Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-11 22:51:42 +00:00
Code Issues Packages Projects Releases Wiki Activity
e56f777af8
linux/arch/sparc/kernel
History
Hugh Dickins 1be7107fbe mm: larger stack guard gap, between vmas 
Stack guard page is a useful feature to reduce a risk of stack smashing
into a different mapping. We have been using a single page gap which
is sufficient to prevent having stack adjacent to a different mapping.
But this seems to be insufficient in the light of the stack usage in
userspace. E.g. glibc uses as large as 64kB alloca() in many commonly
used functions. Others use constructs liks gid_t buffer[NGROUPS_MAX]
which is 256kB or stack strings with MAX_ARG_STRLEN.

This will become especially dangerous for suid binaries and the default
no limit for the stack size limit because those applications can be
tricked to consume a large portion of the stack and a single glibc call
could jump over the guard page. These attacks are not theoretical,
unfortunatelly.

Make those attacks less probable by increasing the stack guard gap
to 1MB (on systems with 4k pages; but make it depend on the page size
because systems with larger base pages might cap stack allocations in
the PAGE_SIZE units) which should cover larger alloca() and VLA stack
allocations. It is obviously not a full fix because the problem is
somehow inherent, but it should reduce attack space a lot.

One could argue that the gap size should be configurable from userspace,
but that can be done later when somebody finds that the new 1MB is wrong
for some special case applications.  For now, add a kernel command line
option (stack_guard_gap) to specify the stack gap size (in page units).

Implementation wise, first delete all the old code for stack guard page:
because although we could get away with accounting one extra page in a
stack vma, accounting a larger gap can break userspace - case in point,
a program run with "ulimit -S -v 20000" failed when the 1MB gap was
counted for RLIMIT_AS; similar problems could come with RLIMIT_MLOCK
and strict non-overcommit mode.

Instead of keeping gap inside the stack vma, maintain the stack guard
gap as a gap between vmas: using vm_start_gap() in place of vm_start
(or vm_end_gap() in place of vm_end if VM_GROWSUP) in just those few
places which need to respect the gap - mainly arch_get_unmapped_area(),
and and the vma tree's subtree_gap support for that.

Original-patch-by: Oleg Nesterov <oleg@redhat.com>
Original-patch-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Tested-by: Helge Deller <deller@gmx.de> # parisc
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-06-19 21:50:20 +08:00
..
.gitignore
apc.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
asm-offsets.c sched/headers: Prepare to remove the <linux/mm_types.h> dependency from <linux/sched.h> 2017-03-02 08:42:37 +01:00
audit.c sparc: Convert naked unsigned uses to unsigned int 2016-03-20 21:28:58 -07:00
auxio_32.c sparc32: fix sparse warning in auxio_32.c 2014-05-18 19:01:27 -07:00
auxio_64.c sparc: kernel: drop owner assignment from platform_drivers 2014-10-20 16:20:15 +02:00
btext.c sparc64: fix sparse warning in btext.c 2014-05-18 19:01:30 -07:00
central.c sparc: kernel: drop owner assignment from platform_drivers 2014-10-20 16:20:15 +02:00
cherrs.S sparc64: Fix bootup regressions on some Kconfig combinations. 2016-04-27 17:27:37 -04:00
