From patchwork Tue Mar 12 17:32:47 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Ali Saidi X-Patchwork-Id: 10849617 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 122621515 for ; Tue, 12 Mar 2019 17:33:44 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id ED4F22972F for ; Tue, 12 Mar 2019 17:33:43 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E128E2973D; Tue, 12 Mar 2019 17:33:43 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.4 required=2.0 tests=BAYES_00,DKIM_ADSP_ALL, DKIM_SIGNED,DKIM_VALID,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 918E52972F for ; Tue, 12 Mar 2019 17:33:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=5GC7EZUolSqp+Y5IrFihTwhQ8OFRUwEk55M8iMezCGg=; b=Dp8cIQzZ0j+nDA Jx8+OKgT7imWpG/xmG3xKUwSrYKoPOTIZzYrjybvhU5pLjXig3ctTESStXb0Iwqo2AqIBtHFTDeo3 ozcywUHhlMOyaIzBtnVM+WTo+3d+sHF+UGUpzWgLiWKOPdvS7IVuW/R+ITW6qngzxMfm2WkANgywk IFvBdMXHVsCk5tXKRBiKq8z8mPZS6+q6cdSVD7Y/RWIOUbDJVnW76Sm0OQ/v8PaIJiNSXkv2lB4lr yNLovC2/4/RKKKPWu9mSunaFrNXxdtG+W8Ecqv3q+1ygQC24y3X3X2oFcBpJFH5k5gJWBgwBlcqDd 9SU1MixpS36RgErGnErg==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1h3lHU-0002h2-Sc; Tue, 12 Mar 2019 17:33:36 +0000 Received: from smtp-fw-9101.amazon.com ([207.171.184.25]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1h3lHF-0002Oq-Ob for linux-arm-kernel@lists.infradead.org; Tue, 12 Mar 2019 17:33:26 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1552412001; x=1583948001; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=4RwtLig5cNzwFS0w/o/vGJ4u0OMGC8lrOqOpbRTWsIo=; b=SeLgJyzuY/VoFgwKjUX/uPuOOwCI1xKiUlZSrb9keCSNM8Zjs0mTmYC2 hWwd4pVJ8RV31oeoEQI/ykpDnob4mt1HQMU9Sa77x16jvEXX9Fh90TAH3 k8AjfAwE94OZI3qcE6oL4JKJzbI2l1Ie5Y1YnmLeyUzcHGX1bnuFodij0 I=; X-IronPort-AV: E=Sophos;i="5.58,471,1544486400"; d="scan'208";a="792968025" Received: from sea3-co-svc-lb6-vlan3.sea.amazon.com (HELO email-inbound-relay-1a-807d4a99.us-east-1.amazon.com) ([10.47.22.38]) by smtp-border-fw-out-9101.sea19.amazon.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 12 Mar 2019 17:33:19 +0000 Received: from EX13MTAUWA001.ant.amazon.com (iad55-ws-svc-p15-lb9-vlan3.iad.amazon.com [10.40.159.166]) by email-inbound-relay-1a-807d4a99.us-east-1.amazon.com (8.14.7/8.14.7) with ESMTP id x2CHX78Z084577 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 12 Mar 2019 17:33:14 GMT Received: from EX13d09UWA001.ant.amazon.com (10.43.160.247) by EX13MTAUWA001.ant.amazon.com (10.43.160.58) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Tue, 12 Mar 2019 17:32:58 +0000 Received: from EX13MTAUWA001.ant.amazon.com (10.43.160.58) by EX13d09UWA001.ant.amazon.com (10.43.160.247) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Tue, 12 Mar 2019 17:32:57 +0000 Received: from dev-dsk-alisaidi-i31e-4ac69482.us-east-1.amazon.com (10.200.136.151) by mail-relay.amazon.com (10.43.160.118) with Microsoft SMTP Server id 15.0.1367.3 via Frontend Transport; Tue, 12 Mar 2019 17:32:57 +0000 Received: by dev-dsk-alisaidi-i31e-4ac69482.us-east-1.amazon.com (Postfix, from userid 5131138) id 115B347D3D; Tue, 12 Mar 2019 17:32:57 +0000 (UTC) From: Ali Saidi To: , , Subject: [PATCH 1/2] arm64/mmap: handle worst-case heap randomization in mmap_base Date: Tue, 12 Mar 2019 17:32:47 +0000 Message-ID: <20190312173248.13490-2-alisaidi@amazon.com> X-Mailer: git-send-email 2.15.3.AMZN In-Reply-To: <20190312173248.13490-1-alisaidi@amazon.com> References: <20190312173248.13490-1-alisaidi@amazon.com> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190312_103322_116413_B4571C4F