From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x224wcwUPe7CqjVShrZ5754sG2oHG3A4nPOdi6MvxBkuZJjhr3bwpp6aZywDSN48dMAxqy7eV ARC-Seal: i=1; a=rsa-sha256; t=1517256876; cv=none; d=google.com; s=arc-20160816; b=r3VS1TT5qCqGufibVIOrZ59p+1+coIprSIfxpg+rDTkENlcrZg414imtywdVFq2RXD OkWShfQXB4nGfFiJqx8InteHZgNAPV3ysVHi2LkuvbE26MIgt/q9MV7PSD/8m2gDVr1v mBQtk5hXNpI339XTCYP1ivGpvmSExsEQ+Qw3w3w+GPQW1fwf6LnKwE+S6AmIZZskyqsT O18DxFL6cc13UPqHlN8pY5gxBYxY9ebFdAHJua0NeQxu3DVjSpHC6aXuuax6ydyyyve/ EngcvTgI6mSxFsrs/wUI9ZK2+4vAHVp9azI/VVnK8GNJuGzSzDC4cmEw9QipDtqQ6IVt uigg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=+sQKaV84S4lWFRV9Xq2Ay55OhqLj7OEQQ9Mp/IAvBgA=; b=er+yOguwl4dmfXBvu7am8iiQeUWgMJC62M38EEzsKgMLlulmKS/j0HqGvXpef6Rdac 3Evy2Gmdw28uO4L7FmMxhHElrMEy+ymv78WEGeyskEixgy/pZZVg0RkLFo/E8ndTYGoi zyKgX9NCzqJQVN6qi+02OixB2TPGd2dlMiKIR04P//Y6QrfqW7BVci6wCvvVfdNTpOsv mB0inrfrriXRmxPXP/Km3AsQIBpUg+NGOOxewz2zfJ9JH18kJXkOTF29qK8tUizOe5gy NaENdWuEuuy+1gTE2BkgejIbxdVLl+eQzpU9nhR0fXQAbAQfo8QO+feTrxO+bVgqB4w3 oBGw== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michal Hocko , Ben Hutchings , Willy Tarreau , Oleg Nesterov , Rik van Riel , Hugh Dickins , Andrew Morton , Linus Torvalds Subject: [PATCH 4.9 13/66] mm/mmap.c: do not blow on PROT_NONE MAP_FIXED holes in the stack Date: Mon, 29 Jan 2018 13:56:37 +0100 Message-Id: <20180129123840.529040411@linuxfoundation.org> X-Mailer: git-send-email 2.16.1 In-Reply-To: <20180129123839.842860149@linuxfoundation.org> References: <20180129123839.842860149@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1590958973747128688?= X-GMAIL-MSGID: =?utf-8?q?1590959146252676726?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Michal Hocko commit 561b5e0709e4a248c67d024d4d94b6e31e3edf2f upstream. Commit 1be7107fbe18 ("mm: larger stack guard gap, between vmas") has introduced a regression in some rust and Java environments which are trying to implement their own stack guard page. They are punching a new MAP_FIXED mapping inside the existing stack Vma. This will confuse expand_{downwards,upwards} into thinking that the stack expansion would in fact get us too close to an existing non-stack vma which is a correct behavior wrt safety. It is a real regression on the other hand. Let's work around the problem by considering PROT_NONE mapping as a part of the stack. This is a gros hack but overflowing to such a mapping would trap anyway an we only can hope that usespace knows what it is doing and handle it propely. Fixes: 1be7107fbe18 ("mm: larger stack guard gap, between vmas") Link: http://lkml.kernel.org/r/20170705182849.GA18027@dhcp22.suse.cz Signed-off-by: Michal Hocko Debugged-by: Vlastimil Babka Cc: Ben Hutchings Cc: Willy Tarreau Cc: Oleg Nesterov Cc: Rik van Riel Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/mmap.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2240,7 +2240,8 @@ int expand_upwards(struct vm_area_struct gap_addr = TASK_SIZE; next = vma->vm_next; - if (next && next->vm_start < gap_addr) { + if (next && next->vm_start < gap_addr && + (next->vm_flags & (VM_WRITE|VM_READ|VM_EXEC))) { if (!(next->vm_flags & VM_GROWSUP)) return -ENOMEM; /* Check that both stack segments have the same anon_vma? */ @@ -2324,7 +2325,8 @@ int expand_downwards(struct vm_area_stru if (gap_addr > address) return -ENOMEM; prev = vma->vm_prev; - if (prev && prev->vm_end > gap_addr) { + if (prev && prev->vm_end > gap_addr && + (prev->vm_flags & (VM_WRITE|VM_READ|VM_EXEC))) { if (!(prev->vm_flags & VM_GROWSDOWN)) return -ENOMEM; /* Check that both stack segments have the same anon_vma? */