chmc.c sparc: kernel: drop owner assignment from platform_drivers 2014-10-20 16:20:15 +02:00
compat_audit.c sparc: Convert naked unsigned uses to unsigned int 2016-03-20 21:28:58 -07:00
cpu.c sparc64: recognize and support Sonoma CPU type 2016-04-21 16:43:47 -04:00
cpumap.c sparc64: recognize and support Sonoma CPU type 2016-04-21 16:43:47 -04:00
cpumap.h sparc: drop use of extern for prototypes in arch/sparc/* 2014-05-18 19:01:29 -07:00
devices.c sparc32: drop tadpole specific code 2014-05-18 19:01:29 -07:00
dma.c
ds.c sparc64: Fix build warnings with gcc 7. 2017-06-01 09:42:46 -07:00
dtlb_miss.S
dtlb_prot.S sparc: Don't leak context bits into thread->fault_address 2016-07-27 17:50:26 -07:00
ebus.c
entry.h sparc: Resolve conflict between sparc v9 and M7 on usage of bit 9 of TTE 2015-05-31 22:15:01 -07:00
entry.S sparc: move exports to definitions 2016-08-07 23:55:43 -04:00
etrap_32.S
etrap_64.S
fpu_traps.S sparc64: Fix bootup regressions on some Kconfig combinations. 2016-04-27 17:27:37 -04:00
ftrace.c sparc/ftrace: Fix ftrace graph time measurement 2017-05-17 12:07:47 -07:00
getsetcc.S
head_32.S sparc32: kill __ret_efault() 2017-03-28 18:24:00 -04:00
head_64.S sparc64: fix fault handling in NGbzero.S and GENbzero.S 2017-05-09 12:16:25 -07:00
helpers.S sparc: move exports to definitions 2016-08-07 23:55:43 -04:00
hvapi.c sparc64: Add ATU (new IOMMU) support 2016-11-18 11:16:59 -08:00
hvcalls.S sparc: move exports to definitions 2016-08-07 23:55:43 -04:00
hvtramp.S sparc64: Fix register corruption in top-most kernel stack frame during boot. 2014-10-24 09:52:49 -07:00
idprom.c net: Add eth_platform_get_mac_address() helper. 2016-01-06 16:31:56 -05:00
iommu_common.h sparc: drop duplicate header scatterlist.h 2016-11-19 10:43:07 -05:00
iommu.c treewide: Constify most dma_map_ops structures 2017-01-24 12:23:35 -05:00
ioport.c treewide: Constify most dma_map_ops structures 2017-01-24 12:23:35 -05:00
irq_32.c sparc32: off by ones in BUG_ON() 2016-07-27 22:53:17 -07:00
irq_64.c arch/sparc: support NR_CPUS = 4096 2017-06-06 16:41:47 -04:00
irq.h sparc: drop use of extern for prototypes in arch/sparc/* 2014-05-18 19:01:29 -07:00
itlb_miss.S
ivec.S
jump_label.c sparc: Handle negative offsets in arch_jump_label_transform 2016-10-25 19:11:17 -07:00
kernel.h sparc64: delete old wrap code 2017-06-06 13:45:29 -07:00
kgdb_32.c sparc32: use proper prototype for trapbase 2016-05-20 17:55:41 -07:00
kgdb_64.c sparc64: fix sparse warning in kgdb_64.c 2014-05-18 19:01:34 -07:00
kprobes.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
kstack.h
ktlb.S sparc: Don't leak context bits into thread->fault_address 2016-07-27 17:50:26 -07:00
ldc.c iommu-common: Fix error code used in iommu_tbl_range_{alloc,free}(). 2015-11-04 11:30:57 -08:00
led.c sparc: use memdup_user_nul in sun4m LED driver 2017-05-09 12:16:25 -07:00
leon_kernel.c sparc: leon: Fix a retry loop in leon_init_timers() 2016-12-11 18:15:49 -08:00
leon_pci_grpci1.c genirq: Remove irq argument from irq flow handlers 2015-09-16 15:47:51 +02:00
leon_pci_grpci2.c genirq: Remove irq argument from irq flow handlers 2015-09-16 15:47:51 +02:00
leon_pci.c PCI: Cleanup control flow 2015-03-19 10:17:22 -05:00
leon_pmc.c sparc32: fix sparse warnings in leon_pmc.c 2014-04-29 01:12:27 -04:00
leon_smp.c sched/headers: Move task->mm handling methods to <linux/sched/mm.h> 2017-03-03 01:43:28 +01:00
