From mboxrd@z Thu Jan  1 00:00:00 1970
From: jan.kiszka@siemens.com (Jan Kiszka)
Date: Mon, 19 Dec 2016 11:52:26 +0100
Subject: [cip-dev] [PATCH 4.4-cip 0/6] Extend user-space ASLR range
In-Reply-To: <7c58c7d6-92fa-4b99-aa15-25c41243810c@siemens.com>
References: <1481241380.1860.120.camel@codethink.co.uk>
	<7c58c7d6-92fa-4b99-aa15-25c41243810c@siemens.com>
Message-ID: <155216cf-3c1a-7f41-3ff2-956f92e3c7cb@siemens.com>
To: cip-dev@lists.cip-project.org
List-Id: cip-dev.lists.cip-project.org

On 2016-12-09 13:20, Jan Kiszka wrote:
> On 2016-12-09 00:56, Ben Hutchings wrote:
>> This is a backport of changes in 4.5 to extend the range of Address
>> Space Layout Randomisation for user-space processes.  When enabled, this
>> should make some user-space vulnerabilities harder to exploit, but it
>> can also cause some applications to fail if they currently use a large
>> proportion of the virtual address space.
>>
>> The default ASLR range remains the same, but it can be changed through
>> kernel config (CONFIG_ARCH_MMAP_RND_BITS) or at run-time through sysctl
>> (vm.mmap_rnd_bits).  (For 32-bit compat tasks, the range is controlled
>> through CONFIG_ARCH_MMAP_RND_COMPAT_BITS and vm.mmap_rnd_compat_bits.)
>>
>> This includes support for arm, arm64 and x86 (32- and 64-bit).  (arm64
>> is not currently supported by CIP, but it was easier to include it in
>> the backport than to leave it out.)
>>
>> For this and other backports, I'm looking for feedback like:
>> - Did I miss a follow-up fix or an earlier dependency?
>> - Does this cause a regression (other than as explained above)?
>> - Are you likely to use it?
>> - Are there related features you want in 4.4?
>>
>> Ben.
>>
>> Daniel Cashman (6):
>>   mm: mmap: add new /proc tunable for mmap_base ASLR
>>   arm: mm: support ARCH_MMAP_RND_BITS
>>   arm64: mm: support ARCH_MMAP_RND_BITS
>>   x86: mm: support ARCH_MMAP_RND_BITS
>>   drivers: char: random: add get_random_long()
>>   mm: ASLR: use get_random_long()
>>
>>  Documentation/sysctl/vm.txt      | 29 +++++++++++++++++
>>  arch/Kconfig                     | 68 ++++++++++++++++++++++++++++++++++++++++
>>  arch/arm/Kconfig                 |  9 ++++++
>>  arch/arm/mm/mmap.c               |  3 +-
>>  arch/arm64/Kconfig               | 29 +++++++++++++++++
>>  arch/arm64/mm/mmap.c             |  8 +++--
>>  arch/mips/mm/mmap.c              |  4 +--
>>  arch/powerpc/kernel/process.c    |  4 +--
>>  arch/powerpc/mm/mmap.c           |  4 +--
>>  arch/sparc/kernel/sys_sparc_64.c |  2 +-
>>  arch/x86/Kconfig                 | 16 ++++++++++
>>  arch/x86/mm/mmap.c               | 12 +++----
>>  drivers/char/random.c            | 22 +++++++++++++
>>  fs/binfmt_elf.c                  |  2 +-
>>  include/linux/mm.h               | 11 +++++++
>>  include/linux/random.h           |  1 +
>>  kernel/sysctl.c                  | 22 +++++++++++++
>>  mm/mmap.c                        | 12 +++++++
>>  18 files changed, 240 insertions(+), 18 deletions(-)
>>
> 
> Did you try to discuss the back-port topic with the KSPP folks or other
> key persons involved in these patches? In the ideal case, the authors
> can be CC'ed, do not get annoyed by "these crazy people doing legacy
> stuff", and may even do some reviews.
> 

I've chatted with Elena over this last week, and she talked to Kees who
pointed out that the Android people are also doing KSPP backports to 4.4
(thanks, folks!). I didn't check any details, just a heads-up to avoid
duplicate work.

Jan

-- 
Siemens AG, Corporate Technology, CT RDA ITP SES-DE
Corporate Competence Center Embedded Linux