]>
Commit | Line | Data |
---|---|---|
4c390211 TL |
1 | From 3e4f09eef73ad12d4876e24daf52a0dc0891d7da Mon Sep 17 00:00:00 2001 |
2 | From: Michal Hocko <mhocko@suse.com> | |
3 | Date: Mon, 17 Jul 2017 14:53:28 +0200 | |
4 | Subject: [PATCH 1/2] mm/mmap.c: do not blow on PROT_NONE MAP_FIXED holes in | |
5 | the stack | |
6 | ||
7 | Commit 1be7107fbe18 ("mm: larger stack guard gap, between vmas") has | |
8 | introduced a regression in some rust and Java environments which are | |
9 | trying to implement their own stack guard page. They are punching a new | |
10 | MAP_FIXED mapping inside the existing stack Vma. | |
11 | ||
12 | This will confuse expand_{downwards,upwards} into thinking that the | |
13 | stack expansion would in fact get us too close to an existing non-stack | |
14 | vma which is a correct behavior wrt safety. It is a real regression on | |
15 | the other hand. | |
16 | ||
17 | Let's work around the problem by considering PROT_NONE mapping as a part | |
18 | of the stack. This is a gros hack but overflowing to such a mapping | |
19 | would trap anyway an we only can hope that usespace knows what it is | |
20 | doing and handle it propely. | |
21 | ||
22 | Fixes: 1be7107fbe18 ("mm: larger stack guard gap, between vmas") | |
23 | Link: http://lkml.kernel.org/r/20170705182849.GA18027@dhcp22.suse.cz | |
24 | Signed-off-by: Michal Hocko <mhocko@suse.com> | |
25 | Debugged-by: Vlastimil Babka <vbabka@suse.cz> | |
26 | Cc: Ben Hutchings <ben@decadent.org.uk> | |
27 | Cc: Willy Tarreau <w@1wt.eu> | |
28 | Cc: Oleg Nesterov <oleg@redhat.com> | |
29 | Cc: Rik van Riel <riel@redhat.com> | |
30 | Cc: Hugh Dickins <hughd@google.com> | |
31 | Signed-off-by: Andrew Morton <akpm@linux-foundation.org> | |
32 | Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | |
33 | ||
34 | CVE-2017-1000364 | |
35 | ||
36 | (cherry picked from commit 561b5e0709e4a248c67d024d4d94b6e31e3edf2f) | |
37 | Signed-off-by: Stefan Bader <stefan.bader@canonical.com> | |
38 | Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com> | |
39 | Acked-by: Kamal Mostafa <kamal@canonical.com> | |
40 | Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com> | |
41 | Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com> | |
42 | --- | |
43 | mm/mmap.c | 6 ++++-- | |
44 | 1 file changed, 4 insertions(+), 2 deletions(-) | |
45 | ||
46 | diff --git a/mm/mmap.c b/mm/mmap.c | |
47 | index ef78a5ca5599..9fabd8c82f38 100644 | |
48 | --- a/mm/mmap.c | |
49 | +++ b/mm/mmap.c | |
50 | @@ -2240,7 +2240,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address) | |
51 | gap_addr = TASK_SIZE; | |
52 | ||
53 | next = vma->vm_next; | |
54 | - if (next && next->vm_start < gap_addr) { | |
55 | + if (next && next->vm_start < gap_addr && | |
56 | + (next->vm_flags & (VM_WRITE|VM_READ|VM_EXEC))) { | |
57 | if (!(next->vm_flags & VM_GROWSUP)) | |
58 | return -ENOMEM; | |
59 | /* Check that both stack segments have the same anon_vma? */ | |
60 | @@ -2324,7 +2325,8 @@ int expand_downwards(struct vm_area_struct *vma, | |
61 | if (gap_addr > address) | |
62 | return -ENOMEM; | |
63 | prev = vma->vm_prev; | |
64 | - if (prev && prev->vm_end > gap_addr) { | |
65 | + if (prev && prev->vm_end > gap_addr && | |
66 | + (prev->vm_flags & (VM_WRITE|VM_READ|VM_EXEC))) { | |
67 | if (!(prev->vm_flags & VM_GROWSDOWN)) | |
68 | return -ENOMEM; | |
69 | /* Check that both stack segments have the same anon_vma? */ | |
70 | -- | |
71 | 2.11.0 | |
72 |