From: Willy Tarreau <w@1wt.eu>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Ben Hutchings <ben@decadent.org.uk>,
Michal Hocko <mhocko@kernel.org>, Hugh Dickins <hughd@google.com>,
Oleg Nesterov <oleg@redhat.com>,
"Jason A. Donenfeld" <Jason@zx2c4.com>,
Rik van Riel <riel@redhat.com>,
Larry Woodman <lwoodman@redhat.com>,
"Kirill A. Shutemov" <kirill@shutemov.name>,
Tony Luck <tony.luck@intel.com>,
"James E.J. Bottomley" <jejb@parisc-linux.org>,
Helge Diller <deller@gmx.de>,
James Hogan <james.hogan@imgtec.com>,
Laura Abbott <labbott@redhat.com>, Greg KH <greg@kroah.com>,
"security@kernel.org" <security@kernel.org>,
Qualys Security Advisory <qsa@qualys.com>,
LKML <linux-kernel@vger.kernel.org>,
Ximin Luo <infinity0@debian.org>
Subject: Re: [PATCH] mm: larger stack guard gap, between vmas
Date: Thu, 6 Jul 2017 12:11:49 +0200 [thread overview]
Message-ID: <20170706101149.GA25937@1wt.eu> (raw)
In-Reply-To: <20170706082406.GA25812@1wt.eu>
On Thu, Jul 06, 2017 at 10:24:06AM +0200, Willy Tarreau wrote:
> On Wed, Jul 05, 2017 at 04:51:06PM -0700, Linus Torvalds wrote:
> > On Wed, Jul 5, 2017 at 4:35 PM, Ben Hutchings <ben@decadent.org.uk> wrote:
> > >>
> > >> And I think your second patch breaks that "use a really large value to
> > >> approximate infinity" case that definitely has existed as a pattern.
> > >
> > > Right. Well that seems to leave us with remembering the MAP_FIXED flag
> > > and using that as the condition to ignore the previous mapping.
> >
> > I'm not particularly happy about having a MAP_FIXED special case, but
> > yeah, I'm not seeing a lot of alternatives.
>
> We can possibly refine it like this :
> - use PROT_NONE as a mark for the end of the stack and consider the
> application doing this knows exactly what it's doing ;
>
> - use other MAP_FIXED as a limit for a shorter gap (ie 4kB), considering
> that 1) it used to work like this for many years, and 2) if an application
> is forcing a MAP_FIXED just below the stack and at the same time uses
> large alloca() or VLA it's definitely bogus and looking for unfixable
> trouble. Not allowing this means we break existing applications anyway.
That would probably give the following (only build-tested on x86_64). Do
you think it would make sense and/or be acceptable ? That would more
easily avoid the other options like adding sysctl + warnings or making
a special case of setuid.
Willy
---
>From 56ae4e57e446bc92fd2647327da281e313930524 Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Thu, 6 Jul 2017 12:00:54 +0200
Subject: mm: mm, mmap: only apply a one page gap betwen the stack an
MAP_FIXED
Some programs place a MAP_FIXED below the stack, not leaving enough room
for the stack guard. This patch keeps track of MAP_FIXED, mirroring it in
a new VM_FIXED flag and reduces the stack guard to a single page (as it
used to be) in such a situation, assuming that when an application places
a fixed map close to the stack, it very likely does it on purpose and is
taking the full responsibility for the risk of the stack blowing up.
Cc: Ben Hutchings <ben@decadent.org.uk>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
include/linux/mm.h | 1 +
include/linux/mman.h | 1 +
mm/mmap.c | 30 ++++++++++++++++++++----------
3 files changed, 22 insertions(+), 10 deletions(-)
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 6f543a4..41492b9 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -188,6 +188,7 @@ extern int overcommit_kbytes_handler(struct ctl_table *, int, void __user *,
#define VM_ACCOUNT 0x00100000 /* Is a VM accounted object */
#define VM_NORESERVE 0x00200000 /* should the VM suppress accounting */
#define VM_HUGETLB 0x00400000 /* Huge TLB Page VM */
+#define VM_FIXED 0x00800000 /* MAP_FIXED was used */
#define VM_ARCH_1 0x01000000 /* Architecture-specific flag */
#define VM_ARCH_2 0x02000000
#define VM_DONTDUMP 0x04000000 /* Do not include in the core dump */
diff --git a/include/linux/mman.h b/include/linux/mman.h
index 634c4c5..3a29069 100644
--- a/include/linux/mman.h
+++ b/include/linux/mman.h
@@ -86,6 +86,7 @@ static inline bool arch_validate_prot(unsigned long prot)
{
return _calc_vm_trans(flags, MAP_GROWSDOWN, VM_GROWSDOWN ) |
_calc_vm_trans(flags, MAP_DENYWRITE, VM_DENYWRITE ) |
+ _calc_vm_trans(flags, MAP_FIXED, VM_FIXED ) |
_calc_vm_trans(flags, MAP_LOCKED, VM_LOCKED );
}
diff --git a/mm/mmap.c b/mm/mmap.c
index ece0f6d..7fc1c29 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2244,12 +2244,17 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
gap_addr = TASK_SIZE;
next = vma->vm_next;
+
+ /* PROT_NONE above a MAP_GROWSUP always serves as a mark and inhibits
+ * the stack guard gap.
