Skip to content

Commit 1be7107

Browse files
Hugh Dickinstorvalds
Hugh Dickins
authored and
torvalds
committed
mm: larger stack guard gap, between vmas
Stack guard page is a useful feature to reduce a risk of stack smashing into a different mapping. We have been using a single page gap which is sufficient to prevent having stack adjacent to a different mapping. But this seems to be insufficient in the light of the stack usage in userspace. E.g. glibc uses as large as 64kB alloca() in many commonly used functions. Others use constructs liks gid_t buffer[NGROUPS_MAX] which is 256kB or stack strings with MAX_ARG_STRLEN. This will become especially dangerous for suid binaries and the default no limit for the stack size limit because those applications can be tricked to consume a large portion of the stack and a single glibc call could jump over the guard page. These attacks are not theoretical, unfortunatelly. Make those attacks less probable by increasing the stack guard gap to 1MB (on systems with 4k pages; but make it depend on the page size because systems with larger base pages might cap stack allocations in the PAGE_SIZE units) which should cover larger alloca() and VLA stack allocations. It is obviously not a full fix because the problem is somehow inherent, but it should reduce attack space a lot. One could argue that the gap size should be configurable from userspace, but that can be done later when somebody finds that the new 1MB is wrong for some special case applications. For now, add a kernel command line option (stack_guard_gap) to specify the stack gap size (in page units). Implementation wise, first delete all the old code for stack guard page: because although we could get away with accounting one extra page in a stack vma, accounting a larger gap can break userspace - case in point, a program run with "ulimit -S -v 20000" failed when the 1MB gap was counted for RLIMIT_AS; similar problems could come with RLIMIT_MLOCK and strict non-overcommit mode. Instead of keeping gap inside the stack vma, maintain the stack guard gap as a gap between vmas: using vm_start_gap() in place of vm_start (or vm_end_gap() in place of vm_end if VM_GROWSUP) in just those few places which need to respect the gap - mainly arch_get_unmapped_area(), and and the vma tree's subtree_gap support for that. Original-patch-by: Oleg Nesterov <[email protected]> Original-patch-by: Michal Hocko <[email protected]> Signed-off-by: Hugh Dickins <[email protected]> Acked-by: Michal Hocko <[email protected]> Tested-by: Helge Deller <[email protected]> # parisc Signed-off-by: Linus Torvalds <[email protected]>
1 parent 1132d5e commit 1be7107

File tree

23 files changed

+152
-163
lines changed

23 files changed

+152
-163
lines changed

‎Documentation/admin-guide/kernel-parameters.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3811,6 +3811,13 @@
38113811
expediting. Set to zero to disable automatic
38123812
expediting.
38133813

3814+
stack_guard_gap= [MM]
3815+
override the default stack gap protection. The value
3816+
is in page units and it defines how many pages prior
3817+
to (for stacks growing down) resp. after (for stacks
3818+
growing up) the main stack are reserved for no other
3819+
mapping. Default value is 256 pages.
3820+
38143821
stacktrace [FTRACE]
38153822
Enabled the stack tracer on boot up.
38163823

‎arch/arc/mm/mmap.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
6565

6666
vma = find_vma(mm, addr);
6767
if (TASK_SIZE - len >= addr &&
68-
(!vma || addr + len <= vma->vm_start))
68+
(!vma || addr + len <= vm_start_gap(vma)))
6969
return addr;
7070
}
7171

‎arch/arm/mm/mmap.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
9090

9191
vma = find_vma(mm, addr);
9292
if (TASK_SIZE - len >= addr &&
93-
(!vma || addr + len <= vma->vm_start))
93+
(!vma || addr + len <= vm_start_gap(vma)))
9494
return addr;
9595
}
9696

@@ -141,7 +141,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
141141
addr = PAGE_ALIGN(addr);
142142
vma = find_vma(mm, addr);
143143
if (TASK_SIZE - len >= addr &&
144-
(!vma || addr + len <= vma->vm_start))
144+
(!vma || addr + len <= vm_start_gap(vma)))
145145
return addr;
146146
}
147147

‎arch/frv/mm/elf-fdpic.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
7575
addr = PAGE_ALIGN(addr);
7676
vma = find_vma(current->mm, addr);
7777
if (TASK_SIZE - len >= addr &&
78-
(!vma || addr + len <= vma->vm_start))
78+
(!vma || addr + len <= vm_start_gap(vma)))
7979
goto success;
8080
}
8181

