From patchwork Tue Mar 28 19:45:47 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhupesh Sharma X-Patchwork-Id: 9650451 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id C3ABF602C8 for ; Tue, 28 Mar 2017 19:46:37 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C7C122841D for ; Tue, 28 Mar 2017 19:46:37 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id BC11B2842C; Tue, 28 Mar 2017 19:46:37 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id C587F28422 for ; Tue, 28 Mar 2017 19:46:36 +0000 (UTC) Received: (qmail 16224 invoked by uid 550); 28 Mar 2017 19:46:34 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 16203 invoked from network); 28 Mar 2017 19:46:34 -0000 X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=+ziwJQcIzLL8MOEhqQW/kbb5rK/p8VhQ+k/bFI8hWik=; b=hf0eXj0yy1BAn2iJ67iu7sEcUCZl0tlDExneHOzZh4pqSPSc5/s5kHmJTY+lOs6uuC dHItfQq0Uy2sejWH48TOAQwPOKuqWMx4SxoOFRivrEiSZ8MQnYjiDqF3L49DD+8B5qDN +RHbNEFaUGQymhRWtzEclkNtdVOyVh+jGEvPrg2RgRRZTllouPuGUT9gXV2lkRgEnwOL qk+7wd1HXWM/udDkP3XrcAPGwBKWap/l+SzYEHKkZ57VFAh0+4vNOTrFp7X+/UmPzkwG 1FaqmIzKuDk0N6whTVCbpPBjyPguyLKp3EbbRdI4E/74cCQMXxoX7lNnlIJFSAJ3gFEk /1Sg== X-Gm-Message-State: AFeK/H03yV58ktC/p7Q3+iRGJH1OH4gV25kWesTPex7OjxTF0aLcZO2vzdYxxTd5ZG6023Mj X-Received: by 10.55.104.22 with SMTP id d22mr6692111qkc.90.1490730382315; Tue, 28 Mar 2017 12:46:22 -0700 (PDT) From: Bhupesh Sharma To: linuxppc-dev@lists.ozlabs.org, kernel-hardening@lists.openwall.com, linux-kernel@vger.kernel.org Cc: dcashman@google.com, mpe@ellerman.id.au, bhupesh.linux@gmail.com, keescook@chromium.org, bhsharma@redhat.com, agraf@suse.com, benh@kernel.crashing.org, paulus@samba.org, agust@denx.de, alistair@popple.id.au, mporter@kernel.crashing.org, vitb@kernel.crashing.org, oss@buserror.net, galak@kernel.crashing.org, dcashman@android.com Date: Wed, 29 Mar 2017 01:15:47 +0530 Message-Id: <1490730347-5165-1-git-send-email-bhsharma@redhat.com> X-Mailer: git-send-email 2.7.4 Subject: [kernel-hardening] [PATCH v3] powerpc: mm: support ARCH_MMAP_RND_BITS X-Virus-Scanned: ClamAV using ClamSMTP powerpc arch_mmap_rnd() currently uses hard-coded values - (23-PAGE_SHIFT) for 32-bit and (30-PAGE_SHIFT) for 64-bit, to generate the random offset for the mmap base address for a ASLR ELF. This patch makes sure that powerpc mmap arch_mmap_rnd() implementation is similar to other ARCHs (like x86, arm64) and uses mmap_rnd_bits and helpers to generate the mmap address randomization. The maximum and minimum randomization range values represent a compromise between increased ASLR effectiveness and avoiding address-space fragmentation. Using the Kconfig option and suitable /proc tunable, platform developers may choose where to place this compromise. Also this patch keeps the default values as new minimums. Signed-off-by: Bhupesh Sharma Reviewed-by: Kees Cook --- * Changes since v2: v2 can be seen here (https://patchwork.kernel.org/patch/9551509/) - Changed a few minimum and maximum randomization ranges as per Michael's suggestion. - Corrected Kees's email address in the Reviewed-by line. - Added further comments in kconfig to explain how the address ranges were worked