X-CRM114-Status: GOOD ( 13.48 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Kees Cook , Peter Zijlstra , Catalin Marinas , Dave Hansen , Will Deacon , Ingo Molnar , Borislav Petkov , David Woodhouse , Andy Lutomirski , "H. Peter Anvin" , Andrew Morton , Thomas Gleixner , Ali Saidi , Anthony Liguori Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP Increase mmap_base by the worst-case brk randomization so that the stack and heap remain apart. In Linux 4.13 a change was committed that special cased the kernel ELF loader when the loader is invoked directly (eab09532d400; binfmt_elf: use ELF_ET_DYN_BASE only for PIE). Generally, the loader isn’t invoked directly and this issue is limited to cases where it is, (e.g to set a non-inheritable LD_LIBRARY_PATH, testing new versions of the loader). In those rare cases, the loader doesn't take into account the amount of brk randomization that will be applied by arch_randomize_brk(). This can lead to the stack and heap being arbitrarily close to each other. Signed-off-by: Ali Saidi --- arch/arm64/mm/mmap.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c index 842c8a5fcd53..0778f7ba8306 100644 --- a/arch/arm64/mm/mmap.c +++ b/arch/arm64/mm/mmap.c @@ -67,6 +67,14 @@ static unsigned long mmap_base(unsigned long rnd, struct rlimit *rlim_stack) unsigned long gap = rlim_stack->rlim_cur; unsigned long pad = (STACK_RND_MASK << PAGE_SHIFT) + stack_guard_gap; + /* Provide space for randomization when randomize_va_space == 2 and + * ld-linux.so is called directly. Values from arch_randomize_brk() + */ + if (test_thread_flag(TIF_32BIT)) + pad += SZ_32M; + else + pad += SZ_1G; + /* Values close to RLIM_INFINITY can overflow. */ if (gap + pad > gap) gap += pad; From patchwork Tue Mar 12 17:32:48 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Ali Saidi X-Patchwork-Id: 10849615 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C5A901515 for ; Tue, 12 Mar 2019 17:33:23 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id AD37F2973F for ; Tue, 12 Mar 2019 17:33:23 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9EDBA29744; Tue, 12 Mar 2019 17:33:23 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.4 required=2.0 tests=BAYES_00,DKIM_ADSP_ALL, DKIM_SIGNED,DKIM_VALID,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 49A582973F for ; Tue, 12 Mar 2019 17:33:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=Hgx5L407bqCrhsbdxrDdaVzFipF6kre/4N7nXVxXdAc=; b=KZh64w+2TppqDQ ckHBjxmZUuSBCso33+Xxl0XaI7ayzJ9aPQZJ1L1x6KgTHJcswFuw7BqLA566rxlGamEpXNHGUj89Z cPmjeqKaJkDbrOAUjerQdUEnNe8oYIsGIdQZPGu1PrYCTTBeZwCPPmujsGH56FDN6/Qka9p8Qthg7 iJYU8RM7D/puURe58xZjIfPV3cuH2EztXvUpFrgrmqtxe1YqFG2RCBMw2Lqt4j7HBkGNyY/1bmMYz m9yaPB/i1W/Qz8OXczR1HIvXu5wHJZ5154OuPMxJfLAS+4dE5YOPSRcUhsVRAdoBOUldTmMSgJ2aA 1USGG8wdwBXKhqlv1YAw==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1h3lHG-0002P4-0I; Tue, 12 Mar 2019 17:33:22 +0000 Received: from smtp-fw-9101.amazon.com ([207.171.184.25]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1h3lH2-00029P-46 for linux-arm-kernel@lists.infradead.org; Tue, 12 Mar 2019 17:33:09 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1552411988; x=1583947988; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=jKqOztkO6Tw7b7bLjzZbKzMPNWbtoN0lKwLRS/I16E8=; b=KlrUTKelUzvF+uL5BFuOaG94HX56X3bpFT4yPtKGwptolR0bLOf69tyU Y4E2v75B7Wycw4RxmwVarRh23fKwXkTThuRDZfeL44AWec4yY6mXADKWk Mv8CpnDbgAKF351RViZvh64UjciLc3wcbHrVlie3snlgierFSRT0wGh67 s=; X-IronPort-AV: E=Sophos;i="5.58,471,1544486400"; d="scan'208";a="792967971" Received: from sea3-co-svc-lb6-vlan3.sea.amazon.com (HELO email-inbound-relay-1e-303d0b0e.us-east-1.amazon.com) ([10.47.22.38]) by smtp-border-fw-out-9101.sea19.amazon.