From patchwork Tue Sep 24 21:23:31 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Timothy Pepper X-Patchwork-Id: 2935901 Return-Path: X-Original-To: patchwork-linux-arm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 9F0BC9F476 for ; Tue, 24 Sep 2013 21:25:06 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 4CA8420420 for ; Tue, 24 Sep 2013 21:25:03 +0000 (UTC) Received: from casper.infradead.org (casper.infradead.org [85.118.1.10]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id CEEC8203EB for ; Tue, 24 Sep 2013 21:24:59 +0000 (UTC) Received: from merlin.infradead.org ([2001:4978:20e::2]) by casper.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1VOa61-0000fJ-Ph; Tue, 24 Sep 2013 21:24:38 +0000 Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1VOa5t-0005PR-7C; Tue, 24 Sep 2013 21:24:29 +0000 Received: from mga09.intel.com ([134.134.136.24]) by merlin.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1VOa5c-0005N0-Df for linux-arm-kernel@lists.infradead.org; Tue, 24 Sep 2013 21:24:16 +0000 Received: from orsmga001.jf.intel.com ([10.7.209.18]) by orsmga102.jf.intel.com with ESMTP; 24 Sep 2013 14:20:44 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="4.90,973,1371106800"; d="scan'208";a="383012452" Received: from tcpepper-desk.jf.intel.com ([10.7.197.221]) by orsmga001.jf.intel.com with SMTP; 24 Sep 2013 14:23:49 -0700 Received: by tcpepper-desk.jf.intel.com (sSMTP sendmail emulation); Tue, 24 Sep 2013 14:23:49 -0700 From: "Timothy Pepper" To: Subject: mm: insure topdown mmap chooses addresses above security minimum Date: Tue, 24 Sep 2013 14:23:31 -0700 Message-Id: <1380057811-5352-1-git-send-email-timothy.c.pepper@linux.intel.com> X-Mailer: git-send-email 1.8.1.4 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20130924_172412_782639_663E6C08 X-CRM114-Status: GOOD ( 22.22 ) X-Spam-Score: -5.8 (-----) Cc: linux-mips@linux-mips.org, Russell King , Paul Mundt , linux-sh@vger.kernel.org, Benjamin Herrenschmidt , x86@kernel.org, Ralf Baechle , linux-mm@kvack.org, Ingo Molnar , Paul Mackerras , Tim Pepper , "H. Peter Anvin" , sparclinux@vger.kernel.org, Thomas Gleixner , linuxppc-dev@lists.ozlabs.org, "David S. Miller" , linux-arm-kernel@lists.infradead.org X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Spam-Status: No, score=-3.1 required=5.0 tests=BAYES_00,KHOP_BIG_TO_CC, RCVD_IN_DNSWL_MED, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP A security check is performed on mmap addresses in security/security.c:security_mmap_addr(). It uses mmap_min_addr to insure mmaps don't get addresses lower than a user configurable guard value (/proc/sys/vm/mmap_min_addr). The arch specific mmap topdown searches look for a map candidate address all the way down to a low_limit that is currently hard coded as PAGE_SIZE. Depending on compile time options and userspace setting the procfs tunable, the security check's view of the minimum allowable address may be something greater than PAGE_SIZE. This leaves a gap where get_unmapped_area()'s call to get_area() might return an address above PAGE_SIZE, but below mmap_min_addr, and thus get_unmapped_area() fails. This was seen on x86_64 in the case of a topdown address space and a large stack rlimit, with mmap_min_addr having been set to 32k by the distro. This left a 28k gap where the get area search intends to place a small mmap, but then get_unmapped_area() stumbles at the security check. What should have happened is the address search wraps back to a higher address, the search continues and perhaps succeeds. Indeed an mmap of a larger size gets a topdown search that does wrap around back up into the rlimit stack reserve and succeeds assuming suitable free space. But a small mmap fits in the low gap and always fails. It becomes possible to make large mmaps but not small ones. When an explicit address hint is given, mm/mmap.c's round_hint_to_min() will round up to mmap_min_addr. A topdown search's low_limit should similarly consider mmap_min_addr instead of just PAGE_SIZE. Signed-off-by: