From: Alexandre Ghiti <alex@ghiti.fr>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: Paul Walmsley <paul.walmsley@sifive.com>,
Luis Chamberlain <mcgrof@kernel.org>,
Christoph Hellwig <hch@lst.de>,
Russell King <linux@armlinux.org.uk>,
Catalin Marinas <catalin.marinas@arm.com>,
Will Deacon <will.deacon@arm.com>,
Ralf Baechle <ralf@linux-mips.org>,
Paul Burton <paul.burton@mips.com>,
James Hogan <jhogan@kernel.org>,
Palmer Dabbelt <palmer@sifive.com>,
Albert Ou <aou@eecs.berkeley.edu>,
Alexander Viro <viro@zeniv.linux.org.uk>,
Kees Cook <keescook@chromium.org>,
linux-kernel@vger.kernel.org,
linux-arm-kernel@lists.infradead.org, linux-mips@vger.kernel.org,
linux-riscv@lists.infradead.org, linux-fsdevel@vger.kernel.org,
linux-mm@kvack.org, Alexandre Ghiti <alex@ghiti.fr>
Subject: [PATCH v6 06/14] arm: Properly account for stack randomization and stack guard gap
Date: Thu, 8 Aug 2019 02:17:48 -0400 [thread overview]
Message-ID: <20190808061756.19712-7-alex@ghiti.fr> (raw)
In-Reply-To: <20190808061756.19712-1-alex@ghiti.fr>
This commit takes care of stack randomization and stack guard gap when
computing mmap base address and checks if the task asked for randomization.
This fixes the problem uncovered and not fixed for arm here:
https://lkml.kernel.org/r/20170622200033.25714-1-riel@redhat.com
Signed-off-by: Alexandre Ghiti <alex@ghiti.fr>
Acked-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
---
arch/arm/mm/mmap.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index f866870db749..bff3d00bda5b 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -18,8 +18,9 @@
(((pgoff)<<PAGE_SHIFT) & (SHMLBA-1)))
/* gap between mmap and stack */
-#define MIN_GAP (128*1024*1024UL)
-#define MAX_GAP ((TASK_SIZE)/6*5)
+#define MIN_GAP (128*1024*1024UL)
+#define MAX_GAP ((TASK_SIZE)/6*5)
+#define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))
static int mmap_is_legacy(struct rlimit *rlim_stack)
{
@@ -35,6 +36,15 @@ static int mmap_is_legacy(struct rlimit *rlim_stack)
static unsigned long mmap_base(unsigned long rnd, struct rlimit *rlim_stack)
{
unsigned long gap = rlim_stack->rlim_cur;
+ unsigned long pad = stack_guard_gap;
+
+ /* Account for stack randomization if necessary */
+ if (current->flags & PF_RANDOMIZE)
+ pad += (STACK_RND_MASK << PAGE_SHIFT);
+
+ /* Values close to RLIM_INFINITY can overflow. */
+ if (gap + pad > gap)
+ gap += pad;
if (gap < MIN_GAP)
gap = MIN_GAP;
--
2.20.1
next prev parent reply other threads:[~2019-08-08 6:24 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-08 6:17 [PATCH v6 00/14] Provide generic top-down mmap layout functions Alexandre Ghiti
2019-08-08 6:17 ` [PATCH v6 01/14] mm, fs: Move randomize_stack_top from fs to mm Alexandre Ghiti
2019-08-08 6:17 ` [PATCH v6 02/14] arm64: Make use of is_compat_task instead of hardcoding this test Alexandre Ghiti
2019-08-08 6:17 ` [PATCH v6 03/14] arm64: Consider stack randomization for mmap base only when necessary Alexandre Ghiti
2019-08-08 6:17 ` [PATCH v6 04/14] arm64, mm: Move generic mmap layout functions to mm Alexandre Ghiti
2019-08-08 6:17 ` [PATCH v6 05/14] arm64, mm: Make randomization selected by generic topdown mmap layout Alexandre Ghiti
2019-08-08 6:17 ` Alexandre Ghiti [this message]
2019-08-08 6:17 ` [PATCH v6 07/14] arm: Use STACK_TOP when computing mmap base address Alexandre Ghiti
2019-08-08 6:17 ` [PATCH v6 08/14] arm: Use generic mmap top-down layout and brk randomization Alexandre Ghiti
2019-08-08 6:17 ` [PATCH v6 09/14] mips: Properly account for stack randomization and stack guard gap Alexandre Ghiti
2019-08-08 9:16 ` Sergei Shtylyov
2019-08-09 9:44 ` Alexandre Ghiti
2019-08-08 6:17 ` [PATCH v6 10/14] mips: Use STACK_TOP when computing mmap base address Alexandre Ghiti
2019-08-08 6:17 ` [PATCH v6 11/14] mips: Adjust brk randomization offset to fit generic version Alexandre Ghiti
2019-08-08 9:19 ` Sergei Shtylyov
2019-08-09 9:45 ` Alexandre Ghiti
2019-08-08 6:17 ` [PATCH v6 12/14] mips: Replace arch specific way to determine 32bit task with " Alexandre Ghiti
2019-08-08 6:17 ` [PATCH v6 13/14] mips: Use generic mmap top-down layout and brk randomization Alexandre Ghiti
2019-08-08 6:17 ` [PATCH v6 14/14] riscv: Make mmap allocation top-down by default Alexandre Ghiti
2019-10-05 2:12 ` Atish Patra
2019-10-07 9:11 ` Alex Ghiti
2019-10-08 0:46 ` Atish Patra
2019-10-08 11:58 ` Alex Ghiti
2019-10-09 2:07 ` Atish Patra
2019-10-09 18:39 ` Alex Ghiti
2019-10-15 0:31 ` Atish Patra
2019-10-15 7:48 ` Andreas Schwab
2019-10-08 9:19 ` Alex Ghiti
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190808061756.19712-7-alex@ghiti.fr \
--to=alex@ghiti.fr \
--cc=akpm@linux-foundation.org \
--cc=aou@eecs.berkeley.edu \
--cc=catalin.marinas@arm.com \
--cc=hch@lst.de \
--cc=jhogan@kernel.org \
--cc=keescook@chromium.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mips@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-riscv@lists.infradead.org \
--cc=linux@armlinux.org.uk \
--cc=mcgrof@kernel.org \
--cc=palmer@sifive.com \
--cc=paul.burton@mips.com \
--cc=paul.walmsley@sifive.com \
--cc=ralf@linux-mips.org \
--cc=viro@zeniv.linux.org.uk \
--cc=will.deacon@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).