Makefile sparc64:Support User Probes for sparc 2016-12-11 18:01:51 -08:00
mdesc.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
misctrap.S arch/sparc: Avoid DCTI Couples 2017-03-27 21:51:40 -07:00
module.c mm: vmalloc: pass additional vm_flags to __vmalloc_node_range() 2015-02-13 21:21:42 -08:00
nmi.c sparc: implement watchdog_nmi_enable and watchdog_nmi_disable 2016-12-14 16:04:08 -08:00
of_device_32.c
of_device_64.c
of_device_common.c sparc: fix sparse warnings in of_device_common.c 2014-04-29 01:12:27 -04:00
of_device_common.h
pci_common.c sparc/PCI: Add mem64 resource parsing for root bus 2015-10-29 17:35:46 -05:00
pci_fire.c sparc: kernel: drop owner assignment from platform_drivers 2014-10-20 16:20:15 +02:00
pci_impl.h sparc/PCI: Add mem64 resource parsing for root bus 2015-10-29 17:35:46 -05:00
pci_msi.c PCI/MSI: Rename mask/unmask_msi_irq treewide 2014-11-23 13:01:45 +01:00
pci_psycho.c sparc: kernel: drop owner assignment from platform_drivers 2014-10-20 16:20:15 +02:00
pci_sabre.c sparc: kernel: drop owner assignment from platform_drivers 2014-10-20 16:20:15 +02:00
pci_schizo.c Driver core patches for 3.19-rc1 2014-12-14 16:10:09 -08:00
pci_sun4v_asm.S sparc64: Enable sun4v dma ops to use IOMMU v2 APIs 2016-11-18 11:17:00 -08:00
pci_sun4v.c treewide: Constify most dma_map_ops structures 2017-01-24 12:23:35 -05:00
pci_sun4v.h sparc64: Enable sun4v dma ops to use IOMMU v2 APIs 2016-11-18 11:17:00 -08:00
pci.c PCI: Add BAR index argument to pci_mmap_page_range() 2017-04-20 08:47:47 -05:00
pcic.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
pcr.c sparc: perf: Add support M7 processor 2015-03-19 18:54:49 -07:00
perf_event.c perf core: Add a 'nr' field to perf_event_callchain_context 2016-05-16 23:11:51 -03:00
pmc.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
power.c sparc: kernel: use builtin_platform_driver 2016-12-11 18:15:48 -08:00
process_32.c sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task_stack.h> 2017-03-02 08:42:36 +01:00
process_64.c sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task_stack.h> 2017-03-02 08:42:36 +01:00
prom_32.c
prom_64.c sparc64: fix sparse warning in prom_64.c 2014-05-18 19:01:31 -07:00
prom_common.c
prom_irqtrans.c
prom.h sparc: drop use of extern for prototypes in arch/sparc/* 2014-05-18 19:01:29 -07:00
psycho_common.c
psycho_common.h sparc: drop use of extern for prototypes in arch/sparc/* 2014-05-18 19:01:29 -07:00
ptrace_32.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
ptrace_64.c sparc64: Fill in rest of HAVE_REGS_AND_STACK_ACCESS_API 2017-04-23 17:15:51 -07:00
reboot.c
rtrap_32.S
rtrap_64.S arch/sparc: Avoid DCTI Couples 2017-03-27 21:51:40 -07:00
sbus.c
setup_32.c sparc: Remove redundant tests in boot_flags_init(). 2017-05-03 08:28:48 -07:00
setup_64.c sparc: Remove redundant tests in boot_flags_init(). 2017-05-03 08:28:48 -07:00
signal32.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
signal_32.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
signal_64.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
sigutil_32.c sparc: Harden signal return frame checks. 2016-05-29 11:24:05 -07:00
sigutil_64.c sparc: Harden signal return frame checks. 2016-05-29 11:24:05 -07:00
sigutil.h
smp_32.c cpu/hotplug: Remove CPU_STARTING and CPU_DYING notifier 2016-09-06 18:30:19 +02:00
