* [PATCH 0/3] properly account for stack randomization and guard gap
@ 2017-06-22 20:00 riel
2017-06-22 20:00 ` [PATCH 1/3] x86/mmap: properly account for stack randomization in mmap_base riel
` (3 more replies)
0 siblings, 4 replies; 6+ messages in thread
From: riel @ 2017-06-22 20:00 UTC (permalink / raw)
To: linux-kernel; +Cc: akpm, mingo, will.deacon, danielmicay, benh, hughd
When RLIMIT_STACK is larger than the minimum gap enforced by
mmap_base(), it is possible for the kernel to place the mmap
area where the stack wants to grow, resulting in the stack
not being able to use the space that should have been allocated
to it through RLIMIT_STACK.
This series ensures that x86, ARM64, and PPC have at least
RLIMIT_STACK + stack randomization + the stack guard gap
space available for the stack.
s390 seems to be ok. I have not checked other architectures.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 1/3] x86/mmap: properly account for stack randomization in mmap_base
2017-06-22 20:00 [PATCH 0/3] properly account for stack randomization and guard gap riel
@ 2017-06-22 20:00 ` riel
2017-06-22 20:00 ` [PATCH 2/3] arm64/mmap: " riel
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: riel @ 2017-06-22 20:00 UTC (permalink / raw)
To: linux-kernel; +Cc: akpm, mingo, will.deacon, danielmicay, benh, hughd
From: Rik van Riel <riel@redhat.com>
When RLIMIT_STACK is, for example, 256MB, the current code results in
a gap between the top of the task and mmap_base of 256MB, failing to
take into account the amount by which the stack address was randomized.
In other words, the stack gets less than RLIMIT_STACK space.
Ensure that the gap between the stack and mmap_base always takes stack
randomization and the stack guard gap into account.
>From Daniel Micay's linux-hardened tree.
Reported-by: Florian Weimer <fweimer@redhat.com>
Signed-off-by: Daniel Micay <danielmicay@gmail.com>
Signed-off-by: Rik van Riel <riel@redhat.com>
---
arch/x86/mm/mmap.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index 19ad095b41df..7c35dd73dbd4 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -95,13 +95,18 @@ unsigned long arch_mmap_rnd(void)
static unsigned long mmap_base(unsigned long rnd, unsigned long task_size)
{
unsigned long gap = rlimit(RLIMIT_STACK);
+ unsigned long pad = stack_maxrandom_size(task_size) + stack_guard_gap;
unsigned long gap_min, gap_max;
+ /* Values close to RLIM_INFINITY can overflow. */
+ if (gap + pad > gap)
+ gap += pad;
+
/*
* Top of mmap area (just below the process stack).
* Leave an at least ~128 MB hole with possible stack randomization.
*/
- gap_min = SIZE_128M + stack_maxrandom_size(task_size);
+ gap_min = SIZE_128M;
gap_max = (task_size / 6) * 5;
if (gap < gap_min)
--
2.9.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/3] arm64/mmap: properly account for stack randomization in mmap_base
2017-06-22 20:00 [PATCH 0/3] properly account for stack randomization and guard gap riel
2017-06-22 20:00 ` [PATCH 1/3] x86/mmap: properly account for stack randomization in mmap_base riel
@ 2017-06-22 20:00 ` riel
2017-06-22 20:00 ` [PATCH 3/3] powerpc,mmap: " riel
2017-06-23 8:35 ` [PATCH 0/3] properly account for stack randomization and guard gap Ingo Molnar
3 siblings, 0 replies; 6+ messages in thread
From: riel @ 2017-06-22 20:00 UTC (permalink / raw)
To: linux-kernel; +Cc: akpm, mingo, will.deacon, danielmicay, benh, hughd
From: Rik van Riel <riel@redhat.com>
When RLIMIT_STACK is, for example, 256MB, the current code results in
a gap between the top of the task and mmap_base of 256MB, failing to
take into account the amount by which the stack address was randomized.
In other words, the stack gets less than RLIMIT_STACK space.
Ensure that the gap between the stack and mmap_base always takes stack
randomization and the stack guard gap into account.
>From Daniel Micay's linux-hardened tree.
