* [PATCH v4 0/10] split ET_DYN ASLR from mmap ASLR
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun Chandran, Yann Droneaud, Min-Hua Chen,
Paul Burton, Alex Smith, Markos Chandras, Vineeth Vijayan,
Jeff Bailey, Michael Holzheu, Ben Hutchings, Borislav Petkov,
Jan-Simon Möller, linux-kernel, linux-arm-kernel,
linux-mips, linuxppc-dev, linux-s390, linux-fsdevel
To address the "offset2lib" ASLR weakness[1], this separates ET_DYN
ASLR from mmap ASLR, as already done on s390. The architectures
that are already randomizing mmap (arm, arm64, mips, powerpc, s390,
and x86), have their various forms of arch_mmap_rnd() made available
via the new CONFIG_ARCH_HAS_ELF_RANDOMIZE. For these architectures,
arch_randomize_brk() is collapsed as well.
This is an alternative to the solutions in:
https://lkml.org/lkml/2015/2/23/442
I've been able to test x86 and arm, and the buildbot (so far) seems
happy with building the rest.
Thanks!
-Kees
[1] http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html
v4:
- added Ack on powerpc (mpe)
- fixed mmap_base argument convention to be the same on all archs
- corrected paste-o in mips variable names (buildbot)
- clarified ET_DYN vs mmap ASLR regions in 9/10 (mpe)
v3:
- split change on a per-arch basis for easier review
- moved PF_RANDOMIZE check out of per-arch code (ingo)
v2:
- verbosified the commit logs, especially 4/5 (akpm)
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v4 0/10] split ET_DYN ASLR from mmap ASLR
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun
To address the "offset2lib" ASLR weakness[1], this separates ET_DYN
ASLR from mmap ASLR, as already done on s390. The architectures
that are already randomizing mmap (arm, arm64, mips, powerpc, s390,
and x86), have their various forms of arch_mmap_rnd() made available
via the new CONFIG_ARCH_HAS_ELF_RANDOMIZE. For these architectures,
arch_randomize_brk() is collapsed as well.
This is an alternative to the solutions in:
https://lkml.org/lkml/2015/2/23/442
I've been able to test x86 and arm, and the buildbot (so far) seems
happy with building the rest.
Thanks!
-Kees
[1] http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html
v4:
- added Ack on powerpc (mpe)
- fixed mmap_base argument convention to be the same on all archs
- corrected paste-o in mips variable names (buildbot)
- clarified ET_DYN vs mmap ASLR regions in 9/10 (mpe)
v3:
- split change on a per-arch basis for easier review
- moved PF_RANDOMIZE check out of per-arch code (ingo)
v2:
- verbosified the commit logs, especially 4/5 (akpm)
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v4 0/10] split ET_DYN ASLR from mmap ASLR
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: linux-mips, Arun Chandran, Heiko Carstens, linux-kernel,
Min-Hua Chen, Paul Mackerras, Ismael Ripoll, Yann Droneaud,
linux-s390, Russell King, Andrey Ryabinin, x86,
Hector Marco-Gisbert, Ingo Molnar, David A. Long,
Catalin Marinas, Borislav Petkov, Ben Hutchings, Kees Cook,
Will Deacon, linux-fsdevel, Alexander Viro, Michael Holzheu,
linux-arm-kernel, Jeff Bailey, Paul Burton, Oleg Nesterov,
Ralf Baechle, Andy Lutomirski, Vineeth Vijayan, Markos Chandras,
Jan-Simon Möller, Martin Schwidefsky, linux390,
linuxppc-dev, Alex Smith
To address the "offset2lib" ASLR weakness[1], this separates ET_DYN
ASLR from mmap ASLR, as already done on s390. The architectures
that are already randomizing mmap (arm, arm64, mips, powerpc, s390,
and x86), have their various forms of arch_mmap_rnd() made available
via the new CONFIG_ARCH_HAS_ELF_RANDOMIZE. For these architectures,
arch_randomize_brk() is collapsed as well.
This is an alternative to the solutions in:
https://lkml.org/lkml/2015/2/23/442
I've been able to test x86 and arm, and the buildbot (so far) seems
happy with building the rest.
Thanks!
-Kees
[1] http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html
v4:
- added Ack on powerpc (mpe)
- fixed mmap_base argument convention to be the same on all archs
- corrected paste-o in mips variable names (buildbot)
- clarified ET_DYN vs mmap ASLR regions in 9/10 (mpe)
v3:
- split change on a per-arch basis for easier review
- moved PF_RANDOMIZE check out of per-arch code (ingo)
v2:
- verbosified the commit logs, especially 4/5 (akpm)
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v4 0/10] split ET_DYN ASLR from mmap ASLR
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: linux-arm-kernel
To address the "offset2lib" ASLR weakness[1], this separates ET_DYN
ASLR from mmap ASLR, as already done on s390. The architectures
that are already randomizing mmap (arm, arm64, mips, powerpc, s390,
and x86), have their various forms of arch_mmap_rnd() made available
via the new CONFIG_ARCH_HAS_ELF_RANDOMIZE. For these architectures,
arch_randomize_brk() is collapsed as well.
This is an alternative to the solutions in:
https://lkml.org/lkml/2015/2/23/442
I've been able to test x86 and arm, and the buildbot (so far) seems
happy with building the rest.
Thanks!
-Kees
[1] http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html
v4:
- added Ack on powerpc (mpe)
- fixed mmap_base argument convention to be the same on all archs
- corrected paste-o in mips variable names (buildbot)
- clarified ET_DYN vs mmap ASLR regions in 9/10 (mpe)
v3:
- split change on a per-arch basis for easier review
- moved PF_RANDOMIZE check out of per-arch code (ingo)
v2:
- verbosified the commit logs, especially 4/5 (akpm)
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v4 01/10] arm: factor out mmap ASLR into mmap_rnd
2015-03-04 21:10 ` Kees Cook
(?)
(?)
@ 2015-03-04 21:10 ` Kees Cook
-1 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun Chandran, Yann Droneaud, Min-Hua Chen,
Paul Burton, Alex Smith, Markos Chandras, Vineeth Vijayan,
Jeff Bailey, Michael Holzheu, Ben Hutchings, Borislav Petkov,
Jan-Simon Möller, linux-kernel, linux-arm-kernel,
linux-mips, linuxppc-dev, linux-s390, linux-fsdevel
In preparation for splitting out ET_DYN ASLR, this moves the ASLR calculations
for mmap on ARM into a separate routine, similar to x86. This also removes
the redundant check of personality (PF_RANDOMIZE is already set before calling
arch_pick_mmap_layout).
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/arm/mm/mmap.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index 5e85ed371364..15a8160096b3 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -169,14 +169,22 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
return addr;
}
+static unsigned long mmap_rnd(void)
+{
+ unsigned long rnd;
+
+ /* 8 bits of randomness in 20 address space bits */
+ rnd = (unsigned long)get_random_int() % (1 << 8);
+
+ return rnd << PAGE_SHIFT;
+}
+
void arch_pick_mmap_layout(struct mm_struct *mm)
{
unsigned long random_factor = 0UL;
- /* 8 bits of randomness in 20 address space bits */
- if ((current->flags & PF_RANDOMIZE) &&
- !(current->personality & ADDR_NO_RANDOMIZE))
- random_factor = (get_random_int() % (1 << 8)) << PAGE_SHIFT;
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 01/10] arm: factor out mmap ASLR into mmap_rnd
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun
In preparation for splitting out ET_DYN ASLR, this moves the ASLR calculations
for mmap on ARM into a separate routine, similar to x86. This also removes
the redundant check of personality (PF_RANDOMIZE is already set before calling
arch_pick_mmap_layout).
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/arm/mm/mmap.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index 5e85ed371364..15a8160096b3 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -169,14 +169,22 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
return addr;
}
+static unsigned long mmap_rnd(void)
+{
+ unsigned long rnd;
+
+ /* 8 bits of randomness in 20 address space bits */
+ rnd = (unsigned long)get_random_int() % (1 << 8);
+
+ return rnd << PAGE_SHIFT;
+}
+
void arch_pick_mmap_layout(struct mm_struct *mm)
{
unsigned long random_factor = 0UL;
- /* 8 bits of randomness in 20 address space bits */
- if ((current->flags & PF_RANDOMIZE) &&
- !(current->personality & ADDR_NO_RANDOMIZE))
- random_factor = (get_random_int() % (1 << 8)) << PAGE_SHIFT;
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 01/10] arm: factor out mmap ASLR into mmap_rnd
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: linux-mips, Arun Chandran, Heiko Carstens, linux-kernel,
Min-Hua Chen, Paul Mackerras, Ismael Ripoll, Yann Droneaud,
linux-s390, Russell King, Andrey Ryabinin, x86,
Hector Marco-Gisbert, Ingo Molnar, David A. Long,
Catalin Marinas, Borislav Petkov, Ben Hutchings, Kees Cook,
Will Deacon, linux-fsdevel, Alexander Viro, Michael Holzheu,
linux-arm-kernel, Jeff Bailey, Paul Burton, Oleg Nesterov,
Ralf Baechle, Andy Lutomirski, Vineeth Vijayan, Markos Chandras,
Jan-Simon Möller, Martin Schwidefsky, linux390,
linuxppc-dev, Alex Smith
In preparation for splitting out ET_DYN ASLR, this moves the ASLR calculations
for mmap on ARM into a separate routine, similar to x86. This also removes
the redundant check of personality (PF_RANDOMIZE is already set before calling
arch_pick_mmap_layout).
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/arm/mm/mmap.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index 5e85ed371364..15a8160096b3 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -169,14 +169,22 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
return addr;
}
+static unsigned long mmap_rnd(void)
+{
+ unsigned long rnd;
+
+ /* 8 bits of randomness in 20 address space bits */
+ rnd = (unsigned long)get_random_int() % (1 << 8);
+
+ return rnd << PAGE_SHIFT;
+}
+
void arch_pick_mmap_layout(struct mm_struct *mm)
{
unsigned long random_factor = 0UL;
- /* 8 bits of randomness in 20 address space bits */
- if ((current->flags & PF_RANDOMIZE) &&
- !(current->personality & ADDR_NO_RANDOMIZE))
- random_factor = (get_random_int() % (1 << 8)) << PAGE_SHIFT;
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 01/10] arm: factor out mmap ASLR into mmap_rnd
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: linux-arm-kernel
In preparation for splitting out ET_DYN ASLR, this moves the ASLR calculations
for mmap on ARM into a separate routine, similar to x86. This also removes
the redundant check of personality (PF_RANDOMIZE is already set before calling
arch_pick_mmap_layout).
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/arm/mm/mmap.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index 5e85ed371364..15a8160096b3 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -169,14 +169,22 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
return addr;
}
+static unsigned long mmap_rnd(void)
+{
+ unsigned long rnd;
+
+ /* 8 bits of randomness in 20 address space bits */
+ rnd = (unsigned long)get_random_int() % (1 << 8);
+
+ return rnd << PAGE_SHIFT;
+}
+
void arch_pick_mmap_layout(struct mm_struct *mm)
{
unsigned long random_factor = 0UL;
- /* 8 bits of randomness in 20 address space bits */
- if ((current->flags & PF_RANDOMIZE) &&
- !(current->personality & ADDR_NO_RANDOMIZE))
- random_factor = (get_random_int() % (1 << 8)) << PAGE_SHIFT;
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 02/10] x86: standardize mmap_rnd() usage
2015-03-04 21:10 ` Kees Cook
(?)
(?)
@ 2015-03-04 21:10 ` Kees Cook
-1 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun Chandran, Yann Droneaud, Min-Hua Chen,
Paul Burton, Alex Smith, Markos Chandras, Vineeth Vijayan,
Jeff Bailey, Michael Holzheu, Ben Hutchings, Borislav Petkov,
Jan-Simon Möller, linux-kernel, linux-arm-kernel,
linux-mips, linuxppc-dev, linux-s390, linux-fsdevel
In preparation for splitting out ET_DYN ASLR, this refactors the use of
mmap_rnd() to be used similarly to arm, and extracts the checking of
PF_RANDOMIZE.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/x86/mm/mmap.c | 36 ++++++++++++++++++++----------------
1 file changed, 20 insertions(+), 16 deletions(-)
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index df4552bd239e..ebfa52030d5c 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -67,22 +67,21 @@ static int mmap_is_legacy(void)
static unsigned long mmap_rnd(void)
{
- unsigned long rnd = 0;
+ unsigned long rnd;
/*
- * 8 bits of randomness in 32bit mmaps, 20 address space bits
- * 28 bits of randomness in 64bit mmaps, 40 address space bits
- */
- if (current->flags & PF_RANDOMIZE) {
- if (mmap_is_ia32())
- rnd = get_random_int() % (1<<8);
- else
- rnd = get_random_int() % (1<<28);
- }
+ * 8 bits of randomness in 32bit mmaps, 20 address space bits
+ * 28 bits of randomness in 64bit mmaps, 40 address space bits
+ */
+ if (mmap_is_ia32())
+ rnd = (unsigned long)get_random_int() % (1<<8);
+ else
+ rnd = (unsigned long)get_random_int() % (1<<28);
+
return rnd << PAGE_SHIFT;
}
-static unsigned long mmap_base(void)
+static unsigned long mmap_base(unsigned long rnd)
{
unsigned long gap = rlimit(RLIMIT_STACK);
@@ -91,19 +90,19 @@ static unsigned long mmap_base(void)
else if (gap > MAX_GAP)
gap = MAX_GAP;
- return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
+ return PAGE_ALIGN(TASK_SIZE - gap - rnd);
}
/*
* Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
* does, but not when emulating X86_32
*/
-static unsigned long mmap_legacy_base(void)
+static unsigned long mmap_legacy_base(unsigned long rnd)
{
if (mmap_is_ia32())
return TASK_UNMAPPED_BASE;
else
- return TASK_UNMAPPED_BASE + mmap_rnd();
+ return TASK_UNMAPPED_BASE + rnd;
}
/*
@@ -112,13 +111,18 @@ static unsigned long mmap_legacy_base(void)
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
- mm->mmap_legacy_base = mmap_legacy_base();
- mm->mmap_base = mmap_base();
+ unsigned long random_factor = 0UL;
+
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
+
+ mm->mmap_legacy_base = mmap_legacy_base(random_factor);
if (mmap_is_legacy()) {
mm->mmap_base = mm->mmap_legacy_base;
mm->get_unmapped_area = arch_get_unmapped_area;
} else {
+ mm->mmap_base = mmap_base(random_factor);
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
}
}
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 02/10] x86: standardize mmap_rnd() usage
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun Chandran, Yann Droneaud, Min-Hua Chen,
Paul Burton
In preparation for splitting out ET_DYN ASLR, this refactors the use of
mmap_rnd() to be used similarly to arm, and extracts the checking of
PF_RANDOMIZE.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/x86/mm/mmap.c | 36 ++++++++++++++++++++----------------
1 file changed, 20 insertions(+), 16 deletions(-)
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index df4552bd239e..ebfa52030d5c 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -67,22 +67,21 @@ static int mmap_is_legacy(void)
static unsigned long mmap_rnd(void)
{
- unsigned long rnd = 0;
+ unsigned long rnd;
/*
- * 8 bits of randomness in 32bit mmaps, 20 address space bits
- * 28 bits of randomness in 64bit mmaps, 40 address space bits
- */
- if (current->flags & PF_RANDOMIZE) {
- if (mmap_is_ia32())
- rnd = get_random_int() % (1<<8);
- else
- rnd = get_random_int() % (1<<28);
- }
+ * 8 bits of randomness in 32bit mmaps, 20 address space bits
+ * 28 bits of randomness in 64bit mmaps, 40 address space bits
+ */
+ if (mmap_is_ia32())
+ rnd = (unsigned long)get_random_int() % (1<<8);
+ else
+ rnd = (unsigned long)get_random_int() % (1<<28);
+
return rnd << PAGE_SHIFT;
}
-static unsigned long mmap_base(void)
+static unsigned long mmap_base(unsigned long rnd)
{
unsigned long gap = rlimit(RLIMIT_STACK);
@@ -91,19 +90,19 @@ static unsigned long mmap_base(void)
else if (gap > MAX_GAP)
gap = MAX_GAP;
- return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
+ return PAGE_ALIGN(TASK_SIZE - gap - rnd);
}
/*
* Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
* does, but not when emulating X86_32
*/
-static unsigned long mmap_legacy_base(void)
+static unsigned long mmap_legacy_base(unsigned long rnd)
{
if (mmap_is_ia32())
return TASK_UNMAPPED_BASE;
else
- return TASK_UNMAPPED_BASE + mmap_rnd();
+ return TASK_UNMAPPED_BASE + rnd;
}
/*
@@ -112,13 +111,18 @@ static unsigned long mmap_legacy_base(void)
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
- mm->mmap_legacy_base = mmap_legacy_base();
- mm->mmap_base = mmap_base();
+ unsigned long random_factor = 0UL;
+
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
+
+ mm->mmap_legacy_base = mmap_legacy_base(random_factor);
if (mmap_is_legacy()) {
mm->mmap_base = mm->mmap_legacy_base;
mm->get_unmapped_area = arch_get_unmapped_area;
} else {
+ mm->mmap_base = mmap_base(random_factor);
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
}
}
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 02/10] x86: standardize mmap_rnd() usage
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: linux-mips, Arun Chandran, Heiko Carstens, linux-kernel,
Min-Hua Chen, Paul Mackerras, Ismael Ripoll, Yann Droneaud,
linux-s390, Russell King, Andrey Ryabinin, x86,
Hector Marco-Gisbert, Ingo Molnar, David A. Long,
Catalin Marinas, Borislav Petkov, Ben Hutchings, Kees Cook,
Will Deacon, linux-fsdevel, Alexander Viro, Michael Holzheu,
linux-arm-kernel, Jeff Bailey, Paul Burton, Oleg Nesterov,
Ralf Baechle, Andy Lutomirski, Vineeth Vijayan, Markos Chandras,
Jan-Simon Möller, Martin Schwidefsky, linux390,
linuxppc-dev, Alex Smith
In preparation for splitting out ET_DYN ASLR, this refactors the use of
mmap_rnd() to be used similarly to arm, and extracts the checking of
PF_RANDOMIZE.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/x86/mm/mmap.c | 36 ++++++++++++++++++++----------------
1 file changed, 20 insertions(+), 16 deletions(-)
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index df4552bd239e..ebfa52030d5c 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -67,22 +67,21 @@ static int mmap_is_legacy(void)
static unsigned long mmap_rnd(void)
{
- unsigned long rnd = 0;
+ unsigned long rnd;
/*
- * 8 bits of randomness in 32bit mmaps, 20 address space bits
- * 28 bits of randomness in 64bit mmaps, 40 address space bits
- */
- if (current->flags & PF_RANDOMIZE) {
- if (mmap_is_ia32())
- rnd = get_random_int() % (1<<8);
- else
- rnd = get_random_int() % (1<<28);
- }
+ * 8 bits of randomness in 32bit mmaps, 20 address space bits
+ * 28 bits of randomness in 64bit mmaps, 40 address space bits
+ */
+ if (mmap_is_ia32())
+ rnd = (unsigned long)get_random_int() % (1<<8);
+ else
+ rnd = (unsigned long)get_random_int() % (1<<28);
+
return rnd << PAGE_SHIFT;
}
-static unsigned long mmap_base(void)
+static unsigned long mmap_base(unsigned long rnd)
{
unsigned long gap = rlimit(RLIMIT_STACK);
@@ -91,19 +90,19 @@ static unsigned long mmap_base(void)
else if (gap > MAX_GAP)
gap = MAX_GAP;
- return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
+ return PAGE_ALIGN(TASK_SIZE - gap - rnd);
}
/*
* Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
* does, but not when emulating X86_32
*/
-static unsigned long mmap_legacy_base(void)
+static unsigned long mmap_legacy_base(unsigned long rnd)
{
if (mmap_is_ia32())
return TASK_UNMAPPED_BASE;
else
- return TASK_UNMAPPED_BASE + mmap_rnd();
+ return TASK_UNMAPPED_BASE + rnd;
}
/*
@@ -112,13 +111,18 @@ static unsigned long mmap_legacy_base(void)
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
- mm->mmap_legacy_base = mmap_legacy_base();
- mm->mmap_base = mmap_base();
+ unsigned long random_factor = 0UL;
+
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
+
+ mm->mmap_legacy_base = mmap_legacy_base(random_factor);
if (mmap_is_legacy()) {
mm->mmap_base = mm->mmap_legacy_base;
mm->get_unmapped_area = arch_get_unmapped_area;
} else {
+ mm->mmap_base = mmap_base(random_factor);
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
}
}
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 02/10] x86: standardize mmap_rnd() usage
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: linux-arm-kernel
In preparation for splitting out ET_DYN ASLR, this refactors the use of
mmap_rnd() to be used similarly to arm, and extracts the checking of
PF_RANDOMIZE.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/x86/mm/mmap.c | 36 ++++++++++++++++++++----------------
1 file changed, 20 insertions(+), 16 deletions(-)
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index df4552bd239e..ebfa52030d5c 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -67,22 +67,21 @@ static int mmap_is_legacy(void)
static unsigned long mmap_rnd(void)
{
- unsigned long rnd = 0;
+ unsigned long rnd;
/*
- * 8 bits of randomness in 32bit mmaps, 20 address space bits
- * 28 bits of randomness in 64bit mmaps, 40 address space bits
- */
- if (current->flags & PF_RANDOMIZE) {
- if (mmap_is_ia32())
- rnd = get_random_int() % (1<<8);
- else
- rnd = get_random_int() % (1<<28);
- }
+ * 8 bits of randomness in 32bit mmaps, 20 address space bits
+ * 28 bits of randomness in 64bit mmaps, 40 address space bits
+ */
+ if (mmap_is_ia32())
+ rnd = (unsigned long)get_random_int() % (1<<8);
+ else
+ rnd = (unsigned long)get_random_int() % (1<<28);
+
return rnd << PAGE_SHIFT;
}
-static unsigned long mmap_base(void)
+static unsigned long mmap_base(unsigned long rnd)
{
unsigned long gap = rlimit(RLIMIT_STACK);
@@ -91,19 +90,19 @@ static unsigned long mmap_base(void)
else if (gap > MAX_GAP)
gap = MAX_GAP;
- return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
+ return PAGE_ALIGN(TASK_SIZE - gap - rnd);
}
/*
* Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
* does, but not when emulating X86_32
*/
-static unsigned long mmap_legacy_base(void)
+static unsigned long mmap_legacy_base(unsigned long rnd)
{
if (mmap_is_ia32())
return TASK_UNMAPPED_BASE;
else
- return TASK_UNMAPPED_BASE + mmap_rnd();
+ return TASK_UNMAPPED_BASE + rnd;
}
/*
@@ -112,13 +111,18 @@ static unsigned long mmap_legacy_base(void)
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
- mm->mmap_legacy_base = mmap_legacy_base();
- mm->mmap_base = mmap_base();
+ unsigned long random_factor = 0UL;
+
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
+
+ mm->mmap_legacy_base = mmap_legacy_base(random_factor);
if (mmap_is_legacy()) {
mm->mmap_base = mm->mmap_legacy_base;
mm->get_unmapped_area = arch_get_unmapped_area;
} else {
+ mm->mmap_base = mmap_base(random_factor);
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
}
}
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 03/10] arm64: standardize mmap_rnd() usage
2015-03-04 21:10 ` Kees Cook
(?)
(?)
@ 2015-03-04 21:10 ` Kees Cook
-1 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun Chandran, Yann Droneaud, Min-Hua Chen,
Paul Burton, Alex Smith, Markos Chandras, Vineeth Vijayan,
Jeff Bailey, Michael Holzheu, Ben Hutchings, Borislav Petkov,
Jan-Simon Möller, linux-kernel, linux-arm-kernel,
linux-mips, linuxppc-dev, linux-s390, linux-fsdevel
In preparation for splitting out ET_DYN ASLR, this refactors the use of
mmap_rnd() to be used similarly to arm and x86. This additionally enables
mmap ASLR on legacy mmap layouts, which appeared to be missing on arm64,
and was already supported on arm. Additionally removes a copy/pasted
declaration of an unused function.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/arm64/include/asm/elf.h | 1 -
arch/arm64/mm/mmap.c | 18 +++++++++++-------
2 files changed, 11 insertions(+), 8 deletions(-)
diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index 1f65be393139..f724db00b235 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -125,7 +125,6 @@ typedef struct user_fpsimd_state elf_fpregset_t;
* the loader. We need to make sure that it is out of the way of the program
* that it will "exec", and that there is sufficient room for the brk.