‎arch/mips/mm/mmap.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
9393

9494
vma = find_vma(mm, addr);
9595
if (TASK_SIZE - len >= addr &&
96-
(!vma || addr + len <= vma->vm_start))
96+
(!vma || addr + len <= vm_start_gap(vma)))
9797
return addr;
9898
}
9999

‎arch/parisc/kernel/sys_parisc.c

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
9090
unsigned long len, unsigned long pgoff, unsigned long flags)
9191
{
9292
struct mm_struct *mm = current->mm;
93-
struct vm_area_struct *vma;
93+
struct vm_area_struct *vma, *prev;
9494
unsigned long task_size = TASK_SIZE;
9595
int do_color_align, last_mmap;
9696
struct vm_unmapped_area_info info;
@@ -117,9 +117,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
117117
else
118118
addr = PAGE_ALIGN(addr);
119119

120-
vma = find_vma(mm, addr);
120+
vma = find_vma_prev(mm, addr, &prev);
121121
if (task_size - len >= addr &&
122-
(!vma || addr + len <= vma->vm_start))
122+
(!vma || addr + len <= vm_start_gap(vma)) &&
123+
(!prev || addr >= vm_end_gap(prev)))
123124
goto found_addr;
124125
}
125126

@@ -143,7 +144,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
143144
const unsigned long len, const unsigned long pgoff,
144145
const unsigned long flags)
145146
{
146-
struct vm_area_struct *vma;
147+
struct vm_area_struct *vma, *prev;
147148
struct mm_struct *mm = current->mm;
148149
unsigned long addr = addr0;
149150
int do_color_align, last_mmap;
@@ -177,9 +178,11 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
177178
addr = COLOR_ALIGN(addr, last_mmap, pgoff);
178179
else
179180
addr = PAGE_ALIGN(addr);
180-
vma = find_vma(mm, addr);
181+
182+
vma = find_vma_prev(mm, addr, &prev);
181183
if (TASK_SIZE - len >= addr &&
182-
(!vma || addr + len <= vma->vm_start))
184+
(!vma || addr + len <= vm_start_gap(vma)) &&
185+
(!prev || addr >= vm_end_gap(prev)))
183186
goto found_addr;
184187
}
185188

‎arch/powerpc/mm/hugetlbpage-radix.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
6868
addr = ALIGN(addr, huge_page_size(h));
6969
vma = find_vma(mm, addr);
7070
if (mm->task_size - len >= addr &&
71-
(!vma || addr + len <= vma->vm_start))
71+
(!vma || addr + len <= vm_start_gap(vma)))
7272
return addr;
7373
}
7474
/*

‎arch/powerpc/mm/mmap.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ radix__arch_get_unmapped_area(struct file *filp, unsigned long addr,
112112
addr = PAGE_ALIGN(addr);
113113
vma = find_vma(mm, addr);
114114
if (mm->task_size - len >= addr && addr >= mmap_min_addr &&
115-
(!vma || addr + len <= vma->vm_start))
115+
(!vma || addr + len <= vm_start_gap(vma)))
116116
return addr;
117117
}
118118

@@ -157,7 +157,7 @@ radix__arch_get_unmapped_area_topdown(struct file *filp,
157157
addr = PAGE_ALIGN(addr);
158158
vma = find_vma(mm, addr);
159159
if (mm->task_size - len >= addr && addr >= mmap_min_addr &&
160-
(!vma || addr + len <= vma->vm_start))
160+
(!vma || addr + len <= vm_start_gap(vma)))
161161
return addr;
162162
}
163163

‎arch/powerpc/mm/slice.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr,
9999
if ((mm->task_size - len) < addr)
100100
return 0;
101101
vma = find_vma(mm, addr);
102-
return (!vma || (addr + len) <= vma->vm_start);
102+
return (!vma || (addr + len) <= vm_start_gap(vma));
103103
}
104104

105105
static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)

‎arch/s390/mm/mmap.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
101101
addr = PAGE_ALIGN(addr);
102102
vma = find_vma(mm, addr);
103103
if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
104-
(!vma || addr + len <= vma->vm_start))
104+
(!vma || addr + len <= vm_start_gap(vma)))
105105
goto check_asce_limit;
106106
}
107107

@@ -151,7 +151,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
151151
addr = PAGE_ALIGN(addr);
152152
vma = find_vma(mm, addr);
153153
if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
154-
(!vma || addr + len <= vma->vm_start))
154+
(!vma || addr + len <= vm_start_gap(vma)))
155155
goto check_asce_limit;
156156
}
157157

