From patchwork Wed Jul 24 05:58:45 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexandre Ghiti X-Patchwork-Id: 11056075 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 761B8912 for ; Wed, 24 Jul 2019 06:09:11 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6469328768 for ; Wed, 24 Jul 2019 06:09:11 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 561302876D; Wed, 24 Jul 2019 06:09:11 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id E8B9028768 for ; Wed, 24 Jul 2019 06:09:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=T9dglkR+1cepkyn9ZyrF8ML+29wYB9s12dukeMNbyRc=; b=IaYGiCyq3kxcuo 7a0TsLQ8I05FYfGg/et2hf2PaSLHksekBeJHyn6C5BViMNwqi0KrJ45lPdqqSumhA3M6BOcR5dK2r AfUb66trmDY+ajrJ9I2tsMnn0u2w/LHpKr/j2DNzohDiOmZUWweyay12a9/4gmrMwHdsRWfsqhih2 WHeLlliAgchU7ivpUQ6Inxw8XDc5vo1mDLR0GI6IY1M0W5kwoKC9YeDRDRDu/GdKqIMzKhBV7xTTa kOO1APi+FbIRf69ETs39YnAYbaNH5kkFTcGzneE1xgdM+8QNpHKPoVAIOux6n905pianqp7L1Y1H3 qj6z8/5h9Koxs8Nj0VNA==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.92 #3 (Red Hat Linux)) id 1hqASX-0002Vc-7A; Wed, 24 Jul 2019 06:09:05 +0000 Received: from relay3-d.mail.gandi.net ([217.70.183.195]) by bombadil.infradead.org with esmtps (Exim 4.92 #3 (Red Hat Linux)) id 1hqAST-0002UZ-DF; Wed, 24 Jul 2019 06:09:03 +0000 X-Originating-IP: 79.86.19.127 Received: from alex.numericable.fr (127.19.86.79.rev.sfr.net [79.86.19.127]) (Authenticated sender: alex@ghiti.fr) by relay3-d.mail.gandi.net (Postfix) with ESMTPSA id 59E6560008; Wed, 24 Jul 2019 06:08:48 +0000 (UTC) From: Alexandre Ghiti To: Andrew Morton Subject: [PATCH REBASE v4 09/14] mips: Properly account for stack randomization and stack guard gap Date: Wed, 24 Jul 2019 01:58:45 -0400 Message-Id: <20190724055850.6232-10-alex@ghiti.fr> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190724055850.6232-1-alex@ghiti.fr> References: <20190724055850.6232-1-alex@ghiti.fr> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190723_230901_605219_361DC99A X-CRM114-Status: GOOD ( 10.86 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Albert Ou , Kees Cook , Alexandre Ghiti , Catalin Marinas , Palmer Dabbelt , Will Deacon , Russell King , Ralf Baechle , linux-kernel@vger.kernel.org, linux-mm@kvack.org, Paul Burton , Alexander Viro , James Hogan , linux-fsdevel@vger.kernel.org, linux-riscv@lists.infradead.org, linux-mips@vger.kernel.org, Christoph Hellwig , linux-arm-kernel@lists.infradead.org, Luis Chamberlain Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP This commit takes care of stack randomization and stack guard gap when computing mmap base address and checks if the task asked for randomization. This fixes the problem uncovered and not fixed for arm here: https://lkml.kernel.org/r/20170622200033.25714-1-riel@redhat.com Signed-off-by: Alexandre Ghiti Acked-by: Kees Cook Acked-by: Paul Burton --- arch/mips/mm/mmap.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c index d79f2b432318..f5c778113384 100644 --- a/arch/mips/mm/mmap.c +++ b/arch/mips/mm/mmap.c @@ -21,8 +21,9 @@ unsigned long shm_align_mask = PAGE_SIZE - 1; /* Sane caches */ EXPORT_SYMBOL(shm_align_mask); /* gap between mmap and stack */ -#define MIN_GAP (128*1024*1024UL) -#define MAX_GAP ((TASK_SIZE)/6*5) +#define MIN_GAP (128*1024*1024UL) +#define MAX_GAP ((TASK_SIZE)/6*5) +#define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12)) static int mmap_is_legacy(struct rlimit *rlim_stack) { @@ -38,6 +39,15 @@ static int mmap_is_legacy(struct rlimit *rlim_stack) static unsigned long mmap_base(unsigned long rnd, struct rlimit *rlim_stack) { unsigned long gap = rlim_stack->rlim_cur; + unsigned long pad = stack_guard_gap; + + /* Account for stack randomization if necessary */ + if (current->flags & PF_RANDOMIZE) + pad += (STACK_RND_MASK << PAGE_SHIFT); + + /* Values close to RLIM_INFINITY can overflow. */ + if (gap + pad > gap) + gap += pad; if (gap < MIN_GAP) gap = MIN_GAP;