*/
-extern unsigned long randomize_et_dyn(unsigned long base);
#define ELF_ET_DYN_BASE (2 * TASK_SIZE_64 / 3)
/*
diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
index 54922d1275b8..ba776c01b552 100644
--- a/arch/arm64/mm/mmap.c
+++ b/arch/arm64/mm/mmap.c
@@ -49,15 +49,14 @@ static int mmap_is_legacy(void)
static unsigned long mmap_rnd(void)
{
- unsigned long rnd = 0;
+ unsigned long rnd;
- if (current->flags & PF_RANDOMIZE)
- rnd = (long)get_random_int() & STACK_RND_MASK;
+ rnd = (unsigned long)get_random_int() & STACK_RND_MASK;
return rnd << PAGE_SHIFT;
}
-static unsigned long mmap_base(void)
+static unsigned long mmap_base(unsigned long rnd)
{
unsigned long gap = rlimit(RLIMIT_STACK);
@@ -66,7 +65,7 @@ static unsigned long mmap_base(void)
else if (gap > MAX_GAP)
gap = MAX_GAP;
- return PAGE_ALIGN(STACK_TOP - gap - mmap_rnd());
+ return PAGE_ALIGN(STACK_TOP - gap - rnd);
}
/*
@@ -75,15 +74,20 @@ static unsigned long mmap_base(void)
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
+ unsigned long random_factor = 0UL;
+
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
+
/*
* Fall back to the standard layout if the personality bit is set, or
* if the expected stack growth is unlimited:
*/
if (mmap_is_legacy()) {
- mm->mmap_base = TASK_UNMAPPED_BASE;
+ mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
mm->get_unmapped_area = arch_get_unmapped_area;
} else {
- mm->mmap_base = mmap_base();
+ mm->mmap_base = mmap_base(random_factor);
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
}
}
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 03/10] arm64: standardize mmap_rnd() usage
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun
In preparation for splitting out ET_DYN ASLR, this refactors the use of
mmap_rnd() to be used similarly to arm and x86. This additionally enables
mmap ASLR on legacy mmap layouts, which appeared to be missing on arm64,
and was already supported on arm. Additionally removes a copy/pasted
declaration of an unused function.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/arm64/include/asm/elf.h | 1 -
arch/arm64/mm/mmap.c | 18 +++++++++++-------
2 files changed, 11 insertions(+), 8 deletions(-)
diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index 1f65be393139..f724db00b235 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -125,7 +125,6 @@ typedef struct user_fpsimd_state elf_fpregset_t;
* the loader. We need to make sure that it is out of the way of the program
* that it will "exec", and that there is sufficient room for the brk.
*/
-extern unsigned long randomize_et_dyn(unsigned long base);
#define ELF_ET_DYN_BASE (2 * TASK_SIZE_64 / 3)
/*
diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
index 54922d1275b8..ba776c01b552 100644
--- a/arch/arm64/mm/mmap.c
+++ b/arch/arm64/mm/mmap.c
@@ -49,15 +49,14 @@ static int mmap_is_legacy(void)
static unsigned long mmap_rnd(void)
{
- unsigned long rnd = 0;
+ unsigned long rnd;
- if (current->flags & PF_RANDOMIZE)
- rnd = (long)get_random_int() & STACK_RND_MASK;
+ rnd = (unsigned long)get_random_int() & STACK_RND_MASK;
return rnd << PAGE_SHIFT;
}
-static unsigned long mmap_base(void)
+static unsigned long mmap_base(unsigned long rnd)
{
unsigned long gap = rlimit(RLIMIT_STACK);
@@ -66,7 +65,7 @@ static unsigned long mmap_base(void)
else if (gap > MAX_GAP)
gap = MAX_GAP;
- return PAGE_ALIGN(STACK_TOP - gap - mmap_rnd());
+ return PAGE_ALIGN(STACK_TOP - gap - rnd);
}
/*
@@ -75,15 +74,20 @@ static unsigned long mmap_base(void)
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
+ unsigned long random_factor = 0UL;
+
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
+
/*
* Fall back to the standard layout if the personality bit is set, or
* if the expected stack growth is unlimited:
*/
if (mmap_is_legacy()) {
- mm->mmap_base = TASK_UNMAPPED_BASE;
+ mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
mm->get_unmapped_area = arch_get_unmapped_area;
} else {
- mm->mmap_base = mmap_base();
+ mm->mmap_base = mmap_base(random_factor);
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
}
}
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 03/10] arm64: standardize mmap_rnd() usage
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: linux-mips, Arun Chandran, Heiko Carstens, linux-kernel,
Min-Hua Chen, Paul Mackerras, Ismael Ripoll, Yann Droneaud,
linux-s390, Russell King, Andrey Ryabinin, x86,
Hector Marco-Gisbert, Ingo Molnar, David A. Long,
Catalin Marinas, Borislav Petkov, Ben Hutchings, Kees Cook,
Will Deacon, linux-fsdevel, Alexander Viro, Michael Holzheu,
linux-arm-kernel, Jeff Bailey, Paul Burton, Oleg Nesterov,
Ralf Baechle, Andy Lutomirski, Vineeth Vijayan, Markos Chandras,
Jan-Simon Möller, Martin Schwidefsky, linux390,
linuxppc-dev, Alex Smith
In preparation for splitting out ET_DYN ASLR, this refactors the use of
mmap_rnd() to be used similarly to arm and x86. This additionally enables
mmap ASLR on legacy mmap layouts, which appeared to be missing on arm64,
and was already supported on arm. Additionally removes a copy/pasted
declaration of an unused function.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/arm64/include/asm/elf.h | 1 -
arch/arm64/mm/mmap.c | 18 +++++++++++-------
2 files changed, 11 insertions(+), 8 deletions(-)
diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index 1f65be393139..f724db00b235 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -125,7 +125,6 @@ typedef struct user_fpsimd_state elf_fpregset_t;
* the loader. We need to make sure that it is out of the way of the program
* that it will "exec", and that there is sufficient room for the brk.
*/
-extern unsigned long randomize_et_dyn(unsigned long base);
#define ELF_ET_DYN_BASE (2 * TASK_SIZE_64 / 3)
/*
diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
index 54922d1275b8..ba776c01b552 100644
--- a/arch/arm64/mm/mmap.c
+++ b/arch/arm64/mm/mmap.c
@@ -49,15 +49,14 @@ static int mmap_is_legacy(void)
static unsigned long mmap_rnd(void)
{
- unsigned long rnd = 0;
+ unsigned long rnd;
- if (current->flags & PF_RANDOMIZE)
- rnd = (long)get_random_int() & STACK_RND_MASK;
+ rnd = (unsigned long)get_random_int() & STACK_RND_MASK;
return rnd << PAGE_SHIFT;
}
-static unsigned long mmap_base(void)
+static unsigned long mmap_base(unsigned long rnd)
{
unsigned long gap = rlimit(RLIMIT_STACK);
@@ -66,7 +65,7 @@ static unsigned long mmap_base(void)
else if (gap > MAX_GAP)
gap = MAX_GAP;
- return PAGE_ALIGN(STACK_TOP - gap - mmap_rnd());
+ return PAGE_ALIGN(STACK_TOP - gap - rnd);
}
/*
@@ -75,15 +74,20 @@ static unsigned long mmap_base(void)
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
+ unsigned long random_factor = 0UL;
+
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
+
/*
* Fall back to the standard layout if the personality bit is set, or
* if the expected stack growth is unlimited:
*/
if (mmap_is_legacy()) {
- mm->mmap_base = TASK_UNMAPPED_BASE;
+ mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
mm->get_unmapped_area = arch_get_unmapped_area;
} else {
- mm->mmap_base = mmap_base();
+ mm->mmap_base = mmap_base(random_factor);
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
}
}
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 03/10] arm64: standardize mmap_rnd() usage
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: linux-arm-kernel
In preparation for splitting out ET_DYN ASLR, this refactors the use of
mmap_rnd() to be used similarly to arm and x86. This additionally enables
mmap ASLR on legacy mmap layouts, which appeared to be missing on arm64,
and was already supported on arm. Additionally removes a copy/pasted
declaration of an unused function.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/arm64/include/asm/elf.h | 1 -
arch/arm64/mm/mmap.c | 18 +++++++++++-------
2 files changed, 11 insertions(+), 8 deletions(-)
diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index 1f65be393139..f724db00b235 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -125,7 +125,6 @@ typedef struct user_fpsimd_state elf_fpregset_t;
* the loader. We need to make sure that it is out of the way of the program
* that it will "exec", and that there is sufficient room for the brk.
*/
-extern unsigned long randomize_et_dyn(unsigned long base);
#define ELF_ET_DYN_BASE (2 * TASK_SIZE_64 / 3)
/*
diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
index 54922d1275b8..ba776c01b552 100644
--- a/arch/arm64/mm/mmap.c
+++ b/arch/arm64/mm/mmap.c
@@ -49,15 +49,14 @@ static int mmap_is_legacy(void)
static unsigned long mmap_rnd(void)
{
- unsigned long rnd = 0;
+ unsigned long rnd;
- if (current->flags & PF_RANDOMIZE)
- rnd = (long)get_random_int() & STACK_RND_MASK;
+ rnd = (unsigned long)get_random_int() & STACK_RND_MASK;
return rnd << PAGE_SHIFT;
}
-static unsigned long mmap_base(void)
+static unsigned long mmap_base(unsigned long rnd)
{
unsigned long gap = rlimit(RLIMIT_STACK);
@@ -66,7 +65,7 @@ static unsigned long mmap_base(void)
else if (gap > MAX_GAP)
gap = MAX_GAP;
- return PAGE_ALIGN(STACK_TOP - gap - mmap_rnd());
+ return PAGE_ALIGN(STACK_TOP - gap - rnd);
}
/*
@@ -75,15 +74,20 @@ static unsigned long mmap_base(void)
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
+ unsigned long random_factor = 0UL;
+
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
+
/*
* Fall back to the standard layout if the personality bit is set, or
* if the expected stack growth is unlimited:
*/
if (mmap_is_legacy()) {
- mm->mmap_base = TASK_UNMAPPED_BASE;
+ mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
mm->get_unmapped_area = arch_get_unmapped_area;
} else {
- mm->mmap_base = mmap_base();
+ mm->mmap_base = mmap_base(random_factor);
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
}
}
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 04/10] mips: extract logic for mmap_rnd()
2015-03-04 21:10 ` Kees Cook
(?)
(?)
@ 2015-03-04 21:10 ` Kees Cook
-1 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun Chandran, Yann Droneaud, Min-Hua Chen,
Paul Burton, Alex Smith, Markos Chandras, Vineeth Vijayan,
Jeff Bailey, Michael Holzheu, Ben Hutchings, Borislav Petkov,
Jan-Simon Möller, linux-kernel, linux-arm-kernel,
linux-mips, linuxppc-dev, linux-s390, linux-fsdevel
In preparation for splitting out ET_DYN ASLR, extract the mmap ASLR
selection into a separate function.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
It seems the entropy gets smaller as the PAGE_SIZE increases. Is this
intentional?
---
arch/mips/mm/mmap.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)
diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
index f1baadd56e82..9a4f1f5c1f0e 100644
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -142,18 +142,26 @@ unsigned long arch_get_unmapped_area_topdown(struct file *filp,
addr0, len, pgoff, flags, DOWN);
}
+static unsigned long mmap_rnd(void)
+{
+ unsigned long rnd;
+
+ rnd = (unsigned long)get_random_int();
+ rnd <<= PAGE_SHIFT;
+ if (TASK_IS_32BIT_ADDR)
+ rnd &= 0xfffffful;
+ else
+ rnd &= 0xffffffful;
+
+ return rnd;
+}
+
void arch_pick_mmap_layout(struct mm_struct *mm)
{
unsigned long random_factor = 0UL;
- if (current->flags & PF_RANDOMIZE) {
- random_factor = get_random_int();
- random_factor = random_factor << PAGE_SHIFT;
- if (TASK_IS_32BIT_ADDR)
- random_factor &= 0xfffffful;
- else
- random_factor &= 0xffffffful;
- }
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 04/10] mips: extract logic for mmap_rnd()
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun
In preparation for splitting out ET_DYN ASLR, extract the mmap ASLR
selection into a separate function.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
It seems the entropy gets smaller as the PAGE_SIZE increases. Is this
intentional?
---
arch/mips/mm/mmap.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)
diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
index f1baadd56e82..9a4f1f5c1f0e 100644
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -142,18 +142,26 @@ unsigned long arch_get_unmapped_area_topdown(struct file *filp,
addr0, len, pgoff, flags, DOWN);
}
+static unsigned long mmap_rnd(void)
+{
+ unsigned long rnd;
+
+ rnd = (unsigned long)get_random_int();
+ rnd <<= PAGE_SHIFT;
+ if (TASK_IS_32BIT_ADDR)
+ rnd &= 0xfffffful;
+ else
+ rnd &= 0xffffffful;
+
+ return rnd;
+}
+
void arch_pick_mmap_layout(struct mm_struct *mm)
{
unsigned long random_factor = 0UL;
- if (current->flags & PF_RANDOMIZE) {
- random_factor = get_random_int();
- random_factor = random_factor << PAGE_SHIFT;
- if (TASK_IS_32BIT_ADDR)
- random_factor &= 0xfffffful;
- else
- random_factor &= 0xffffffful;
- }
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 04/10] mips: extract logic for mmap_rnd()
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: linux-mips, Arun Chandran, Heiko Carstens, linux-kernel,
Min-Hua Chen, Paul Mackerras, Ismael Ripoll, Yann Droneaud,
linux-s390, Russell King, Andrey Ryabinin, x86,
Hector Marco-Gisbert, Ingo Molnar, David A. Long,
Catalin Marinas, Borislav Petkov, Ben Hutchings, Kees Cook,
Will Deacon, linux-fsdevel, Alexander Viro, Michael Holzheu,
linux-arm-kernel, Jeff Bailey, Paul Burton, Oleg Nesterov,
Ralf Baechle, Andy Lutomirski, Vineeth Vijayan, Markos Chandras,
Jan-Simon Möller, Martin Schwidefsky, linux390,
linuxppc-dev, Alex Smith
In preparation for splitting out ET_DYN ASLR, extract the mmap ASLR
selection into a separate function.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
It seems the entropy gets smaller as the PAGE_SIZE increases. Is this
intentional?
---
arch/mips/mm/mmap.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)
diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
index f1baadd56e82..9a4f1f5c1f0e 100644
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -142,18 +142,26 @@ unsigned long arch_get_unmapped_area_topdown(struct file *filp,
addr0, len, pgoff, flags, DOWN);
}
+static unsigned long mmap_rnd(void)
+{
+ unsigned long rnd;
+
+ rnd = (unsigned long)get_random_int();
+ rnd <<= PAGE_SHIFT;
+ if (TASK_IS_32BIT_ADDR)
+ rnd &= 0xfffffful;
+ else
+ rnd &= 0xffffffful;
+
+ return rnd;
+}
+
void arch_pick_mmap_layout(struct mm_struct *mm)
{
unsigned long random_factor = 0UL;
- if (current->flags & PF_RANDOMIZE) {
- random_factor = get_random_int();
- random_factor = random_factor << PAGE_SHIFT;
- if (TASK_IS_32BIT_ADDR)
- random_factor &= 0xfffffful;
- else
- random_factor &= 0xffffffful;
- }
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 04/10] mips: extract logic for mmap_rnd()
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: linux-arm-kernel
In preparation for splitting out ET_DYN ASLR, extract the mmap ASLR
selection into a separate function.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
It seems the entropy gets smaller as the PAGE_SIZE increases. Is this
intentional?
---
arch/mips/mm/mmap.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)
diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
index f1baadd56e82..9a4f1f5c1f0e 100644
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -142,18 +142,26 @@ unsigned long arch_get_unmapped_area_topdown(struct file *filp,
addr0, len, pgoff, flags, DOWN);
}
+static unsigned long mmap_rnd(void)
+{
+ unsigned long rnd;
+
+ rnd = (unsigned long)get_random_int();
+ rnd <<= PAGE_SHIFT;
+ if (TASK_IS_32BIT_ADDR)
+ rnd &= 0xfffffful;
+ else
+ rnd &= 0xffffffful;
+
+ return rnd;
+}
+
void arch_pick_mmap_layout(struct mm_struct *mm)
{
unsigned long random_factor = 0UL;
- if (current->flags & PF_RANDOMIZE) {
- random_factor = get_random_int();
- random_factor = random_factor << PAGE_SHIFT;
- if (TASK_IS_32BIT_ADDR)
- random_factor &= 0xfffffful;
- else
- random_factor &= 0xffffffful;
- }
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 05/10] powerpc: standardize mmap_rnd() usage
2015-03-04 21:10 ` Kees Cook
(?)
(?)
@ 2015-03-04 21:10 ` Kees Cook
-1 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun Chandran, Yann Droneaud, Min-Hua Chen,
Paul Burton, Alex Smith, Markos Chandras, Vineeth Vijayan,
Jeff Bailey, Michael Holzheu, Ben Hutchings, Borislav Petkov,
Jan-Simon Möller, linux-kernel, linux-arm-kernel,
linux-mips, linuxppc-dev, linux-s390, linux-fsdevel
In preparation for splitting out ET_DYN ASLR, this refactors the use of
mmap_rnd() to be used similarly to arm and x86.
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Michael Ellerman <mpe@ellerman.id.au>
---
Can mmap ASLR be safely enabled in the legacy mmap case here? Other archs
use "mm->mmap_base = TASK_UNMAPPED_BASE + random_factor".
---
arch/powerpc/mm/mmap.c | 26 +++++++++++++++-----------
1 file changed, 15 insertions(+), 11 deletions(-)
diff --git a/arch/powerpc/mm/mmap.c b/arch/powerpc/mm/mmap.c
index cb8bdbe4972f..1ad2299d795d 100644
--- a/arch/powerpc/mm/mmap.c
+++ b/arch/powerpc/mm/mmap.c
@@ -55,19 +55,18 @@ static inline int mmap_is_legacy(void)
static unsigned long mmap_rnd(void)
{
- unsigned long rnd = 0;
+ unsigned long rnd;
+
+ /* 8MB for 32bit, 1GB for 64bit */
+ if (is_32bit_task())
+ rnd = (unsigned long)get_random_int() % (1<<(23-PAGE_SHIFT));
+ else
+ rnd = (unsigned long)get_random_int() % (1<<(30-PAGE_SHIFT));
- if (current->flags & PF_RANDOMIZE) {
- /* 8MB for 32bit, 1GB for 64bit */
- if (is_32bit_task())
- rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
- else
- rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
- }
return rnd << PAGE_SHIFT;
}
-static inline unsigned long mmap_base(void)
+static inline unsigned long mmap_base(unsigned long rnd)
{
unsigned long gap = rlimit(RLIMIT_STACK);
@@ -76,7 +75,7 @@ static inline unsigned long mmap_base(void)
else if (gap > MAX_GAP)
gap = MAX_GAP;
- return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
+ return PAGE_ALIGN(TASK_SIZE - gap - rnd);
}
/*
@@ -85,6 +84,11 @@ static inline unsigned long mmap_base(void)
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
+ unsigned long random_factor = 0UL;
+
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
+
/*
* Fall back to the standard layout if the personality
* bit is set, or if the expected stack growth is unlimited:
@@ -93,7 +97,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
mm->mmap_base = TASK_UNMAPPED_BASE;
mm->get_unmapped_area = arch_get_unmapped_area;
} else {
- mm->mmap_base = mmap_base();
+ mm->mmap_base = mmap_base(random_factor);
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
}
}
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 05/10] powerpc: standardize mmap_rnd() usage
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun
In preparation for splitting out ET_DYN ASLR, this refactors the use of
mmap_rnd() to be used similarly to arm and x86.
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Michael Ellerman <mpe@ellerman.id.au>
---
Can mmap ASLR be safely enabled in the legacy mmap case here? Other archs
use "mm->mmap_base = TASK_UNMAPPED_BASE + random_factor".
---
arch/powerpc/mm/mmap.c | 26 +++++++++++++++-----------
1 file changed, 15 insertions(+), 11 deletions(-)
diff --git a/arch/powerpc/mm/mmap.c b/arch/powerpc/mm/mmap.c
index cb8bdbe4972f..1ad2299d795d 100644
--- a/arch/powerpc/mm/mmap.c
+++ b/arch/powerpc/mm/mmap.c
@@ -55,19 +55,18 @@ static inline int mmap_is_legacy(void)
static unsigned long mmap_rnd(void)
{
- unsigned long rnd = 0;
+ unsigned long rnd;
+
+ /* 8MB for 32bit, 1GB for 64bit */
+ if (is_32bit_task())
+ rnd = (unsigned long)get_random_int() % (1<<(23-PAGE_SHIFT));
+ else
+ rnd = (unsigned long)get_random_int() % (1<<(30-PAGE_SHIFT));
- if (current->flags & PF_RANDOMIZE) {
- /* 8MB for 32bit, 1GB for 64bit */
- if (is_32bit_task())
- rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
- else
- rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
- }
return rnd << PAGE_SHIFT;
}
-static inline unsigned long mmap_base(void)
+static inline unsigned long mmap_base(unsigned long rnd)
{
unsigned long gap = rlimit(RLIMIT_STACK);
@@ -76,7 +75,7 @@ static inline unsigned long mmap_base(void)
else if (gap > MAX_GAP)
gap = MAX_GAP;
- return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
+ return PAGE_ALIGN(TASK_SIZE - gap - rnd);
}
/*
@@ -85,6 +84,11 @@ static inline unsigned long mmap_base(void)
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
+ unsigned long random_factor = 0UL;
+
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
+
/*
* Fall back to the standard layout if the personality
* bit is set, or if the expected stack growth is unlimited:
@@ -93,7 +97,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
mm->mmap_base = TASK_UNMAPPED_BASE;
mm->get_unmapped_area = arch_get_unmapped_area;
} else {
- mm->mmap_base = mmap_base();
+ mm->mmap_base = mmap_base(random_factor);
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
}
}
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 05/10] powerpc: standardize mmap_rnd() usage
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: linux-mips, Arun Chandran, Heiko Carstens, linux-kernel,
Min-Hua Chen, Paul Mackerras, Ismael Ripoll, Yann Droneaud,
linux-s390, Russell King, Andrey Ryabinin, x86,
Hector Marco-Gisbert, Ingo Molnar, David A. Long,
Catalin Marinas, Borislav Petkov, Ben Hutchings, Kees Cook,
Will Deacon, linux-fsdevel, Alexander Viro, Michael Holzheu,
linux-arm-kernel, Jeff Bailey, Paul Burton, Oleg Nesterov,
Ralf Baechle, Andy Lutomirski, Vineeth Vijayan, Markos Chandras,
Jan-Simon Möller, Martin Schwidefsky, linux390,
linuxppc-dev, Alex Smith
In preparation for splitting out ET_DYN ASLR, this refactors the use of
mmap_rnd() to be used similarly to arm and x86.
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Michael Ellerman <mpe@ellerman.id.au>
---
Can mmap ASLR be safely enabled in the legacy mmap case here? Other archs
use "mm->mmap_base = TASK_UNMAPPED_BASE + random_factor".
---
arch/powerpc/mm/mmap.c | 26 +++++++++++++++-----------
1 file changed, 15 insertions(+), 11 deletions(-)
diff --git a/arch/powerpc/mm/mmap.c b/arch/powerpc/mm/mmap.c
index cb8bdbe4972f..1ad2299d795d 100644
--- a/arch/powerpc/mm/mmap.c
+++ b/arch/powerpc/mm/mmap.c
@@ -55,19 +55,18 @@ static inline int mmap_is_legacy(void)
static unsigned long mmap_rnd(void)
{
- unsigned long rnd = 0;
+ unsigned long rnd;
+
+ /* 8MB for 32bit, 1GB for 64bit */
+ if (is_32bit_task())
+ rnd = (unsigned long)get_random_int() % (1<<(23-PAGE_SHIFT));
+ else
+ rnd = (unsigned long)get_random_int() % (1<<(30-PAGE_SHIFT));
- if (current->flags & PF_RANDOMIZE) {
- /* 8MB for 32bit, 1GB for 64bit */
- if (is_32bit_task())
- rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
- else
- rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
- }
return rnd << PAGE_SHIFT;
}
-static inline unsigned long mmap_base(void)
+static inline unsigned long mmap_base(unsigned long rnd)
{
unsigned long gap = rlimit(RLIMIT_STACK);
@@ -76,7 +75,7 @@ static inline unsigned long mmap_base(void)
else if (gap > MAX_GAP)
gap = MAX_GAP;
- return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
+ return PAGE_ALIGN(TASK_SIZE - gap - rnd);
}
/*
@@ -85,6 +84,11 @@ static inline unsigned long mmap_base(void)
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
+ unsigned long random_factor = 0UL;
+
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
+
/*
* Fall back to the standard layout if the personality
* bit is set, or if the expected stack growth is unlimited:
@@ -93,7 +97,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
mm->mmap_base = TASK_UNMAPPED_BASE;
mm->get_unmapped_area = arch_get_unmapped_area;
} else {
- mm->mmap_base = mmap_base();
+ mm->mmap_base = mmap_base(random_factor);
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
}
}
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 05/10] powerpc: standardize mmap_rnd() usage
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: linux-arm-kernel
In preparation for splitting out ET_DYN ASLR, this refactors the use of
mmap_rnd() to be used similarly to arm and x86.