+ * MAP_FIXED above a MAP_GROWSUP only requires a single page guard.
+ */
if (next && next->vm_start < gap_addr &&
- (next->vm_flags & (VM_WRITE|VM_READ|VM_EXEC))) {
- if (!(next->vm_flags & VM_GROWSUP))
- return -ENOMEM;
- /* Check that both stack segments have the same anon_vma? */
- }
+ !(next->vm_flags & VM_GROWSUP) &&
+ (next->vm_flags & (VM_WRITE|VM_READ|VM_EXEC)) &&
+ (!(next->vm_flags & VM_FIXED) ||
+ next->vm_start < address + PAGE_SIZE))
+ return -ENOMEM;
/* We must make sure the anon_vma is allocated. */
if (unlikely(anon_vma_prepare(vma)))
@@ -2329,12 +2334,17 @@ int expand_downwards(struct vm_area_struct *vma,
if (gap_addr > address)
return -ENOMEM;
prev = vma->vm_prev;
+
+ /* PROT_NONE below a MAP_GROWSDOWN always serves as a mark and inhibits
+ * the stack guard gap.
+ * MAP_FIXED below a MAP_GROWSDOWN only requires a single page guard.
+ */
if (prev && prev->vm_end > gap_addr &&
- (prev->vm_flags & (VM_WRITE|VM_READ|VM_EXEC))) {
- if (!(prev->vm_flags & VM_GROWSDOWN))
- return -ENOMEM;
- /* Check that both stack segments have the same anon_vma? */
- }
+ !(prev->vm_flags & VM_GROWSDOWN) &&
+ (prev->vm_flags & (VM_WRITE|VM_READ|VM_EXEC)) &&
+ (!(prev->vm_flags & VM_FIXED) ||
+ prev->vm_end > address - PAGE_SIZE))
+ return -ENOMEM;
/* We must make sure the anon_vma is allocated. */
if (unlikely(anon_vma_prepare(vma)))
--
1.7.12.1
next prev parent reply other threads:[~2017-07-06 10:12 UTC|newest]
Thread overview: 91+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <alpine.LSU.2.11.1706190355140.2626@eggly.anvils>
2017-06-22 12:30 ` [PATCH] mm: larger stack guard gap, between vmas Ben Hutchings
2017-06-22 12:46 ` Willy Tarreau
2017-06-22 12:58 ` Ben Hutchings
2017-06-22 13:10 ` Willy Tarreau
2017-06-22 13:28 ` Willy Tarreau
2017-06-22 13:15 ` [vs-plain] " Levente Polyak
2017-06-22 13:59 ` Willy Tarreau
2017-06-22 14:14 ` Ben Hutchings
2017-06-22 14:34 ` Willy Tarreau
2017-06-23 3:10 ` Andy Lutomirski
2017-06-23 4:42 ` Linus Torvalds
2017-06-22 21:23 ` Helge Deller
2017-06-23 4:35 ` Hugh Dickins
2017-06-24 9:11 ` Hugh Dickins
2017-06-24 18:29 ` Ben Hutchings
[not found] ` <CA+55aFx6j4na3BVRC2aQuf-kNp1jzGahN8To_SFpNu+H=gopJA@mail.gmail.com>
[not found] ` <20170619142358.GA32654@1wt.eu>
[not found] ` <1498009101.2655.6.camel@decadent.org.uk>
[not found] ` <20170621092419.GA22051@dhcp22.suse.cz>
[not found] ` <1498042057.2655.8.camel@decadent.org.uk>
2017-07-03 23:55 ` Ben Hutchings
2017-07-04 0:05 ` Linus Torvalds
2017-07-04 8:41 ` Michal Hocko
2017-07-04 9:35 ` Michal Hocko
2017-07-04 9:47 ` Willy Tarreau
2017-07-04 10:42 ` Michal Hocko
2017-07-04 11:36 ` Ben Hutchings
2017-07-04 12:00 ` Michal Hocko
2017-07-04 12:11 ` Michal Hocko
2017-07-04 12:21 ` Ben Hutchings
2017-07-04 12:33 ` Michal Hocko
2017-07-04 14:19 ` Ximin Luo
2017-07-04 14:48 ` Michal Hocko