smp_64.c sparc64: delete old wrap code 2017-06-06 13:45:29 -07:00
sparc_ksyms.c sparc: move exports to definitions 2016-08-07 23:55:43 -04:00
spiterrs.S arch/sparc: Avoid DCTI Couples 2017-03-27 21:51:40 -07:00
sstate.c sparc: Fixed typo in sstate.c. Replaced panicing with panicking 2017-01-16 22:31:51 -05:00
stacktrace.c sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h> 2017-03-02 08:42:34 +01:00
starfire.c arch: sparc: kernel: starfire.c: Remove unused function 2015-03-01 21:33:58 -08:00
sun4d_irq.c sparc/irq: Use helper irq_data_get_irq_handler_data() 2015-07-31 22:20:05 +02:00
sun4d_smp.c sched/headers: Move task->mm handling methods to <linux/sched/mm.h> 2017-03-03 01:43:28 +01:00
sun4m_irq.c sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h> 2017-03-02 08:42:34 +01:00
sun4m_smp.c sched/headers: Move task->mm handling methods to <linux/sched/mm.h> 2017-03-03 01:43:28 +01:00
sun4v_ivec.S
sun4v_tlb_miss.S arch/sparc: Avoid DCTI Couples 2017-03-27 21:51:40 -07:00
sys32.S sparc: Hook up renameat2 syscall. 2014-07-21 22:27:56 -07:00
sys_sparc32.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
sys_sparc_32.c sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h> 2017-03-02 08:42:34 +01:00
sys_sparc_64.c mm: larger stack guard gap, between vmas 2017-06-19 21:50:20 +08:00
syscalls.S sparc: Fix system call tracing register handling. 2016-01-21 16:06:00 -08:00
sysfs.c sparc/sysfs: Replace racy task affinity logic 2017-04-15 12:20:54 +02:00
systbls_32.S sparc: Update syscall tables. 2017-04-23 18:28:55 -07:00
systbls_64.S sparc: Update syscall tables. 2017-04-23 18:28:55 -07:00
systbls.h sparc64: fix sparse warnings in sys_sparc32.c 2014-05-18 19:01:31 -07:00
time_32.c sparc/time: Set ->min_delta_ticks and ->max_delta_ticks 2017-04-14 13:11:11 -07:00
time_64.c sparc/time: Set ->min_delta_ticks and ->max_delta_ticks 2017-04-14 13:11:11 -07:00
trampoline_32.S
trampoline_64.S sparc64: Fix register corruption in top-most kernel stack frame during boot. 2014-10-24 09:52:49 -07:00
traps_32.c sched/headers: Move task->mm handling methods to <linux/sched/mm.h> 2017-03-03 01:43:28 +01:00
traps_64.c sched/headers: Move task->mm handling methods to <linux/sched/mm.h> 2017-03-03 01:43:28 +01:00
tsb.S sparc64: mm: fix copy_tsb to correctly copy huge page TSBs 2017-06-06 13:45:02 -07:00
ttable_32.S
ttable_64.S sparc64: delete old wrap code 2017-06-06 13:45:29 -07:00
una_asm_32.S
una_asm_64.S
unaligned_32.c sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h> 2017-03-02 08:42:29 +01:00
unaligned_64.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
uprobes.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
urtt_fill.S arch/sparc: Avoid DCTI Couples 2017-03-27 21:51:40 -07:00
utrap.S sparc64: Fix bootup regressions on some Kconfig combinations. 2016-04-27 17:27:37 -04:00
vio.c sparc: Machine description indices can vary 2017-06-06 13:45:03 -07:00
viohs.c sched/headers: Prepare for new header dependencies before moving code to <linux/sched/clock.h> 2017-03-02 08:42:27 +01:00
visemul.c scripts/spelling.txt: add "partiton" pattern and fix typo instances 2017-02-27 18:43:46 -08:00
vmlinux.lds.S nmi_backtrace: generate one-line reports for idle cpus 2016-10-07 18:46:30 -07:00
windows.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
winfixup.S arch/sparc: Avoid DCTI Couples 2017-03-27 21:51:40 -07:00
wof.S
wuf.S