From: riel@redhat.com To: linux-kernel@vger.kernel.org Cc: kernel-hardening@lists.openwall.com, akpm@linux-foundation.org, mingo@kernel.org, oleg@redhat.com, lwoodman@redhat.com, mhocko@suse.de, danielmicay@gmail.com, will.deacon@arm.com, benh@kernel.crashing.org Subject: [PATCH 4/6] arm64/mmap: properly account for stack randomization in mmap_base Date: Fri, 2 Jun 2017 11:20:08 -0400 [thread overview] Message-ID: <20170602152010.2064-5-riel@redhat.com> (raw) In-Reply-To: <20170602152010.2064-1-riel@redhat.com> From: Rik van Riel <riel@redhat.com> When RLIMIT_STACK is, for example, 256MB, the current code results in a gap between the top of the task and mmap_base of 256MB, failing to take into account the amount by which the stack address was randomized. In other words, the stack gets less than RLIMIT_STACK space. Ensure that the gap between the stack and mmap_base always takes stack randomization into account. >From Daniel Micay's linux-hardened tree. Reported-by: Florian Weimer <fweimer@redhat.com> Signed-off-by: Daniel Micay <danielmicay@gmail.com> Signed-off-by: Rik van Riel <riel@redhat.com> --- arch/arm64/mm/mmap.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c index 7b0d55756eb1..3f15eb193e33 100644 --- a/arch/arm64/mm/mmap.c +++ b/arch/arm64/mm/mmap.c @@ -34,7 +34,7 @@ * Leave enough space between the mmap area and the stack to honour ulimit in * the face of randomisation. */ -#define MIN_GAP (SZ_128M + ((STACK_RND_MASK << PAGE_SHIFT) + 1)) +#define MIN_GAP (SZ_128M) #define MAX_GAP (STACK_TOP/6*5) static int mmap_is_legacy(void) @@ -64,6 +64,11 @@ unsigned long arch_mmap_rnd(void) static unsigned long mmap_base(unsigned long rnd) { unsigned long gap = rlimit(RLIMIT_STACK); + unsigned long pad = STACK_RND_MASK << PAGE_SHIFT; + + /* Values close to RLIM_INFINITY can overflow. */ + if (gap + pad > gap) + gap += pad; if (gap < MIN_GAP) gap = MIN_GAP; -- 2.9.3
WARNING: multiple messages have this Message-ID (diff)
From: riel@redhat.com To: linux-kernel@vger.kernel.org Cc: kernel-hardening@lists.openwall.com, akpm@linux-foundation.org, mingo@kernel.org, oleg@redhat.com, lwoodman@redhat.com, mhocko@suse.de, danielmicay@gmail.com, will.deacon@arm.com, benh@kernel.crashing.org Subject: [kernel-hardening] [PATCH 4/6] arm64/mmap: properly account for stack randomization in mmap_base Date: Fri, 2 Jun 2017 11:20:08 -0400 [thread overview] Message-ID: <20170602152010.2064-5-riel@redhat.com> (raw) In-Reply-To: <20170602152010.2064-1-riel@redhat.com> From: Rik van Riel <riel@redhat.com> When RLIMIT_STACK is, for example, 256MB, the current code results in a gap between the top of the task and mmap_base of 256MB, failing to take into account the amount by which the stack address was randomized. In other words, the stack gets less than RLIMIT_STACK space. Ensure that the gap between the stack and mmap_base always takes stack randomization into account. >From Daniel Micay's linux-hardened tree. Reported-by: Florian Weimer <fweimer@redhat.com> Signed-off-by: Daniel Micay <danielmicay@gmail.com> Signed-off-by: Rik van Riel <riel@redhat.com> --- arch/arm64/mm/mmap.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c index 7b0d55756eb1..3f15eb193e33 100644 --- a/arch/arm64/mm/mmap.c +++ b/arch/arm64/mm/mmap.c @@ -34,7 +34,7 @@ * Leave enough space between the mmap area and the stack to honour ulimit in * the face of randomisation. */ -#define MIN_GAP (SZ_128M + ((STACK_RND_MASK << PAGE_SHIFT) + 1)) +#define MIN_GAP (SZ_128M) #define MAX_GAP (STACK_TOP/6*5) static int mmap_is_legacy(void) @@ -64,6 +64,11 @@ unsigned long arch_mmap_rnd(void) static unsigned long mmap_base(unsigned long rnd) { unsigned long gap = rlimit(RLIMIT_STACK); + unsigned long pad = STACK_RND_MASK << PAGE_SHIFT; + + /* Values close to RLIM_INFINITY can overflow. */ + if (gap + pad > gap) + gap += pad; if (gap < MIN_GAP) gap = MIN_GAP; -- 2.9.3
next prev parent reply other threads:[~2017-06-02 15:28 UTC|newest] Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-06-02 15:20 [PATCH 0/6] move mmap_area and PIE binaries away from the stack riel 2017-06-02 15:20 ` [kernel-hardening] " riel 2017-06-02 15:20 ` [PATCH 1/6] binfmt_elf: document load_bias a little bit riel 2017-06-02 15:20 ` [kernel-hardening] " riel 2017-06-02 19:27 ` Kees Cook 2017-06-02 19:27 ` Kees Cook 2017-06-02 15:20 ` [PATCH 2/6] x86/elf: move 32 bit ELF_ET_DYN_BASE to 256MB riel 2017-06-02 15:20 ` [kernel-hardening] " riel 2017-06-03 4:22 ` Kees Cook 2017-06-03 4:22 ` [kernel-hardening] " Kees Cook 2017-06-03 11:57 ` Daniel Micay 2017-06-03 11:57 ` [kernel-hardening] " Daniel Micay 2017-06-05 13:54 ` Rik van Riel 2017-06-05 13:54 ` [kernel-hardening] " Rik van Riel 2017-06-02 15:20 ` [PATCH 3/6] x86/mmap: properly account for stack randomization in mmap_base riel 2017-06-02 15:20 ` [kernel-hardening] " riel 2017-06-03 4:46 ` Kees Cook 2017-06-03 4:46 ` Kees Cook 2017-06-03 12:16 ` Daniel Micay 2017-06-03 12:16 ` Daniel Micay 2017-06-02 15:20 ` riel [this message] 2017-06-02 15:20 ` [kernel-hardening] [PATCH 4/6] arm64/mmap: " riel 2017-06-02 15:20 ` [PATCH 5/6] arm64: move COMPAT_ELF_ET_DYN_BASE lower in the address space riel 2017-06-02 15:20 ` [kernel-hardening] " riel 2017-06-02 15:20 ` [PATCH 6/6] powerpc,mmap: properly account for stack randomization in mmap_base riel 2017-06-02 15:20 ` [kernel-hardening] " riel 2017-06-03 4:37 ` [kernel-hardening] [PATCH 0/6] move mmap_area and PIE binaries away from the stack Kees Cook 2017-06-03 4:37 ` Kees Cook 2017-06-03 12:14 ` Daniel Micay 2017-06-03 12:14 ` Daniel Micay
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20170602152010.2064-5-riel@redhat.com \ --to=riel@redhat.com \ --cc=akpm@linux-foundation.org \ --cc=benh@kernel.crashing.org \ --cc=danielmicay@gmail.com \ --cc=kernel-hardening@lists.openwall.com \ --cc=linux-kernel@vger.kernel.org \ --cc=lwoodman@redhat.com \ --cc=mhocko@suse.de \ --cc=mingo@kernel.org \ --cc=oleg@redhat.com \ --cc=will.deacon@arm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.