Linux-ARM-Kernel Archive on lore.kernel.org
 help / color / Atom feed
From: Alexandre Ghiti <alex@ghiti.fr>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: Albert Ou <aou@eecs.berkeley.edu>,
	Kees Cook <keescook@chromium.org>,
	Alexandre Ghiti <alex@ghiti.fr>,
	Catalin Marinas <catalin.marinas@arm.com>,
	Palmer Dabbelt <palmer@sifive.com>,
	Will Deacon <will.deacon@arm.com>,
	Russell King <linux@armlinux.org.uk>,
	Ralf Baechle <ralf@linux-mips.org>,
	linux-kernel@vger.kernel.org, linux-mm@kvack.org,
	Luis Chamberlain <mcgrof@kernel.org>,
	Paul Burton <paul.burton@mips.com>,
	James Hogan <jhogan@kernel.org>,
	linux-fsdevel@vger.kernel.org, linux-riscv@lists.infradead.org,
	linux-mips@vger.kernel.org, Christoph Hellwig <hch@lst.de>,
	linux-arm-kernel@lists.infradead.org,
	Alexander Viro <viro@zeniv.linux.org.uk>
Subject: [PATCH v5 06/14] arm: Properly account for stack randomization and stack guard gap
Date: Tue, 30 Jul 2019 01:51:05 -0400
Message-ID: <20190730055113.23635-7-alex@ghiti.fr> (raw)
In-Reply-To: <20190730055113.23635-1-alex@ghiti.fr>

This commit takes care of stack randomization and stack guard gap when
computing mmap base address and checks if the task asked for randomization.
This fixes the problem uncovered and not fixed for arm here:
https://lkml.kernel.org/r/20170622200033.25714-1-riel@redhat.com

Signed-off-by: Alexandre Ghiti <alex@ghiti.fr>
Acked-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
---
 arch/arm/mm/mmap.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index f866870db749..bff3d00bda5b 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -18,8 +18,9 @@
 	 (((pgoff)<<PAGE_SHIFT) & (SHMLBA-1)))
 
 /* gap between mmap and stack */
-#define MIN_GAP (128*1024*1024UL)
-#define MAX_GAP ((TASK_SIZE)/6*5)
+#define MIN_GAP		(128*1024*1024UL)
+#define MAX_GAP		((TASK_SIZE)/6*5)
+#define STACK_RND_MASK	(0x7ff >> (PAGE_SHIFT - 12))
 
 static int mmap_is_legacy(struct rlimit *rlim_stack)
 {
@@ -35,6 +36,15 @@ static int mmap_is_legacy(struct rlimit *rlim_stack)
 static unsigned long mmap_base(unsigned long rnd, struct rlimit *rlim_stack)
 {
 	unsigned long gap = rlim_stack->rlim_cur;
+	unsigned long pad = stack_guard_gap;
+
+	/* Account for stack randomization if necessary */
+	if (current->flags & PF_RANDOMIZE)
+		pad += (STACK_RND_MASK << PAGE_SHIFT);
+
+	/* Values close to RLIM_INFINITY can overflow. */
+	if (gap + pad > gap)
+		gap += pad;
 
 	if (gap < MIN_GAP)
 		gap = MIN_GAP;
-- 
2.20.1


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

  parent reply index

Thread overview: 18+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-07-30  5:50 [PATCH v5 00/14] Provide generic top-down mmap layout functions Alexandre Ghiti
2019-07-30  5:51 ` [PATCH v5 01/14] mm, fs: Move randomize_stack_top from fs to mm Alexandre Ghiti
2019-07-30  5:51 ` [PATCH v5 02/14] arm64: Make use of is_compat_task instead of hardcoding this test Alexandre Ghiti
2019-07-30  5:51 ` [PATCH v5 03/14] arm64: Consider stack randomization for mmap base only when necessary Alexandre Ghiti
2019-07-30  5:51 ` [PATCH v5 04/14] arm64, mm: Move generic mmap layout functions to mm Alexandre Ghiti
2019-07-30  5:51 ` [PATCH v5 05/14] arm64, mm: Make randomization selected by generic topdown mmap layout Alexandre Ghiti
2019-07-30  5:51 ` Alexandre Ghiti [this message]
2019-07-30  5:51 ` [PATCH v5 07/14] arm: Use STACK_TOP when computing mmap base address Alexandre Ghiti
2019-07-30  5:51 ` [PATCH v5 08/14] arm: Use generic mmap top-down layout and brk randomization Alexandre Ghiti
2019-07-30  5:51 ` [PATCH v5 09/14] mips: Properly account for stack randomization and stack guard gap Alexandre Ghiti
2019-07-30  5:51 ` [PATCH v5 10/14] mips: Use STACK_TOP when computing mmap base address Alexandre Ghiti
2019-07-30  5:51 ` [PATCH v5 11/14] mips: Adjust brk randomization offset to fit generic version Alexandre Ghiti
2019-07-30  5:51 ` [PATCH v5 12/14] mips: Replace arch specific way to determine 32bit task with " Alexandre Ghiti
2019-07-30  5:51 ` [PATCH v5 13/14] mips: Use generic mmap top-down layout and brk randomization Alexandre Ghiti
2019-07-30  5:51 ` [PATCH v5 14/14] riscv: Make mmap allocation top-down by default Alexandre Ghiti
2019-07-31  6:05   ` Alex Ghiti
2019-07-31 17:33     ` Guenter Roeck
2019-07-31 22:40   ` Paul Walmsley

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190730055113.23635-7-alex@ghiti.fr \
    --to=alex@ghiti.fr \
    --cc=akpm@linux-foundation.org \
    --cc=aou@eecs.berkeley.edu \
    --cc=catalin.marinas@arm.com \
    --cc=hch@lst.de \
    --cc=jhogan@kernel.org \
    --cc=keescook@chromium.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mips@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=linux-riscv@lists.infradead.org \
    --cc=linux@armlinux.org.uk \
    --cc=mcgrof@kernel.org \
    --cc=palmer@sifive.com \
    --cc=paul.burton@mips.com \
    --cc=ralf@linux-mips.org \
    --cc=viro@zeniv.linux.org.uk \
    --cc=will.deacon@arm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-ARM-Kernel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-arm-kernel/0 linux-arm-kernel/git/0.git
	git clone --mirror https://lore.kernel.org/linux-arm-kernel/1 linux-arm-kernel/git/1.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-arm-kernel linux-arm-kernel/ https://lore.kernel.org/linux-arm-kernel \
		linux-arm-kernel@lists.infradead.org infradead-linux-arm-kernel@archiver.kernel.org
	public-inbox-index linux-arm-kernel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.infradead.lists.linux-arm-kernel


AGPL code for this site: git clone https://public-inbox.org/ public-inbox