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Michael Ellerman <mpe@ellerman.id.au>
---
Can mmap ASLR be safely enabled in the legacy mmap case here? Other archs
use "mm->mmap_base = TASK_UNMAPPED_BASE + random_factor".
---
arch/powerpc/mm/mmap.c | 26 +++++++++++++++-----------
1 file changed, 15 insertions(+), 11 deletions(-)
diff --git a/arch/powerpc/mm/mmap.c b/arch/powerpc/mm/mmap.c
index cb8bdbe4972f..1ad2299d795d 100644
--- a/arch/powerpc/mm/mmap.c
+++ b/arch/powerpc/mm/mmap.c
@@ -55,19 +55,18 @@ static inline int mmap_is_legacy(void)
static unsigned long mmap_rnd(void)
{
- unsigned long rnd = 0;
+ unsigned long rnd;
+
+ /* 8MB for 32bit, 1GB for 64bit */
+ if (is_32bit_task())
+ rnd = (unsigned long)get_random_int() % (1<<(23-PAGE_SHIFT));
+ else
+ rnd = (unsigned long)get_random_int() % (1<<(30-PAGE_SHIFT));
- if (current->flags & PF_RANDOMIZE) {
- /* 8MB for 32bit, 1GB for 64bit */
- if (is_32bit_task())
- rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
- else
- rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
- }
return rnd << PAGE_SHIFT;
}
-static inline unsigned long mmap_base(void)
+static inline unsigned long mmap_base(unsigned long rnd)
{
unsigned long gap = rlimit(RLIMIT_STACK);
@@ -76,7 +75,7 @@ static inline unsigned long mmap_base(void)
else if (gap > MAX_GAP)
gap = MAX_GAP;
- return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
+ return PAGE_ALIGN(TASK_SIZE - gap - rnd);
}
/*
@@ -85,6 +84,11 @@ static inline unsigned long mmap_base(void)
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
+ unsigned long random_factor = 0UL;
+
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
+
/*
* Fall back to the standard layout if the personality
* bit is set, or if the expected stack growth is unlimited:
@@ -93,7 +97,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
mm->mmap_base = TASK_UNMAPPED_BASE;
mm->get_unmapped_area = arch_get_unmapped_area;
} else {
- mm->mmap_base = mmap_base();
+ mm->mmap_base = mmap_base(random_factor);
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
}
}
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 06/10] s390: standardize mmap_rnd() usage
2015-03-04 21:10 ` Kees Cook
(?)
(?)
@ 2015-03-04 21:10 ` Kees Cook
-1 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun Chandran, Yann Droneaud, Min-Hua Chen,
Paul Burton, Alex Smith, Markos Chandras, Vineeth Vijayan,
Jeff Bailey, Michael Holzheu, Ben Hutchings, Borislav Petkov,
Jan-Simon Möller, linux-kernel, linux-arm-kernel,
linux-mips, linuxppc-dev, linux-s390, linux-fsdevel
In preparation for splitting out ET_DYN ASLR, this refactors the use of
mmap_rnd() to be used similarly to arm and x86, and extracts the checking
of PF_RANDOMIZE.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/s390/mm/mmap.c | 34 +++++++++++++++++++++++-----------
1 file changed, 23 insertions(+), 11 deletions(-)
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index 179a2c20b01f..db57078075c5 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -62,20 +62,18 @@ static inline int mmap_is_legacy(void)
static unsigned long mmap_rnd(void)
{
- if (!(current->flags & PF_RANDOMIZE))
- return 0;
if (is_32bit_task())
return (get_random_int() & 0x7ff) << PAGE_SHIFT;
else
return (get_random_int() & mmap_rnd_mask) << PAGE_SHIFT;
}
-static unsigned long mmap_base_legacy(void)
+static unsigned long mmap_base_legacy(unsigned long rnd)
{
- return TASK_UNMAPPED_BASE + mmap_rnd();
+ return TASK_UNMAPPED_BASE + rnd;
}
-static inline unsigned long mmap_base(void)
+static inline unsigned long mmap_base(unsigned long rnd)
{
unsigned long gap = rlimit(RLIMIT_STACK);
@@ -84,7 +82,7 @@ static inline unsigned long mmap_base(void)
else if (gap > MAX_GAP)
gap = MAX_GAP;
gap &= PAGE_MASK;
- return STACK_TOP - stack_maxrandom_size() - mmap_rnd() - gap;
+ return STACK_TOP - stack_maxrandom_size() - rnd - gap;
}
unsigned long
@@ -187,7 +185,11 @@ unsigned long randomize_et_dyn(void)
if (!is_32bit_task())
/* Align to 4GB */
base &= ~((1UL << 32) - 1);
- return base + mmap_rnd();
+
+ if (current->flags & PF_RANDOMIZE)
+ base += mmap_rnd();
+
+ return base;
}
#ifndef CONFIG_64BIT
@@ -198,15 +200,20 @@ unsigned long randomize_et_dyn(void)
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
+ unsigned long random_factor = 0UL;
+
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
+
/*
* Fall back to the standard layout if the personality
* bit is set, or if the expected stack growth is unlimited:
*/
if (mmap_is_legacy()) {
- mm->mmap_base = mmap_base_legacy();
+ mm->mmap_base = mmap_base_legacy(random_factor);
mm->get_unmapped_area = arch_get_unmapped_area;
} else {
- mm->mmap_base = mmap_base();
+ mm->mmap_base = mmap_base(random_factor);
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
}
}
@@ -273,15 +280,20 @@ s390_get_unmapped_area_topdown(struct file *filp, const unsigned long addr,
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
+ unsigned long random_factor = 0UL;
+
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
+
/*
* Fall back to the standard layout if the personality
* bit is set, or if the expected stack growth is unlimited:
*/
if (mmap_is_legacy()) {
- mm->mmap_base = mmap_base_legacy();
+ mm->mmap_base = mmap_base_legacy(random_factor);
mm->get_unmapped_area = s390_get_unmapped_area;
} else {
- mm->mmap_base = mmap_base();
+ mm->mmap_base = mmap_base(random_factor);
mm->get_unmapped_area = s390_get_unmapped_area_topdown;
}
}
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 06/10] s390: standardize mmap_rnd() usage
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun
In preparation for splitting out ET_DYN ASLR, this refactors the use of
mmap_rnd() to be used similarly to arm and x86, and extracts the checking
of PF_RANDOMIZE.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/s390/mm/mmap.c | 34 +++++++++++++++++++++++-----------
1 file changed, 23 insertions(+), 11 deletions(-)
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index 179a2c20b01f..db57078075c5 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -62,20 +62,18 @@ static inline int mmap_is_legacy(void)
static unsigned long mmap_rnd(void)
{
- if (!(current->flags & PF_RANDOMIZE))
- return 0;
if (is_32bit_task())
return (get_random_int() & 0x7ff) << PAGE_SHIFT;
else
return (get_random_int() & mmap_rnd_mask) << PAGE_SHIFT;
}
-static unsigned long mmap_base_legacy(void)
+static unsigned long mmap_base_legacy(unsigned long rnd)
{
- return TASK_UNMAPPED_BASE + mmap_rnd();
+ return TASK_UNMAPPED_BASE + rnd;
}
-static inline unsigned long mmap_base(void)
+static inline unsigned long mmap_base(unsigned long rnd)
{
unsigned long gap = rlimit(RLIMIT_STACK);
@@ -84,7 +82,7 @@ static inline unsigned long mmap_base(void)
else if (gap > MAX_GAP)
gap = MAX_GAP;
gap &= PAGE_MASK;
- return STACK_TOP - stack_maxrandom_size() - mmap_rnd() - gap;
+ return STACK_TOP - stack_maxrandom_size() - rnd - gap;
}
unsigned long
@@ -187,7 +185,11 @@ unsigned long randomize_et_dyn(void)
if (!is_32bit_task())
/* Align to 4GB */
base &= ~((1UL << 32) - 1);
- return base + mmap_rnd();
+
+ if (current->flags & PF_RANDOMIZE)
+ base += mmap_rnd();
+
+ return base;
}
#ifndef CONFIG_64BIT
@@ -198,15 +200,20 @@ unsigned long randomize_et_dyn(void)
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
+ unsigned long random_factor = 0UL;
+
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
+
/*
* Fall back to the standard layout if the personality
* bit is set, or if the expected stack growth is unlimited:
*/
if (mmap_is_legacy()) {
- mm->mmap_base = mmap_base_legacy();
+ mm->mmap_base = mmap_base_legacy(random_factor);
mm->get_unmapped_area = arch_get_unmapped_area;
} else {
- mm->mmap_base = mmap_base();
+ mm->mmap_base = mmap_base(random_factor);
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
}
}
@@ -273,15 +280,20 @@ s390_get_unmapped_area_topdown(struct file *filp, const unsigned long addr,
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
+ unsigned long random_factor = 0UL;
+
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
+
/*
* Fall back to the standard layout if the personality
* bit is set, or if the expected stack growth is unlimited:
*/
if (mmap_is_legacy()) {
- mm->mmap_base = mmap_base_legacy();
+ mm->mmap_base = mmap_base_legacy(random_factor);
mm->get_unmapped_area = s390_get_unmapped_area;
} else {
- mm->mmap_base = mmap_base();
+ mm->mmap_base = mmap_base(random_factor);
mm->get_unmapped_area = s390_get_unmapped_area_topdown;
}
}
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 06/10] s390: standardize mmap_rnd() usage
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: linux-mips, Arun Chandran, Heiko Carstens, linux-kernel,
Min-Hua Chen, Paul Mackerras, Ismael Ripoll, Yann Droneaud,
linux-s390, Russell King, Andrey Ryabinin, x86,
Hector Marco-Gisbert, Ingo Molnar, David A. Long,
Catalin Marinas, Borislav Petkov, Ben Hutchings, Kees Cook,
Will Deacon, linux-fsdevel, Alexander Viro, Michael Holzheu,
linux-arm-kernel, Jeff Bailey, Paul Burton, Oleg Nesterov,
Ralf Baechle, Andy Lutomirski, Vineeth Vijayan, Markos Chandras,
Jan-Simon Möller, Martin Schwidefsky, linux390,
linuxppc-dev, Alex Smith
In preparation for splitting out ET_DYN ASLR, this refactors the use of
mmap_rnd() to be used similarly to arm and x86, and extracts the checking
of PF_RANDOMIZE.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/s390/mm/mmap.c | 34 +++++++++++++++++++++++-----------
1 file changed, 23 insertions(+), 11 deletions(-)
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index 179a2c20b01f..db57078075c5 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -62,20 +62,18 @@ static inline int mmap_is_legacy(void)
static unsigned long mmap_rnd(void)
{
- if (!(current->flags & PF_RANDOMIZE))
- return 0;
if (is_32bit_task())
return (get_random_int() & 0x7ff) << PAGE_SHIFT;
else
return (get_random_int() & mmap_rnd_mask) << PAGE_SHIFT;
}
-static unsigned long mmap_base_legacy(void)
+static unsigned long mmap_base_legacy(unsigned long rnd)
{
- return TASK_UNMAPPED_BASE + mmap_rnd();
+ return TASK_UNMAPPED_BASE + rnd;
}
-static inline unsigned long mmap_base(void)
+static inline unsigned long mmap_base(unsigned long rnd)
{
unsigned long gap = rlimit(RLIMIT_STACK);
@@ -84,7 +82,7 @@ static inline unsigned long mmap_base(void)
else if (gap > MAX_GAP)
gap = MAX_GAP;
gap &= PAGE_MASK;
- return STACK_TOP - stack_maxrandom_size() - mmap_rnd() - gap;
+ return STACK_TOP - stack_maxrandom_size() - rnd - gap;
}
unsigned long
@@ -187,7 +185,11 @@ unsigned long randomize_et_dyn(void)
if (!is_32bit_task())
/* Align to 4GB */
base &= ~((1UL << 32) - 1);
- return base + mmap_rnd();
+
+ if (current->flags & PF_RANDOMIZE)
+ base += mmap_rnd();
+
+ return base;
}
#ifndef CONFIG_64BIT
@@ -198,15 +200,20 @@ unsigned long randomize_et_dyn(void)
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
+ unsigned long random_factor = 0UL;
+
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
+
/*
* Fall back to the standard layout if the personality
* bit is set, or if the expected stack growth is unlimited:
*/
if (mmap_is_legacy()) {
- mm->mmap_base = mmap_base_legacy();
+ mm->mmap_base = mmap_base_legacy(random_factor);
mm->get_unmapped_area = arch_get_unmapped_area;
} else {
- mm->mmap_base = mmap_base();
+ mm->mmap_base = mmap_base(random_factor);
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
}
}
@@ -273,15 +280,20 @@ s390_get_unmapped_area_topdown(struct file *filp, const unsigned long addr,
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
+ unsigned long random_factor = 0UL;
+
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
+
/*
* Fall back to the standard layout if the personality
* bit is set, or if the expected stack growth is unlimited:
*/
if (mmap_is_legacy()) {
- mm->mmap_base = mmap_base_legacy();
+ mm->mmap_base = mmap_base_legacy(random_factor);
mm->get_unmapped_area = s390_get_unmapped_area;
} else {
- mm->mmap_base = mmap_base();
+ mm->mmap_base = mmap_base(random_factor);
mm->get_unmapped_area = s390_get_unmapped_area_topdown;
}
}
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 06/10] s390: standardize mmap_rnd() usage
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: linux-arm-kernel
In preparation for splitting out ET_DYN ASLR, this refactors the use of
mmap_rnd() to be used similarly to arm and x86, and extracts the checking
of PF_RANDOMIZE.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/s390/mm/mmap.c | 34 +++++++++++++++++++++++-----------
1 file changed, 23 insertions(+), 11 deletions(-)
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index 179a2c20b01f..db57078075c5 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -62,20 +62,18 @@ static inline int mmap_is_legacy(void)
static unsigned long mmap_rnd(void)
{
- if (!(current->flags & PF_RANDOMIZE))
- return 0;
if (is_32bit_task())
return (get_random_int() & 0x7ff) << PAGE_SHIFT;
else
return (get_random_int() & mmap_rnd_mask) << PAGE_SHIFT;
}
-static unsigned long mmap_base_legacy(void)
+static unsigned long mmap_base_legacy(unsigned long rnd)
{
- return TASK_UNMAPPED_BASE + mmap_rnd();
+ return TASK_UNMAPPED_BASE + rnd;
}
-static inline unsigned long mmap_base(void)
+static inline unsigned long mmap_base(unsigned long rnd)
{
unsigned long gap = rlimit(RLIMIT_STACK);
@@ -84,7 +82,7 @@ static inline unsigned long mmap_base(void)
else if (gap > MAX_GAP)
gap = MAX_GAP;
gap &= PAGE_MASK;
- return STACK_TOP - stack_maxrandom_size() - mmap_rnd() - gap;
+ return STACK_TOP - stack_maxrandom_size() - rnd - gap;
}
unsigned long
@@ -187,7 +185,11 @@ unsigned long randomize_et_dyn(void)
if (!is_32bit_task())
/* Align to 4GB */
base &= ~((1UL << 32) - 1);
- return base + mmap_rnd();
+
+ if (current->flags & PF_RANDOMIZE)
+ base += mmap_rnd();
+
+ return base;
}
#ifndef CONFIG_64BIT
@@ -198,15 +200,20 @@ unsigned long randomize_et_dyn(void)
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
+ unsigned long random_factor = 0UL;
+
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
+
/*
* Fall back to the standard layout if the personality
* bit is set, or if the expected stack growth is unlimited:
*/
if (mmap_is_legacy()) {
- mm->mmap_base = mmap_base_legacy();
+ mm->mmap_base = mmap_base_legacy(random_factor);
mm->get_unmapped_area = arch_get_unmapped_area;
} else {
- mm->mmap_base = mmap_base();
+ mm->mmap_base = mmap_base(random_factor);
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
}
}
@@ -273,15 +280,20 @@ s390_get_unmapped_area_topdown(struct file *filp, const unsigned long addr,
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
+ unsigned long random_factor = 0UL;
+
+ if (current->flags & PF_RANDOMIZE)
+ random_factor = mmap_rnd();
+
/*
* Fall back to the standard layout if the personality
* bit is set, or if the expected stack growth is unlimited:
*/
if (mmap_is_legacy()) {
- mm->mmap_base = mmap_base_legacy();
+ mm->mmap_base = mmap_base_legacy(random_factor);
mm->get_unmapped_area = s390_get_unmapped_area;
} else {
- mm->mmap_base = mmap_base();
+ mm->mmap_base = mmap_base(random_factor);
mm->get_unmapped_area = s390_get_unmapped_area_topdown;
}
}
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 07/10] mm: expose arch_mmap_rnd when available
2015-03-04 21:10 ` Kees Cook
(?)
(?)
@ 2015-03-04 21:10 ` Kees Cook
-1 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun Chandran, Yann Droneaud, Min-Hua Chen,
Paul Burton, Alex Smith, Markos Chandras, Vineeth Vijayan,
Jeff Bailey, Michael Holzheu, Ben Hutchings, Borislav Petkov,
Jan-Simon Möller, linux-kernel, linux-arm-kernel,
linux-mips, linuxppc-dev, linux-s390, linux-fsdevel
When an architecture fully supports randomizing the ELF load location,
a per-arch mmap_rnd() function is used to find a randomized mmap base.
In preparation for randomizing the location of ET_DYN binaries
separately from mmap, this renames and exports these functions as
arch_mmap_rnd(). Additionally introduces CONFIG_ARCH_HAS_ELF_RANDOMIZE
for describing this feature on architectures that support it
(which is a superset of ARCH_BINFMT_ELF_RANDOMIZE_PIE, since s390
already supports a separated ET_DYN ASLR from mmap ASLR without the
ARCH_BINFMT_ELF_RANDOMIZE_PIE logic).
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/Kconfig | 7 +++++++
arch/arm/Kconfig | 1 +
arch/arm/mm/mmap.c | 4 ++--
arch/arm64/Kconfig | 1 +
arch/arm64/mm/mmap.c | 4 ++--
arch/mips/Kconfig | 1 +
arch/mips/mm/mmap.c | 4 ++--
arch/powerpc/Kconfig | 1 +
arch/powerpc/mm/mmap.c | 4 ++--
arch/s390/Kconfig | 1 +
arch/s390/mm/mmap.c | 8 ++++----
arch/x86/Kconfig | 1 +
arch/x86/mm/mmap.c | 4 ++--
include/linux/elf-randomize.h | 10 ++++++++++
14 files changed, 37 insertions(+), 14 deletions(-)
create mode 100644 include/linux/elf-randomize.h
diff --git a/arch/Kconfig b/arch/Kconfig
index 05d7a8a458d5..9ff5aa8fa2c1 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -484,6 +484,13 @@ config HAVE_IRQ_EXIT_ON_IRQ_STACK
This spares a stack switch and improves cache usage on softirq
processing.
+config ARCH_HAS_ELF_RANDOMIZE
+ bool
+ help
+ An architecture supports choosing randomized locations for
+ stack, mmap, brk, and ET_DYN. Defined functions:
+ - arch_mmap_rnd()
+
#
# ABI hall of shame
#
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 9f1f09a2bc9b..248d99cabaa8 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -3,6 +3,7 @@ config ARM
default y
select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
+ select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
select ARCH_HAVE_CUSTOM_GPIO_H
select ARCH_HAS_GCOV_PROFILE_ALL
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index 15a8160096b3..407dc786583a 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -169,7 +169,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
return addr;
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
unsigned long rnd;
@@ -184,7 +184,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 1b8e97331ffb..5f469095e0e2 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -2,6 +2,7 @@ config ARM64
def_bool y
select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
+ select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_GCOV_PROFILE_ALL
select ARCH_HAS_SG_CHAIN
select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
index ba776c01b552..ed177475dd8c 100644
--- a/arch/arm64/mm/mmap.c
+++ b/arch/arm64/mm/mmap.c
@@ -47,7 +47,7 @@ static int mmap_is_legacy(void)
return sysctl_legacy_va_layout;
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
unsigned long rnd;
@@ -77,7 +77,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
/*
* Fall back to the standard layout if the personality bit is set, or
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index c7a16904cd03..72ce5cece768 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -24,6 +24,7 @@ config MIPS
select HAVE_DEBUG_KMEMLEAK
select HAVE_SYSCALL_TRACEPOINTS
select ARCH_BINFMT_ELF_RANDOMIZE_PIE
+ select ARCH_HAS_ELF_RANDOMIZE
select HAVE_ARCH_TRANSPARENT_HUGEPAGE if CPU_SUPPORTS_HUGEPAGES && 64BIT
select RTC_LIB if !MACH_LOONGSON
select GENERIC_ATOMIC64 if !64BIT
diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
index 9a4f1f5c1f0e..5c81fdd032c3 100644
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -142,7 +142,7 @@ unsigned long arch_get_unmapped_area_topdown(struct file *filp,
addr0, len, pgoff, flags, DOWN);
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
unsigned long rnd;
@@ -161,7 +161,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 22b0940494bb..14fe1c411489 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -89,6 +89,7 @@ config PPC
select ARCH_MIGHT_HAVE_PC_SERIO
select BINFMT_ELF
select ARCH_BINFMT_ELF_RANDOMIZE_PIE
+ select ARCH_HAS_ELF_RANDOMIZE
select OF
select OF_EARLY_FLATTREE
select OF_RESERVED_MEM
diff --git a/arch/powerpc/mm/mmap.c b/arch/powerpc/mm/mmap.c
index 1ad2299d795d..0f0502e12f6c 100644
--- a/arch/powerpc/mm/mmap.c
+++ b/arch/powerpc/mm/mmap.c
@@ -53,7 +53,7 @@ static inline int mmap_is_legacy(void)
return sysctl_legacy_va_layout;
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
unsigned long rnd;
@@ -87,7 +87,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
/*
* Fall back to the standard layout if the personality
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 373cd5badf1c..4d707bb3e8dd 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -65,6 +65,7 @@ config S390
def_bool y
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
+ select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_GCOV_PROFILE_ALL
select ARCH_HAS_SG_CHAIN
select ARCH_HAVE_NMI_SAFE_CMPXCHG
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index db57078075c5..a94504d99c47 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -60,7 +60,7 @@ static inline int mmap_is_legacy(void)
return sysctl_legacy_va_layout;
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
if (is_32bit_task())
return (get_random_int() & 0x7ff) << PAGE_SHIFT;
@@ -187,7 +187,7 @@ unsigned long randomize_et_dyn(void)
base &= ~((1UL << 32) - 1);
if (current->flags & PF_RANDOMIZE)
- base += mmap_rnd();
+ base += arch_mmap_rnd();
return base;
}
@@ -203,7 +203,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
/*
* Fall back to the standard layout if the personality
@@ -283,7 +283,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
/*
* Fall back to the standard layout if the personality
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index c2fb8a87dccb..9aa91727fbf8 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -88,6 +88,7 @@ config X86
select HAVE_ARCH_KASAN if X86_64 && SPARSEMEM_VMEMMAP
select HAVE_USER_RETURN_NOTIFIER
select ARCH_BINFMT_ELF_RANDOMIZE_PIE
+ select ARCH_HAS_ELF_RANDOMIZE
select HAVE_ARCH_JUMP_LABEL
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
select SPARSE_IRQ
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index ebfa52030d5c..9d518d693b4b 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -65,7 +65,7 @@ static int mmap_is_legacy(void)
return sysctl_legacy_va_layout;
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
unsigned long rnd;
@@ -114,7 +114,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
mm->mmap_legacy_base = mmap_legacy_base(random_factor);
diff --git a/include/linux/elf-randomize.h b/include/linux/elf-randomize.h
new file mode 100644
index 000000000000..7a4eda02d2b1
--- /dev/null
+++ b/include/linux/elf-randomize.h
@@ -0,0 +1,10 @@
+#ifndef _ELF_RANDOMIZE_H
+#define _ELF_RANDOMIZE_H
+
+#ifndef CONFIG_ARCH_HAS_ELF_RANDOMIZE
+static inline unsigned long arch_mmap_rnd(void) { return 0; }
+#else
+extern unsigned long arch_mmap_rnd(void);
+#endif
+
+#endif
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 07/10] mm: expose arch_mmap_rnd when available
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun
When an architecture fully supports randomizing the ELF load location,
a per-arch mmap_rnd() function is used to find a randomized mmap base.
