The patch titled
Subject: x86/elf: move 32 bit ELF_ET_DYN_BASE to 256MB
has been added to the -mm tree. Its filename is
x86-elf-move-32-bit-elf_et_dyn_base-to-256mb.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/x86-elf-move-32-bit-elf_et_dyn_base-to-256mb.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/x86-elf-move-32-bit-elf_et_dyn_base-to-256mb.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Rik van Riel <riel@xxxxxxxxxx>
Subject: x86/elf: move 32 bit ELF_ET_DYN_BASE to 256MB
When setting up mmap_base, we take care to start the mmap base below the
maximum extent to which the stack will grow. However, we take no such
precautions with PIE binaries, which are placed at 5/6 of TASK_SIZE plus a
random offset. As a result, 32 bit PIE binaries can end up smack in the
middle of where the stack (which is randomized down) is supposed to go.
That problem can be avoided by putting the 32 bit ELF_ET_DYN_BASE at
256MB, which is a value linux-hardened and grsecurity have used for a long
time now without any known (to me) bug reports.
Link: http://lkml.kernel.org/r/20170602152010.2064-3-riel@xxxxxxxxxx
Signed-off-by: Rik van Riel <riel@xxxxxxxxxx>
Cc: Ingo Molnar <mingo@xxxxxxxxxx>
Cc: Oleg Nesterov <oleg@xxxxxxxxxx>
Cc: Larry Woodman <lwoodman@xxxxxxxxxx>
Cc: Daniel Micay <danielmicay@xxxxxxxxx>
Cc: Will Deacon <will.deacon@xxxxxxx>
Cc: Benjamin Herrenschmidt <benh@xxxxxxxxxxxxxxxxxxx>
Cc: Michal Hocko <mhocko@xxxxxxxxxx>
Cc: "H. Peter Anvin" <hpa@xxxxxxxxx>
Cc: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
Cc: Catalin Marinas <catalin.marinas@xxxxxxx>
Cc: Florian Weimer <fweimer@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
arch/x86/include/asm/elf.h | 23 ++++++++++++-----------
1 file changed, 12 insertions(+), 11 deletions(-)
diff -puN arch/x86/include/asm/elf.h~x86-elf-move-32-bit-elf_et_dyn_base-to-256mb arch/x86/include/asm/elf.h
--- a/arch/x86/include/asm/elf.h~x86-elf-move-32-bit-elf_et_dyn_base-to-256mb
+++ a/arch/x86/include/asm/elf.h
@@ -245,12 +245,23 @@ extern int force_personality32;
#define CORE_DUMP_USE_REGSET
#define ELF_EXEC_PAGESIZE 4096
+/*
+ * True on X86_32 or when emulating IA32 on X86_64
+ */
+static inline int mmap_is_ia32(void)
+{
+ return IS_ENABLED(CONFIG_X86_32) ||
+ (IS_ENABLED(CONFIG_COMPAT) &&
+ test_thread_flag(TIF_ADDR32));
+}
+
/* This is the location that an ET_DYN program is loaded if exec'ed. Typical
use of this is to invoke "./ld.so someprog" to test out a new version of
the loader. We need to make sure that it is out of the way of the program
that it will "exec", and that there is sufficient room for the brk. */
-#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
+#define ELF_ET_DYN_BASE (mmap_is_ia32() ? 0x10000000UL : \
+ (TASK_SIZE / 3 * 2))
/* This yields a mask that user programs can use to figure out what
instruction set this CPU supports. This could be done in user space,
@@ -293,16 +304,6 @@ do { \
} \
} while (0)
-/*
- * True on X86_32 or when emulating IA32 on X86_64
- */
-static inline int mmap_is_ia32(void)
-{
- return IS_ENABLED(CONFIG_X86_32) ||
- (IS_ENABLED(CONFIG_COMPAT) &&
- test_thread_flag(TIF_ADDR32));
-}
-
extern unsigned long tasksize_32bit(void);
extern unsigned long tasksize_64bit(void);
extern unsigned long get_mmap_base(int is_legacy);
_
Patches currently in -mm which might be from riel@xxxxxxxxxx are
binfmt_elf-document-load_bias-a-little-bit.patch
x86-elf-move-32-bit-elf_et_dyn_base-to-256mb.patch
x86-mmap-properly-account-for-stack-randomization-in-mmap_base.patch
arm64-mmap-properly-account-for-stack-randomization-in-mmap_base.patch
arm64-move-compat_elf_et_dyn_base-lower-in-the-address-space.patch
powerpcmmap-properly-account-for-stack-randomization-in-mmap_base.patch
randomstackprotect-introduce-get_random_canary-function.patch
forkrandom-use-get_random_canary-to-set-tsk-stack_canary.patch
x86-ascii-armor-the-x86_64-boot-init-stack-canary.patch
arm64-ascii-armor-the-arm64-boot-init-stack-canary.patch
sh64-ascii-armor-the-sh64-boot-init-stack-canary.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