2017-07-04 15:51 ` Willy Tarreau
2017-07-04 17:22 ` Michal Hocko
2017-07-04 18:37 ` Linus Torvalds
2017-07-04 18:39 ` Willy Tarreau
2017-07-04 18:47 ` Linus Torvalds
2017-07-04 19:03 ` Willy Tarreau
2017-07-04 16:18 ` Linus Torvalds
2017-07-04 16:27 ` John Haxby
2017-07-04 17:02 ` Willy Tarreau
2017-07-05 12:26 ` Ben Hutchings
2017-07-04 17:11 ` Willy Tarreau
2017-07-05 12:25 ` Ben Hutchings
2017-07-04 23:01 ` Ben Hutchings
2017-07-04 23:31 ` Linus Torvalds
2017-07-05 6:36 ` Michal Hocko
2017-07-05 8:14 ` Willy Tarreau
2017-07-05 8:24 ` Michal Hocko
2017-07-05 9:15 ` Willy Tarreau
2017-07-05 12:21 ` Ben Hutchings
2017-07-05 13:52 ` Willy Tarreau
2017-07-05 14:19 ` Michal Hocko
2017-07-05 16:06 ` Linus Torvalds
2017-07-06 7:34 ` Michal Hocko
2017-07-05 12:19 ` Ben Hutchings
2017-07-05 14:23 ` Michal Hocko
2017-07-05 15:25 ` Ben Hutchings
2017-07-05 15:59 ` Michal Hocko
2017-07-05 16:58 ` Ben Hutchings
2017-07-05 17:05 ` Michal Hocko
2017-07-05 17:24 ` Ben Hutchings
2017-07-05 17:15 ` Linus Torvalds
2017-07-05 23:35 ` Ben Hutchings
2017-07-05 23:51 ` Linus Torvalds
2017-07-06 8:24 ` Willy Tarreau
2017-07-06 10:11 ` Willy Tarreau [this message]
2017-07-10 2:40 ` [lkp-robot] [mm] a99d848d3b: kernel_BUG_at_mm/mmap.c kernel test robot
2017-07-05 16:15 ` [PATCH] mm: larger stack guard gap, between vmas Andy Lutomirski
2017-07-05 16:20 ` Linus Torvalds
2017-07-05 17:23 ` Andy Lutomirski
2017-07-05 19:32 ` Ben Hutchings
2017-07-05 20:40 ` Willy Tarreau
2017-07-05 20:53 ` Andy Lutomirski
2017-07-05 23:50 ` Ben Hutchings
2017-07-06 0:23 ` Andy Lutomirski
2017-07-05 23:50 ` Kees Cook
2017-07-05 23:55 ` Linus Torvalds
2017-07-06 0:31 ` Andy Lutomirski
2017-07-06 0:47 ` Linus Torvalds
2017-07-06 0:19 ` Andy Lutomirski
2017-07-06 2:45 ` Kees Cook
2017-07-06 5:23 ` Willy Tarreau
2017-07-06 5:33 ` Kevin Easton
2017-07-05 16:17 ` Linus Torvalds
2017-07-05 18:59 ` Willy Tarreau
2017-07-05 19:17 ` Linus Torvalds
2017-07-05 19:18 ` Willy Tarreau
2017-07-05 19:21 ` Linus Torvalds
2017-07-05 1:16 ` [vs-plain] " kseifried
2017-07-05 14:11 ` Solar Designer
2017-07-04 10:46 ` Michal Hocko
2017-07-04 10:51 ` Michal Hocko
2017-07-04 0:27 ` Andy Lutomirski
2017-07-04 12:26 ` [vs-plain] " John Haxby
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170706101149.GA25937@1wt.eu \
--to=w@1wt.eu \
--cc=Jason@zx2c4.com \
--cc=ben@decadent.org.uk \
--cc=deller@gmx.de \
--cc=greg@kroah.com \
--cc=hughd@google.com \
--cc=infinity0@debian.org \
--cc=james.hogan@imgtec.com \
--cc=jejb@parisc-linux.org \
--cc=kirill@shutemov.name \
--cc=labbott@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lwoodman@redhat.com \
--cc=mhocko@kernel.org \
--cc=oleg@redhat.com \
--cc=qsa@qualys.com \
--cc=riel@redhat.com \
--cc=security@kernel.org \
--cc=tony.luck@intel.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).