In preparation for randomizing the location of ET_DYN binaries
separately from mmap, this renames and exports these functions as
arch_mmap_rnd(). Additionally introduces CONFIG_ARCH_HAS_ELF_RANDOMIZE
for describing this feature on architectures that support it
(which is a superset of ARCH_BINFMT_ELF_RANDOMIZE_PIE, since s390
already supports a separated ET_DYN ASLR from mmap ASLR without the
ARCH_BINFMT_ELF_RANDOMIZE_PIE logic).
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/Kconfig | 7 +++++++
arch/arm/Kconfig | 1 +
arch/arm/mm/mmap.c | 4 ++--
arch/arm64/Kconfig | 1 +
arch/arm64/mm/mmap.c | 4 ++--
arch/mips/Kconfig | 1 +
arch/mips/mm/mmap.c | 4 ++--
arch/powerpc/Kconfig | 1 +
arch/powerpc/mm/mmap.c | 4 ++--
arch/s390/Kconfig | 1 +
arch/s390/mm/mmap.c | 8 ++++----
arch/x86/Kconfig | 1 +
arch/x86/mm/mmap.c | 4 ++--
include/linux/elf-randomize.h | 10 ++++++++++
14 files changed, 37 insertions(+), 14 deletions(-)
create mode 100644 include/linux/elf-randomize.h
diff --git a/arch/Kconfig b/arch/Kconfig
index 05d7a8a458d5..9ff5aa8fa2c1 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -484,6 +484,13 @@ config HAVE_IRQ_EXIT_ON_IRQ_STACK
This spares a stack switch and improves cache usage on softirq
processing.
+config ARCH_HAS_ELF_RANDOMIZE
+ bool
+ help
+ An architecture supports choosing randomized locations for
+ stack, mmap, brk, and ET_DYN. Defined functions:
+ - arch_mmap_rnd()
+
#
# ABI hall of shame
#
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 9f1f09a2bc9b..248d99cabaa8 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -3,6 +3,7 @@ config ARM
default y
select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
+ select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
select ARCH_HAVE_CUSTOM_GPIO_H
select ARCH_HAS_GCOV_PROFILE_ALL
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index 15a8160096b3..407dc786583a 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -169,7 +169,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
return addr;
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
unsigned long rnd;
@@ -184,7 +184,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 1b8e97331ffb..5f469095e0e2 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -2,6 +2,7 @@ config ARM64
def_bool y
select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
+ select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_GCOV_PROFILE_ALL
select ARCH_HAS_SG_CHAIN
select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
index ba776c01b552..ed177475dd8c 100644
--- a/arch/arm64/mm/mmap.c
+++ b/arch/arm64/mm/mmap.c
@@ -47,7 +47,7 @@ static int mmap_is_legacy(void)
return sysctl_legacy_va_layout;
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
unsigned long rnd;
@@ -77,7 +77,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
/*
* Fall back to the standard layout if the personality bit is set, or
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index c7a16904cd03..72ce5cece768 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -24,6 +24,7 @@ config MIPS
select HAVE_DEBUG_KMEMLEAK
select HAVE_SYSCALL_TRACEPOINTS
select ARCH_BINFMT_ELF_RANDOMIZE_PIE
+ select ARCH_HAS_ELF_RANDOMIZE
select HAVE_ARCH_TRANSPARENT_HUGEPAGE if CPU_SUPPORTS_HUGEPAGES && 64BIT
select RTC_LIB if !MACH_LOONGSON
select GENERIC_ATOMIC64 if !64BIT
diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
index 9a4f1f5c1f0e..5c81fdd032c3 100644
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -142,7 +142,7 @@ unsigned long arch_get_unmapped_area_topdown(struct file *filp,
addr0, len, pgoff, flags, DOWN);
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
unsigned long rnd;
@@ -161,7 +161,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 22b0940494bb..14fe1c411489 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -89,6 +89,7 @@ config PPC
select ARCH_MIGHT_HAVE_PC_SERIO
select BINFMT_ELF
select ARCH_BINFMT_ELF_RANDOMIZE_PIE
+ select ARCH_HAS_ELF_RANDOMIZE
select OF
select OF_EARLY_FLATTREE
select OF_RESERVED_MEM
diff --git a/arch/powerpc/mm/mmap.c b/arch/powerpc/mm/mmap.c
index 1ad2299d795d..0f0502e12f6c 100644
--- a/arch/powerpc/mm/mmap.c
+++ b/arch/powerpc/mm/mmap.c
@@ -53,7 +53,7 @@ static inline int mmap_is_legacy(void)
return sysctl_legacy_va_layout;
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
unsigned long rnd;
@@ -87,7 +87,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
/*
* Fall back to the standard layout if the personality
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 373cd5badf1c..4d707bb3e8dd 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -65,6 +65,7 @@ config S390
def_bool y
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
+ select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_GCOV_PROFILE_ALL
select ARCH_HAS_SG_CHAIN
select ARCH_HAVE_NMI_SAFE_CMPXCHG
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index db57078075c5..a94504d99c47 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -60,7 +60,7 @@ static inline int mmap_is_legacy(void)
return sysctl_legacy_va_layout;
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
if (is_32bit_task())
return (get_random_int() & 0x7ff) << PAGE_SHIFT;
@@ -187,7 +187,7 @@ unsigned long randomize_et_dyn(void)
base &= ~((1UL << 32) - 1);
if (current->flags & PF_RANDOMIZE)
- base += mmap_rnd();
+ base += arch_mmap_rnd();
return base;
}
@@ -203,7 +203,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
/*
* Fall back to the standard layout if the personality
@@ -283,7 +283,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
/*
* Fall back to the standard layout if the personality
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index c2fb8a87dccb..9aa91727fbf8 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -88,6 +88,7 @@ config X86
select HAVE_ARCH_KASAN if X86_64 && SPARSEMEM_VMEMMAP
select HAVE_USER_RETURN_NOTIFIER
select ARCH_BINFMT_ELF_RANDOMIZE_PIE
+ select ARCH_HAS_ELF_RANDOMIZE
select HAVE_ARCH_JUMP_LABEL
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
select SPARSE_IRQ
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index ebfa52030d5c..9d518d693b4b 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -65,7 +65,7 @@ static int mmap_is_legacy(void)
return sysctl_legacy_va_layout;
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
unsigned long rnd;
@@ -114,7 +114,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
mm->mmap_legacy_base = mmap_legacy_base(random_factor);
diff --git a/include/linux/elf-randomize.h b/include/linux/elf-randomize.h
new file mode 100644
index 000000000000..7a4eda02d2b1
--- /dev/null
+++ b/include/linux/elf-randomize.h
@@ -0,0 +1,10 @@
+#ifndef _ELF_RANDOMIZE_H
+#define _ELF_RANDOMIZE_H
+
+#ifndef CONFIG_ARCH_HAS_ELF_RANDOMIZE
+static inline unsigned long arch_mmap_rnd(void) { return 0; }
+#else
+extern unsigned long arch_mmap_rnd(void);
+#endif
+
+#endif
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 07/10] mm: expose arch_mmap_rnd when available
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: linux-mips, Arun Chandran, Heiko Carstens, linux-kernel,
Min-Hua Chen, Paul Mackerras, Ismael Ripoll, Yann Droneaud,
linux-s390, Russell King, Andrey Ryabinin, x86,
Hector Marco-Gisbert, Ingo Molnar, David A. Long,
Catalin Marinas, Borislav Petkov, Ben Hutchings, Kees Cook,
Will Deacon, linux-fsdevel, Alexander Viro, Michael Holzheu,
linux-arm-kernel, Jeff Bailey, Paul Burton, Oleg Nesterov,
Ralf Baechle, Andy Lutomirski, Vineeth Vijayan, Markos Chandras,
Jan-Simon Möller, Martin Schwidefsky, linux390,
linuxppc-dev, Alex Smith
When an architecture fully supports randomizing the ELF load location,
a per-arch mmap_rnd() function is used to find a randomized mmap base.
In preparation for randomizing the location of ET_DYN binaries
separately from mmap, this renames and exports these functions as
arch_mmap_rnd(). Additionally introduces CONFIG_ARCH_HAS_ELF_RANDOMIZE
for describing this feature on architectures that support it
(which is a superset of ARCH_BINFMT_ELF_RANDOMIZE_PIE, since s390
already supports a separated ET_DYN ASLR from mmap ASLR without the
ARCH_BINFMT_ELF_RANDOMIZE_PIE logic).
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/Kconfig | 7 +++++++
arch/arm/Kconfig | 1 +
arch/arm/mm/mmap.c | 4 ++--
arch/arm64/Kconfig | 1 +
arch/arm64/mm/mmap.c | 4 ++--
arch/mips/Kconfig | 1 +
arch/mips/mm/mmap.c | 4 ++--
arch/powerpc/Kconfig | 1 +
arch/powerpc/mm/mmap.c | 4 ++--
arch/s390/Kconfig | 1 +
arch/s390/mm/mmap.c | 8 ++++----
arch/x86/Kconfig | 1 +
arch/x86/mm/mmap.c | 4 ++--
include/linux/elf-randomize.h | 10 ++++++++++
14 files changed, 37 insertions(+), 14 deletions(-)
create mode 100644 include/linux/elf-randomize.h
diff --git a/arch/Kconfig b/arch/Kconfig
index 05d7a8a458d5..9ff5aa8fa2c1 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -484,6 +484,13 @@ config HAVE_IRQ_EXIT_ON_IRQ_STACK
This spares a stack switch and improves cache usage on softirq
processing.
+config ARCH_HAS_ELF_RANDOMIZE
+ bool
+ help
+ An architecture supports choosing randomized locations for
+ stack, mmap, brk, and ET_DYN. Defined functions:
+ - arch_mmap_rnd()
+
#
# ABI hall of shame
#
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 9f1f09a2bc9b..248d99cabaa8 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -3,6 +3,7 @@ config ARM
default y
select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
+ select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
select ARCH_HAVE_CUSTOM_GPIO_H
select ARCH_HAS_GCOV_PROFILE_ALL
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index 15a8160096b3..407dc786583a 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -169,7 +169,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
return addr;
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
unsigned long rnd;
@@ -184,7 +184,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 1b8e97331ffb..5f469095e0e2 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -2,6 +2,7 @@ config ARM64
def_bool y
select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
+ select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_GCOV_PROFILE_ALL
select ARCH_HAS_SG_CHAIN
select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
index ba776c01b552..ed177475dd8c 100644
--- a/arch/arm64/mm/mmap.c
+++ b/arch/arm64/mm/mmap.c
@@ -47,7 +47,7 @@ static int mmap_is_legacy(void)
return sysctl_legacy_va_layout;
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
unsigned long rnd;
@@ -77,7 +77,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
/*
* Fall back to the standard layout if the personality bit is set, or
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index c7a16904cd03..72ce5cece768 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -24,6 +24,7 @@ config MIPS
select HAVE_DEBUG_KMEMLEAK
select HAVE_SYSCALL_TRACEPOINTS
select ARCH_BINFMT_ELF_RANDOMIZE_PIE
+ select ARCH_HAS_ELF_RANDOMIZE
select HAVE_ARCH_TRANSPARENT_HUGEPAGE if CPU_SUPPORTS_HUGEPAGES && 64BIT
select RTC_LIB if !MACH_LOONGSON
select GENERIC_ATOMIC64 if !64BIT
diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
index 9a4f1f5c1f0e..5c81fdd032c3 100644
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -142,7 +142,7 @@ unsigned long arch_get_unmapped_area_topdown(struct file *filp,
addr0, len, pgoff, flags, DOWN);
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
unsigned long rnd;
@@ -161,7 +161,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 22b0940494bb..14fe1c411489 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -89,6 +89,7 @@ config PPC
select ARCH_MIGHT_HAVE_PC_SERIO
select BINFMT_ELF
select ARCH_BINFMT_ELF_RANDOMIZE_PIE
+ select ARCH_HAS_ELF_RANDOMIZE
select OF
select OF_EARLY_FLATTREE
select OF_RESERVED_MEM
diff --git a/arch/powerpc/mm/mmap.c b/arch/powerpc/mm/mmap.c
index 1ad2299d795d..0f0502e12f6c 100644
--- a/arch/powerpc/mm/mmap.c
+++ b/arch/powerpc/mm/mmap.c
@@ -53,7 +53,7 @@ static inline int mmap_is_legacy(void)
return sysctl_legacy_va_layout;
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
unsigned long rnd;
@@ -87,7 +87,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
/*
* Fall back to the standard layout if the personality
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 373cd5badf1c..4d707bb3e8dd 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -65,6 +65,7 @@ config S390
def_bool y
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
+ select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_GCOV_PROFILE_ALL
select ARCH_HAS_SG_CHAIN
select ARCH_HAVE_NMI_SAFE_CMPXCHG
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index db57078075c5..a94504d99c47 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -60,7 +60,7 @@ static inline int mmap_is_legacy(void)
return sysctl_legacy_va_layout;
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
if (is_32bit_task())
return (get_random_int() & 0x7ff) << PAGE_SHIFT;
@@ -187,7 +187,7 @@ unsigned long randomize_et_dyn(void)
base &= ~((1UL << 32) - 1);
if (current->flags & PF_RANDOMIZE)
- base += mmap_rnd();
+ base += arch_mmap_rnd();
return base;
}
@@ -203,7 +203,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
/*
* Fall back to the standard layout if the personality
@@ -283,7 +283,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
/*
* Fall back to the standard layout if the personality
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index c2fb8a87dccb..9aa91727fbf8 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -88,6 +88,7 @@ config X86
select HAVE_ARCH_KASAN if X86_64 && SPARSEMEM_VMEMMAP
select HAVE_USER_RETURN_NOTIFIER
select ARCH_BINFMT_ELF_RANDOMIZE_PIE
+ select ARCH_HAS_ELF_RANDOMIZE
select HAVE_ARCH_JUMP_LABEL
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
select SPARSE_IRQ
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index ebfa52030d5c..9d518d693b4b 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -65,7 +65,7 @@ static int mmap_is_legacy(void)
return sysctl_legacy_va_layout;
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
unsigned long rnd;
@@ -114,7 +114,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
mm->mmap_legacy_base = mmap_legacy_base(random_factor);
diff --git a/include/linux/elf-randomize.h b/include/linux/elf-randomize.h
new file mode 100644
index 000000000000..7a4eda02d2b1
--- /dev/null
+++ b/include/linux/elf-randomize.h
@@ -0,0 +1,10 @@
+#ifndef _ELF_RANDOMIZE_H
+#define _ELF_RANDOMIZE_H
+
+#ifndef CONFIG_ARCH_HAS_ELF_RANDOMIZE
+static inline unsigned long arch_mmap_rnd(void) { return 0; }
+#else
+extern unsigned long arch_mmap_rnd(void);
+#endif
+
+#endif
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 07/10] mm: expose arch_mmap_rnd when available
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: linux-arm-kernel
When an architecture fully supports randomizing the ELF load location,
a per-arch mmap_rnd() function is used to find a randomized mmap base.
In preparation for randomizing the location of ET_DYN binaries
separately from mmap, this renames and exports these functions as
arch_mmap_rnd(). Additionally introduces CONFIG_ARCH_HAS_ELF_RANDOMIZE
for describing this feature on architectures that support it
(which is a superset of ARCH_BINFMT_ELF_RANDOMIZE_PIE, since s390
already supports a separated ET_DYN ASLR from mmap ASLR without the
ARCH_BINFMT_ELF_RANDOMIZE_PIE logic).
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/Kconfig | 7 +++++++
arch/arm/Kconfig | 1 +
arch/arm/mm/mmap.c | 4 ++--
arch/arm64/Kconfig | 1 +
arch/arm64/mm/mmap.c | 4 ++--
arch/mips/Kconfig | 1 +
arch/mips/mm/mmap.c | 4 ++--
arch/powerpc/Kconfig | 1 +
arch/powerpc/mm/mmap.c | 4 ++--
arch/s390/Kconfig | 1 +
arch/s390/mm/mmap.c | 8 ++++----
arch/x86/Kconfig | 1 +
arch/x86/mm/mmap.c | 4 ++--
include/linux/elf-randomize.h | 10 ++++++++++
14 files changed, 37 insertions(+), 14 deletions(-)
create mode 100644 include/linux/elf-randomize.h
diff --git a/arch/Kconfig b/arch/Kconfig
index 05d7a8a458d5..9ff5aa8fa2c1 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -484,6 +484,13 @@ config HAVE_IRQ_EXIT_ON_IRQ_STACK
This spares a stack switch and improves cache usage on softirq
processing.
+config ARCH_HAS_ELF_RANDOMIZE
+ bool
+ help
+ An architecture supports choosing randomized locations for
+ stack, mmap, brk, and ET_DYN. Defined functions:
+ - arch_mmap_rnd()
+
#
# ABI hall of shame
#
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 9f1f09a2bc9b..248d99cabaa8 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -3,6 +3,7 @@ config ARM
default y
select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
+ select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
select ARCH_HAVE_CUSTOM_GPIO_H
select ARCH_HAS_GCOV_PROFILE_ALL
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index 15a8160096b3..407dc786583a 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -169,7 +169,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
return addr;
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
unsigned long rnd;
@@ -184,7 +184,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 1b8e97331ffb..5f469095e0e2 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -2,6 +2,7 @@ config ARM64
def_bool y
select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
+ select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_GCOV_PROFILE_ALL
select ARCH_HAS_SG_CHAIN
select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
index ba776c01b552..ed177475dd8c 100644
--- a/arch/arm64/mm/mmap.c
+++ b/arch/arm64/mm/mmap.c
@@ -47,7 +47,7 @@ static int mmap_is_legacy(void)
return sysctl_legacy_va_layout;
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
unsigned long rnd;
@@ -77,7 +77,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
/*
* Fall back to the standard layout if the personality bit is set, or
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index c7a16904cd03..72ce5cece768 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -24,6 +24,7 @@ config MIPS
select HAVE_DEBUG_KMEMLEAK
select HAVE_SYSCALL_TRACEPOINTS
select ARCH_BINFMT_ELF_RANDOMIZE_PIE
+ select ARCH_HAS_ELF_RANDOMIZE
select HAVE_ARCH_TRANSPARENT_HUGEPAGE if CPU_SUPPORTS_HUGEPAGES && 64BIT
select RTC_LIB if !MACH_LOONGSON
select GENERIC_ATOMIC64 if !64BIT
diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
index 9a4f1f5c1f0e..5c81fdd032c3 100644
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -142,7 +142,7 @@ unsigned long arch_get_unmapped_area_topdown(struct file *filp,
addr0, len, pgoff, flags, DOWN);
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
unsigned long rnd;
@@ -161,7 +161,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 22b0940494bb..14fe1c411489 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -89,6 +89,7 @@ config PPC
select ARCH_MIGHT_HAVE_PC_SERIO
select BINFMT_ELF
select ARCH_BINFMT_ELF_RANDOMIZE_PIE
+ select ARCH_HAS_ELF_RANDOMIZE
select OF
select OF_EARLY_FLATTREE
select OF_RESERVED_MEM
diff --git a/arch/powerpc/mm/mmap.c b/arch/powerpc/mm/mmap.c
index 1ad2299d795d..0f0502e12f6c 100644
--- a/arch/powerpc/mm/mmap.c
+++ b/arch/powerpc/mm/mmap.c
@@ -53,7 +53,7 @@ static inline int mmap_is_legacy(void)
return sysctl_legacy_va_layout;
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
unsigned long rnd;
@@ -87,7 +87,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
/*
* Fall back to the standard layout if the personality
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 373cd5badf1c..4d707bb3e8dd 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -65,6 +65,7 @@ config S390
def_bool y
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
+ select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_GCOV_PROFILE_ALL
select ARCH_HAS_SG_CHAIN
select ARCH_HAVE_NMI_SAFE_CMPXCHG
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index db57078075c5..a94504d99c47 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -60,7 +60,7 @@ static inline int mmap_is_legacy(void)
return sysctl_legacy_va_layout;
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
if (is_32bit_task())
return (get_random_int() & 0x7ff) << PAGE_SHIFT;
@@ -187,7 +187,7 @@ unsigned long randomize_et_dyn(void)
base &= ~((1UL << 32) - 1);
if (current->flags & PF_RANDOMIZE)
- base += mmap_rnd();
+ base += arch_mmap_rnd();
return base;
}
@@ -203,7 +203,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
/*
* Fall back to the standard layout if the personality
@@ -283,7 +283,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
/*
* Fall back to the standard layout if the personality
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index c2fb8a87dccb..9aa91727fbf8 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -88,6 +88,7 @@ config X86
select HAVE_ARCH_KASAN if X86_64 && SPARSEMEM_VMEMMAP
select HAVE_USER_RETURN_NOTIFIER
select ARCH_BINFMT_ELF_RANDOMIZE_PIE
+ select ARCH_HAS_ELF_RANDOMIZE
select HAVE_ARCH_JUMP_LABEL
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
select SPARSE_IRQ
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index ebfa52030d5c..9d518d693b4b 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -65,7 +65,7 @@ static int mmap_is_legacy(void)
return sysctl_legacy_va_layout;
}
-static unsigned long mmap_rnd(void)
+unsigned long arch_mmap_rnd(void)
{
unsigned long rnd;
@@ -114,7 +114,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
unsigned long random_factor = 0UL;
if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
+ random_factor = arch_mmap_rnd();
mm->mmap_legacy_base = mmap_legacy_base(random_factor);
diff --git a/include/linux/elf-randomize.h b/include/linux/elf-randomize.h
new file mode 100644
index 000000000000..7a4eda02d2b1
--- /dev/null
+++ b/include/linux/elf-randomize.h
@@ -0,0 +1,10 @@
+#ifndef _ELF_RANDOMIZE_H
+#define _ELF_RANDOMIZE_H
+
+#ifndef CONFIG_ARCH_HAS_ELF_RANDOMIZE
+static inline unsigned long arch_mmap_rnd(void) { return 0; }
+#else
+extern unsigned long arch_mmap_rnd(void);
+#endif
+
+#endif
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 08/10] s390: redefine randomize_et_dyn for ELF_ET_DYN_BASE
2015-03-04 21:10 ` Kees Cook
(?)
(?)
