CVE-2017-1000364-mm-mmap.c-do-not-blow-on-PROT_NONE-MAP_FIXED-holes-i.patch

   1 From 3e4f09eef73ad12d4876e24daf52a0dc0891d7da Mon Sep 17 00:00:00 2001
   2 From: Michal Hocko <mhocko@suse.com>
   3 Date: Mon, 17 Jul 2017 14:53:28 +0200
   4 Subject: [PATCH 1/2] mm/mmap.c: do not blow on PROT_NONE MAP_FIXED holes in
   5  the stack
   6
   7 Commit 1be7107fbe18 ("mm: larger stack guard gap, between vmas") has
   8 introduced a regression in some rust and Java environments which are
   9 trying to implement their own stack guard page.  They are punching a new
  10 MAP_FIXED mapping inside the existing stack Vma.
  11
  12 This will confuse expand_{downwards,upwards} into thinking that the
  13 stack expansion would in fact get us too close to an existing non-stack
  14 vma which is a correct behavior wrt safety.  It is a real regression on
  15 the other hand.
  16
  17 Let's work around the problem by considering PROT_NONE mapping as a part
  18 of the stack.  This is a gros hack but overflowing to such a mapping
  19 would trap anyway an we only can hope that usespace knows what it is
  20 doing and handle it propely.
  21
  22 Fixes: 1be7107fbe18 ("mm: larger stack guard gap, between vmas")
  23 Link: http://lkml.kernel.org/r/20170705182849.GA18027@dhcp22.suse.cz
  24 Signed-off-by: Michal Hocko <mhocko@suse.com>
  25 Debugged-by: Vlastimil Babka <vbabka@suse.cz>
  26 Cc: Ben Hutchings <ben@decadent.org.uk>
  27 Cc: Willy Tarreau <w@1wt.eu>
  28 Cc: Oleg Nesterov <oleg@redhat.com>
  29 Cc: Rik van Riel <riel@redhat.com>
  30 Cc: Hugh Dickins <hughd@google.com>
  31 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
  32 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  33
  34 CVE-2017-1000364
  35
  36 (cherry picked from commit 561b5e0709e4a248c67d024d4d94b6e31e3edf2f)
  37 Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
  38 Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
  39 Acked-by: Kamal Mostafa <kamal@canonical.com>
  40 Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
  41 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  42 ---
  43  mm/mmap.c | 6 ++++--
  44  1 file changed, 4 insertions(+), 2 deletions(-)
  45
  46 diff --git a/mm/mmap.c b/mm/mmap.c
  47 index ef78a5ca5599..9fabd8c82f38 100644
  48 --- a/mm/mmap.c
  49 +++ b/mm/mmap.c
  50 @@ -2240,7 +2240,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
  51                 gap_addr = TASK_SIZE;
  52
  53         next = vma->vm_next;
  54 -       if (next && next->vm_start < gap_addr) {
  55 +       if (next && next->vm_start < gap_addr &&
  56 +                       (next->vm_flags & (VM_WRITE|VM_READ|VM_EXEC))) {
  57                 if (!(next->vm_flags & VM_GROWSUP))
  58                         return -ENOMEM;
  59                 /* Check that both stack segments have the same anon_vma? */
  60 @@ -2324,7 +2325,8 @@ int expand_downwards(struct vm_area_struct *vma,
  61         if (gap_addr > address)
  62                 return -ENOMEM;
  63         prev = vma->vm_prev;
  64 -       if (prev && prev->vm_end > gap_addr) {
  65 +       if (prev && prev->vm_end > gap_addr &&
  66 +                       (prev->vm_flags & (VM_WRITE|VM_READ|VM_EXEC))) {
  67                 if (!(prev->vm_flags & VM_GROWSDOWN))
  68                         return -ENOMEM;
  69                 /* Check that both stack segments have the same anon_vma? */
  70 --
  71 2.11.0
  72