From: Alexandre Ghiti <alex@ghiti.fr>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: Luis Chamberlain <mcgrof@kernel.org>,
Christoph Hellwig <hch@lst.de>,
Russell King <linux@armlinux.org.uk>,
Catalin Marinas <catalin.marinas@arm.com>,
Will Deacon <will.deacon@arm.com>,
Ralf Baechle <ralf@linux-mips.org>,
Paul Burton <paul.burton@mips.com>,
James Hogan <jhogan@kernel.org>,
Palmer Dabbelt <palmer@sifive.com>,
Albert Ou <aou@eecs.berkeley.edu>,
Alexander Viro <viro@zeniv.linux.org.uk>,
Kees Cook <keescook@chromium.org>,
linux-kernel@vger.kernel.org,
linux-arm-kernel@lists.infradead.org, linux-mips@vger.kernel.org,
linux-riscv@lists.infradead.org, linux-fsdevel@vger.kernel.org,
linux-mm@kvack.org, Alexandre Ghiti <alex@ghiti.fr>
Subject: [PATCH v5 09/14] mips: Properly account for stack randomization and stack guard gap
Date: Tue, 30 Jul 2019 01:51:08 -0400 [thread overview]
Message-ID: <20190730055113.23635-10-alex@ghiti.fr> (raw)
In-Reply-To: <20190730055113.23635-1-alex@ghiti.fr>
This commit takes care of stack randomization and stack guard gap when
computing mmap base address and checks if the task asked for randomization.
This fixes the problem uncovered and not fixed for arm here:
https://lkml.kernel.org/r/20170622200033.25714-1-riel@redhat.com
Signed-off-by: Alexandre Ghiti <alex@ghiti.fr>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Paul Burton <paul.burton@mips.com>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
---
arch/mips/mm/mmap.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
index d79f2b432318..f5c778113384 100644
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -21,8 +21,9 @@ unsigned long shm_align_mask = PAGE_SIZE - 1; /* Sane caches */
EXPORT_SYMBOL(shm_align_mask);
/* gap between mmap and stack */
-#define MIN_GAP (128*1024*1024UL)
-#define MAX_GAP ((TASK_SIZE)/6*5)
+#define MIN_GAP (128*1024*1024UL)
+#define MAX_GAP ((TASK_SIZE)/6*5)
+#define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))
static int mmap_is_legacy(struct rlimit *rlim_stack)
{
@@ -38,6 +39,15 @@ static int mmap_is_legacy(struct rlimit *rlim_stack)
static unsigned long mmap_base(unsigned long rnd, struct rlimit *rlim_stack)
{
unsigned long gap = rlim_stack->rlim_cur;
+ unsigned long pad = stack_guard_gap;
+
+ /* Account for stack randomization if necessary */
+ if (current->flags & PF_RANDOMIZE)
+ pad += (STACK_RND_MASK << PAGE_SHIFT);
+
+ /* Values close to RLIM_INFINITY can overflow. */
+ if (gap + pad > gap)
+ gap += pad;
if (gap < MIN_GAP)
gap = MIN_GAP;
--
2.20.1
next prev parent reply other threads:[~2019-07-30 6:01 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-30 5:50 [PATCH v5 00/14] Provide generic top-down mmap layout functions Alexandre Ghiti
2019-07-30 5:51 ` [PATCH v5 01/14] mm, fs: Move randomize_stack_top from fs to mm Alexandre Ghiti
2019-07-30 5:51 ` [PATCH v5 02/14] arm64: Make use of is_compat_task instead of hardcoding this test Alexandre Ghiti
2019-07-30 5:51 ` [PATCH v5 03/14] arm64: Consider stack randomization for mmap base only when necessary Alexandre Ghiti
2019-07-30 5:51 ` [PATCH v5 04/14] arm64, mm: Move generic mmap layout functions to mm Alexandre Ghiti
2019-07-30 5:51 ` [PATCH v5 05/14] arm64, mm: Make randomization selected by generic topdown mmap layout Alexandre Ghiti
2019-07-30 5:51 ` [PATCH v5 06/14] arm: Properly account for stack randomization and stack guard gap Alexandre Ghiti
2019-07-30 5:51 ` [PATCH v5 07/14] arm: Use STACK_TOP when computing mmap base address Alexandre Ghiti
2019-07-30 5:51 ` [PATCH v5 08/14] arm: Use generic mmap top-down layout and brk randomization Alexandre Ghiti
2019-07-30 5:51 ` Alexandre Ghiti [this message]
2019-07-30 5:51 ` [PATCH v5 10/14] mips: Use STACK_TOP when computing mmap base address Alexandre Ghiti
2019-07-30 5:51 ` [PATCH v5 11/14] mips: Adjust brk randomization offset to fit generic version Alexandre Ghiti
2019-07-30 5:51 ` [PATCH v5 12/14] mips: Replace arch specific way to determine 32bit task with " Alexandre Ghiti
2019-07-30 5:51 ` [PATCH v5 13/14] mips: Use generic mmap top-down layout and brk randomization Alexandre Ghiti
2019-07-30 5:51 ` [PATCH v5 14/14] riscv: Make mmap allocation top-down by default Alexandre Ghiti
2019-07-31 6:05 ` Alex Ghiti
2019-07-31 17:33 ` Guenter Roeck
2019-07-31 22:40 ` Paul Walmsley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190730055113.23635-10-alex@ghiti.fr \
--to=alex@ghiti.fr \
--cc=akpm@linux-foundation.org \
--cc=aou@eecs.berkeley.edu \
--cc=catalin.marinas@arm.com \
--cc=hch@lst.de \
--cc=jhogan@kernel.org \
--cc=keescook@chromium.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mips@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-riscv@lists.infradead.org \
--cc=linux@armlinux.org.uk \
--cc=mcgrof@kernel.org \
--cc=palmer@sifive.com \
--cc=paul.burton@mips.com \
--cc=ralf@linux-mips.org \
--cc=viro@zeniv.linux.org.uk \
--cc=will.deacon@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).