Tim Pepper Cc: linux-mm@kvack.org Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: x86@kernel.org Cc: Russell King Cc: linux-arm-kernel@lists.infradead.org Cc: Ralf Baechle Cc: linux-mips@linux-mips.org Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: linuxppc-dev@lists.ozlabs.org Cc: Paul Mundt Cc: linux-sh@vger.kernel.org Cc: "David S. Miller" Cc: sparclinux@vger.kernel.org Acked-by: Russell King --- arch/arm/mm/mmap.c | 3 ++- arch/mips/mm/mmap.c | 3 ++- arch/powerpc/mm/slice.c | 3 ++- arch/sh/mm/mmap.c | 3 ++- arch/sparc/kernel/sys_sparc_64.c | 3 ++- arch/x86/kernel/sys_x86_64.c | 3 ++- 6 files changed, 12 insertions(+), 6 deletions(-) diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c index 0c63562..0e7355d 100644 --- a/arch/arm/mm/mmap.c +++ b/arch/arm/mm/mmap.c @@ -9,6 +9,7 @@ #include #include #include +#include #include #define COLOUR_ALIGN(addr,pgoff) \ @@ -146,7 +147,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, info.flags = VM_UNMAPPED_AREA_TOPDOWN; info.length = len; - info.low_limit = PAGE_SIZE; + info.low_limit = max(PAGE_SIZE, PAGE_ALIGN(mmap_min_addr)); info.high_limit = mm->mmap_base; info.align_mask = do_align ? (PAGE_MASK & (SHMLBA - 1)) : 0; info.align_offset = pgoff << PAGE_SHIFT; diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c index f1baadd..8c0deb7 100644 --- a/arch/mips/mm/mmap.c +++ b/arch/mips/mm/mmap.c @@ -14,6 +14,7 @@ #include #include #include +#include unsigned long shm_align_mask = PAGE_SIZE - 1; /* Sane caches */ EXPORT_SYMBOL(shm_align_mask); @@ -102,7 +103,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp, if (dir == DOWN) { info.flags = VM_UNMAPPED_AREA_TOPDOWN; - info.low_limit = PAGE_SIZE; + info.low_limit = max(PAGE_SIZE, PAGE_ALIGN(mmap_min_addr)); info.high_limit = mm->mmap_base; addr = vm_unmapped_area(&info); diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c index 3e99c14..34fc601 100644 --- a/arch/powerpc/mm/slice.c +++ b/arch/powerpc/mm/slice.c @@ -30,6 +30,7 @@ #include #include #include +#include #include #include #include @@ -338,7 +339,7 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm, addr = prev; goto prev_slice; } - info.low_limit = addr; + info.low_limit = max(addr, PAGE_ALIGN(mmap_min_addr)); found = vm_unmapped_area(&info); if (!(found & ~PAGE_MASK)) diff --git a/arch/sh/mm/mmap.c b/arch/sh/mm/mmap.c index 6777177..1e0c53d 100644 --- a/arch/sh/mm/mmap.c +++ b/arch/sh/mm/mmap.c @@ -11,6 +11,7 @@ #include #include #include +#include #include #include @@ -119,7 +120,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, info.flags = VM_UNMAPPED_AREA_TOPDOWN; info.length = len; - info.low_limit = PAGE_SIZE; + info.low_limit = max(PAGE_SIZE, PAGE_ALIGN(mmap_min_addr)); info.high_limit = mm->mmap_base; info.align_mask = do_colour_align ? (PAGE_MASK & shm_align_mask) : 0; info.align_offset = pgoff << PAGE_SHIFT; diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c index 51561b8..dab0a5d 100644 --- a/arch/sparc/kernel/sys_sparc_64.c +++ b/arch/sparc/kernel/sys_sparc_64.c @@ -24,6 +24,7 @@ #include #include #include +#include #include #include @@ -188,7 +189,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, info.flags = VM_UNMAPPED_AREA_TOPDOWN; info.length = len; - info.low_limit = PAGE_SIZE; + info.low_limit = max(PAGE_SIZE, PAGE_ALIGN(mmap_min_addr)); info.high_limit = mm->mmap_base; info.align_mask = do_color_align ? (PAGE_MASK & (SHMLBA - 1)) : 0; info.align_offset = pgoff << PAGE_SHIFT; diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c index 30277e2..93e563e 100644 --- a/arch/x86/kernel/sys_x86_64.c +++ b/arch/x86/kernel/sys_x86_64.c @@ -15,6 +15,7 @@ #include #include #include +#include #include #include @@ -172,7 +173,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, info.flags = VM_UNMAPPED_AREA_TOPDOWN; info.length = len; - info.low_limit = PAGE_SIZE; + info.low_limit = max(PAGE_SIZE, PAGE_ALIGN(mmap_min_addr)); info.high_limit = mm->mmap_base; info.align_mask = filp ? get_align_mask() : 0; info.align_offset = pgoff << PAGE_SHIFT;