mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-25 02:09:42 +00:00
x86/mmap: properly account for stack randomization in mmap_base
When RLIMIT_STACK is, for example, 256MB, the current code results in a gap between the top of the task and mmap_base of 256MB, failing to take into account the amount by which the stack address was randomized. In other words, the stack gets less than RLIMIT_STACK space. Ensure that the gap between the stack and mmap_base always takes stack randomization and the stack guard gap into account. Obtained from Daniel Micay's linux-hardened tree. Link: http://lkml.kernel.org/r/20170622200033.25714-2-riel@redhat.com Signed-off-by: Daniel Micay <danielmicay@gmail.com> Signed-off-by: Rik van Riel <riel@redhat.com> Reported-by: Florian Weimer <fweimer@redhat.com> Acked-by: Ingo Molnar <mingo@kernel.org> Cc: Will Deacon <will.deacon@arm.com> Cc: Daniel Micay <danielmicay@gmail.com> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Hugh Dickins <hughd@google.com> Cc: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
2c8340eda4
commit
c204d21f22
1 changed files with 6 additions and 1 deletions
|
@ -92,13 +92,18 @@ unsigned long arch_mmap_rnd(void)
|
|||
static unsigned long mmap_base(unsigned long rnd, unsigned long task_size)
|
||||
{
|
||||
unsigned long gap = rlimit(RLIMIT_STACK);
|
||||
unsigned long pad = stack_maxrandom_size(task_size) + stack_guard_gap;
|
||||
unsigned long gap_min, gap_max;
|
||||
|
||||
/* Values close to RLIM_INFINITY can overflow. */
|
||||
if (gap + pad > gap)
|
||||
gap += pad;
|
||||
|
||||
/*
|
||||
* Top of mmap area (just below the process stack).
|
||||
* Leave an at least ~128 MB hole with possible stack randomization.
|
||||
*/
|
||||
gap_min = SIZE_128M + stack_maxrandom_size(task_size);
|
||||
gap_min = SIZE_128M;
|
||||
gap_max = (task_size / 6) * 5;
|
||||
|
||||
if (gap < gap_min)
|
||||
|
|
Loading…
Reference in a new issue