@ 2015-03-04 21:10 ` Kees Cook
-1 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun Chandran, Yann Droneaud, Min-Hua Chen,
Paul Burton, Alex Smith, Markos Chandras, Vineeth Vijayan,
Jeff Bailey, Michael Holzheu, Ben Hutchings, Borislav Petkov,
Jan-Simon Möller, linux-kernel, linux-arm-kernel,
linux-mips, linuxppc-dev, linux-s390, linux-fsdevel
In preparation for moving ET_DYN randomization into the ELF loader (which
requires a static ELF_ET_DYN_BASE), this redefines s390's existing ET_DYN
randomization in a call to arch_mmap_rnd(). This refactoring results in
the same ET_DYN randomization on s390.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/s390/include/asm/elf.h | 8 +++++---
arch/s390/mm/mmap.c | 11 ++---------
2 files changed, 7 insertions(+), 12 deletions(-)
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index c9df40b5c0ac..2e63de8aac7c 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -161,10 +161,12 @@ extern unsigned int vdso_enabled;
/* This is the location that an ET_DYN program is loaded if exec'ed. Typical
use of this is to invoke "./ld.so someprog" to test out a new version of
the loader. We need to make sure that it is out of the way of the program
- that it will "exec", and that there is sufficient room for the brk. */
-
+ that it will "exec", and that there is sufficient room for the brk. 64-bit
+ tasks are aligned to 4GB. */
extern unsigned long randomize_et_dyn(void);
-#define ELF_ET_DYN_BASE randomize_et_dyn()
+#define ELF_ET_DYN_BASE (randomize_et_dyn() + (is_32bit_task() ? \
+ (STACK_TOP / 3 * 2) : \
+ (STACK_TOP / 3 * 2) & ~((1UL << 32) - 1)))
/* This yields a mask that user programs can use to figure out what
instruction set this CPU supports. */
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index a94504d99c47..8c11536f972d 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -179,17 +179,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
unsigned long randomize_et_dyn(void)
{
- unsigned long base;
-
- base = STACK_TOP / 3 * 2;
- if (!is_32bit_task())
- /* Align to 4GB */
- base &= ~((1UL << 32) - 1);
-
if (current->flags & PF_RANDOMIZE)
- base += arch_mmap_rnd();
+ return arch_mmap_rnd();
- return base;
+ return 0UL;
}
#ifndef CONFIG_64BIT
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 08/10] s390: redefine randomize_et_dyn for ELF_ET_DYN_BASE
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun
In preparation for moving ET_DYN randomization into the ELF loader (which
requires a static ELF_ET_DYN_BASE), this redefines s390's existing ET_DYN
randomization in a call to arch_mmap_rnd(). This refactoring results in
the same ET_DYN randomization on s390.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/s390/include/asm/elf.h | 8 +++++---
arch/s390/mm/mmap.c | 11 ++---------
2 files changed, 7 insertions(+), 12 deletions(-)
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index c9df40b5c0ac..2e63de8aac7c 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -161,10 +161,12 @@ extern unsigned int vdso_enabled;
/* This is the location that an ET_DYN program is loaded if exec'ed. Typical
use of this is to invoke "./ld.so someprog" to test out a new version of
the loader. We need to make sure that it is out of the way of the program
- that it will "exec", and that there is sufficient room for the brk. */
-
+ that it will "exec", and that there is sufficient room for the brk. 64-bit
+ tasks are aligned to 4GB. */
extern unsigned long randomize_et_dyn(void);
-#define ELF_ET_DYN_BASE randomize_et_dyn()
+#define ELF_ET_DYN_BASE (randomize_et_dyn() + (is_32bit_task() ? \
+ (STACK_TOP / 3 * 2) : \
+ (STACK_TOP / 3 * 2) & ~((1UL << 32) - 1)))
/* This yields a mask that user programs can use to figure out what
instruction set this CPU supports. */
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index a94504d99c47..8c11536f972d 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -179,17 +179,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
unsigned long randomize_et_dyn(void)
{
- unsigned long base;
-
- base = STACK_TOP / 3 * 2;
- if (!is_32bit_task())
- /* Align to 4GB */
- base &= ~((1UL << 32) - 1);
-
if (current->flags & PF_RANDOMIZE)
- base += arch_mmap_rnd();
+ return arch_mmap_rnd();
- return base;
+ return 0UL;
}
#ifndef CONFIG_64BIT
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 08/10] s390: redefine randomize_et_dyn for ELF_ET_DYN_BASE
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: linux-mips, Arun Chandran, Heiko Carstens, linux-kernel,
Min-Hua Chen, Paul Mackerras, Ismael Ripoll, Yann Droneaud,
linux-s390, Russell King, Andrey Ryabinin, x86,
Hector Marco-Gisbert, Ingo Molnar, David A. Long,
Catalin Marinas, Borislav Petkov, Ben Hutchings, Kees Cook,
Will Deacon, linux-fsdevel, Alexander Viro, Michael Holzheu,
linux-arm-kernel, Jeff Bailey, Paul Burton, Oleg Nesterov,
Ralf Baechle, Andy Lutomirski, Vineeth Vijayan, Markos Chandras,
Jan-Simon Möller, Martin Schwidefsky, linux390,
linuxppc-dev, Alex Smith
In preparation for moving ET_DYN randomization into the ELF loader (which
requires a static ELF_ET_DYN_BASE), this redefines s390's existing ET_DYN
randomization in a call to arch_mmap_rnd(). This refactoring results in
the same ET_DYN randomization on s390.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/s390/include/asm/elf.h | 8 +++++---
arch/s390/mm/mmap.c | 11 ++---------
2 files changed, 7 insertions(+), 12 deletions(-)
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index c9df40b5c0ac..2e63de8aac7c 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -161,10 +161,12 @@ extern unsigned int vdso_enabled;
/* This is the location that an ET_DYN program is loaded if exec'ed. Typical
use of this is to invoke "./ld.so someprog" to test out a new version of
the loader. We need to make sure that it is out of the way of the program
- that it will "exec", and that there is sufficient room for the brk. */
-
+ that it will "exec", and that there is sufficient room for the brk. 64-bit
+ tasks are aligned to 4GB. */
extern unsigned long randomize_et_dyn(void);
-#define ELF_ET_DYN_BASE randomize_et_dyn()
+#define ELF_ET_DYN_BASE (randomize_et_dyn() + (is_32bit_task() ? \
+ (STACK_TOP / 3 * 2) : \
+ (STACK_TOP / 3 * 2) & ~((1UL << 32) - 1)))
/* This yields a mask that user programs can use to figure out what
instruction set this CPU supports. */
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index a94504d99c47..8c11536f972d 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -179,17 +179,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
unsigned long randomize_et_dyn(void)
{
- unsigned long base;
-
- base = STACK_TOP / 3 * 2;
- if (!is_32bit_task())
- /* Align to 4GB */
- base &= ~((1UL << 32) - 1);
-
if (current->flags & PF_RANDOMIZE)
- base += arch_mmap_rnd();
+ return arch_mmap_rnd();
- return base;
+ return 0UL;
}
#ifndef CONFIG_64BIT
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 08/10] s390: redefine randomize_et_dyn for ELF_ET_DYN_BASE
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: linux-arm-kernel
In preparation for moving ET_DYN randomization into the ELF loader (which
requires a static ELF_ET_DYN_BASE), this redefines s390's existing ET_DYN
randomization in a call to arch_mmap_rnd(). This refactoring results in
the same ET_DYN randomization on s390.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/s390/include/asm/elf.h | 8 +++++---
arch/s390/mm/mmap.c | 11 ++---------
2 files changed, 7 insertions(+), 12 deletions(-)
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index c9df40b5c0ac..2e63de8aac7c 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -161,10 +161,12 @@ extern unsigned int vdso_enabled;
/* This is the location that an ET_DYN program is loaded if exec'ed. Typical
use of this is to invoke "./ld.so someprog" to test out a new version of
the loader. We need to make sure that it is out of the way of the program
- that it will "exec", and that there is sufficient room for the brk. */
-
+ that it will "exec", and that there is sufficient room for the brk. 64-bit
+ tasks are aligned to 4GB. */
extern unsigned long randomize_et_dyn(void);
-#define ELF_ET_DYN_BASE randomize_et_dyn()
+#define ELF_ET_DYN_BASE (randomize_et_dyn() + (is_32bit_task() ? \
+ (STACK_TOP / 3 * 2) : \
+ (STACK_TOP / 3 * 2) & ~((1UL << 32) - 1)))
/* This yields a mask that user programs can use to figure out what
instruction set this CPU supports. */
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index a94504d99c47..8c11536f972d 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -179,17 +179,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
unsigned long randomize_et_dyn(void)
{
- unsigned long base;
-
- base = STACK_TOP / 3 * 2;
- if (!is_32bit_task())
- /* Align to 4GB */
- base &= ~((1UL << 32) - 1);
-
if (current->flags & PF_RANDOMIZE)
- base += arch_mmap_rnd();
+ return arch_mmap_rnd();
- return base;
+ return 0UL;
}
#ifndef CONFIG_64BIT
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 09/10] mm: split ET_DYN ASLR from mmap ASLR
2015-03-04 21:10 ` Kees Cook
(?)
(?)
@ 2015-03-04 21:10 ` Kees Cook
-1 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun Chandran, Yann Droneaud, Min-Hua Chen,
Paul Burton, Alex Smith, Markos Chandras, Vineeth Vijayan,
Jeff Bailey, Michael Holzheu, Ben Hutchings, Borislav Petkov,
Jan-Simon Möller, linux-kernel, linux-arm-kernel,
linux-mips, linuxppc-dev, linux-s390, linux-fsdevel
This fixes the "offset2lib" weakness in ASLR for arm, arm64, mips,
powerpc, and x86. The problem is that if there is a leak of ASLR from
the executable (ET_DYN), it means a leak of shared library offset as
well (mmap), and vice versa. Further details and a PoC of this attack
is available here:
http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html
With this patch, a PIE linked executable (ET_DYN) has its own ASLR region
(e.g. 0x5... instead of 0x7f... on x86_64):
$ ./show_mmaps_pie
54859ccd6000-54859ccd7000 r-xp ... /tmp/show_mmaps_pie
54859ced6000-54859ced7000 r--p ... /tmp/show_mmaps_pie
54859ced7000-54859ced8000 rw-p ... /tmp/show_mmaps_pie
7f75be764000-7f75be91f000 r-xp ... /lib/x86_64-linux-gnu/libc.so.6
7f75be91f000-7f75beb1f000 ---p ... /lib/x86_64-linux-gnu/libc.so.6
7f75beb1f000-7f75beb23000 r--p ... /lib/x86_64-linux-gnu/libc.so.6
7f75beb23000-7f75beb25000 rw-p ... /lib/x86_64-linux-gnu/libc.so.6
7f75beb25000-7f75beb2a000 rw-p ...
7f75beb2a000-7f75beb4d000 r-xp ... /lib64/ld-linux-x86-64.so.2
7f75bed45000-7f75bed46000 rw-p ...
7f75bed46000-7f75bed47000 r-xp ...
7f75bed47000-7f75bed4c000 rw-p ...
7f75bed4c000-7f75bed4d000 r--p ... /lib64/ld-linux-x86-64.so.2
7f75bed4d000-7f75bed4e000 rw-p ... /lib64/ld-linux-x86-64.so.2
7f75bed4e000-7f75bed4f000 rw-p ...
7fffb3741000-7fffb3762000 rw-p ... [stack]
7fffb377b000-7fffb377d000 r--p ... [vvar]
7fffb377d000-7fffb377f000 r-xp ... [vdso]
The change is to add a call the newly created arch_mmap_rnd() into the
ELF loader for handling ET_DYN ASLR in a separate region from mmap ASLR,
as was already done on s390. Removes CONFIG_BINFMT_ELF_RANDOMIZE_PIE,
which is no longer needed.
Reported-by: Hector Marco-Gisbert <hecmargi@upv.es>
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/arm/Kconfig | 1 -
arch/arm64/Kconfig | 1 -
arch/mips/Kconfig | 1 -
arch/powerpc/Kconfig | 1 -
arch/s390/include/asm/elf.h | 5 ++---
arch/s390/mm/mmap.c | 8 --------
arch/x86/Kconfig | 1 -
fs/Kconfig.binfmt | 3 ---
fs/binfmt_elf.c | 18 ++++--------------
9 files changed, 6 insertions(+), 33 deletions(-)
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 248d99cabaa8..e2f0ef9c6ee3 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1,7 +1,6 @@
config ARM
bool
default y
- select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 5f469095e0e2..07e0fc7adc88 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1,6 +1,5 @@
config ARM64
def_bool y
- select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_GCOV_PROFILE_ALL
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 72ce5cece768..557c5f1772c1 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -23,7 +23,6 @@ config MIPS
select HAVE_KRETPROBES
select HAVE_DEBUG_KMEMLEAK
select HAVE_SYSCALL_TRACEPOINTS
- select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ELF_RANDOMIZE
select HAVE_ARCH_TRANSPARENT_HUGEPAGE if CPU_SUPPORTS_HUGEPAGES && 64BIT
select RTC_LIB if !MACH_LOONGSON
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 14fe1c411489..910fa4f9ad1e 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -88,7 +88,6 @@ config PPC
select ARCH_MIGHT_HAVE_PC_PARPORT
select ARCH_MIGHT_HAVE_PC_SERIO
select BINFMT_ELF
- select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ELF_RANDOMIZE
select OF
select OF_EARLY_FLATTREE
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index 2e63de8aac7c..d0db9d944b6d 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -163,10 +163,9 @@ extern unsigned int vdso_enabled;
the loader. We need to make sure that it is out of the way of the program
that it will "exec", and that there is sufficient room for the brk. 64-bit
tasks are aligned to 4GB. */
-extern unsigned long randomize_et_dyn(void);
-#define ELF_ET_DYN_BASE (randomize_et_dyn() + (is_32bit_task() ? \
+#define ELF_ET_DYN_BASE (is_32bit_task() ? \
(STACK_TOP / 3 * 2) : \
- (STACK_TOP / 3 * 2) & ~((1UL << 32) - 1)))
+ (STACK_TOP / 3 * 2) & ~((1UL << 32) - 1))
/* This yields a mask that user programs can use to figure out what
instruction set this CPU supports. */
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index 8c11536f972d..bb3367c5cb0b 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -177,14 +177,6 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
return addr;
}
-unsigned long randomize_et_dyn(void)
-{
- if (current->flags & PF_RANDOMIZE)
- return arch_mmap_rnd();
-
- return 0UL;
-}
-
#ifndef CONFIG_64BIT
/*
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 9aa91727fbf8..328be0fab910 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -87,7 +87,6 @@ config X86
select HAVE_ARCH_KMEMCHECK
select HAVE_ARCH_KASAN if X86_64 && SPARSEMEM_VMEMMAP
select HAVE_USER_RETURN_NOTIFIER
- select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ELF_RANDOMIZE
select HAVE_ARCH_JUMP_LABEL
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
index 270c48148f79..2d0cbbd14cfc 100644
--- a/fs/Kconfig.binfmt
+++ b/fs/Kconfig.binfmt
@@ -27,9 +27,6 @@ config COMPAT_BINFMT_ELF
bool
depends on COMPAT && BINFMT_ELF
-config ARCH_BINFMT_ELF_RANDOMIZE_PIE
- bool
-
config ARCH_BINFMT_ELF_STATE
bool
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 995986b8e36b..6f08f5fa99dc 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -31,6 +31,7 @@
#include <linux/security.h>
#include <linux/random.h>
#include <linux/elf.h>
+#include <linux/elf-randomize.h>
#include <linux/utsname.h>
#include <linux/coredump.h>
#include <linux/sched.h>
@@ -909,21 +910,10 @@ static int load_elf_binary(struct linux_binprm *bprm)
* default mmap base, as well as whatever program they
* might try to exec. This is because the brk will
* follow the loader, and is not movable. */
-#ifdef CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE
- /* Memory randomization might have been switched off
- * in runtime via sysctl or explicit setting of
- * personality flags.
- * If that is the case, retain the original non-zero
- * load_bias value in order to establish proper
- * non-randomized mappings.
- */
+ load_bias = ELF_ET_DYN_BASE - vaddr;
if (current->flags & PF_RANDOMIZE)
- load_bias = 0;
- else
- load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
-#else
- load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
-#endif
+ load_bias += arch_mmap_rnd();
+ load_bias = ELF_PAGESTART(load_bias);
}
error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 09/10] mm: split ET_DYN ASLR from mmap ASLR
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun
This fixes the "offset2lib" weakness in ASLR for arm, arm64, mips,
powerpc, and x86. The problem is that if there is a leak of ASLR from
the executable (ET_DYN), it means a leak of shared library offset as
well (mmap), and vice versa. Further details and a PoC of this attack
is available here:
http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html
With this patch, a PIE linked executable (ET_DYN) has its own ASLR region
(e.g. 0x5... instead of 0x7f... on x86_64):
$ ./show_mmaps_pie
54859ccd6000-54859ccd7000 r-xp ... /tmp/show_mmaps_pie
54859ced6000-54859ced7000 r--p ... /tmp/show_mmaps_pie
54859ced7000-54859ced8000 rw-p ... /tmp/show_mmaps_pie
7f75be764000-7f75be91f000 r-xp ... /lib/x86_64-linux-gnu/libc.so.6
7f75be91f000-7f75beb1f000 ---p ... /lib/x86_64-linux-gnu/libc.so.6
7f75beb1f000-7f75beb23000 r--p ... /lib/x86_64-linux-gnu/libc.so.6
7f75beb23000-7f75beb25000 rw-p ... /lib/x86_64-linux-gnu/libc.so.6
7f75beb25000-7f75beb2a000 rw-p ...
7f75beb2a000-7f75beb4d000 r-xp ... /lib64/ld-linux-x86-64.so.2
7f75bed45000-7f75bed46000 rw-p ...
7f75bed46000-7f75bed47000 r-xp ...
7f75bed47000-7f75bed4c000 rw-p ...
7f75bed4c000-7f75bed4d000 r--p ... /lib64/ld-linux-x86-64.so.2
7f75bed4d000-7f75bed4e000 rw-p ... /lib64/ld-linux-x86-64.so.2
7f75bed4e000-7f75bed4f000 rw-p ...
7fffb3741000-7fffb3762000 rw-p ... [stack]
7fffb377b000-7fffb377d000 r--p ... [vvar]
7fffb377d000-7fffb377f000 r-xp ... [vdso]
The change is to add a call the newly created arch_mmap_rnd() into the
ELF loader for handling ET_DYN ASLR in a separate region from mmap ASLR,
as was already done on s390. Removes CONFIG_BINFMT_ELF_RANDOMIZE_PIE,
which is no longer needed.
Reported-by: Hector Marco-Gisbert <hecmargi@upv.es>
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/arm/Kconfig | 1 -
arch/arm64/Kconfig | 1 -
arch/mips/Kconfig | 1 -
arch/powerpc/Kconfig | 1 -
arch/s390/include/asm/elf.h | 5 ++---
arch/s390/mm/mmap.c | 8 --------
arch/x86/Kconfig | 1 -
fs/Kconfig.binfmt | 3 ---
fs/binfmt_elf.c | 18 ++++--------------
9 files changed, 6 insertions(+), 33 deletions(-)
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 248d99cabaa8..e2f0ef9c6ee3 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1,7 +1,6 @@
config ARM
bool
default y
- select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 5f469095e0e2..07e0fc7adc88 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1,6 +1,5 @@
config ARM64
def_bool y
- select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_GCOV_PROFILE_ALL
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 72ce5cece768..557c5f1772c1 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -23,7 +23,6 @@ config MIPS
select HAVE_KRETPROBES
select HAVE_DEBUG_KMEMLEAK
select HAVE_SYSCALL_TRACEPOINTS
- select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ELF_RANDOMIZE
select HAVE_ARCH_TRANSPARENT_HUGEPAGE if CPU_SUPPORTS_HUGEPAGES && 64BIT
select RTC_LIB if !MACH_LOONGSON
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 14fe1c411489..910fa4f9ad1e 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -88,7 +88,6 @@ config PPC
select ARCH_MIGHT_HAVE_PC_PARPORT
select ARCH_MIGHT_HAVE_PC_SERIO
select BINFMT_ELF
- select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ELF_RANDOMIZE
select OF
select OF_EARLY_FLATTREE
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index 2e63de8aac7c..d0db9d944b6d 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -163,10 +163,9 @@ extern unsigned int vdso_enabled;
the loader. We need to make sure that it is out of the way of the program
that it will "exec", and that there is sufficient room for the brk. 64-bit
tasks are aligned to 4GB. */
-extern unsigned long randomize_et_dyn(void);
-#define ELF_ET_DYN_BASE (randomize_et_dyn() + (is_32bit_task() ? \
+#define ELF_ET_DYN_BASE (is_32bit_task() ? \
(STACK_TOP / 3 * 2) : \
- (STACK_TOP / 3 * 2) & ~((1UL << 32) - 1)))
+ (STACK_TOP / 3 * 2) & ~((1UL << 32) - 1))
/* This yields a mask that user programs can use to figure out what
instruction set this CPU supports. */
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index 8c11536f972d..bb3367c5cb0b 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -177,14 +177,6 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
return addr;
}
-unsigned long randomize_et_dyn(void)
-{
- if (current->flags & PF_RANDOMIZE)
- return arch_mmap_rnd();
-
- return 0UL;
-}
-
#ifndef CONFIG_64BIT
/*
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 9aa91727fbf8..328be0fab910 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -87,7 +87,6 @@ config X86
select HAVE_ARCH_KMEMCHECK
select HAVE_ARCH_KASAN if X86_64 && SPARSEMEM_VMEMMAP
select HAVE_USER_RETURN_NOTIFIER
- select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ELF_RANDOMIZE
select HAVE_ARCH_JUMP_LABEL
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
index 270c48148f79..2d0cbbd14cfc 100644
--- a/fs/Kconfig.binfmt
+++ b/fs/Kconfig.binfmt
@@ -27,9 +27,6 @@ config COMPAT_BINFMT_ELF
bool
depends on COMPAT && BINFMT_ELF
-config ARCH_BINFMT_ELF_RANDOMIZE_PIE
- bool
-
config ARCH_BINFMT_ELF_STATE
bool
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 995986b8e36b..6f08f5fa99dc 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -31,6 +31,7 @@
#include <linux/security.h>
#include <linux/random.h>
#include <linux/elf.h>
+#include <linux/elf-randomize.h>
#include <linux/utsname.h>
#include <linux/coredump.h>
#include <linux/sched.h>
@@ -909,21 +910,10 @@ static int load_elf_binary(struct linux_binprm *bprm)
* default mmap base, as well as whatever program they
* might try to exec. This is because the brk will
* follow the loader, and is not movable. */
-#ifdef CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE
- /* Memory randomization might have been switched off
- * in runtime via sysctl or explicit setting of
- * personality flags.
- * If that is the case, retain the original non-zero
- * load_bias value in order to establish proper
- * non-randomized mappings.
- */
+ load_bias = ELF_ET_DYN_BASE - vaddr;
if (current->flags & PF_RANDOMIZE)
- load_bias = 0;
- else
- load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
-#else
- load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
-#endif
+ load_bias += arch_mmap_rnd();
+ load_bias = ELF_PAGESTART(load_bias);
}
error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 09/10] mm: split ET_DYN ASLR from mmap ASLR
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: linux-mips, Arun Chandran, Heiko Carstens, linux-kernel,
Min-Hua Chen, Paul Mackerras, Ismael Ripoll, Yann Droneaud,
linux-s390, Russell King, Andrey Ryabinin, x86,
Hector Marco-Gisbert, Ingo Molnar, David A. Long,
Catalin Marinas, Borislav Petkov, Ben Hutchings, Kees Cook,
Will Deacon, linux-fsdevel, Alexander Viro, Michael Holzheu,
linux-arm-kernel, Jeff Bailey, Paul Burton, Oleg Nesterov,
Ralf Baechle, Andy Lutomirski, Vineeth Vijayan, Markos Chandras,
Jan-Simon Möller, Martin Schwidefsky, linux390,
linuxppc-dev, Alex Smith
This fixes the "offset2lib" weakness in ASLR for arm, arm64, mips,
powerpc, and x86. The problem is that if there is a leak of ASLR from
the executable (ET_DYN), it means a leak of shared library offset as
well (mmap), and vice versa. Further details and a PoC of this attack
is available here:
http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html
With this patch, a PIE linked executable (ET_DYN) has its own ASLR region
(e.g. 0x5... instead of 0x7f... on x86_64):
$ ./show_mmaps_pie
54859ccd6000-54859ccd7000 r-xp ... /tmp/show_mmaps_pie
54859ced6000-54859ced7000 r--p ... /tmp/show_mmaps_pie
54859ced7000-54859ced8000 rw-p ... /tmp/show_mmaps_pie
7f75be764000-7f75be91f000 r-xp ... /lib/x86_64-linux-gnu/libc.so.6
7f75be91f000-7f75beb1f000 ---p ... /lib/x86_64-linux-gnu/libc.so.6
7f75beb1f000-7f75beb23000 r--p ... /lib/x86_64-linux-gnu/libc.so.6
7f75beb23000-7f75beb25000 rw-p ... /lib/x86_64-linux-gnu/libc.so.6
7f75beb25000-7f75beb2a000 rw-p ...
7f75beb2a000-7f75beb4d000 r-xp ... /lib64/ld-linux-x86-64.so.2
7f75bed45000-7f75bed46000 rw-p ...
7f75bed46000-7f75bed47000 r-xp ...
7f75bed47000-7f75bed4c000 rw-p ...
7f75bed4c000-7f75bed4d000 r--p ... /lib64/ld-linux-x86-64.so.2
7f75bed4d000-7f75bed4e000 rw-p ... /lib64/ld-linux-x86-64.so.2
7f75bed4e000-7f75bed4f000 rw-p ...
7fffb3741000-7fffb3762000 rw-p ... [stack]
7fffb377b000-7fffb377d000 r--p ... [vvar]
7fffb377d000-7fffb377f000 r-xp ... [vdso]
The change is to add a call the newly created arch_mmap_rnd() into the
ELF loader for handling ET_DYN ASLR in a separate region from mmap ASLR,
as was already done on s390. Removes CONFIG_BINFMT_ELF_RANDOMIZE_PIE,
which is no longer needed.
