From patchwork Thu Jun 22 18:06:29 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 9805067 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 7527F60329 for ; Thu, 22 Jun 2017 18:07:18 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6D2A72870B for ; Thu, 22 Jun 2017 18:07:18 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 612772870D; Thu, 22 Jun 2017 18:07:18 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 991B02870B for ; Thu, 22 Jun 2017 18:07:17 +0000 (UTC) Received: (qmail 11576 invoked by uid 550); 22 Jun 2017 18:06:56 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 11393 invoked from network); 22 Jun 2017 18:06:54 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=8wM+oph3TYL2oF4q0ZAWR3D3chNkuca6SyJ/2DwkoJ4=; b=dj3PvZXil5G6wIiMqRZnDGnphRKHS8wbcL3CJhY46+IseP4wgzIsooJUzkts8Fvm55 Hq3VTumxnwv0lb92wWBhtsAT4HrhQ6QBHdWyZf1o7dztTHc6pPZyg5tSAwEIuWJBt8n0 Nq/nTWJETloyjMlyuXFYZk5JeQFqkmMsfKo3U= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=8wM+oph3TYL2oF4q0ZAWR3D3chNkuca6SyJ/2DwkoJ4=; b=hb6yMogCipszDZqdvea70EEkAjyB36W3yoF2yegY0Ti42eGBrUYFuVlZ1RAuBayrfn o5Kgv6VaBa0jOtKWAn0uowMr3TzXalH8cYaCv65fDXnnX8IiyctBFsUtdOqeKHDGq4qW qdCBjBvkLRG28ZWUfiL43RqxppGsxlwB7tDcOa3ey5wmlgRw0iGaCa04f5wfGAtsfwT7 XDHPQ7fj610SpiebULos0mqcZE39NxNPmmO6xIPZcUP5NtFbMv5em/Qhf/4nApm4AHuw 037lbr2U2em91ZWipOkAwa4U18QAE2RLxY+BP22MYzK1K7xv6H5AtuaJ1Q5x1FnQ+JZ1 NNsQ== X-Gm-Message-State: AKS2vOyRzmvT3G/gRhia50PqggHCB2qDv5NFo0e1mq9q3lIF9CNuBrf7 a6pBv5hCQv8XY4ed X-Received: by 10.84.218.198 with SMTP id g6mr4289446plm.132.1498154802670; Thu, 22 Jun 2017 11:06:42 -0700 (PDT) From: Kees Cook To: Andrew Morton Cc: Kees Cook , Russell King , Catalin Marinas , Will Deacon , Benjamin Herrenschmidt , Paul Mackerras , Michael Ellerman , Martin Schwidefsky , Heiko Carstens , James Hogan , Pratyush Anand , Ingo Molnar , linux-arm-kernel@lists.infradead.org, linuxppc-dev@lists.ozlabs.org, linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arch@vger.kernel.org, kernel-hardening@lists.openwall.com Date: Thu, 22 Jun 2017 11:06:29 -0700 Message-Id: <1498154792-49952-2-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1498154792-49952-1-git-send-email-keescook@chromium.org> References: <1498154792-49952-1-git-send-email-keescook@chromium.org> Subject: [kernel-hardening] [PATCH 1/4] arm: Reduce ELF_ET_DYN_BASE X-Virus-Scanned: ClamAV using ClamSMTP Now that explicitly executed loaders are loaded in the mmap region, position PIE binaries lower in the address space to avoid possible collisions with mmap or stack regions. Signed-off-by: Kees Cook --- arch/arm/include/asm/elf.h | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h index d2315ffd8f12..f13ae153fb24 100644 --- a/arch/arm/include/asm/elf.h +++ b/arch/arm/include/asm/elf.h @@ -112,12 +112,8 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs); #define CORE_DUMP_USE_REGSET #define ELF_EXEC_PAGESIZE 4096 -/* This is the location that an ET_DYN program is loaded if exec'ed. Typical - use of this is to invoke "./ld.so someprog" to test out a new version of - the loader. We need to make sure that it is out of the way of the program - that it will "exec", and that there is sufficient room for the brk. */ - -#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2) +/* This is the base location for PIE (ET_DYN with INTERP) loads. */ +#define ELF_ET_DYN_BASE 0x400000UL /* When the program starts, a1 contains a pointer to a function to be registered with atexit, as per the SVR4 ABI. A value of 0 means we