[lkml]   [2007]   [Nov]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH 1/3] mmap: protect from stack expantion into low vm addresses
    When adding the new security hooks into mmap to enhance protection
    against NULL pointers in the kernel I overlooked that a user may be able
    to expand the stack all the way down to low addresses. This flaw was
    pointed out by a PaX/grsecurity developer and this patch should provide
    protection against this missed code path.

    Signed-off-by: Eric Paris <>


    ** Be very careful applying/rediffing this patch. Standard 3 lines of
    context from git diff will misapply the first hunk to expand_upwards
    instead of properly in expand_downwards. This patch was generated using
    -U 4 to make sure it applies in the correct place. **

    mm/mmap.c | 8 ++++++--
    1 file changed, 6 insertions(+), 2 deletions(-)

    --- kernel-1/mm/mmap.c
    +++ kernel-2/mm/mmap.c
    @@ -1614,17 +1614,21 @@ static inline int expand_downwards(struc
    * so that the anon_vma locking is not a noop.
    if (unlikely(anon_vma_prepare(vma)))
    return -ENOMEM;
    + address &= PAGE_MASK;
    + error = security_file_mmap(0, 0, 0, 0, address, 1);
    + if (error)
    + return error;

    * vma->vm_start/vm_end cannot change under us because the caller
    * is required to hold the mmap_sem in read mode. We need the
    * anon_vma lock to serialize against concurrent expand_stacks.
    - address &= PAGE_MASK;
    - error = 0;

    /* Somebody else might have raced and expanded it already */
    if (address < vma->vm_start) {
    unsigned long size, grow;

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2007-11-16 21:59    [W:0.021 / U:9.468 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site