All of lore.kernel.org
 help / color / mirror / Atom feed
From: riel@redhat.com
To: linux-kernel@vger.kernel.org
Cc: kernel-hardening@lists.openwall.com, akpm@linux-foundation.org,
	mingo@kernel.org, oleg@redhat.com, lwoodman@redhat.com,
	mhocko@suse.de, danielmicay@gmail.com, will.deacon@arm.com,
	benh@kernel.crashing.org
Subject: [PATCH 2/6] x86/elf: move 32 bit ELF_ET_DYN_BASE to 256MB
Date: Fri,  2 Jun 2017 11:20:06 -0400	[thread overview]
Message-ID: <20170602152010.2064-3-riel@redhat.com> (raw)
In-Reply-To: <20170602152010.2064-1-riel@redhat.com>

From: Rik van Riel <riel@redhat.com>

When setting up mmap_base, we take care to start the mmap base
below the maximum extent to which the stack will grow. However,
we take no such precautions with PIE binaries, which are placed
at 5/6 of TASK_SIZE plus a random offset. As a result, 32 bit PIE
binaries can end up smack in the middle of where the stack (which
is randomized down) is supposed to go.

That problem can be avoided by putting the 32 bit ELF_ET_DYN_BASE
at 256MB, which is a value linux-hardened and grsecurity have used
for a long time now without any known (to me) bug reports.

Signed-off-by: Rik van Riel <riel@redhat.com>
---
 arch/x86/include/asm/elf.h | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index e8ab9a46bc68..dafa098cc05a 100644
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -245,12 +245,23 @@ extern int force_personality32;
 #define CORE_DUMP_USE_REGSET
 #define ELF_EXEC_PAGESIZE	4096
 
+/*
+ * True on X86_32 or when emulating IA32 on X86_64
+ */
+static inline int mmap_is_ia32(void)
+{
+	return IS_ENABLED(CONFIG_X86_32) ||
+	       (IS_ENABLED(CONFIG_COMPAT) &&
+		test_thread_flag(TIF_ADDR32));
+}
+
 /* This is the location that an ET_DYN program is loaded if exec'ed.  Typical
    use of this is to invoke "./ld.so someprog" to test out a new version of
    the loader.  We need to make sure that it is out of the way of the program
    that it will "exec", and that there is sufficient room for the brk.  */
 
-#define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
+#define ELF_ET_DYN_BASE		(mmap_is_ia32() ? 0x10000000UL : \
+				(TASK_SIZE / 3 * 2))
 
 /* This yields a mask that user programs can use to figure out what
    instruction set this CPU supports.  This could be done in user space,
@@ -293,16 +304,6 @@ do {									\
 	}								\
 } while (0)
 
-/*
- * True on X86_32 or when emulating IA32 on X86_64
- */
-static inline int mmap_is_ia32(void)
-{
-	return IS_ENABLED(CONFIG_X86_32) ||
-	       (IS_ENABLED(CONFIG_COMPAT) &&
-		test_thread_flag(TIF_ADDR32));
-}
-
 extern unsigned long tasksize_32bit(void);
 extern unsigned long tasksize_64bit(void);
 extern unsigned long get_mmap_base(int is_legacy);
-- 
2.9.3

WARNING: multiple messages have this Message-ID (diff)
From: riel@redhat.com
To: linux-kernel@vger.kernel.org
Cc: kernel-hardening@lists.openwall.com, akpm@linux-foundation.org,
	mingo@kernel.org, oleg@redhat.com, lwoodman@redhat.com,
	mhocko@suse.de, danielmicay@gmail.com, will.deacon@arm.com,
	benh@kernel.crashing.org
Subject: [kernel-hardening] [PATCH 2/6] x86/elf: move 32 bit ELF_ET_DYN_BASE to 256MB
Date: Fri,  2 Jun 2017 11:20:06 -0400	[thread overview]
Message-ID: <20170602152010.2064-3-riel@redhat.com> (raw)
In-Reply-To: <20170602152010.2064-1-riel@redhat.com>

From: Rik van Riel <riel@redhat.com>

When setting up mmap_base, we take care to start the mmap base
below the maximum extent to which the stack will grow. However,
we take no such precautions with PIE binaries, which are placed
at 5/6 of TASK_SIZE plus a random offset. As a result, 32 bit PIE
binaries can end up smack in the middle of where the stack (which
is randomized down) is supposed to go.

That problem can be avoided by putting the 32 bit ELF_ET_DYN_BASE
at 256MB, which is a value linux-hardened and grsecurity have used
for a long time now without any known (to me) bug reports.