Reported-by: Hector Marco-Gisbert <hecmargi@upv.es>
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/arm/Kconfig | 1 -
arch/arm64/Kconfig | 1 -
arch/mips/Kconfig | 1 -
arch/powerpc/Kconfig | 1 -
arch/s390/include/asm/elf.h | 5 ++---
arch/s390/mm/mmap.c | 8 --------
arch/x86/Kconfig | 1 -
fs/Kconfig.binfmt | 3 ---
fs/binfmt_elf.c | 18 ++++--------------
9 files changed, 6 insertions(+), 33 deletions(-)
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 248d99cabaa8..e2f0ef9c6ee3 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1,7 +1,6 @@
config ARM
bool
default y
- select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 5f469095e0e2..07e0fc7adc88 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1,6 +1,5 @@
config ARM64
def_bool y
- select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_GCOV_PROFILE_ALL
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 72ce5cece768..557c5f1772c1 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -23,7 +23,6 @@ config MIPS
select HAVE_KRETPROBES
select HAVE_DEBUG_KMEMLEAK
select HAVE_SYSCALL_TRACEPOINTS
- select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ELF_RANDOMIZE
select HAVE_ARCH_TRANSPARENT_HUGEPAGE if CPU_SUPPORTS_HUGEPAGES && 64BIT
select RTC_LIB if !MACH_LOONGSON
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 14fe1c411489..910fa4f9ad1e 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -88,7 +88,6 @@ config PPC
select ARCH_MIGHT_HAVE_PC_PARPORT
select ARCH_MIGHT_HAVE_PC_SERIO
select BINFMT_ELF
- select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ELF_RANDOMIZE
select OF
select OF_EARLY_FLATTREE
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index 2e63de8aac7c..d0db9d944b6d 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -163,10 +163,9 @@ extern unsigned int vdso_enabled;
the loader. We need to make sure that it is out of the way of the program
that it will "exec", and that there is sufficient room for the brk. 64-bit
tasks are aligned to 4GB. */
-extern unsigned long randomize_et_dyn(void);
-#define ELF_ET_DYN_BASE (randomize_et_dyn() + (is_32bit_task() ? \
+#define ELF_ET_DYN_BASE (is_32bit_task() ? \
(STACK_TOP / 3 * 2) : \
- (STACK_TOP / 3 * 2) & ~((1UL << 32) - 1)))
+ (STACK_TOP / 3 * 2) & ~((1UL << 32) - 1))
/* This yields a mask that user programs can use to figure out what
instruction set this CPU supports. */
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index 8c11536f972d..bb3367c5cb0b 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -177,14 +177,6 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
return addr;
}
-unsigned long randomize_et_dyn(void)
-{
- if (current->flags & PF_RANDOMIZE)
- return arch_mmap_rnd();
-
- return 0UL;
-}
-
#ifndef CONFIG_64BIT
/*
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 9aa91727fbf8..328be0fab910 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -87,7 +87,6 @@ config X86
select HAVE_ARCH_KMEMCHECK
select HAVE_ARCH_KASAN if X86_64 && SPARSEMEM_VMEMMAP
select HAVE_USER_RETURN_NOTIFIER
- select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ELF_RANDOMIZE
select HAVE_ARCH_JUMP_LABEL
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
index 270c48148f79..2d0cbbd14cfc 100644
--- a/fs/Kconfig.binfmt
+++ b/fs/Kconfig.binfmt
@@ -27,9 +27,6 @@ config COMPAT_BINFMT_ELF
bool
depends on COMPAT && BINFMT_ELF
-config ARCH_BINFMT_ELF_RANDOMIZE_PIE
- bool
-
config ARCH_BINFMT_ELF_STATE
bool
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 995986b8e36b..6f08f5fa99dc 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -31,6 +31,7 @@
#include <linux/security.h>
#include <linux/random.h>
#include <linux/elf.h>
+#include <linux/elf-randomize.h>
#include <linux/utsname.h>
#include <linux/coredump.h>
#include <linux/sched.h>
@@ -909,21 +910,10 @@ static int load_elf_binary(struct linux_binprm *bprm)
* default mmap base, as well as whatever program they
* might try to exec. This is because the brk will
* follow the loader, and is not movable. */
-#ifdef CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE
- /* Memory randomization might have been switched off
- * in runtime via sysctl or explicit setting of
- * personality flags.
- * If that is the case, retain the original non-zero
- * load_bias value in order to establish proper
- * non-randomized mappings.
- */
+ load_bias = ELF_ET_DYN_BASE - vaddr;
if (current->flags & PF_RANDOMIZE)
- load_bias = 0;
- else
- load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
-#else
- load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
-#endif
+ load_bias += arch_mmap_rnd();
+ load_bias = ELF_PAGESTART(load_bias);
}
error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 09/10] mm: split ET_DYN ASLR from mmap ASLR
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: linux-arm-kernel
This fixes the "offset2lib" weakness in ASLR for arm, arm64, mips,
powerpc, and x86. The problem is that if there is a leak of ASLR from
the executable (ET_DYN), it means a leak of shared library offset as
well (mmap), and vice versa. Further details and a PoC of this attack
is available here:
http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html
With this patch, a PIE linked executable (ET_DYN) has its own ASLR region
(e.g. 0x5... instead of 0x7f... on x86_64):
$ ./show_mmaps_pie
54859ccd6000-54859ccd7000 r-xp ... /tmp/show_mmaps_pie
54859ced6000-54859ced7000 r--p ... /tmp/show_mmaps_pie
54859ced7000-54859ced8000 rw-p ... /tmp/show_mmaps_pie
7f75be764000-7f75be91f000 r-xp ... /lib/x86_64-linux-gnu/libc.so.6
7f75be91f000-7f75beb1f000 ---p ... /lib/x86_64-linux-gnu/libc.so.6
7f75beb1f000-7f75beb23000 r--p ... /lib/x86_64-linux-gnu/libc.so.6
7f75beb23000-7f75beb25000 rw-p ... /lib/x86_64-linux-gnu/libc.so.6
7f75beb25000-7f75beb2a000 rw-p ...
7f75beb2a000-7f75beb4d000 r-xp ... /lib64/ld-linux-x86-64.so.2
7f75bed45000-7f75bed46000 rw-p ...
7f75bed46000-7f75bed47000 r-xp ...
7f75bed47000-7f75bed4c000 rw-p ...
7f75bed4c000-7f75bed4d000 r--p ... /lib64/ld-linux-x86-64.so.2
7f75bed4d000-7f75bed4e000 rw-p ... /lib64/ld-linux-x86-64.so.2
7f75bed4e000-7f75bed4f000 rw-p ...
7fffb3741000-7fffb3762000 rw-p ... [stack]
7fffb377b000-7fffb377d000 r--p ... [vvar]
7fffb377d000-7fffb377f000 r-xp ... [vdso]
The change is to add a call the newly created arch_mmap_rnd() into the
ELF loader for handling ET_DYN ASLR in a separate region from mmap ASLR,
as was already done on s390. Removes CONFIG_BINFMT_ELF_RANDOMIZE_PIE,
which is no longer needed.
Reported-by: Hector Marco-Gisbert <hecmargi@upv.es>
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/arm/Kconfig | 1 -
arch/arm64/Kconfig | 1 -
arch/mips/Kconfig | 1 -
arch/powerpc/Kconfig | 1 -
arch/s390/include/asm/elf.h | 5 ++---
arch/s390/mm/mmap.c | 8 --------
arch/x86/Kconfig | 1 -
fs/Kconfig.binfmt | 3 ---
fs/binfmt_elf.c | 18 ++++--------------
9 files changed, 6 insertions(+), 33 deletions(-)
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 248d99cabaa8..e2f0ef9c6ee3 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1,7 +1,6 @@
config ARM
bool
default y
- select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 5f469095e0e2..07e0fc7adc88 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1,6 +1,5 @@
config ARM64
def_bool y
- select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
select ARCH_HAS_ELF_RANDOMIZE
select ARCH_HAS_GCOV_PROFILE_ALL
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 72ce5cece768..557c5f1772c1 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -23,7 +23,6 @@ config MIPS
select HAVE_KRETPROBES
select HAVE_DEBUG_KMEMLEAK
select HAVE_SYSCALL_TRACEPOINTS
- select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ELF_RANDOMIZE
select HAVE_ARCH_TRANSPARENT_HUGEPAGE if CPU_SUPPORTS_HUGEPAGES && 64BIT
select RTC_LIB if !MACH_LOONGSON
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 14fe1c411489..910fa4f9ad1e 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -88,7 +88,6 @@ config PPC
select ARCH_MIGHT_HAVE_PC_PARPORT
select ARCH_MIGHT_HAVE_PC_SERIO
select BINFMT_ELF
- select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ELF_RANDOMIZE
select OF
select OF_EARLY_FLATTREE
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index 2e63de8aac7c..d0db9d944b6d 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -163,10 +163,9 @@ extern unsigned int vdso_enabled;
the loader. We need to make sure that it is out of the way of the program
that it will "exec", and that there is sufficient room for the brk. 64-bit
tasks are aligned to 4GB. */
-extern unsigned long randomize_et_dyn(void);
-#define ELF_ET_DYN_BASE (randomize_et_dyn() + (is_32bit_task() ? \
+#define ELF_ET_DYN_BASE (is_32bit_task() ? \
(STACK_TOP / 3 * 2) : \
- (STACK_TOP / 3 * 2) & ~((1UL << 32) - 1)))
+ (STACK_TOP / 3 * 2) & ~((1UL << 32) - 1))
/* This yields a mask that user programs can use to figure out what
instruction set this CPU supports. */
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index 8c11536f972d..bb3367c5cb0b 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -177,14 +177,6 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
return addr;
}
-unsigned long randomize_et_dyn(void)
-{
- if (current->flags & PF_RANDOMIZE)
- return arch_mmap_rnd();
-
- return 0UL;
-}
-
#ifndef CONFIG_64BIT
/*
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 9aa91727fbf8..328be0fab910 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -87,7 +87,6 @@ config X86
select HAVE_ARCH_KMEMCHECK
select HAVE_ARCH_KASAN if X86_64 && SPARSEMEM_VMEMMAP
select HAVE_USER_RETURN_NOTIFIER
- select ARCH_BINFMT_ELF_RANDOMIZE_PIE
select ARCH_HAS_ELF_RANDOMIZE
select HAVE_ARCH_JUMP_LABEL
select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
index 270c48148f79..2d0cbbd14cfc 100644
--- a/fs/Kconfig.binfmt
+++ b/fs/Kconfig.binfmt
@@ -27,9 +27,6 @@ config COMPAT_BINFMT_ELF
bool
depends on COMPAT && BINFMT_ELF
-config ARCH_BINFMT_ELF_RANDOMIZE_PIE
- bool
-
config ARCH_BINFMT_ELF_STATE
bool
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 995986b8e36b..6f08f5fa99dc 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -31,6 +31,7 @@
#include <linux/security.h>
#include <linux/random.h>
#include <linux/elf.h>
+#include <linux/elf-randomize.h>
#include <linux/utsname.h>
#include <linux/coredump.h>
#include <linux/sched.h>
@@ -909,21 +910,10 @@ static int load_elf_binary(struct linux_binprm *bprm)
* default mmap base, as well as whatever program they
* might try to exec. This is because the brk will
* follow the loader, and is not movable. */
-#ifdef CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE
- /* Memory randomization might have been switched off
- * in runtime via sysctl or explicit setting of
- * personality flags.
- * If that is the case, retain the original non-zero
- * load_bias value in order to establish proper
- * non-randomized mappings.
- */
+ load_bias = ELF_ET_DYN_BASE - vaddr;
if (current->flags & PF_RANDOMIZE)
- load_bias = 0;
- else
- load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
-#else
- load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
-#endif
+ load_bias += arch_mmap_rnd();
+ load_bias = ELF_PAGESTART(load_bias);
}
error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 10/10] mm: fold arch_randomize_brk into ARCH_HAS_ELF_RANDOMIZE
2015-03-04 21:10 ` Kees Cook
(?)
(?)
@ 2015-03-04 21:10 ` Kees Cook
-1 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun Chandran, Yann Droneaud, Min-Hua Chen,
Paul Burton, Alex Smith, Markos Chandras, Vineeth Vijayan,
Jeff Bailey, Michael Holzheu, Ben Hutchings, Borislav Petkov,
Jan-Simon Möller, linux-kernel, linux-arm-kernel,
linux-mips, linuxppc-dev, linux-s390, linux-fsdevel
The arch_randomize_brk() function is used on several architectures,
even those that don't support ET_DYN ASLR. To avoid bulky extern/#define
tricks, consolidate the support under CONFIG_ARCH_HAS_ELF_RANDOMIZE for
the architectures that support it, while still handling CONFIG_COMPAT_BRK.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/Kconfig | 1 +
arch/arm/include/asm/elf.h | 4 ----
arch/arm64/include/asm/elf.h | 4 ----
arch/mips/include/asm/elf.h | 4 ----
arch/powerpc/include/asm/elf.h | 4 ----
arch/s390/include/asm/elf.h | 3 ---
arch/x86/include/asm/elf.h | 3 ---
fs/binfmt_elf.c | 4 +---
include/linux/elf-randomize.h | 12 ++++++++++++
9 files changed, 14 insertions(+), 25 deletions(-)
diff --git a/arch/Kconfig b/arch/Kconfig
index 9ff5aa8fa2c1..d4f270a54fe6 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -490,6 +490,7 @@ config ARCH_HAS_ELF_RANDOMIZE
An architecture supports choosing randomized locations for
stack, mmap, brk, and ET_DYN. Defined functions:
- arch_mmap_rnd()
+ - arch_randomize_brk()
#
# ABI hall of shame
diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
index afb9cafd3786..c1ff8ab12914 100644
--- a/arch/arm/include/asm/elf.h
+++ b/arch/arm/include/asm/elf.h
@@ -125,10 +125,6 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
extern void elf_set_personality(const struct elf32_hdr *);
#define SET_PERSONALITY(ex) elf_set_personality(&(ex))
-struct mm_struct;
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
#ifdef CONFIG_MMU
#define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
struct linux_binprm;
diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index f724db00b235..faad6df49e5b 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -156,10 +156,6 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
#define STACK_RND_MASK (0x3ffff >> (PAGE_SHIFT - 12))
#endif
-struct mm_struct;
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
#ifdef CONFIG_COMPAT
#ifdef __AARCH64EB__
diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
index 535f196ffe02..31d747d46a23 100644
--- a/arch/mips/include/asm/elf.h
+++ b/arch/mips/include/asm/elf.h
@@ -410,10 +410,6 @@ struct linux_binprm;
extern int arch_setup_additional_pages(struct linux_binprm *bprm,
int uses_interp);
-struct mm_struct;
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
struct arch_elf_state {
int fp_abi;
int interp_fp_abi;
diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
index 57d289acb803..ee46ffef608e 100644
--- a/arch/powerpc/include/asm/elf.h
+++ b/arch/powerpc/include/asm/elf.h
@@ -128,10 +128,6 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
(0x7ff >> (PAGE_SHIFT - 12)) : \
(0x3ffff >> (PAGE_SHIFT - 12)))
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
-
#ifdef CONFIG_SPU_BASE
/* Notes used in ET_CORE. Note name is "SPU/<fd>/<filename>". */
#define NT_SPU 1
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index d0db9d944b6d..fdda72e56404 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -226,9 +226,6 @@ struct linux_binprm;
#define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
int arch_setup_additional_pages(struct linux_binprm *, int);
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
void *fill_cpu_elf_notes(void *ptr, struct save_area *sa, __vector128 *vxrs);
#endif
diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index ca3347a9dab5..bbdace22daf8 100644
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -338,9 +338,6 @@ extern int compat_arch_setup_additional_pages(struct linux_binprm *bprm,
int uses_interp);
#define compat_arch_setup_additional_pages compat_arch_setup_additional_pages
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
/*
* True on X86_32 or when emulating IA32 on X86_64
*/
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 6f08f5fa99dc..a115da230ce0 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1043,15 +1043,13 @@ static int load_elf_binary(struct linux_binprm *bprm)
current->mm->end_data = end_data;
current->mm->start_stack = bprm->p;
-#ifdef arch_randomize_brk
if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
current->mm->brk = current->mm->start_brk =
arch_randomize_brk(current->mm);
-#ifdef CONFIG_COMPAT_BRK
+#ifdef compat_brk_randomized
current->brk_randomized = 1;
#endif
}
-#endif
if (current->personality & MMAP_PAGE_ZERO) {
/* Why this, you ask??? Well SVr4 maps page 0 as read-only,
diff --git a/include/linux/elf-randomize.h b/include/linux/elf-randomize.h
index 7a4eda02d2b1..b5f0bda9472e 100644
--- a/include/linux/elf-randomize.h
+++ b/include/linux/elf-randomize.h
@@ -1,10 +1,22 @@
#ifndef _ELF_RANDOMIZE_H
#define _ELF_RANDOMIZE_H
+struct mm_struct;
+
#ifndef CONFIG_ARCH_HAS_ELF_RANDOMIZE
static inline unsigned long arch_mmap_rnd(void) { return 0; }
+# if defined(arch_randomize_brk) && defined(CONFIG_COMPAT_BRK)
+# define compat_brk_randomized
+# endif
+# ifndef arch_randomize_brk
+# define arch_randomize_brk(mm) (mm->brk)
+# endif
#else
extern unsigned long arch_mmap_rnd(void);
+extern unsigned long arch_randomize_brk(struct mm_struct *mm);
+# ifdef CONFIG_COMPAT_BRK
+# define compat_brk_randomized
+# endif
#endif
#endif
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 10/10] mm: fold arch_randomize_brk into ARCH_HAS_ELF_RANDOMIZE
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: Kees Cook, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun
The arch_randomize_brk() function is used on several architectures,
even those that don't support ET_DYN ASLR. To avoid bulky extern/#define
tricks, consolidate the support under CONFIG_ARCH_HAS_ELF_RANDOMIZE for
the architectures that support it, while still handling CONFIG_COMPAT_BRK.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/Kconfig | 1 +
arch/arm/include/asm/elf.h | 4 ----
arch/arm64/include/asm/elf.h | 4 ----
arch/mips/include/asm/elf.h | 4 ----
arch/powerpc/include/asm/elf.h | 4 ----
arch/s390/include/asm/elf.h | 3 ---
arch/x86/include/asm/elf.h | 3 ---
fs/binfmt_elf.c | 4 +---
include/linux/elf-randomize.h | 12 ++++++++++++
9 files changed, 14 insertions(+), 25 deletions(-)
diff --git a/arch/Kconfig b/arch/Kconfig
index 9ff5aa8fa2c1..d4f270a54fe6 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -490,6 +490,7 @@ config ARCH_HAS_ELF_RANDOMIZE
An architecture supports choosing randomized locations for
stack, mmap, brk, and ET_DYN. Defined functions:
- arch_mmap_rnd()
+ - arch_randomize_brk()
#
# ABI hall of shame
diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
index afb9cafd3786..c1ff8ab12914 100644
--- a/arch/arm/include/asm/elf.h
+++ b/arch/arm/include/asm/elf.h
@@ -125,10 +125,6 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
extern void elf_set_personality(const struct elf32_hdr *);
#define SET_PERSONALITY(ex) elf_set_personality(&(ex))
-struct mm_struct;
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
#ifdef CONFIG_MMU
#define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
struct linux_binprm;
diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index f724db00b235..faad6df49e5b 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -156,10 +156,6 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
#define STACK_RND_MASK (0x3ffff >> (PAGE_SHIFT - 12))
#endif
-struct mm_struct;
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
#ifdef CONFIG_COMPAT
#ifdef __AARCH64EB__
diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
index 535f196ffe02..31d747d46a23 100644
--- a/arch/mips/include/asm/elf.h
+++ b/arch/mips/include/asm/elf.h
@@ -410,10 +410,6 @@ struct linux_binprm;
extern int arch_setup_additional_pages(struct linux_binprm *bprm,
int uses_interp);
-struct mm_struct;
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
struct arch_elf_state {
int fp_abi;
int interp_fp_abi;
diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
index 57d289acb803..ee46ffef608e 100644
--- a/arch/powerpc/include/asm/elf.h
+++ b/arch/powerpc/include/asm/elf.h
@@ -128,10 +128,6 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
(0x7ff >> (PAGE_SHIFT - 12)) : \
(0x3ffff >> (PAGE_SHIFT - 12)))
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
-
#ifdef CONFIG_SPU_BASE
/* Notes used in ET_CORE. Note name is "SPU/<fd>/<filename>". */
#define NT_SPU 1
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index d0db9d944b6d..fdda72e56404 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -226,9 +226,6 @@ struct linux_binprm;
#define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
int arch_setup_additional_pages(struct linux_binprm *, int);
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
void *fill_cpu_elf_notes(void *ptr, struct save_area *sa, __vector128 *vxrs);
#endif
diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index ca3347a9dab5..bbdace22daf8 100644
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -338,9 +338,6 @@ extern int compat_arch_setup_additional_pages(struct linux_binprm *bprm,
int uses_interp);
#define compat_arch_setup_additional_pages compat_arch_setup_additional_pages
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
/*
* True on X86_32 or when emulating IA32 on X86_64
*/
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 6f08f5fa99dc..a115da230ce0 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1043,15 +1043,13 @@ static int load_elf_binary(struct linux_binprm *bprm)
current->mm->end_data = end_data;
current->mm->start_stack = bprm->p;
-#ifdef arch_randomize_brk
if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
current->mm->brk = current->mm->start_brk =
arch_randomize_brk(current->mm);
-#ifdef CONFIG_COMPAT_BRK
+#ifdef compat_brk_randomized
current->brk_randomized = 1;
#endif
}
-#endif
if (current->personality & MMAP_PAGE_ZERO) {
/* Why this, you ask??? Well SVr4 maps page 0 as read-only,
diff --git a/include/linux/elf-randomize.h b/include/linux/elf-randomize.h
index 7a4eda02d2b1..b5f0bda9472e 100644
--- a/include/linux/elf-randomize.h
+++ b/include/linux/elf-randomize.h
@@ -1,10 +1,22 @@
#ifndef _ELF_RANDOMIZE_H
#define _ELF_RANDOMIZE_H
+struct mm_struct;
+
#ifndef CONFIG_ARCH_HAS_ELF_RANDOMIZE
static inline unsigned long arch_mmap_rnd(void) { return 0; }
+# if defined(arch_randomize_brk) && defined(CONFIG_COMPAT_BRK)
+# define compat_brk_randomized
+# endif
+# ifndef arch_randomize_brk
+# define arch_randomize_brk(mm) (mm->brk)
+# endif
#else
extern unsigned long arch_mmap_rnd(void);
+extern unsigned long arch_randomize_brk(struct mm_struct *mm);
+# ifdef CONFIG_COMPAT_BRK
+# define compat_brk_randomized
+# endif
#endif
#endif
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 10/10] mm: fold arch_randomize_brk into ARCH_HAS_ELF_RANDOMIZE
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: akpm
Cc: linux-mips, Arun Chandran, Heiko Carstens, linux-kernel,
Min-Hua Chen, Paul Mackerras, Ismael Ripoll, Yann Droneaud,
linux-s390, Russell King, Andrey Ryabinin, x86,
Hector Marco-Gisbert, Ingo Molnar, David A. Long,
Catalin Marinas, Borislav Petkov, Ben Hutchings, Kees Cook,
Will Deacon, linux-fsdevel, Alexander Viro, Michael Holzheu,
linux-arm-kernel, Jeff Bailey, Paul Burton, Oleg Nesterov,
Ralf Baechle, Andy Lutomirski, Vineeth Vijayan, Markos Chandras,
Jan-Simon Möller, Martin Schwidefsky, linux390,
linuxppc-dev, Alex Smith
The arch_randomize_brk() function is used on several architectures,
even those that don't support ET_DYN ASLR. To avoid bulky extern/#define
tricks, consolidate the support under CONFIG_ARCH_HAS_ELF_RANDOMIZE for
the architectures that support it, while still handling CONFIG_COMPAT_BRK.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/Kconfig | 1 +
arch/arm/include/asm/elf.h | 4 ----
arch/arm64/include/asm/elf.h | 4 ----
arch/mips/include/asm/elf.h | 4 ----
arch/powerpc/include/asm/elf.h | 4 ----
arch/s390/include/asm/elf.h | 3 ---
arch/x86/include/asm/elf.h | 3 ---