Reported-by: Florian Weimer <fweimer@redhat.com>
Signed-off-by: Daniel Micay <danielmicay@gmail.com>
Signed-off-by: Rik van Riel <riel@redhat.com>
---
arch/arm64/mm/mmap.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
index 7b0d55756eb1..a0cb6b8ccde7 100644
--- a/arch/arm64/mm/mmap.c
+++ b/arch/arm64/mm/mmap.c
@@ -34,7 +34,7 @@
* Leave enough space between the mmap area and the stack to honour ulimit in
* the face of randomisation.
*/
-#define MIN_GAP (SZ_128M + ((STACK_RND_MASK << PAGE_SHIFT) + 1))
+#define MIN_GAP (SZ_128M)
#define MAX_GAP (STACK_TOP/6*5)
static int mmap_is_legacy(void)
@@ -64,6 +64,11 @@ unsigned long arch_mmap_rnd(void)
static unsigned long mmap_base(unsigned long rnd)
{
unsigned long gap = rlimit(RLIMIT_STACK);
+ unsigned long pad = (STACK_RND_MASK << PAGE_SHIFT) + stack_guard_gap;
+
+ /* Values close to RLIM_INFINITY can overflow. */
+ if (gap + pad > gap)
+ gap += pad;
if (gap < MIN_GAP)
gap = MIN_GAP;
--
2.9.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 3/3] powerpc,mmap: properly account for stack randomization in mmap_base
2017-06-22 20:00 [PATCH 0/3] properly account for stack randomization and guard gap riel
2017-06-22 20:00 ` [PATCH 1/3] x86/mmap: properly account for stack randomization in mmap_base riel
2017-06-22 20:00 ` [PATCH 2/3] arm64/mmap: " riel
@ 2017-06-22 20:00 ` riel
2017-06-23 8:35 ` [PATCH 0/3] properly account for stack randomization and guard gap Ingo Molnar
3 siblings, 0 replies; 6+ messages in thread
From: riel @ 2017-06-22 20:00 UTC (permalink / raw)
To: linux-kernel; +Cc: akpm, mingo, will.deacon, danielmicay, benh, hughd
From: Rik van Riel <riel@redhat.com>
When RLIMIT_STACK is, for example, 256MB, the current code results in
a gap between the top of the task and mmap_base of 256MB, failing to
take into account the amount by which the stack address was randomized.
In other words, the stack gets less than RLIMIT_STACK space.
Ensure that the gap between the stack and mmap_base always takes stack
randomization and the stack guard gap into account.
Inspired by Daniel Micay's linux-hardened tree.
Reported-by: Florian Weimer <fweimer@redhat.com>
Signed-off-by: Rik van Riel <riel@redhat.com>
---
arch/powerpc/mm/mmap.c | 28 +++++++++++++++++++---------
1 file changed, 19 insertions(+), 9 deletions(-)
diff --git a/arch/powerpc/mm/mmap.c b/arch/powerpc/mm/mmap.c
index 0ee6be4f1ba4..5d78b193fec4 100644
--- a/arch/powerpc/mm/mmap.c
+++ b/arch/powerpc/mm/mmap.c
@@ -34,16 +34,9 @@
/*
* Top of mmap area (just below the process stack).
*
- * Leave at least a ~128 MB hole on 32bit applications.
- *
- * On 64bit applications we randomise the stack by 1GB so we need to
- * space our mmap start address by a further 1GB, otherwise there is a
- * chance the mmap area will end up closer to the stack than our ulimit
- * requires.
+ * Leave at least a ~128 MB hole.