out. * Changes since v1: v1 can be seen here (https://lists.ozlabs.org/pipermail/linuxppc-dev/2017-February/153594.html) - No functional change in this patch. - Dropped PATCH 2/2 from v1 as recommended by Kees Cook. arch/powerpc/Kconfig | 44 ++++++++++++++++++++++++++++++++++++++++++++ arch/powerpc/mm/mmap.c | 7 ++++--- 2 files changed, 48 insertions(+), 3 deletions(-) diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig index 97a8bc8..84aae67 100644 --- a/arch/powerpc/Kconfig +++ b/arch/powerpc/Kconfig @@ -22,6 +22,48 @@ config MMU bool default y +# min bits determined by the following formula: +# VA_BITS - PAGE_SHIFT - CONSTANT +# where, +# VA_BITS = 46 bits for 64BIT and 4GB - 1 Page = 31 bits for 32BIT +# CONSTANT = 16 for 64BIT and 8 for 32BIT +config ARCH_MMAP_RND_BITS_MIN + default 5 if PPC_256K_PAGES && 32BIT # 31 - 18 - 8 = 5 + default 7 if PPC_64K_PAGES && 32BIT # 31 - 16 - 8 = 7 + default 9 if PPC_16K_PAGES && 32BIT # 31 - 14 - 8 = 9 + default 11 if PPC_4K_PAGES && 32BIT # 31 - 12 - 8 = 11 + default 12 if PPC_256K_PAGES && 64BIT # 46 - 18 - 16 = 12 + default 14 if PPC_64K_PAGES && 64BIT # 46 - 16 - 16 = 14 + default 16 if PPC_16K_PAGES && 64BIT # 46 - 14 - 16 = 16 + default 18 if PPC_4K_PAGES && 64BIT # 46 - 12 - 16 = 18 + +# max bits determined by the following formula: +# VA_BITS - PAGE_SHIFT - CONSTANT +# where, +# VA_BITS = 46 bits for 64BIT, and 4GB - 1 Page = 31 bits for 32BIT +# CONSTANT = 2, both for 64BIT and 32BIT +config ARCH_MMAP_RND_BITS_MAX + default 11 if PPC_256K_PAGES && 32BIT # 31 - 18 - 2 = 11 + default 13 if PPC_64K_PAGES && 32BIT # 31 - 16 - 2 = 13 + default 15 if PPC_16K_PAGES && 32BIT # 31 - 14 - 2 = 15 + default 17 if PPC_4K_PAGES && 32BIT # 31 - 12 - 2 = 17 + default 26 if PPC_256K_PAGES && 64BIT # 46 - 18 - 2 = 26 + default 28 if PPC_64K_PAGES && 64BIT # 46 - 16 - 2 = 28 + default 30 if PPC_16K_PAGES && 64BIT # 46 - 14 - 2 = 30 + default 32 if PPC_4K_PAGES && 64BIT # 46 - 12 - 2 = 32 + +config ARCH_MMAP_RND_COMPAT_BITS_MIN + default 5 if PPC_256K_PAGES + default 7 if PPC_64K_PAGES + default 9 if PPC_16K_PAGES + default 11 + +config ARCH_MMAP_RND_COMPAT_BITS_MAX + default 11 if PPC_256K_PAGES + default 13 if PPC_64K_PAGES + default 15 if PPC_16K_PAGES + default 17 + config HAVE_SETUP_PER_CPU_AREA def_bool PPC64 @@ -142,6 +184,8 @@ config PPC select HAVE_IRQ_EXIT_ON_IRQ_STACK select HAVE_KERNEL_GZIP select HAVE_KPROBES + select HAVE_ARCH_MMAP_RND_BITS + select HAVE_ARCH_MMAP_RND_COMPAT_BITS if COMPAT select HAVE_KRETPROBES select HAVE_LIVEPATCH if HAVE_DYNAMIC_FTRACE_WITH_REGS select HAVE_MEMBLOCK diff --git a/arch/powerpc/mm/mmap.c b/arch/powerpc/mm/mmap.c index a5d9ef5..92a9355 100644 --- a/arch/powerpc/mm/mmap.c +++ b/arch/powerpc/mm/mmap.c @@ -61,11 +61,12 @@ unsigned long arch_mmap_rnd(void) { unsigned long rnd; - /* 8MB for 32bit, 1GB for 64bit */ +#ifdef CONFIG_COMPAT if (is_32bit_task()) - rnd = get_random_long() % (1<<(23-PAGE_SHIFT)); + rnd = get_random_long() & ((1UL << mmap_rnd_compat_bits) - 1); else - rnd = get_random_long() % (1UL<<(30-PAGE_SHIFT)); +#endif + rnd = get_random_long() & ((1UL << mmap_rnd_bits) - 1); return rnd << PAGE_SHIFT; }