‎arch/sh/mm/mmap.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
6464

6565
vma = find_vma(mm, addr);
6666
if (TASK_SIZE - len >= addr &&
67-
(!vma || addr + len <= vma->vm_start))
67+
(!vma || addr + len <= vm_start_gap(vma)))
6868
return addr;
6969
}
7070

@@ -114,7 +114,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
114114

115115
vma = find_vma(mm, addr);
116116
if (TASK_SIZE - len >= addr &&
117-
(!vma || addr + len <= vma->vm_start))
117+
(!vma || addr + len <= vm_start_gap(vma)))
118118
return addr;
119119
}
120120

‎arch/sparc/kernel/sys_sparc_64.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
120120

121121
vma = find_vma(mm, addr);
122122
if (task_size - len >= addr &&
123-
(!vma || addr + len <= vma->vm_start))
123+
(!vma || addr + len <= vm_start_gap(vma)))
124124
return addr;
125125
}
126126

@@ -183,7 +183,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
183183

184184
vma = find_vma(mm, addr);
185185
if (task_size - len >= addr &&
186-
(!vma || addr + len <= vma->vm_start))
186+
(!vma || addr + len <= vm_start_gap(vma)))
187187
return addr;
188188
}
189189

‎arch/sparc/mm/hugetlbpage.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
120120
addr = ALIGN(addr, huge_page_size(h));
121121
vma = find_vma(mm, addr);
122122
if (task_size - len >= addr &&
123-
(!vma || addr + len <= vma->vm_start))
123+
(!vma || addr + len <= vm_start_gap(vma)))
124124
return addr;
125125
}
126126
if (mm->get_unmapped_area == arch_get_unmapped_area)

‎arch/tile/mm/hugetlbpage.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -233,7 +233,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
233233
addr = ALIGN(addr, huge_page_size(h));
234234
vma = find_vma(mm, addr);
235235
if (TASK_SIZE - len >= addr &&
236-
(!vma || addr + len <= vma->vm_start))
236+
(!vma || addr + len <= vm_start_gap(vma)))
237237
return addr;
238238
}
239239
if (current->mm->get_unmapped_area == arch_get_unmapped_area)

‎arch/x86/kernel/sys_x86_64.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
144144
addr = PAGE_ALIGN(addr);
145145
vma = find_vma(mm, addr);
146146
if (end - len >= addr &&
147-
(!vma || addr + len <= vma->vm_start))
147+
(!vma || addr + len <= vm_start_gap(vma)))
148148
return addr;
149149
}
150150

@@ -187,7 +187,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
187187
addr = PAGE_ALIGN(addr);
188188
vma = find_vma(mm, addr);
189189
if (TASK_SIZE - len >= addr &&
190-
(!vma || addr + len <= vma->vm_start))
190+
(!vma || addr + len <= vm_start_gap(vma)))
191191
return addr;
192192
}
193193

‎arch/x86/mm/hugetlbpage.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
148148
addr = ALIGN(addr, huge_page_size(h));
149149
vma = find_vma(mm, addr);
150150
if (TASK_SIZE - len >= addr &&
151-
(!vma || addr + len <= vma->vm_start))
151+
(!vma || addr + len <= vm_start_gap(vma)))
152152
return addr;
153153
}
154154
if (mm->get_unmapped_area == arch_get_unmapped_area)

‎arch/xtensa/kernel/syscall.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
8888
/* At this point: (!vmm || addr < vmm->vm_end). */
8989
if (TASK_SIZE - len < addr)
9090
return -ENOMEM;
91-
if (!vmm || addr + len <= vmm->vm_start)
91+
if (!vmm || addr + len <= vm_start_gap(vmm))
9292
return addr;
9393
addr = vmm->vm_end;
9494
if (flags & MAP_SHARED)

‎fs/hugetlbfs/inode.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -200,7 +200,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
200200
addr = ALIGN(addr, huge_page_size(h));
201201
vma = find_vma(mm, addr);
202202
if (TASK_SIZE - len >= addr &&
203-
(!vma || addr + len <= vma->vm_start))
203+
(!vma || addr + len <= vm_start_gap(vma)))
204204
return addr;
205205
}
206206

‎fs/proc/task_mmu.c

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -300,11 +300,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
300300

