[PATCH] x86/mm: Fix ELF_ET_DYN_BASE for 5-level paging

[PATCH] x86/mm: Fix ELF_ET_DYN_BASE for 5-level paging

[Kirill A. Shutemov]

On machines with 5-level paging we don't want to allocate mapping above
47-bit unless user explicitly asked for it. See b569bab78d8d ("x86/mm:
Prepare to expose larger address space to userspace") for details.

c715b72c1ba4 ("mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base
changes") broke the behaviour. After the commit elf binary and heap got
mapped above 47-bits.

Let's fix this.

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Fixes: c715b72c1ba4 ("mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes")
Cc: Kees Cook <keescook@chromium.org>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Nicholas Piggin <npiggin@gmail.com>
---
 arch/x86/include/asm/elf.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index c1a125e47ff3..3a091cea36c5 100644
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -253,7 +253,7 @@ extern int force_personality32;
  * space open for things that want to use the area for 32-bit pointers.
  */
 #define ELF_ET_DYN_BASE		(mmap_is_ia32() ? 0x000400000UL : \
-						  (TASK_SIZE / 3 * 2))
+						  (DEFAULT_MAP_WINDOW / 3 * 2))
 
 /* This yields a mask that user programs can use to figure out what
    instruction set this CPU supports.  This could be done in user space,
-- 
2.14.2

Re: [PATCH] x86/mm: Fix ELF_ET_DYN_BASE for 5-level paging

[Kirill A. Shutemov]

On Tue, Nov 07, 2017 at 01:38:04PM +0300, Kirill A. Shutemov wrote:
> On machines with 5-level paging we don't want to allocate mapping above
> 47-bit unless user explicitly asked for it. See b569bab78d8d ("x86/mm:
> Prepare to expose larger address space to userspace") for details.
> 
> c715b72c1ba4 ("mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base
> changes") broke the behaviour. After the commit elf binary and heap got
> mapped above 47-bits.
> 
> Let's fix this.
> 
> Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> Fixes: c715b72c1ba4 ("mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes")
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Ingo Molnar <mingo@elte.hu>
> Cc: "H. Peter Anvin" <hpa@zytor.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Nicholas Piggin <npiggin@gmail.com>

Folks, can we please get this applied?

Without the change on 5-level paging machine we will have elf binary and
heap mapped above 47-bit by default. This may lead to userspace brakage.

> ---
>  arch/x86/include/asm/elf.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
> index c1a125e47ff3..3a091cea36c5 100644
> --- a/arch/x86/include/asm/elf.h
> +++ b/arch/x86/include/asm/elf.h
> @@ -253,7 +253,7 @@ extern int force_personality32;
>   * space open for things that want to use the area for 32-bit pointers.
>   */
>  #define ELF_ET_DYN_BASE		(mmap_is_ia32() ? 0x000400000UL : \
> -						  (TASK_SIZE / 3 * 2))
> +						  (DEFAULT_MAP_WINDOW / 3 * 2))
>  
>  /* This yields a mask that user programs can use to figure out what
>     instruction set this CPU supports.  This could be done in user space,
> -- 
> 2.14.2
> 
> --
> To unsubscribe, send a message with 'unsubscribe linux-mm' in
> the body to majordomo@kvack.org.  For more info on Linux MM,
> see: http://www.linux-mm.org/ .
> Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

-- 
 Kirill A. Shutemov

Re: [PATCH] x86/mm: Fix ELF_ET_DYN_BASE for 5-level paging

[Michal Hocko]

On Tue 07-11-17 13:38:04, Kirill A. Shutemov wrote:
> On machines with 5-level paging we don't want to allocate mapping above
> 47-bit unless user explicitly asked for it. See b569bab78d8d ("x86/mm:
> Prepare to expose larger address space to userspace") for details.
> 
> c715b72c1ba4 ("mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base
> changes") broke the behaviour. After the commit elf binary and heap got
> mapped above 47-bits.
> 
> Let's fix this.
> 
> Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> Fixes: c715b72c1ba4 ("mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes")
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Ingo Molnar <mingo@elte.hu>
> Cc: "H. Peter Anvin" <hpa@zytor.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Nicholas Piggin <npiggin@gmail.com>

