lkml.org 
[lkml]   [2017]   [Oct]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.2 39/74] mm/mmap.c: do not blow on PROT_NONE MAP_FIXED holes in the stack
    3.2.94-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Michal Hocko <mhocko@suse.com>

    commit 561b5e0709e4a248c67d024d4d94b6e31e3edf2f upstream.

    Commit 1be7107fbe18 ("mm: larger stack guard gap, between vmas") has
    introduced a regression in some rust and Java environments which are
    trying to implement their own stack guard page. They are punching a new
    MAP_FIXED mapping inside the existing stack Vma.

    This will confuse expand_{downwards,upwards} into thinking that the
    stack expansion would in fact get us too close to an existing non-stack
    vma which is a correct behavior wrt safety. It is a real regression on
    the other hand.

    Let's work around the problem by considering PROT_NONE mapping as a part
    of the stack. This is a gros hack but overflowing to such a mapping
    would trap anyway an we only can hope that usespace knows what it is
    doing and handle it propely.

    Fixes: 1be7107fbe18 ("mm: larger stack guard gap, between vmas")
    Link: http://lkml.kernel.org/r/20170705182849.GA18027@dhcp22.suse.cz
    Signed-off-by: Michal Hocko <mhocko@suse.com>
    Debugged-by: Vlastimil Babka <vbabka@suse.cz>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Cc: Willy Tarreau <w@1wt.eu>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Hugh Dickins <hughd@google.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    mm/mmap.c | 6 ++++--
    1 file changed, 4 insertions(+), 2 deletions(-)

    --- a/mm/mmap.c
    +++ b/mm/mmap.c
    @@ -1729,7 +1729,8 @@ int expand_upwards(struct vm_area_struct
    gap_addr = TASK_SIZE;

    next = vma->vm_next;
    - if (next && next->vm_start < gap_addr) {
    + if (next && next->vm_start < gap_addr &&
    + (next->vm_flags & (VM_WRITE|VM_READ|VM_EXEC))) {
    if (!(next->vm_flags & VM_GROWSUP))
    return -ENOMEM;
    /* Check that both stack segments have the same anon_vma? */
    @@ -1788,7 +1789,8 @@ int expand_downwards(struct vm_area_stru
    if (gap_addr > address)
    return -ENOMEM;
    prev = vma->vm_prev;
    - if (prev && prev->vm_end > gap_addr) {
    + if (prev && prev->vm_end > gap_addr &&
    + (prev->vm_flags & (VM_WRITE|VM_READ|VM_EXEC))) {
    if (!(prev->vm_flags & VM_GROWSDOWN))
    return -ENOMEM;
    /* Check that both stack segments have the same anon_vma? */
    \
     
     \ /
      Last update: 2017-10-09 15:20    [W:3.299 / U:0.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site