Re: get_arg_page() && ptr_size accounting

[Kees Cook <keescook@chromium.org>]

On Mon, Sep 10, 2018 at 9:41 AM, Kees Cook <keescook@chromium.org> wrote:
> On Mon, Sep 10, 2018 at 5:29 AM, Oleg Nesterov <oleg@redhat.com> wrote:
>> Hi Kees,
>>
>> I was thinking about backporting the commit 98da7d08850fb8bde
>> ("fs/exec.c: account for argv/envp pointers"), but I am not sure
>> I understand it...

BTW, if you backport that, please get the rest associated with the
various Stack Clash related weaknesses:

c31dbb146dd4 exec: pin stack limit during exec
b83838313386 exec: introduce finalize_exec() before start_thread()
8f2af155b513 exec: pass stack rlimit into mm layout functions
7bd698b3c04e exec: Set file unwritable before LSM check
e816c201aed5 exec: Weaken dumpability for secureexec
779f4e1c6c7c Revert "exec: avoid RLIMIT_STACK races with prlimit()"
04e35f4495dd exec: avoid RLIMIT_STACK races with prlimit()
fe8993b3a05c exec: Consolidate pdeath_signal clearing
64701dee4178 exec: Use sane stack rlimit under secureexec
473d89639db0 exec: Consolidate dumpability logic
a70423dfbc58 exec: Use secureexec for clearing pdeath_signal
e37fdb785a5f exec: Use secureexec for setting dumpability
2af622802696 LSM: drop bprm_secureexec hook
46d98eb4e1d2 commoncap: Refactor to remove bprm_secureexec hook
c425e189ffd7 binfmt: Introduce secureexec flag
a9208e42ba99 exec: Correct comments about "point of no return"
ddb4a1442def exec: Rename bprm->cred_prepared to called_set_creds
da029c11e6b1 exec: Limit arg stack to at most 75% of _STK_LIM
98da7d08850f fs/exec.c: account for argv/envp pointers

(and there may be more related to the secureexec changes)

-Kees

-- 
Kees Cook
Pixel Security