Signed-off-by: Rik van Riel <riel@redhat.com>
---
 arch/x86/include/asm/elf.h | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index e8ab9a46bc68..dafa098cc05a 100644
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -245,12 +245,23 @@ extern int force_personality32;
 #define CORE_DUMP_USE_REGSET
 #define ELF_EXEC_PAGESIZE	4096
 
+/*
+ * True on X86_32 or when emulating IA32 on X86_64
+ */
+static inline int mmap_is_ia32(void)
+{
+	return IS_ENABLED(CONFIG_X86_32) ||
+	       (IS_ENABLED(CONFIG_COMPAT) &&
+		test_thread_flag(TIF_ADDR32));
+}
+
 /* This is the location that an ET_DYN program is loaded if exec'ed.  Typical
    use of this is to invoke "./ld.so someprog" to test out a new version of
    the loader.  We need to make sure that it is out of the way of the program
    that it will "exec", and that there is sufficient room for the brk.  */
 
-#define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
+#define ELF_ET_DYN_BASE		(mmap_is_ia32() ? 0x10000000UL : \
+				(TASK_SIZE / 3 * 2))
 
 /* This yields a mask that user programs can use to figure out what
    instruction set this CPU supports.  This could be done in user space,
@@ -293,16 +304,6 @@ do {									\
 	}								\
 } while (0)
 
-/*
- * True on X86_32 or when emulating IA32 on X86_64
- */
-static inline int mmap_is_ia32(void)
-{
-	return IS_ENABLED(CONFIG_X86_32) ||
-	       (IS_ENABLED(CONFIG_COMPAT) &&
-		test_thread_flag(TIF_ADDR32));
-}
-
 extern unsigned long tasksize_32bit(void);
 extern unsigned long tasksize_64bit(void);
 extern unsigned long get_mmap_base(int is_legacy);
-- 
2.9.3

  parent reply	other threads:[~2017-06-02 15:20 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-06-02 15:20 [PATCH 0/6] move mmap_area and PIE binaries away from the stack riel
2017-06-02 15:20 ` [kernel-hardening] " riel
2017-06-02 15:20 ` [PATCH 1/6] binfmt_elf: document load_bias a little bit riel
2017-06-02 15:20   ` [kernel-hardening] " riel
2017-06-02 19:27   ` Kees Cook
2017-06-02 19:27     ` Kees Cook
2017-06-02 15:20 ` riel [this message]
2017-06-02 15:20   ` [kernel-hardening] [PATCH 2/6] x86/elf: move 32 bit ELF_ET_DYN_BASE to 256MB riel
2017-06-03  4:22   ` Kees Cook
2017-06-03  4:22     ` [kernel-hardening] " Kees Cook
2017-06-03 11:57     ` Daniel Micay
2017-06-03 11:57       ` [kernel-hardening] " Daniel Micay
2017-06-05 13:54     ` Rik van Riel
2017-06-05 13:54       ` [kernel-hardening] " Rik van Riel
2017-06-02 15:20 ` [PATCH 3/6] x86/mmap: properly account for stack randomization in mmap_base riel
2017-06-02 15:20   ` [kernel-hardening] " riel
2017-06-03  4:46   ` Kees Cook
2017-06-03  4:46     ` Kees Cook
2017-06-03 12:16     ` Daniel Micay
2017-06-03 12:16       ` Daniel Micay
2017-06-02 15:20 ` [PATCH 4/6] arm64/mmap: " riel
2017-06-02 15:20   ` [kernel-hardening] " riel
2017-06-02 15:20 ` [PATCH 5/6] arm64: move COMPAT_ELF_ET_DYN_BASE lower in the address space riel
2017-06-02 15:20   ` [kernel-hardening] " riel
2017-06-02 15:20 ` [PATCH 6/6] powerpc,mmap: properly account for stack randomization in mmap_base riel
2017-06-02 15:20   ` [kernel-hardening] " riel
2017-06-03  4:37 ` [kernel-hardening] [PATCH 0/6] move mmap_area and PIE binaries away from the stack Kees Cook
2017-06-03  4:37   ` Kees Cook
2017-06-03 12:14   ` Daniel Micay
2017-06-03 12:14     ` Daniel Micay

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170602152010.2064-3-riel@redhat.com \
    --to=riel@redhat.com \
    --cc=akpm@linux-foundation.org \
    --cc=benh@kernel.crashing.org \
    --cc=danielmicay@gmail.com \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=lwoodman@redhat.com \
    --cc=mhocko@suse.de \
    --cc=mingo@kernel.org \
    --cc=oleg@redhat.com \
    --cc=will.deacon@arm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.