301301
/* We don't show the stack guard page in /proc/maps */
302302
start = vma->vm_start;
303-
if (stack_guard_page_start(vma, start))
304-
start += PAGE_SIZE;
305303
end = vma->vm_end;
306-
if (stack_guard_page_end(vma, end))
307-
end -= PAGE_SIZE;
308304

309305
seq_setwidth(m, 25 + sizeof(void *) * 6 - 1);
310306
seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu ",

‎include/linux/mm.h

Lines changed: 25 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1393,12 +1393,6 @@ int clear_page_dirty_for_io(struct page *page);
13931393

13941394
int get_cmdline(struct task_struct *task, char *buffer, int buflen);
13951395

1396-
/* Is the vma a continuation of the stack vma above it? */
1397-
static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
1398-
{
1399-
return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
1400-
}
1401-
14021396
static inline bool vma_is_anonymous(struct vm_area_struct *vma)
14031397
{
14041398
return !vma->vm_ops;
@@ -1414,28 +1408,6 @@ bool vma_is_shmem(struct vm_area_struct *vma);
14141408
static inline bool vma_is_shmem(struct vm_area_struct *vma) { return false; }
14151409
#endif
14161410

1417-
static inline int stack_guard_page_start(struct vm_area_struct *vma,
1418-
unsigned long addr)
1419-
{
1420-
return (vma->vm_flags & VM_GROWSDOWN) &&
1421-
(vma->vm_start == addr) &&
1422-
!vma_growsdown(vma->vm_prev, addr);
1423-
}
1424-
1425-
/* Is the vma a continuation of the stack vma below it? */
1426-
static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
1427-
{
1428-
return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
1429-
}
1430-
1431-
static inline int stack_guard_page_end(struct vm_area_struct *vma,
1432-
unsigned long addr)
1433-
{
1434-
return (vma->vm_flags & VM_GROWSUP) &&
1435-
(vma->vm_end == addr) &&
1436-
!vma_growsup(vma->vm_next, addr);
1437-
}
1438-
14391411
int vma_is_stack_for_current(struct vm_area_struct *vma);
14401412

14411413
extern unsigned long move_page_tables(struct vm_area_struct *vma,
@@ -2222,6 +2194,7 @@ void page_cache_async_readahead(struct address_space *mapping,
22222194
pgoff_t offset,
22232195
unsigned long size);
22242196

2197+
extern unsigned long stack_guard_gap;
22252198
/* Generic expand stack which grows the stack according to GROWS{UP,DOWN} */
22262199
extern int expand_stack(struct vm_area_struct *vma, unsigned long address);
22272200

@@ -2250,6 +2223,30 @@ static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * m
22502223
return vma;
22512224
}
22522225

2226+
static inline unsigned long vm_start_gap(struct vm_area_struct *vma)
2227+
{
2228+
unsigned long vm_start = vma->vm_start;
2229+
2230+
if (vma->vm_flags & VM_GROWSDOWN) {
2231+
vm_start -= stack_guard_gap;
2232+
if (vm_start > vma->vm_start)
2233+
vm_start = 0;
2234+
}
2235+
return vm_start;
2236+
}
2237+
2238+
static inline unsigned long vm_end_gap(struct vm_area_struct *vma)
2239+
{
2240+
unsigned long vm_end = vma->vm_end;
2241+
2242+
if (vma->vm_flags & VM_GROWSUP) {
2243+
vm_end += stack_guard_gap;
2244+
if (vm_end < vma->vm_end)
2245+
vm_end = -PAGE_SIZE;
2246+
}
2247+
return vm_end;
2248+
}
2249+
22532250
static inline unsigned long vma_pages(struct vm_area_struct *vma)
22542251
{
22552252
return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;

‎mm/gup.c

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -387,11 +387,6 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
387387
/* mlock all present pages, but do not fault in new pages */
388388
if ((*flags & (FOLL_POPULATE | FOLL_MLOCK)) == FOLL_MLOCK)
389389
return -ENOENT;
390-
/* For mm_populate(), just skip the stack guard page. */
391-
if ((*flags & FOLL_POPULATE) &&
392-
(stack_guard_page_start(vma, address) ||
393-
stack_guard_page_end(vma, address + PAGE_SIZE)))
394-
return -ENOENT;
395390
if (*flags & FOLL_WRITE)
396391
fault_flags |= FAULT_FLAG_WRITE;
397392
if (*flags & FOLL_REMOTE)

0 commit comments

Comments
 (0)