lkml.org 
[lkml]   [2017]   [Jul]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] mm: larger stack guard gap, between vmas
From
Date


> On Jul 5, 2017, at 12:32 PM, Ben Hutchings <ben@decadent.org.uk> wrote:
>
>> On Wed, 2017-07-05 at 10:23 -0700, Andy Lutomirski wrote:
>> [...]
>> Looking at it that way, I think a new inherited-on-exec flag is nucking futs.
>>
>> I'm starting to think that the right approach is to mostly revert all
>> this stuff (the execve fixes are fine). Then start over and think
>> about it as hardening. I would suggest the following approach:
>>
>> - The stack gap is one page, just like it's been for years.
>
> Given that in the following points you say that something sounding like
> a stack gap would be "64k or whatever", what does "the stack gap" mean
> in this first point?

I mean one page, with semantics as close to previous (4.11) behavior as practical.

>
>> - As a hardening feature, if the stack would expand within 64k or
>> whatever of a non-MAP_FIXED mapping, refuse to expand it. (This might
>> have to be a non-hinted mapping, not just a non-MAP_FIXED mapping.)
>> The idea being that, if you deliberately place a mapping under the
>> stack, you know what you're doing. If you're like LibreOffice and do
>> something daft and are thus exploitable, you're on your own.
>> - As a hardening measure, don't let mmap without MAP_FIXED position
>> something within 64k or whatever of the bottom of the stack unless a
>> MAP_FIXED mapping is between them.
>
> Having tested patches along these lines, I think the above would avoid
> the reported regressions.
>

FWIW, even this last part may be problematic. It'll break anything that tries to allocate many small MAP_GROWSDOWN stacks on 32-bit. Hopefully nothing does this, but maybe Java does.

> Ben.
>
>> And that's all. It's not like a 64k gap actually fixes these bugs for
>> real -- it just makes them harder to exploit.
>>
>> [1] The code that GCC generates for char buf[bug number] and alloca()
>> is flat-out wrong. Everyone who's ever thought about it all all knows
>> it and has known about it for years, but no one cared to fix it.
> --
> Ben Hutchings
> Anthony's Law of Force: Don't force it, get a larger hammer.
>

\
 
 \ /
  Last update: 2017-07-05 22:54    [W:1.542 / U:0.020 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site