fs/binfmt_elf.c | 4 +---
include/linux/elf-randomize.h | 12 ++++++++++++
9 files changed, 14 insertions(+), 25 deletions(-)
diff --git a/arch/Kconfig b/arch/Kconfig
index 9ff5aa8fa2c1..d4f270a54fe6 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -490,6 +490,7 @@ config ARCH_HAS_ELF_RANDOMIZE
An architecture supports choosing randomized locations for
stack, mmap, brk, and ET_DYN. Defined functions:
- arch_mmap_rnd()
+ - arch_randomize_brk()
#
# ABI hall of shame
diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
index afb9cafd3786..c1ff8ab12914 100644
--- a/arch/arm/include/asm/elf.h
+++ b/arch/arm/include/asm/elf.h
@@ -125,10 +125,6 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
extern void elf_set_personality(const struct elf32_hdr *);
#define SET_PERSONALITY(ex) elf_set_personality(&(ex))
-struct mm_struct;
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
#ifdef CONFIG_MMU
#define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
struct linux_binprm;
diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index f724db00b235..faad6df49e5b 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -156,10 +156,6 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
#define STACK_RND_MASK (0x3ffff >> (PAGE_SHIFT - 12))
#endif
-struct mm_struct;
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
#ifdef CONFIG_COMPAT
#ifdef __AARCH64EB__
diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
index 535f196ffe02..31d747d46a23 100644
--- a/arch/mips/include/asm/elf.h
+++ b/arch/mips/include/asm/elf.h
@@ -410,10 +410,6 @@ struct linux_binprm;
extern int arch_setup_additional_pages(struct linux_binprm *bprm,
int uses_interp);
-struct mm_struct;
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
struct arch_elf_state {
int fp_abi;
int interp_fp_abi;
diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
index 57d289acb803..ee46ffef608e 100644
--- a/arch/powerpc/include/asm/elf.h
+++ b/arch/powerpc/include/asm/elf.h
@@ -128,10 +128,6 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
(0x7ff >> (PAGE_SHIFT - 12)) : \
(0x3ffff >> (PAGE_SHIFT - 12)))
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
-
#ifdef CONFIG_SPU_BASE
/* Notes used in ET_CORE. Note name is "SPU/<fd>/<filename>". */
#define NT_SPU 1
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index d0db9d944b6d..fdda72e56404 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -226,9 +226,6 @@ struct linux_binprm;
#define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
int arch_setup_additional_pages(struct linux_binprm *, int);
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
void *fill_cpu_elf_notes(void *ptr, struct save_area *sa, __vector128 *vxrs);
#endif
diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index ca3347a9dab5..bbdace22daf8 100644
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -338,9 +338,6 @@ extern int compat_arch_setup_additional_pages(struct linux_binprm *bprm,
int uses_interp);
#define compat_arch_setup_additional_pages compat_arch_setup_additional_pages
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
/*
* True on X86_32 or when emulating IA32 on X86_64
*/
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 6f08f5fa99dc..a115da230ce0 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1043,15 +1043,13 @@ static int load_elf_binary(struct linux_binprm *bprm)
current->mm->end_data = end_data;
current->mm->start_stack = bprm->p;
-#ifdef arch_randomize_brk
if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
current->mm->brk = current->mm->start_brk =
arch_randomize_brk(current->mm);
-#ifdef CONFIG_COMPAT_BRK
+#ifdef compat_brk_randomized
current->brk_randomized = 1;
#endif
}
-#endif
if (current->personality & MMAP_PAGE_ZERO) {
/* Why this, you ask??? Well SVr4 maps page 0 as read-only,
diff --git a/include/linux/elf-randomize.h b/include/linux/elf-randomize.h
index 7a4eda02d2b1..b5f0bda9472e 100644
--- a/include/linux/elf-randomize.h
+++ b/include/linux/elf-randomize.h
@@ -1,10 +1,22 @@
#ifndef _ELF_RANDOMIZE_H
#define _ELF_RANDOMIZE_H
+struct mm_struct;
+
#ifndef CONFIG_ARCH_HAS_ELF_RANDOMIZE
static inline unsigned long arch_mmap_rnd(void) { return 0; }
+# if defined(arch_randomize_brk) && defined(CONFIG_COMPAT_BRK)
+# define compat_brk_randomized
+# endif
+# ifndef arch_randomize_brk
+# define arch_randomize_brk(mm) (mm->brk)
+# endif
#else
extern unsigned long arch_mmap_rnd(void);
+extern unsigned long arch_randomize_brk(struct mm_struct *mm);
+# ifdef CONFIG_COMPAT_BRK
+# define compat_brk_randomized
+# endif
#endif
#endif
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* [PATCH v4 10/10] mm: fold arch_randomize_brk into ARCH_HAS_ELF_RANDOMIZE
@ 2015-03-04 21:10 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:10 UTC (permalink / raw)
To: linux-arm-kernel
The arch_randomize_brk() function is used on several architectures,
even those that don't support ET_DYN ASLR. To avoid bulky extern/#define
tricks, consolidate the support under CONFIG_ARCH_HAS_ELF_RANDOMIZE for
the architectures that support it, while still handling CONFIG_COMPAT_BRK.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/Kconfig | 1 +
arch/arm/include/asm/elf.h | 4 ----
arch/arm64/include/asm/elf.h | 4 ----
arch/mips/include/asm/elf.h | 4 ----
arch/powerpc/include/asm/elf.h | 4 ----
arch/s390/include/asm/elf.h | 3 ---
arch/x86/include/asm/elf.h | 3 ---
fs/binfmt_elf.c | 4 +---
include/linux/elf-randomize.h | 12 ++++++++++++
9 files changed, 14 insertions(+), 25 deletions(-)
diff --git a/arch/Kconfig b/arch/Kconfig
index 9ff5aa8fa2c1..d4f270a54fe6 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -490,6 +490,7 @@ config ARCH_HAS_ELF_RANDOMIZE
An architecture supports choosing randomized locations for
stack, mmap, brk, and ET_DYN. Defined functions:
- arch_mmap_rnd()
+ - arch_randomize_brk()
#
# ABI hall of shame
diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
index afb9cafd3786..c1ff8ab12914 100644
--- a/arch/arm/include/asm/elf.h
+++ b/arch/arm/include/asm/elf.h
@@ -125,10 +125,6 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
extern void elf_set_personality(const struct elf32_hdr *);
#define SET_PERSONALITY(ex) elf_set_personality(&(ex))
-struct mm_struct;
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
#ifdef CONFIG_MMU
#define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
struct linux_binprm;
diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index f724db00b235..faad6df49e5b 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -156,10 +156,6 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
#define STACK_RND_MASK (0x3ffff >> (PAGE_SHIFT - 12))
#endif
-struct mm_struct;
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
#ifdef CONFIG_COMPAT
#ifdef __AARCH64EB__
diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
index 535f196ffe02..31d747d46a23 100644
--- a/arch/mips/include/asm/elf.h
+++ b/arch/mips/include/asm/elf.h
@@ -410,10 +410,6 @@ struct linux_binprm;
extern int arch_setup_additional_pages(struct linux_binprm *bprm,
int uses_interp);
-struct mm_struct;
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
struct arch_elf_state {
int fp_abi;
int interp_fp_abi;
diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
index 57d289acb803..ee46ffef608e 100644
--- a/arch/powerpc/include/asm/elf.h
+++ b/arch/powerpc/include/asm/elf.h
@@ -128,10 +128,6 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
(0x7ff >> (PAGE_SHIFT - 12)) : \
(0x3ffff >> (PAGE_SHIFT - 12)))
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
-
#ifdef CONFIG_SPU_BASE
/* Notes used in ET_CORE. Note name is "SPU/<fd>/<filename>". */
#define NT_SPU 1
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index d0db9d944b6d..fdda72e56404 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -226,9 +226,6 @@ struct linux_binprm;
#define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
int arch_setup_additional_pages(struct linux_binprm *, int);
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
void *fill_cpu_elf_notes(void *ptr, struct save_area *sa, __vector128 *vxrs);
#endif
diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index ca3347a9dab5..bbdace22daf8 100644
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -338,9 +338,6 @@ extern int compat_arch_setup_additional_pages(struct linux_binprm *bprm,
int uses_interp);
#define compat_arch_setup_additional_pages compat_arch_setup_additional_pages
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
/*
* True on X86_32 or when emulating IA32 on X86_64
*/
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 6f08f5fa99dc..a115da230ce0 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1043,15 +1043,13 @@ static int load_elf_binary(struct linux_binprm *bprm)
current->mm->end_data = end_data;
current->mm->start_stack = bprm->p;
-#ifdef arch_randomize_brk
if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
current->mm->brk = current->mm->start_brk =
arch_randomize_brk(current->mm);
-#ifdef CONFIG_COMPAT_BRK
+#ifdef compat_brk_randomized
current->brk_randomized = 1;
#endif
}
-#endif
if (current->personality & MMAP_PAGE_ZERO) {
/* Why this, you ask??? Well SVr4 maps page 0 as read-only,
diff --git a/include/linux/elf-randomize.h b/include/linux/elf-randomize.h
index 7a4eda02d2b1..b5f0bda9472e 100644
--- a/include/linux/elf-randomize.h
+++ b/include/linux/elf-randomize.h
@@ -1,10 +1,22 @@
#ifndef _ELF_RANDOMIZE_H
#define _ELF_RANDOMIZE_H
+struct mm_struct;
+
#ifndef CONFIG_ARCH_HAS_ELF_RANDOMIZE
static inline unsigned long arch_mmap_rnd(void) { return 0; }
+# if defined(arch_randomize_brk) && defined(CONFIG_COMPAT_BRK)
+# define compat_brk_randomized
+# endif
+# ifndef arch_randomize_brk
+# define arch_randomize_brk(mm) (mm->brk)
+# endif
#else
extern unsigned long arch_mmap_rnd(void);
+extern unsigned long arch_randomize_brk(struct mm_struct *mm);
+# ifdef CONFIG_COMPAT_BRK
+# define compat_brk_randomized
+# endif
#endif
#endif
--
1.9.1
^ permalink raw reply related [flat|nested] 68+ messages in thread
* Re: [PATCH v4 0/10] split ET_DYN ASLR from mmap ASLR
2015-03-04 21:10 ` Kees Cook
(?)
(?)
@ 2015-03-04 21:54 ` Ingo Molnar
-1 siblings, 0 replies; 68+ messages in thread
From: Ingo Molnar @ 2015-03-04 21:54 UTC (permalink / raw)
To: Kees Cook
Cc: akpm, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun Chandran, Yann Droneaud, Min-Hua Chen,
Paul Burton, Alex Smith, Markos Chandras, Vineeth Vijayan,
Jeff Bailey, Michael Holzheu, Ben Hutchings, Borislav Petkov,
Jan-Simon Möller, linux-kernel, linux-arm-kernel,
linux-mips, linuxppc-dev, linux-s390, linux-fsdevel
* Kees Cook <keescook@chromium.org> wrote:
> To address the "offset2lib" ASLR weakness[1], this separates ET_DYN
> ASLR from mmap ASLR, as already done on s390. The architectures
> that are already randomizing mmap (arm, arm64, mips, powerpc, s390,
> and x86), have their various forms of arch_mmap_rnd() made available
> via the new CONFIG_ARCH_HAS_ELF_RANDOMIZE. For these architectures,
> arch_randomize_brk() is collapsed as well.
>
> This is an alternative to the solutions in:
> https://lkml.org/lkml/2015/2/23/442
>
> I've been able to test x86 and arm, and the buildbot (so far) seems
> happy with building the rest.
Ok, this looks really good - for all patches:
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Thanks,
Ingo
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH v4 0/10] split ET_DYN ASLR from mmap ASLR
@ 2015-03-04 21:54 ` Ingo Molnar
0 siblings, 0 replies; 68+ messages in thread
From: Ingo Molnar @ 2015-03-04 21:54 UTC (permalink / raw)
To: Kees Cook
Cc: akpm, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Martin Schwidefsky, Heiko Carstens, linux390, x86,
Alexander Viro, Andy Lutomirski, Oleg Nesterov, David A. Long,
Andrey Ryabinin, Arun Chandran, Yann Droneaud, Min-Hua Chen,
Paul Burton
* Kees Cook <keescook@chromium.org> wrote:
> To address the "offset2lib" ASLR weakness[1], this separates ET_DYN
> ASLR from mmap ASLR, as already done on s390. The architectures
> that are already randomizing mmap (arm, arm64, mips, powerpc, s390,
> and x86), have their various forms of arch_mmap_rnd() made available
> via the new CONFIG_ARCH_HAS_ELF_RANDOMIZE. For these architectures,
> arch_randomize_brk() is collapsed as well.
>
> This is an alternative to the solutions in:
> https://lkml.org/lkml/2015/2/23/442
>
> I've been able to test x86 and arm, and the buildbot (so far) seems
> happy with building the rest.
Ok, this looks really good - for all patches:
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Thanks,
Ingo
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH v4 0/10] split ET_DYN ASLR from mmap ASLR
@ 2015-03-04 21:54 ` Ingo Molnar
0 siblings, 0 replies; 68+ messages in thread
From: Ingo Molnar @ 2015-03-04 21:54 UTC (permalink / raw)
To: Kees Cook
Cc: linux-mips, Arun Chandran, Heiko Carstens, linux-kernel,
Min-Hua Chen, Paul Mackerras, Ismael Ripoll, Yann Droneaud,
linux-s390, Russell King, Andrey Ryabinin, x86,
Hector Marco-Gisbert, Ingo Molnar, David A. Long,
Catalin Marinas, Borislav Petkov, Ben Hutchings, Will Deacon,
linux-fsdevel, Alexander Viro, Michael Holzheu, linux-arm-kernel,
Jeff Bailey, Paul Burton, Oleg Nesterov, Ralf Baechle,
Andy Lutomirski, Vineeth Vijayan, Markos Chandras,
Jan-Simon Möller, Martin Schwidefsky, linux390, akpm,
linuxppc-dev, Alex Smith
* Kees Cook <keescook@chromium.org> wrote:
> To address the "offset2lib" ASLR weakness[1], this separates ET_DYN
> ASLR from mmap ASLR, as already done on s390. The architectures
> that are already randomizing mmap (arm, arm64, mips, powerpc, s390,
> and x86), have their various forms of arch_mmap_rnd() made available
> via the new CONFIG_ARCH_HAS_ELF_RANDOMIZE. For these architectures,
> arch_randomize_brk() is collapsed as well.
>
> This is an alternative to the solutions in:
> https://lkml.org/lkml/2015/2/23/442
>
> I've been able to test x86 and arm, and the buildbot (so far) seems
> happy with building the rest.
Ok, this looks really good - for all patches:
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Thanks,
Ingo
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v4 0/10] split ET_DYN ASLR from mmap ASLR
@ 2015-03-04 21:54 ` Ingo Molnar
0 siblings, 0 replies; 68+ messages in thread
From: Ingo Molnar @ 2015-03-04 21:54 UTC (permalink / raw)
To: linux-arm-kernel
* Kees Cook <keescook@chromium.org> wrote:
> To address the "offset2lib" ASLR weakness[1], this separates ET_DYN
> ASLR from mmap ASLR, as already done on s390. The architectures
> that are already randomizing mmap (arm, arm64, mips, powerpc, s390,
> and x86), have their various forms of arch_mmap_rnd() made available
> via the new CONFIG_ARCH_HAS_ELF_RANDOMIZE. For these architectures,
> arch_randomize_brk() is collapsed as well.
>
> This is an alternative to the solutions in:
> https://lkml.org/lkml/2015/2/23/442
>
> I've been able to test x86 and arm, and the buildbot (so far) seems
> happy with building the rest.
Ok, this looks really good - for all patches:
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Thanks,
Ingo
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH v4 0/10] split ET_DYN ASLR from mmap ASLR
2015-03-04 21:54 ` Ingo Molnar
(?)
(?)
@ 2015-03-04 21:58 ` Kees Cook
-1 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:58 UTC (permalink / raw)
To: Ingo Molnar
Cc: Andrew Morton, Ingo Molnar, Michael Ellerman,
Hector Marco-Gisbert, Ismael Ripoll, Russell King,
Catalin Marinas, Will Deacon, Ralf Baechle,
Benjamin Herrenschmidt, Paul Mackerras, Martin Schwidefsky,
Heiko Carstens, linux390, x86, Alexander Viro, Andy Lutomirski,
Oleg Nesterov, David A. Long, Andrey Ryabinin, Arun Chandran,
Yann Droneaud, Min-Hua Chen, Paul Burton, Alex Smith,
Markos Chandras, Vineeth Vijayan, Jeff Bailey, Michael Holzheu,
Ben Hutchings, Borislav Petkov, Jan-Simon Möller, LKML,
linux-arm-kernel, Linux MIPS Mailing List, linuxppc-dev,
linux-s390, linux-fsdevel
On Wed, Mar 4, 2015 at 1:54 PM, Ingo Molnar <mingo@kernel.org> wrote:
>
> * Kees Cook <keescook@chromium.org> wrote:
>
>> To address the "offset2lib" ASLR weakness[1], this separates ET_DYN
>> ASLR from mmap ASLR, as already done on s390. The architectures
>> that are already randomizing mmap (arm, arm64, mips, powerpc, s390,
>> and x86), have their various forms of arch_mmap_rnd() made available
>> via the new CONFIG_ARCH_HAS_ELF_RANDOMIZE. For these architectures,
>> arch_randomize_brk() is collapsed as well.
>>
>> This is an alternative to the solutions in:
>> https://lkml.org/lkml/2015/2/23/442
>>
>> I've been able to test x86 and arm, and the buildbot (so far) seems
>> happy with building the rest.
>
> Ok, this looks really good - for all patches:
>
> Reviewed-by: Ingo Molnar <mingo@kernel.org>
Great! Thanks for the suggestions and reviews. :)
-Kees
--
Kees Cook
Chrome OS Security
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH v4 0/10] split ET_DYN ASLR from mmap ASLR
@ 2015-03-04 21:58 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:58 UTC (permalink / raw)
To: Ingo Molnar
Cc: Andrew Morton, Ingo Molnar, Michael Ellerman,
Hector Marco-Gisbert, Ismael Ripoll, Russell King,
Catalin Marinas, Will Deacon, Ralf Baechle,
Benjamin Herrenschmidt, Paul Mackerras, Martin Schwidefsky,
Heiko Carstens, linux390, x86, Alexander Viro, Andy Lutomirski,
Oleg Nesterov, David A. Long, Andrey Ryabinin, Arun Chandran,
Yann Droneaud, Min-Hua Chen
On Wed, Mar 4, 2015 at 1:54 PM, Ingo Molnar <mingo@kernel.org> wrote:
>
> * Kees Cook <keescook@chromium.org> wrote:
>
>> To address the "offset2lib" ASLR weakness[1], this separates ET_DYN
>> ASLR from mmap ASLR, as already done on s390. The architectures
>> that are already randomizing mmap (arm, arm64, mips, powerpc, s390,
>> and x86), have their various forms of arch_mmap_rnd() made available
>> via the new CONFIG_ARCH_HAS_ELF_RANDOMIZE. For these architectures,
>> arch_randomize_brk() is collapsed as well.
>>
>> This is an alternative to the solutions in:
>> https://lkml.org/lkml/2015/2/23/442
>>
>> I've been able to test x86 and arm, and the buildbot (so far) seems
>> happy with building the rest.
>
> Ok, this looks really good - for all patches:
>
> Reviewed-by: Ingo Molnar <mingo@kernel.org>
Great! Thanks for the suggestions and reviews. :)
-Kees
--
Kees Cook
Chrome OS Security
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH v4 0/10] split ET_DYN ASLR from mmap ASLR
@ 2015-03-04 21:58 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:58 UTC (permalink / raw)
To: Ingo Molnar
Cc: Linux MIPS Mailing List, Arun Chandran, Heiko Carstens, LKML,
Min-Hua Chen, Paul Mackerras, Ismael Ripoll, Yann Droneaud,
linux-s390, Russell King, Andrey Ryabinin, x86,
Hector Marco-Gisbert, Ingo Molnar, David A. Long,
Catalin Marinas, Borislav Petkov, Ben Hutchings, Will Deacon,
linux-fsdevel, Alexander Viro, Michael Holzheu, linux-arm-kernel,
Jeff Bailey, Paul Burton, Oleg Nesterov, Ralf Baechle,
Andy Lutomirski, Vineeth Vijayan, Markos Chandras,
Jan-Simon Möller, Martin Schwidefsky, linux390,
Andrew Morton, linuxppc-dev, Alex Smith
On Wed, Mar 4, 2015 at 1:54 PM, Ingo Molnar <mingo@kernel.org> wrote:
>
> * Kees Cook <keescook@chromium.org> wrote:
>
>> To address the "offset2lib" ASLR weakness[1], this separates ET_DYN
>> ASLR from mmap ASLR, as already done on s390. The architectures
>> that are already randomizing mmap (arm, arm64, mips, powerpc, s390,
>> and x86), have their various forms of arch_mmap_rnd() made available
>> via the new CONFIG_ARCH_HAS_ELF_RANDOMIZE. For these architectures,
>> arch_randomize_brk() is collapsed as well.
>>
>> This is an alternative to the solutions in:
>> https://lkml.org/lkml/2015/2/23/442
>>
>> I've been able to test x86 and arm, and the buildbot (so far) seems
>> happy with building the rest.
>
> Ok, this looks really good - for all patches:
>
> Reviewed-by: Ingo Molnar <mingo@kernel.org>
Great! Thanks for the suggestions and reviews. :)
-Kees
--
Kees Cook
Chrome OS Security
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v4 0/10] split ET_DYN ASLR from mmap ASLR
@ 2015-03-04 21:58 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-04 21:58 UTC (permalink / raw)
To: linux-arm-kernel
On Wed, Mar 4, 2015 at 1:54 PM, Ingo Molnar <mingo@kernel.org> wrote:
>
> * Kees Cook <keescook@chromium.org> wrote:
>
>> To address the "offset2lib" ASLR weakness[1], this separates ET_DYN
>> ASLR from mmap ASLR, as already done on s390. The architectures
>> that are already randomizing mmap (arm, arm64, mips, powerpc, s390,
>> and x86), have their various forms of arch_mmap_rnd() made available
>> via the new CONFIG_ARCH_HAS_ELF_RANDOMIZE. For these architectures,
>> arch_randomize_brk() is collapsed as well.
>>
>> This is an alternative to the solutions in:
>> https://lkml.org/lkml/2015/2/23/442
>>
>> I've been able to test x86 and arm, and the buildbot (so far) seems
>> happy with building the rest.
>
> Ok, this looks really good - for all patches:
>
> Reviewed-by: Ingo Molnar <mingo@kernel.org>
Great! Thanks for the suggestions and reviews. :)
-Kees
--
Kees Cook
Chrome OS Security
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH v4 06/10] s390: standardize mmap_rnd() usage
2015-03-04 21:10 ` Kees Cook
(?)
(?)
@ 2015-03-09 17:41 ` Martin Schwidefsky
-1 siblings, 0 replies; 68+ messages in thread
From: Martin Schwidefsky @ 2015-03-09 17:41 UTC (permalink / raw)
To: Kees Cook
Cc: akpm, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Heiko Carstens, linux390, x86, Alexander Viro, Andy Lutomirski,
Oleg Nesterov, David A. Long, Andrey Ryabinin, Arun Chandran,
Yann Droneaud, Min-Hua Chen, Paul Burton, Alex Smith,
Markos Chandras, Vineeth Vijayan, Jeff Bailey, Michael Holzheu,
Ben Hutchings, Borislav Petkov, Jan-Simon Möller,
linux-kernel, linux-arm-kernel, linux-mips, linuxppc-dev,
linux-s390, linux-fsdevel
On Wed, 4 Mar 2015 13:10:50 -0800
Kees Cook <keescook@chromium.org> wrote:
> In preparation for splitting out ET_DYN ASLR, this refactors the use of
> mmap_rnd() to be used similarly to arm and x86, and extracts the checking
> of PF_RANDOMIZE.
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> arch/s390/mm/mmap.c | 34 +++++++++++++++++++++++-----------
> 1 file changed, 23 insertions(+), 11 deletions(-)
Patch series including this patch works fine
Acked-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
--
blue skies,
Martin.
"Reality continues to ruin my life." - Calvin.
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH v4 06/10] s390: standardize mmap_rnd() usage
@ 2015-03-09 17:41 ` Martin Schwidefsky
0 siblings, 0 replies; 68+ messages in thread
From: Martin Schwidefsky @ 2015-03-09 17:41 UTC (permalink / raw)
To: Kees Cook
Cc: akpm, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Heiko Carstens, linux390, x86, Alexander Viro, Andy Lutomirski,
Oleg Nesterov, David A. Long, Andrey Ryabinin, Arun Chandran,
Yann Droneaud, Min-Hua Chen, Paul Burton, Alex Smith, Ma
On Wed, 4 Mar 2015 13:10:50 -0800
Kees Cook <keescook@chromium.org> wrote:
> In preparation for splitting out ET_DYN ASLR, this refactors the use of
> mmap_rnd() to be used similarly to arm and x86, and extracts the checking
> of PF_RANDOMIZE.
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> arch/s390/mm/mmap.c | 34 +++++++++++++++++++++++-----------
> 1 file changed, 23 insertions(+), 11 deletions(-)
Patch series including this patch works fine
Acked-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
--
blue skies,
Martin.