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 12 Mar 2019 17:33:05 +0000 Received: from EX13MTAUWA001.ant.amazon.com (iad55-ws-svc-p15-lb9-vlan2.iad.amazon.com [10.40.159.162]) by email-inbound-relay-1e-303d0b0e.us-east-1.amazon.com (8.14.7/8.14.7) with ESMTP id x2CHWtLn091501 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 12 Mar 2019 17:32:59 GMT Received: from EX13d09UWA003.ant.amazon.com (10.43.160.227) by EX13MTAUWA001.ant.amazon.com (10.43.160.58) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Tue, 12 Mar 2019 17:32:58 +0000 Received: from EX13MTAUWA001.ant.amazon.com (10.43.160.58) by EX13d09UWA003.ant.amazon.com (10.43.160.227) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Tue, 12 Mar 2019 17:32:57 +0000 Received: from dev-dsk-alisaidi-i31e-4ac69482.us-east-1.amazon.com (10.200.136.151) by mail-relay.amazon.com (10.43.160.118) with Microsoft SMTP Server id 15.0.1367.3 via Frontend Transport; Tue, 12 Mar 2019 17:32:57 +0000 Received: by dev-dsk-alisaidi-i31e-4ac69482.us-east-1.amazon.com (Postfix, from userid 5131138) id 1480147D3F; Tue, 12 Mar 2019 17:32:57 +0000 (UTC) From: Ali Saidi To: , , Subject: [PATCH 2/2] x86/mmap: handle worst-case heap randomization in mmap_base Date: Tue, 12 Mar 2019 17:32:48 +0000 Message-ID: <20190312173248.13490-3-alisaidi@amazon.com> X-Mailer: git-send-email 2.15.3.AMZN In-Reply-To: <20190312173248.13490-1-alisaidi@amazon.com> References: <20190312173248.13490-1-alisaidi@amazon.com> MIME-Version: 1.0 Precedence: Bulk X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190312_103308_256025_883ABCF4 X-CRM114-Status: GOOD ( 12.64 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Kees Cook , Peter Zijlstra , Catalin Marinas , Dave Hansen , Will Deacon , Ingo Molnar , Borislav Petkov , David Woodhouse , Andy Lutomirski , "H. Peter Anvin" , Andrew Morton , Thomas Gleixner , Ali Saidi , Anthony Liguori Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP Increase mmap_base by the worst-case brk randomization so that the stack and heap remain apart. In Linux 4.13 a change was committed that special cased the kernel ELF loader when the loader is invoked directly (eab09532d400; binfmt_elf: use ELF_ET_DYN_BASE only for PIE). Generally, the loader isn’t invoked directly and this issue is limited to cases where it is, (e.g to set a non-inheritable LD_LIBRARY_PATH, testing new versions of the loader). In those rare cases, the loader doesn't take into account the amount of brk randomization that will be applied by arch_randomize_brk(). This can lead to the stack and heap being arbitrarily close to each other. Signed-off-by: Ali Saidi --- arch/x86/mm/mmap.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c index db3165714521..98a2875c37e3 100644 --- a/arch/x86/mm/mmap.c +++ b/arch/x86/mm/mmap.c @@ -31,6 +31,7 @@ #include #include #include +#include #include #include "physaddr.h" @@ -97,6 +98,9 @@ static unsigned long mmap_base(unsigned long rnd, unsigned long task_size, unsigned long pad = stack_maxrandom_size(task_size) + stack_guard_gap; unsigned long gap_min, gap_max; + /* Provide space for brk randomization */ + pad += SZ_32M; + /* Values close to RLIM_INFINITY can overflow. */ if (gap + pad > gap) gap += pad;