*/
-#define MIN_GAP32 (128*1024*1024)
-#define MIN_GAP64 ((128 + 1024)*1024*1024UL)
-#define MIN_GAP ((is_32bit_task()) ? MIN_GAP32 : MIN_GAP64)
+#define MIN_GAP (128*1024*1024)
#define MAX_GAP (TASK_SIZE/6*5)
static inline int mmap_is_legacy(void)
@@ -71,9 +64,26 @@ unsigned long arch_mmap_rnd(void)
return rnd << PAGE_SHIFT;
}
+static inline unsigned long stack_maxrandom_size(void)
+{
+ if (!(current->flags & PF_RANDOMIZE))
+ return 0;
+
+ /* 8MB for 32bit, 1GB for 64bit */
+ if (is_32bit_task())
+ return (1<<23);
+ else
+ return (1<<30);
+}
+
static inline unsigned long mmap_base(unsigned long rnd)
{
unsigned long gap = rlimit(RLIMIT_STACK);
+ unsigned long pad = stack_maxrandom_size() + stack_guard_gap;
+
+ /* Values close to RLIM_INFINITY can overflow. */
+ if (gap + pad > gap)
+ gap += pad;
if (gap < MIN_GAP)
gap = MIN_GAP;
--
2.9.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 0/3] properly account for stack randomization and guard gap
2017-06-22 20:00 [PATCH 0/3] properly account for stack randomization and guard gap riel
` (2 preceding siblings ...)
2017-06-22 20:00 ` [PATCH 3/3] powerpc,mmap: " riel
@ 2017-06-23 8:35 ` Ingo Molnar
2017-06-23 15:13 ` Rik van Riel
3 siblings, 1 reply; 6+ messages in thread
From: Ingo Molnar @ 2017-06-23 8:35 UTC (permalink / raw)
To: riel
Cc: linux-kernel, akpm, will.deacon, danielmicay, benh, hughd,
Linus Torvalds, Michal Hocko, Dave Jones, Oleg Nesterov
* riel@redhat.com <riel@redhat.com> wrote:
> When RLIMIT_STACK is larger than the minimum gap enforced by
> mmap_base(), it is possible for the kernel to place the mmap
> area where the stack wants to grow, resulting in the stack
> not being able to use the space that should have been allocated
> to it through RLIMIT_STACK.
>
> This series ensures that x86, ARM64, and PPC have at least
> RLIMIT_STACK + stack randomization + the stack guard gap
> space available for the stack.
>
> s390 seems to be ok. I have not checked other architectures.
x86 patch LGTM:
Acked-by: Ingo Molnar <mingo@kernel.org>
... but I suspect this wants to go via -mm or Linus directly?
Thanks,
Ingo
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 0/3] properly account for stack randomization and guard gap
2017-06-23 8:35 ` [PATCH 0/3] properly account for stack randomization and guard gap Ingo Molnar
@ 2017-06-23 15:13 ` Rik van Riel
0 siblings, 0 replies; 6+ messages in thread
From: Rik van Riel @ 2017-06-23 15:13 UTC (permalink / raw)
To: Ingo Molnar
Cc: linux-kernel, akpm, will.deacon, danielmicay, benh, hughd,
Linus Torvalds, Michal Hocko, Dave Jones, Oleg Nesterov
On Fri, 2017-06-23 at 10:35 +0200, Ingo Molnar wrote:
> * riel@redhat.com <riel@redhat.com> wrote:
>
> > When RLIMIT_STACK is larger than the minimum gap enforced by
> > mmap_base(), it is possible for the kernel to place the mmap
> > area where the stack wants to grow, resulting in the stack
> > not being able to use the space that should have been allocated
> > to it through RLIMIT_STACK.
> >
> > This series ensures that x86, ARM64, and PPC have at least
> > RLIMIT_STACK + stack randomization + the stack guard gap
> > space available for the stack.
> >
> > s390 seems to be ok. I have not checked other architectures.
>
> x86 patch LGTM:
>
> Acked-by: Ingo Molnar <mingo@kernel.org>
>
> ... but I suspect this wants to go via -mm or Linus directly?
I believe Andrew picked it up yesterday.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2017-06-23 15:13 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-06-22 20:00 [PATCH 0/3] properly account for stack randomization and guard gap riel
2017-06-22 20:00 ` [PATCH 1/3] x86/mmap: properly account for stack randomization in mmap_base riel
2017-06-22 20:00 ` [PATCH 2/3] arm64/mmap: " riel
2017-06-22 20:00 ` [PATCH 3/3] powerpc,mmap: " riel
2017-06-23 8:35 ` [PATCH 0/3] properly account for stack randomization and guard gap Ingo Molnar
2017-06-23 15:13 ` Rik van Riel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).