The patch titled
Subject: mm: move randomize_et_dyn into ELF_ET_DYN_BASE
has been added to the -mm tree. Its filename is
mm-move-randomize_et_dyn-into-elf_et_dyn_base.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-move-randomize_et_dyn-into-elf_et_dyn_base.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-move-randomize_et_dyn-into-elf_et_dyn_base.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Kees Cook <keescook@xxxxxxxxxxxx>
Subject: mm: move randomize_et_dyn into ELF_ET_DYN_BASE
In preparation for moving ET_DYN randomization into the ELF loader (which
requires a static ELF_ET_DYN_BASE), this redefines s390's existing ET_DYN
randomization away from a separate function (randomize_et_dyn) and into
ELF_ET_DYN_BASE and a call to arch_mmap_rnd(). This refactoring results
in the same ET_DYN randomization on s390. Additionally removes a
copy/pasted unused arm64 extern.
Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
Cc: Hector Marco-Gisbert <hecmargi@xxxxxx>
Cc: Russell King <linux@xxxxxxxxxxxxxxxx>
Reviewed-by: Ingo Molnar <mingo@xxxxxxxxxx>
Cc: Catalin Marinas <catalin.marinas@xxxxxxx>
Cc: Will Deacon <will.deacon@xxxxxxx>
Cc: Ralf Baechle <ralf@xxxxxxxxxxxxxx>
Cc: Benjamin Herrenschmidt <benh@xxxxxxxxxxxxxxxxxxx>
Cc: Paul Mackerras <paulus@xxxxxxxxx>
Cc: Michael Ellerman <mpe@xxxxxxxxxxxxxx>
Cc: Martin Schwidefsky <schwidefsky@xxxxxxxxxx>
Cc: Heiko Carstens <heiko.carstens@xxxxxxxxxx>
Cc: Alexander Viro <viro@xxxxxxxxxxxxxxxxxx>
Cc: Oleg Nesterov <oleg@xxxxxxxxxx>
Cc: Andy Lutomirski <luto@xxxxxxxxxxxxxx>
Cc: "David A. Long" <dave.long@xxxxxxxxxx>
Cc: Andrey Ryabinin <a.ryabinin@xxxxxxxxxxx>
Cc: Arun Chandran <achandran@xxxxxxxxxx>
Cc: Yann Droneaud <ydroneaud@xxxxxxxxxx>
Cc: Min-Hua Chen <orca.chen@xxxxxxxxx>
Cc: Paul Burton <paul.burton@xxxxxxxxxx>
Cc: Alex Smith <alex@xxxxxxxxxxxxxxxx>
Cc: Markos Chandras <markos.chandras@xxxxxxxxxx>
Cc: Vineeth Vijayan <vvijayan@xxxxxxxxxx>
Cc: Jeff Bailey <jeffbailey@xxxxxxxxxx>
Cc: Michael Holzheu <holzheu@xxxxxxxxxxxxxxxxxx>
Cc: Ben Hutchings <ben@xxxxxxxxxxxxxxx>
Cc: Behan Webster <behanw@xxxxxxxxxxxxxxxxxx>
Cc: Ismael Ripoll <iripoll@xxxxxx>
Cc: Jan-Simon Mller <dl9pf@xxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
arch/arm64/include/asm/elf.h | 1 -
arch/s390/include/asm/elf.h | 9 +++++----
arch/s390/mm/mmap.c | 11 -----------
3 files changed, 5 insertions(+), 16 deletions(-)
diff -puN arch/arm64/include/asm/elf.h~mm-move-randomize_et_dyn-into-elf_et_dyn_base arch/arm64/include/asm/elf.h
--- a/arch/arm64/include/asm/elf.h~mm-move-randomize_et_dyn-into-elf_et_dyn_base
+++ a/arch/arm64/include/asm/elf.h
@@ -125,7 +125,6 @@ typedef struct user_fpsimd_state elf_fpr
* the loader. We need to make sure that it is out of the way of the program
* that it will "exec", and that there is sufficient room for the brk.
*/
-extern unsigned long randomize_et_dyn(unsigned long base);
#define ELF_ET_DYN_BASE (2 * TASK_SIZE_64 / 3)
/*
diff -puN arch/s390/include/asm/elf.h~mm-move-randomize_et_dyn-into-elf_et_dyn_base arch/s390/include/asm/elf.h
--- a/arch/s390/include/asm/elf.h~mm-move-randomize_et_dyn-into-elf_et_dyn_base
+++ a/arch/s390/include/asm/elf.h
@@ -161,10 +161,11 @@ extern unsigned int vdso_enabled;
/* This is the location that an ET_DYN program is loaded if exec'ed. Typical
use of this is to invoke "./ld.so someprog" to test out a new version of
the loader. We need to make sure that it is out of the way of the program
- that it will "exec", and that there is sufficient room for the brk. */
-
-extern unsigned long randomize_et_dyn(void);
-#define ELF_ET_DYN_BASE randomize_et_dyn()
+ that it will "exec", and that there is sufficient room for the brk. 64-bit
+ tasks are aligned to 4GB. */
+#define ELF_ET_DYN_BASE (arch_mmap_rnd() + (is_32bit_task() ? \
+ (STACK_TOP / 3 * 2) : \
+ (STACK_TOP / 3 * 2) & ~((1UL << 32) - 1)))
/* This yields a mask that user programs can use to figure out what
instruction set this CPU supports. */
diff -puN arch/s390/mm/mmap.c~mm-move-randomize_et_dyn-into-elf_et_dyn_base arch/s390/mm/mmap.c
--- a/arch/s390/mm/mmap.c~mm-move-randomize_et_dyn-into-elf_et_dyn_base
+++ a/arch/s390/mm/mmap.c
@@ -179,17 +179,6 @@ arch_get_unmapped_area_topdown(struct fi
return addr;
}
-unsigned long randomize_et_dyn(void)
-{
- unsigned long base;
-
- base = STACK_TOP / 3 * 2;
- if (!is_32bit_task())
- /* Align to 4GB */
- base &= ~((1UL << 32) - 1);
- return base + arch_mmap_rnd();
-}
-
#ifndef CONFIG_64BIT
/*
_
Patches currently in -mm which might be from keescook@xxxxxxxxxxxx are
arm-factor-out-mmap-aslr-into-mmap_rnd.patch
mm-expose-arch_mmap_rnd-when-available.patch
mm-move-randomize_et_dyn-into-elf_et_dyn_base.patch
mm-split-et_dyn-aslr-from-mmap-aslr.patch
mm-fold-arch_randomize_brk-into-arch_has_elf_randomize.patch
lib-vsprintf-add-%pt-format-specifier.patch
linux-next.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