"Reality continues to ruin my life." - Calvin.
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH v4 06/10] s390: standardize mmap_rnd() usage
@ 2015-03-09 17:41 ` Martin Schwidefsky
0 siblings, 0 replies; 68+ messages in thread
From: Martin Schwidefsky @ 2015-03-09 17:41 UTC (permalink / raw)
To: Kees Cook
Cc: linux-mips, Min-Hua Chen, Heiko Carstens, linux-kernel,
Arun Chandran, Paul Mackerras, Ismael Ripoll, Yann Droneaud,
linux-s390, Russell King, Andrey Ryabinin, x86,
Hector Marco-Gisbert, Ingo Molnar, David A. Long,
Catalin Marinas, Borislav Petkov, Ben Hutchings, Will Deacon,
Alexander Viro, Michael Holzheu, linux-arm-kernel, Jeff Bailey,
Paul Burton, Oleg Nesterov, Ralf Baechle, Andy Lutomirski,
Vineeth Vijayan, Markos Chandras, Jan-Simon Möller,
linux-fsdevel, linux390, akpm, linuxppc-dev, Alex Smith
On Wed, 4 Mar 2015 13:10:50 -0800
Kees Cook <keescook@chromium.org> wrote:
> In preparation for splitting out ET_DYN ASLR, this refactors the use of
> mmap_rnd() to be used similarly to arm and x86, and extracts the checking
> of PF_RANDOMIZE.
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> arch/s390/mm/mmap.c | 34 +++++++++++++++++++++++-----------
> 1 file changed, 23 insertions(+), 11 deletions(-)
Patch series including this patch works fine
Acked-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
--
blue skies,
Martin.
"Reality continues to ruin my life." - Calvin.
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v4 06/10] s390: standardize mmap_rnd() usage
@ 2015-03-09 17:41 ` Martin Schwidefsky
0 siblings, 0 replies; 68+ messages in thread
From: Martin Schwidefsky @ 2015-03-09 17:41 UTC (permalink / raw)
To: linux-arm-kernel
On Wed, 4 Mar 2015 13:10:50 -0800
Kees Cook <keescook@chromium.org> wrote:
> In preparation for splitting out ET_DYN ASLR, this refactors the use of
> mmap_rnd() to be used similarly to arm and x86, and extracts the checking
> of PF_RANDOMIZE.
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> arch/s390/mm/mmap.c | 34 +++++++++++++++++++++++-----------
> 1 file changed, 23 insertions(+), 11 deletions(-)
Patch series including this patch works fine
Acked-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
--
blue skies,
Martin.
"Reality continues to ruin my life." - Calvin.
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH v4 08/10] s390: redefine randomize_et_dyn for ELF_ET_DYN_BASE
2015-03-04 21:10 ` Kees Cook
(?)
(?)
@ 2015-03-09 17:42 ` Martin Schwidefsky
-1 siblings, 0 replies; 68+ messages in thread
From: Martin Schwidefsky @ 2015-03-09 17:42 UTC (permalink / raw)
To: Kees Cook
Cc: akpm, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Heiko Carstens, linux390, x86, Alexander Viro, Andy Lutomirski,
Oleg Nesterov, David A. Long, Andrey Ryabinin, Arun Chandran,
Yann Droneaud, Min-Hua Chen, Paul Burton, Alex Smith,
Markos Chandras, Vineeth Vijayan, Jeff Bailey, Michael Holzheu,
Ben Hutchings, Borislav Petkov, Jan-Simon Möller,
linux-kernel, linux-arm-kernel, linux-mips, linuxppc-dev,
linux-s390, linux-fsdevel
On Wed, 4 Mar 2015 13:10:52 -0800
Kees Cook <keescook@chromium.org> wrote:
> In preparation for moving ET_DYN randomization into the ELF loader (which
> requires a static ELF_ET_DYN_BASE), this redefines s390's existing ET_DYN
> randomization in a call to arch_mmap_rnd(). This refactoring results in
> the same ET_DYN randomization on s390.
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> arch/s390/include/asm/elf.h | 8 +++++---
> arch/s390/mm/mmap.c | 11 ++---------
> 2 files changed, 7 insertions(+), 12 deletions(-)
Patch series including this patch works fine
Acked-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
--
blue skies,
Martin.
"Reality continues to ruin my life." - Calvin.
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH v4 08/10] s390: redefine randomize_et_dyn for ELF_ET_DYN_BASE
@ 2015-03-09 17:42 ` Martin Schwidefsky
0 siblings, 0 replies; 68+ messages in thread
From: Martin Schwidefsky @ 2015-03-09 17:42 UTC (permalink / raw)
To: Kees Cook
Cc: akpm, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Will Deacon,
Ralf Baechle, Benjamin Herrenschmidt, Paul Mackerras,
Heiko Carstens, linux390, x86, Alexander Viro, Andy Lutomirski,
Oleg Nesterov, David A. Long, Andrey Ryabinin, Arun Chandran,
Yann Droneaud, Min-Hua Chen, Paul Burton, Alex Smith, Ma
On Wed, 4 Mar 2015 13:10:52 -0800
Kees Cook <keescook@chromium.org> wrote:
> In preparation for moving ET_DYN randomization into the ELF loader (which
> requires a static ELF_ET_DYN_BASE), this redefines s390's existing ET_DYN
> randomization in a call to arch_mmap_rnd(). This refactoring results in
> the same ET_DYN randomization on s390.
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> arch/s390/include/asm/elf.h | 8 +++++---
> arch/s390/mm/mmap.c | 11 ++---------
> 2 files changed, 7 insertions(+), 12 deletions(-)
Patch series including this patch works fine
Acked-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
--
blue skies,
Martin.
"Reality continues to ruin my life." - Calvin.
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH v4 08/10] s390: redefine randomize_et_dyn for ELF_ET_DYN_BASE
@ 2015-03-09 17:42 ` Martin Schwidefsky
0 siblings, 0 replies; 68+ messages in thread
From: Martin Schwidefsky @ 2015-03-09 17:42 UTC (permalink / raw)
To: Kees Cook
Cc: linux-mips, Min-Hua Chen, Heiko Carstens, linux-kernel,
Arun Chandran, Paul Mackerras, Ismael Ripoll, Yann Droneaud,
linux-s390, Russell King, Andrey Ryabinin, x86,
Hector Marco-Gisbert, Ingo Molnar, David A. Long,
Catalin Marinas, Borislav Petkov, Ben Hutchings, Will Deacon,
Alexander Viro, Michael Holzheu, linux-arm-kernel, Jeff Bailey,
Paul Burton, Oleg Nesterov, Ralf Baechle, Andy Lutomirski,
Vineeth Vijayan, Markos Chandras, Jan-Simon Möller,
linux-fsdevel, linux390, akpm, linuxppc-dev, Alex Smith
On Wed, 4 Mar 2015 13:10:52 -0800
Kees Cook <keescook@chromium.org> wrote:
> In preparation for moving ET_DYN randomization into the ELF loader (which
> requires a static ELF_ET_DYN_BASE), this redefines s390's existing ET_DYN
> randomization in a call to arch_mmap_rnd(). This refactoring results in
> the same ET_DYN randomization on s390.
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> arch/s390/include/asm/elf.h | 8 +++++---
> arch/s390/mm/mmap.c | 11 ++---------
> 2 files changed, 7 insertions(+), 12 deletions(-)
Patch series including this patch works fine
Acked-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
--
blue skies,
Martin.
"Reality continues to ruin my life." - Calvin.
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v4 08/10] s390: redefine randomize_et_dyn for ELF_ET_DYN_BASE
@ 2015-03-09 17:42 ` Martin Schwidefsky
0 siblings, 0 replies; 68+ messages in thread
From: Martin Schwidefsky @ 2015-03-09 17:42 UTC (permalink / raw)
To: linux-arm-kernel
On Wed, 4 Mar 2015 13:10:52 -0800
Kees Cook <keescook@chromium.org> wrote:
> In preparation for moving ET_DYN randomization into the ELF loader (which
> requires a static ELF_ET_DYN_BASE), this redefines s390's existing ET_DYN
> randomization in a call to arch_mmap_rnd(). This refactoring results in
> the same ET_DYN randomization on s390.
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> arch/s390/include/asm/elf.h | 8 +++++---
> arch/s390/mm/mmap.c | 11 ++---------
> 2 files changed, 7 insertions(+), 12 deletions(-)
Patch series including this patch works fine
Acked-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
--
blue skies,
Martin.
"Reality continues to ruin my life." - Calvin.
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH v4 03/10] arm64: standardize mmap_rnd() usage
2015-03-04 21:10 ` Kees Cook
(?)
(?)
@ 2015-03-17 14:47 ` Will Deacon
-1 siblings, 0 replies; 68+ messages in thread
From: Will Deacon @ 2015-03-17 14:47 UTC (permalink / raw)
To: Kees Cook
Cc: akpm, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Ralf Baechle,
Benjamin Herrenschmidt, Paul Mackerras, Martin Schwidefsky,
Heiko Carstens, linux390, x86, Alexander Viro, Andy Lutomirski,
Oleg Nesterov, David A. Long, Andrey Ryabinin, Arun Chandran,
Yann Droneaud, Min-Hua Chen, Paul Burton, Alex Smith,
Markos Chandras, Vineeth Vijayan, Jeff Bailey, Michael Holzheu,
Ben Hutchings, Borislav Petkov, Jan-Simon Möller,
linux-kernel, linux-arm-kernel, linux-mips, linuxppc-dev,
linux-s390, linux-fsdevel
On Wed, Mar 04, 2015 at 09:10:47PM +0000, Kees Cook wrote:
> In preparation for splitting out ET_DYN ASLR, this refactors the use of
> mmap_rnd() to be used similarly to arm and x86. This additionally enables
> mmap ASLR on legacy mmap layouts, which appeared to be missing on arm64,
> and was already supported on arm. Additionally removes a copy/pasted
> declaration of an unused function.
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> arch/arm64/include/asm/elf.h | 1 -
> arch/arm64/mm/mmap.c | 18 +++++++++++-------
> 2 files changed, 11 insertions(+), 8 deletions(-)
Looks fine to me:
Acked-by: Will Deacon <will.deacon@arm.com>
Do you want me to pick this up, or are you taking it along with the rest of
your series (it doesn't have any obvious dependencies to me)?
Will
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH v4 03/10] arm64: standardize mmap_rnd() usage
@ 2015-03-17 14:47 ` Will Deacon
0 siblings, 0 replies; 68+ messages in thread
From: Will Deacon @ 2015-03-17 14:47 UTC (permalink / raw)
To: Kees Cook
Cc: akpm, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Ralf Baechle,
Benjamin Herrenschmidt, Paul Mackerras, Martin Schwidefsky,
Heiko Carstens, linux390, x86, Alexander Viro, Andy Lutomirski,
Oleg Nesterov, David A. Long, Andrey Ryabinin, Arun Chandran,
Yann Droneaud, Min-Hua Chen
On Wed, Mar 04, 2015 at 09:10:47PM +0000, Kees Cook wrote:
> In preparation for splitting out ET_DYN ASLR, this refactors the use of
> mmap_rnd() to be used similarly to arm and x86. This additionally enables
> mmap ASLR on legacy mmap layouts, which appeared to be missing on arm64,
> and was already supported on arm. Additionally removes a copy/pasted
> declaration of an unused function.
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> arch/arm64/include/asm/elf.h | 1 -
> arch/arm64/mm/mmap.c | 18 +++++++++++-------
> 2 files changed, 11 insertions(+), 8 deletions(-)
Looks fine to me:
Acked-by: Will Deacon <will.deacon@arm.com>
Do you want me to pick this up, or are you taking it along with the rest of
your series (it doesn't have any obvious dependencies to me)?
Will
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH v4 03/10] arm64: standardize mmap_rnd() usage
@ 2015-03-17 14:47 ` Will Deacon
0 siblings, 0 replies; 68+ messages in thread
From: Will Deacon @ 2015-03-17 14:47 UTC (permalink / raw)
To: Kees Cook
Cc: linux-mips, Min-Hua Chen, Heiko Carstens, linux-kernel,
Arun Chandran, Paul Mackerras, Ismael Ripoll, Yann Droneaud,
linux-s390, Russell King, Andrey Ryabinin, x86,
Hector Marco-Gisbert, Ingo Molnar, David A. Long,
Catalin Marinas, Borislav Petkov, Ben Hutchings, linux-fsdevel,
Alexander Viro, Michael Holzheu, linux-arm-kernel, Jeff Bailey,
Paul Burton, Oleg Nesterov, Ralf Baechle, Andy Lutomirski,
Vineeth Vijayan, Markos Chandras, Jan-Simon Möller,
Martin Schwidefsky, linux390, akpm, linuxppc-dev, Alex Smith
On Wed, Mar 04, 2015 at 09:10:47PM +0000, Kees Cook wrote:
> In preparation for splitting out ET_DYN ASLR, this refactors the use of
> mmap_rnd() to be used similarly to arm and x86. This additionally enables
> mmap ASLR on legacy mmap layouts, which appeared to be missing on arm64,
> and was already supported on arm. Additionally removes a copy/pasted
> declaration of an unused function.
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> arch/arm64/include/asm/elf.h | 1 -
> arch/arm64/mm/mmap.c | 18 +++++++++++-------
> 2 files changed, 11 insertions(+), 8 deletions(-)
Looks fine to me:
Acked-by: Will Deacon <will.deacon@arm.com>
Do you want me to pick this up, or are you taking it along with the rest of
your series (it doesn't have any obvious dependencies to me)?
Will
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v4 03/10] arm64: standardize mmap_rnd() usage
@ 2015-03-17 14:47 ` Will Deacon
0 siblings, 0 replies; 68+ messages in thread
From: Will Deacon @ 2015-03-17 14:47 UTC (permalink / raw)
To: linux-arm-kernel
On Wed, Mar 04, 2015 at 09:10:47PM +0000, Kees Cook wrote:
> In preparation for splitting out ET_DYN ASLR, this refactors the use of
> mmap_rnd() to be used similarly to arm and x86. This additionally enables
> mmap ASLR on legacy mmap layouts, which appeared to be missing on arm64,
> and was already supported on arm. Additionally removes a copy/pasted
> declaration of an unused function.
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> arch/arm64/include/asm/elf.h | 1 -
> arch/arm64/mm/mmap.c | 18 +++++++++++-------
> 2 files changed, 11 insertions(+), 8 deletions(-)
Looks fine to me:
Acked-by: Will Deacon <will.deacon@arm.com>
Do you want me to pick this up, or are you taking it along with the rest of
your series (it doesn't have any obvious dependencies to me)?
Will
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH v4 03/10] arm64: standardize mmap_rnd() usage
2015-03-17 14:47 ` Will Deacon
(?)
(?)
@ 2015-03-17 15:19 ` Kees Cook
-1 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-17 15:19 UTC (permalink / raw)
To: Will Deacon
Cc: akpm, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Ralf Baechle,
Benjamin Herrenschmidt, Paul Mackerras, Martin Schwidefsky,
Heiko Carstens, linux390, x86, Alexander Viro, Andy Lutomirski,
Oleg Nesterov, David A. Long, Andrey Ryabinin, Arun Chandran,
Yann Droneaud, Min-Hua Chen, Paul Burton, Alex Smith,
Markos Chandras, Vineeth Vijayan, Jeff Bailey, Michael Holzheu,
Ben Hutchings, Borislav Petkov, Jan-Simon Möller,
linux-kernel, linux-arm-kernel, linux-mips, linuxppc-dev,
linux-s390, linux-fsdevel
On Tue, Mar 17, 2015 at 7:47 AM, Will Deacon <will.deacon@arm.com> wrote:
> On Wed, Mar 04, 2015 at 09:10:47PM +0000, Kees Cook wrote:
>> In preparation for splitting out ET_DYN ASLR, this refactors the use of
>> mmap_rnd() to be used similarly to arm and x86. This additionally enables
>> mmap ASLR on legacy mmap layouts, which appeared to be missing on arm64,
>> and was already supported on arm. Additionally removes a copy/pasted
>> declaration of an unused function.
>>
>> Signed-off-by: Kees Cook <keescook@chromium.org>
>> ---
>> arch/arm64/include/asm/elf.h | 1 -
>> arch/arm64/mm/mmap.c | 18 +++++++++++-------
>> 2 files changed, 11 insertions(+), 8 deletions(-)
>
> Looks fine to me:
>
> Acked-by: Will Deacon <will.deacon@arm.com>
>
> Do you want me to pick this up, or are you taking it along with the rest of
> your series (it doesn't have any obvious dependencies to me)?
Thanks! Right now akpm is carrying it, since the series ends with
changes that depend on all the per-arch refactoring.
-Kees
--
Kees Cook
Chrome OS Security
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH v4 03/10] arm64: standardize mmap_rnd() usage
@ 2015-03-17 15:19 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-17 15:19 UTC (permalink / raw)
To: Will Deacon
Cc: akpm, Ingo Molnar, Michael Ellerman, Hector Marco-Gisbert,
Ismael Ripoll, Russell King, Catalin Marinas, Ralf Baechle,
Benjamin Herrenschmidt, Paul Mackerras, Martin Schwidefsky,
Heiko Carstens, linux390, x86, Alexander Viro, Andy Lutomirski,
Oleg Nesterov, David A. Long, Andrey Ryabinin, Arun Chandran,
Yann Droneaud, Min-Hua Chen
On Tue, Mar 17, 2015 at 7:47 AM, Will Deacon <will.deacon@arm.com> wrote:
> On Wed, Mar 04, 2015 at 09:10:47PM +0000, Kees Cook wrote:
>> In preparation for splitting out ET_DYN ASLR, this refactors the use of
>> mmap_rnd() to be used similarly to arm and x86. This additionally enables
>> mmap ASLR on legacy mmap layouts, which appeared to be missing on arm64,
>> and was already supported on arm. Additionally removes a copy/pasted
>> declaration of an unused function.
>>
>> Signed-off-by: Kees Cook <keescook@chromium.org>
>> ---
>> arch/arm64/include/asm/elf.h | 1 -
>> arch/arm64/mm/mmap.c | 18 +++++++++++-------
>> 2 files changed, 11 insertions(+), 8 deletions(-)
>
> Looks fine to me:
>
> Acked-by: Will Deacon <will.deacon@arm.com>
>
> Do you want me to pick this up, or are you taking it along with the rest of
> your series (it doesn't have any obvious dependencies to me)?
Thanks! Right now akpm is carrying it, since the series ends with
changes that depend on all the per-arch refactoring.
-Kees
--
Kees Cook
Chrome OS Security
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH v4 03/10] arm64: standardize mmap_rnd() usage
@ 2015-03-17 15:19 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-17 15:19 UTC (permalink / raw)
To: Will Deacon
Cc: linux-mips, Min-Hua Chen, Heiko Carstens, linux-kernel,
Arun Chandran, Paul Mackerras, Ismael Ripoll, Yann Droneaud,
linux-s390, Russell King, Andrey Ryabinin, x86,
Hector Marco-Gisbert, Ingo Molnar, David A. Long,
Catalin Marinas, Borislav Petkov, Ben Hutchings, linux-fsdevel,
Alexander Viro, Michael Holzheu, linux-arm-kernel, Jeff Bailey,
Paul Burton, Oleg Nesterov, Ralf Baechle, Andy Lutomirski,
Vineeth Vijayan, Markos Chandras, Jan-Simon Möller,
Martin Schwidefsky, linux390, akpm, linuxppc-dev, Alex Smith
On Tue, Mar 17, 2015 at 7:47 AM, Will Deacon <will.deacon@arm.com> wrote:
> On Wed, Mar 04, 2015 at 09:10:47PM +0000, Kees Cook wrote:
>> In preparation for splitting out ET_DYN ASLR, this refactors the use of
>> mmap_rnd() to be used similarly to arm and x86. This additionally enables
>> mmap ASLR on legacy mmap layouts, which appeared to be missing on arm64,
>> and was already supported on arm. Additionally removes a copy/pasted
>> declaration of an unused function.
>>
>> Signed-off-by: Kees Cook <keescook@chromium.org>
>> ---
>> arch/arm64/include/asm/elf.h | 1 -
>> arch/arm64/mm/mmap.c | 18 +++++++++++-------
>> 2 files changed, 11 insertions(+), 8 deletions(-)
>
> Looks fine to me:
>
> Acked-by: Will Deacon <will.deacon@arm.com>
>
> Do you want me to pick this up, or are you taking it along with the rest of
> your series (it doesn't have any obvious dependencies to me)?
Thanks! Right now akpm is carrying it, since the series ends with
changes that depend on all the per-arch refactoring.
-Kees
--
Kees Cook
Chrome OS Security
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v4 03/10] arm64: standardize mmap_rnd() usage
@ 2015-03-17 15:19 ` Kees Cook
0 siblings, 0 replies; 68+ messages in thread
From: Kees Cook @ 2015-03-17 15:19 UTC (permalink / raw)
To: linux-arm-kernel
On Tue, Mar 17, 2015 at 7:47 AM, Will Deacon <will.deacon@arm.com> wrote:
> On Wed, Mar 04, 2015 at 09:10:47PM +0000, Kees Cook wrote:
>> In preparation for splitting out ET_DYN ASLR, this refactors the use of
>> mmap_rnd() to be used similarly to arm and x86. This additionally enables
>> mmap ASLR on legacy mmap layouts, which appeared to be missing on arm64,
>> and was already supported on arm. Additionally removes a copy/pasted
>> declaration of an unused function.
>>
>> Signed-off-by: Kees Cook <keescook@chromium.org>
>> ---
>> arch/arm64/include/asm/elf.h | 1 -
>> arch/arm64/mm/mmap.c | 18 +++++++++++-------
>> 2 files changed, 11 insertions(+), 8 deletions(-)
>
> Looks fine to me:
>
> Acked-by: Will Deacon <will.deacon@arm.com>
>
> Do you want me to pick this up, or are you taking it along with the rest of
> your series (it doesn't have any obvious dependencies to me)?
Thanks! Right now akpm is carrying it, since the series ends with
changes that depend on all the per-arch refactoring.
-Kees
--
Kees Cook
Chrome OS Security
^ permalink raw reply [flat|nested] 68+ messages in thread
end of thread, other threads:[~2015-03-17 15:19 UTC | newest]
Thread overview: 68+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-03-04 21:10 [PATCH v4 0/10] split ET_DYN ASLR from mmap ASLR Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` [PATCH v4 01/10] arm: factor out mmap ASLR into mmap_rnd Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` [PATCH v4 02/10] x86: standardize mmap_rnd() usage Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` [PATCH v4 03/10] arm64: " Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-17 14:47 ` Will Deacon
2015-03-17 14:47 ` Will Deacon
2015-03-17 14:47 ` Will Deacon
2015-03-17 14:47 ` Will Deacon
2015-03-17 15:19 ` Kees Cook
2015-03-17 15:19 ` Kees Cook
2015-03-17 15:19 ` Kees Cook
2015-03-17 15:19 ` Kees Cook
2015-03-04 21:10 ` [PATCH v4 04/10] mips: extract logic for mmap_rnd() Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` [PATCH v4 05/10] powerpc: standardize mmap_rnd() usage Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` [PATCH v4 06/10] s390: " Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-09 17:41 ` Martin Schwidefsky
2015-03-09 17:41 ` Martin Schwidefsky
2015-03-09 17:41 ` Martin Schwidefsky
2015-03-09 17:41 ` Martin Schwidefsky
2015-03-04 21:10 ` [PATCH v4 07/10] mm: expose arch_mmap_rnd when available Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` [PATCH v4 08/10] s390: redefine randomize_et_dyn for ELF_ET_DYN_BASE Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-09 17:42 ` Martin Schwidefsky
2015-03-09 17:42 ` Martin Schwidefsky
2015-03-09 17:42 ` Martin Schwidefsky
2015-03-09 17:42 ` Martin Schwidefsky
2015-03-04 21:10 ` [PATCH v4 09/10] mm: split ET_DYN ASLR from mmap ASLR Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` [PATCH v4 10/10] mm: fold arch_randomize_brk into ARCH_HAS_ELF_RANDOMIZE Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:10 ` Kees Cook
2015-03-04 21:54 ` [PATCH v4 0/10] split ET_DYN ASLR from mmap ASLR Ingo Molnar
2015-03-04 21:54 ` Ingo Molnar
2015-03-04 21:54 ` Ingo Molnar
2015-03-04 21:54 ` Ingo Molnar
2015-03-04 21:58 ` Kees Cook
2015-03-04 21:58 ` Kees Cook
2015-03-04 21:58 ` Kees Cook
2015-03-04 21:58 ` Kees Cook
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.