From patchwork Thu Aug 20 19:11:06 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rich Felker X-Patchwork-Id: 7046621 Return-Path: X-Original-To: patchwork-linux-fsdevel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 1A1AD9F358 for ; Thu, 20 Aug 2015 19:11:30 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 429962053D for ; Thu, 20 Aug 2015 19:11:29 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6A4CC20529 for ; Thu, 20 Aug 2015 19:11:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751729AbbHTTLK (ORCPT ); Thu, 20 Aug 2015 15:11:10 -0400 Received: from 216-12-86-13.cv.mvl.ntelos.net ([216.12.86.13]:42652 "EHLO brightrain.aerifal.cx" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751576AbbHTTLJ (ORCPT ); Thu, 20 Aug 2015 15:11:09 -0400 Received: from dalias by brightrain.aerifal.cx with local (Exim 3.15 #2) id 1ZSVEw-00037m-00; Thu, 20 Aug 2015 19:11:06 +0000 Date: Thu, 20 Aug 2015 15:11:06 -0400 From: Rich Felker To: linux-embedded@vger.kernel.org Cc: Greg Ungerer , Paul Gortmaker , Matt Mackall , David Woodhouse , Alexander Viro , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] fs/binfmt_elf_fdpic.c: fix brk area overlap with stack on NOMMU Message-ID: <20150820191106.GA9655@brightrain.aerifal.cx> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Spam-Status: No, score=-5.8 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY, URIBL_BLACK autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Rich Felker On NOMMU archs, the FDPIC ELF loader sets up the usable brk range to overlap with all but the last PAGE_SIZE bytes of the stack. This leads to catastrophic memory reuse/corruption if brk is used. Fix by setting the brk area to zero size to disable its use. Signed-off-by: Rich Felker Acked-by: Greg Ungerer Acked-by: David Howells --- There is no reason for the kernel to be providing a brk area at all on NOMMU; the bFLT loader does not provide one, uClibc never uses brk on NOMMU targets, and musl libc goes out of its way to avoid using brk that might run into the stack. -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html --- fs/binfmt_elf_fdpic.c.orig 2015-08-20 18:05:19.089888654 +0000 +++ fs/binfmt_elf_fdpic.c 2015-08-20 18:10:01.519871432 +0000 @@ -374,10 +388,7 @@ static int load_elf_fdpic_binary(struct PAGE_ALIGN(current->mm->start_brk); #else - /* create a stack and brk area big enough for everyone - * - the brk heap starts at the bottom and works up - * - the stack starts at the top and works down - */ + /* create a stack area and zero-size brk area */ stack_size = (stack_size + PAGE_SIZE - 1) & PAGE_MASK; if (stack_size < PAGE_SIZE * 2) stack_size = PAGE_SIZE * 2; @@ -400,8 +411,6 @@ static int load_elf_fdpic_binary(struct current->mm->brk = current->mm->start_brk; current->mm->context.end_brk = current->mm->start_brk; - current->mm->context.end_brk += - (stack_size > PAGE_SIZE) ? (stack_size - PAGE_SIZE) : 0; current->mm->start_stack = current->mm->start_brk + stack_size; #endif