomize_brk
+
 #endif /* _ASM_ELF_H */
diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
index 9824a82..58bab2e 100644
--- a/arch/mips/kernel/syscall.c
+++ b/arch/mips/kernel/syscall.c
@@ -30,6 +30,7 @@
 #include <linux/uaccess.h>
 #include <linux/slab.h>
 #include <linux/random.h>
+#include <linux/elf.h>
 
 #include <asm/asm.h>
 #include <asm/branch.h>
@@ -153,6 +154,33 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
 	mm->unmap_area = arch_unmap_area;
 }
 
+static inline unsigned long brk_rnd(void)
+{
+	unsigned long rnd = get_random_int();
+
+	rnd = rnd << PAGE_SHIFT;
+	/* 8MB for 32bit, 256MB for 64bit */
+	if (TASK_IS_32BIT_ADDR)
+		rnd = rnd & 0x7ffffful;
+	else
+		rnd = rnd & 0xffffffful;
+
+	return rnd;
+}
+
+unsigned long arch_randomize_brk(struct mm_struct *mm)
+{
+	unsigned long base = mm->brk;
+	unsigned long ret;
+
+	ret = PAGE_ALIGN(base + brk_rnd());
+
+	if (ret < mm->brk)
+		return mm->brk;
+
+	return ret;
+}
+
 SYSCALL_DEFINE6(mips_mmap, unsigned long, addr, unsigned long, len,
 	unsigned long, prot, unsigned long, flags, unsigned long,
 	fd, off_t, offset)
-- 
1.7.1.1

Re: [PATCH 1/2] MIPS: Randomize mmap if randomize_va_space is set

[Ralf Baechle]

On Mon, Jul 19, 2010 at 01:14:56PM -0700, David Daney wrote:

> Fairly straight forward: For 32-bit address spaces randomize within a
> 16MB space, for 64-bit within a 256MB space.

Thanks, queued for 2.6.26.

  Ralf

Re: [PATCH 2/2] MIPS: Enable heap randomization.

[Ralf Baechle]

Thanks, queued for 2.6.26.

  Ralf