Michal Hocko 4ed2863951 fs, elf: drop MAP_FIXED usage from elf_map ... Both load_elf_interp and load_elf_binary rely on elf_map to map segments on a controlled address and they use MAP_FIXED to enforce that. This is however dangerous thing prone to silent data corruption which can be even exploitable. Let's take CVE-2017-1000253 as an example. At the time (before commit eab09532d4: "binfmt_elf: use ELF_ET_DYN_BASE only for PIE") ELF_ET_DYN_BASE was at TASK_SIZE / 3 * 2 which is not that far away from the stack top on 32b (legacy) memory layout (only 1GB away). Therefore we could end up mapping over the existing stack with some luck. The issue has been fixed since then (a87938b2e2: "fs/binfmt_elf.c: fix bug in loading of PIE binaries"), ELF_ET_DYN_BASE moved moved much further from the stack (eab09532d4 and later by c715b72c1b: "mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes") and excessive stack consumption early during execve fully stopped by da029c11e6 ("exec: Limit arg stack to at most 75% of _STK_LIM"). So we should be safe and any attack should be impractical. On the other hand this is just too subtle assumption so it can break quite easily and hard to spot. I believe that the MAP_FIXED usage in load_elf_binary (et. al) is still fundamentally dangerous. Moreover it shouldn't be even needed. We are at the early process stage and so there shouldn't be unrelated mappings (except for stack and loader) existing so mmap for a given address should succeed even without MAP_FIXED. Something is terribly wrong if this is not the case and we should rather fail than silently corrupt the underlying mapping. Address this issue by changing MAP_FIXED to the newly added MAP_FIXED_NOREPLACE. This will mean that mmap will fail if there is an existing mapping clashing with the requested one without clobbering it. [mhocko@suse.com: fix build] [akpm@linux-foundation.org: coding-style fixes] [avagin@openvz.org: don't use the same value for MAP_FIXED_NOREPLACE and MAP_SYNC] Link: http://lkml.kernel.org/r/20171218184916.24445-1-avagin@openvz.org Link: http://lkml.kernel.org/r/20171213092550.2774-3-mhocko@kernel.org Signed-off-by: Michal Hocko <mhocko@suse.com> Signed-off-by: Andrei Vagin <avagin@openvz.org> Signed-off-by: Michal Hocko <mhocko@suse.com> Reviewed-by: Khalid Aziz <khalid.aziz@oracle.com> Acked-by: Michael Ellerman <mpe@ellerman.id.au> Acked-by: Kees Cook <keescook@chromium.org> Cc: Abdul Haleem <abdhalee@linux.vnet.ibm.com> Cc: Joel Stanley <joel@jms.id.au> Cc: Anshuman Khandual <khandual@linux.vnet.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2018-04-11 10:28:38 -07:00
..
acpi	pci-v4.17-changes	2018-04-06 18:31:06 -07:00
asm-generic	ARM:	2018-04-09 11:42:31 -07:00
clocksource	ARM: SoC platform updates for 4.17	2018-04-05 21:21:08 -07:00
crypto
drm
dt-bindings	ARM: SoC driver updates for 4.17	2018-04-05 21:29:35 -07:00
keys
kvm
linux	include/linux/kfifo.h: fix comment	2018-04-11 10:28:38 -07:00
math-emu
media	media updates for v4.17-rc1	2018-04-10 10:10:30 -07:00
memory
misc
net	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-04-09 17:04:10 -07:00
pcmcia
ras
rdma	Merge candidates for 4.17 merge window	2018-04-06 17:35:43 -07:00
scsi	SCSI for-linus on 20180404	2018-04-05 15:05:53 -07:00
soc	ARM: SoC driver updates for 4.17	2018-04-05 21:29:35 -07:00
sound	sound updates for 4.17-rc1	2018-04-05 10:42:07 -07:00
target
trace	mm, vmscan, tracing: use pointer to reclaim_stat struct in trace event	2018-04-11 10:28:30 -07:00
uapi	fs, elf: drop MAP_FIXED usage from elf_map	2018-04-11 10:28:38 -07:00
video
xen