Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1656786

Re: [kernel-hardening] [PATCH 3/6] x86/mmap: properly account for stack randomization in mmap_base

Show all headers | View raw

On Fri, 2017-06-02 at 21:46 -0700, Kees Cook wrote:
> On Fri, Jun 2, 2017 at 8:20 AM,  <riel@redhat.com> wrote:
> > From: Rik van Riel <riel@redhat.com>
> > 
> > When RLIMIT_STACK is, for example, 256MB, the current code results
> > in
> > a gap between the top of the task and mmap_base of 256MB, failing to
> > take into account the amount by which the stack address was
> > randomized.
> > In other words, the stack gets less than RLIMIT_STACK space.
> 
> Is this entirely accurate? The top of the task would be task_size, but
> this code is using task_size / 6 * 5 as the bottom of stack / top of
> mmap gap_max. Is there a reason for this?

MIN_GAP / MAX_GAP are only the boundaries that this gap is clamped to.

If it's not smaller than MIN_GAP, MIN_GAP isn't used. If it's not larger
than MAX_GAP, MAX_GAP isn't used. The stack randomization is currently
only taken into account for MIN_GAP. This only fixes that bug by always
taking it into account. It's not a subjective design change.

The MAX_GAP value is 5/6 of the address space which is overly large but
that's a separate bug.

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 0/6] move mmap_area and PIE binaries away from the stack riel@redhat.com - 2017-06-02 17:30 +0200
  [PATCH 1/6] binfmt_elf: document load_bias a little bit riel@redhat.com - 2017-06-02 17:30 +0200
    Re: [kernel-hardening] [PATCH 1/6] binfmt_elf: document load_bias a  little bit Kees Cook <keescook@chromium.org> - 2017-06-02 21:30 +0200
  [PATCH 6/6] powerpc,mmap: properly account for stack randomization in mmap_base riel@redhat.com - 2017-06-02 17:30 +0200
  [PATCH 4/6] arm64/mmap: properly account for stack randomization in mmap_base riel@redhat.com - 2017-06-02 17:30 +0200
  [PATCH 2/6] x86/elf: move 32 bit ELF_ET_DYN_BASE to 256MB riel@redhat.com - 2017-06-02 17:30 +0200
    Re: [PATCH 2/6] x86/elf: move 32 bit ELF_ET_DYN_BASE to 256MB Kees Cook <keescook@chromium.org> - 2017-06-03 06:30 +0200
      Re: [PATCH 2/6] x86/elf: move 32 bit ELF_ET_DYN_BASE to 256MB Daniel Micay <danielmicay@gmail.com> - 2017-06-03 14:00 +0200
      Re: [PATCH 2/6] x86/elf: move 32 bit ELF_ET_DYN_BASE to 256MB Rik van Riel <riel@redhat.com> - 2017-06-05 16:00 +0200
  [PATCH 3/6] x86/mmap: properly account for stack randomization in mmap_base riel@redhat.com - 2017-06-02 17:30 +0200
    Re: [kernel-hardening] [PATCH 3/6] x86/mmap: properly account for  stack randomization in mmap_base Kees Cook <keescook@chromium.org> - 2017-06-03 06:50 +0200
      Re: [kernel-hardening] [PATCH 3/6] x86/mmap: properly account for  stack randomization in mmap_base Daniel Micay <danielmicay@gmail.com> - 2017-06-03 14:20 +0200
  [PATCH 5/6] arm64: move COMPAT_ELF_ET_DYN_BASE lower in the address space riel@redhat.com - 2017-06-02 17:30 +0200
  Re: [kernel-hardening] [PATCH 0/6] move mmap_area and PIE binaries  away from the stack Kees Cook <keescook@chromium.org> - 2017-06-03 06:40 +0200
    Re: [kernel-hardening] [PATCH 0/6] move mmap_area and PIE binaries  away from the stack Daniel Micay <danielmicay@gmail.com> - 2017-06-03 14:20 +0200

csiph-web