FWIW
Acked-by: Michal Hocko <mhocko@suse.com>

> ---
>  arch/x86/include/asm/elf.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
> index c1a125e47ff3..3a091cea36c5 100644
> --- a/arch/x86/include/asm/elf.h
> +++ b/arch/x86/include/asm/elf.h
> @@ -253,7 +253,7 @@ extern int force_personality32;
>   * space open for things that want to use the area for 32-bit pointers.
>   */
>  #define ELF_ET_DYN_BASE		(mmap_is_ia32() ? 0x000400000UL : \
> -						  (TASK_SIZE / 3 * 2))
> +						  (DEFAULT_MAP_WINDOW / 3 * 2))
>  
>  /* This yields a mask that user programs can use to figure out what
>     instruction set this CPU supports.  This could be done in user space,
> -- 
> 2.14.2

-- 
Michal Hocko
SUSE Labs

Re: [PATCH] x86/mm: Fix ELF_ET_DYN_BASE for 5-level paging

[Thomas Gleixner]

On Tue, 7 Nov 2017, Kirill A. Shutemov wrote:

> On machines with 5-level paging we don't want to allocate mapping above
> 47-bit unless user explicitly asked for it. See b569bab78d8d ("x86/mm:
> Prepare to expose larger address space to userspace") for details.
> 
> c715b72c1ba4 ("mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base
> changes") broke the behaviour. After the commit elf binary and heap got
> mapped above 47-bits.
> 
> Let's fix this.

That's a really useless sentence.....

> Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> Fixes: c715b72c1ba4 ("mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes")
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Ingo Molnar <mingo@elte.hu>
> Cc: "H. Peter Anvin" <hpa@zytor.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Nicholas Piggin <npiggin@gmail.com>
> ---
>  arch/x86/include/asm/elf.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
> index c1a125e47ff3..3a091cea36c5 100644
> --- a/arch/x86/include/asm/elf.h
> +++ b/arch/x86/include/asm/elf.h
> @@ -253,7 +253,7 @@ extern int force_personality32;
>   * space open for things that want to use the area for 32-bit pointers.
>   */
>  #define ELF_ET_DYN_BASE		(mmap_is_ia32() ? 0x000400000UL : \
> -						  (TASK_SIZE / 3 * 2))
> +						  (DEFAULT_MAP_WINDOW / 3 * 2))
>  
>  /* This yields a mask that user programs can use to figure out what
>     instruction set this CPU supports.  This could be done in user space,
> -- 
> 2.14.2
> 
> 

[tip:x86/urgent] x86/mm: Fix ELF_ET_DYN_BASE for 5-level paging

[tip-bot for Kirill A. Shutemov]

Commit-ID:  be739f4b5ddece74ef25e2304b17a7fd24575e9b
Gitweb:     https://git.kernel.org/tip/be739f4b5ddece74ef25e2304b17a7fd24575e9b
Author:     Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
AuthorDate: Tue, 7 Nov 2017 13:38:04 +0300
Committer:  Thomas Gleixner <tglx@linutronix.de>
CommitDate: Thu, 9 Nov 2017 18:20:20 +0100

x86/mm: Fix ELF_ET_DYN_BASE for 5-level paging

On machines with 5-level paging we don't want to allocate mapping above
47-bit unless user explicitly asked for it. See b569bab78d8d ("x86/mm:
Prepare to expose larger address space to userspace") for details.

c715b72c1ba4 ("mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base
changes") broke the behaviour. After the commit elf binary and heap got
mapped above 47-bits.

Use DEFAULT_MAP_WINDOW instead of TASK_SIZE to determine ELF_ET_DYN_BASE so
it's forced to be below 47-bits unconditionally.

Fixes: c715b72c1ba4 ("mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes")
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: linux-mm@kvack.org
Cc: Andrew Morton <akpm@linux-foundation.org>
Link: https://lkml.kernel.org/r/20171107103804.47341-1-kirill.shutemov@linux.intel.com

---
 arch/x86/include/asm/elf.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index c1a125e4..3a091ce 100644
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -253,7 +253,7 @@ extern int force_personality32;
  * space open for things that want to use the area for 32-bit pointers.
  */
 #define ELF_ET_DYN_BASE		(mmap_is_ia32() ? 0x000400000UL : \
-						  (TASK_SIZE / 3 * 2))
+						  (DEFAULT_MAP_WINDOW / 3 * 2))
 
 /* This yields a mask that user programs can use to figure out what
    instruction set this CPU supports.  This could be done in user space,