3.19.8-ckt21 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------ From: Kees Cook <keesc...@chromium.org> commit fbbc400f3924ce095b466c776dc294727ec0a202 upstream. To address the "offset2lib" ASLR weakness[1], this separates ET_DYN ASLR from mmap ASLR, as already done on s390. The architectures that are already randomizing mmap (arm, arm64, mips, powerpc, s390, and x86), have their various forms of arch_mmap_rnd() made available via the new CONFIG_ARCH_HAS_ELF_RANDOMIZE. For these architectures, arch_randomize_brk() is collapsed as well. This is an alternative to the solutions in: https://lkml.org/lkml/2015/2/23/442 I've been able to test x86 and arm, and the buildbot (so far) seems happy with building the rest. [1] http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html This patch (of 10): In preparation for splitting out ET_DYN ASLR, this moves the ASLR calculations for mmap on ARM into a separate routine, similar to x86. This also removes the redundant check of personality (PF_RANDOMIZE is already set before calling arch_pick_mmap_layout). Signed-off-by: Kees Cook <keesc...@chromium.org> Cc: Hector Marco-Gisbert <hecma...@upv.es> Cc: Russell King <li...@arm.linux.org.uk> Reviewed-by: Ingo Molnar <mi...@kernel.org> Cc: Catalin Marinas <catalin.mari...@arm.com> Cc: Will Deacon <will.dea...@arm.com> Cc: Ralf Baechle <r...@linux-mips.org> Cc: Benjamin Herrenschmidt <b...@kernel.crashing.org> Cc: Paul Mackerras <pau...@samba.org> Cc: Michael Ellerman <m...@ellerman.id.au> Cc: Martin Schwidefsky <schwidef...@de.ibm.com> Cc: Heiko Carstens <heiko.carst...@de.ibm.com> Cc: Alexander Viro <v...@zeniv.linux.org.uk> Cc: Oleg Nesterov <o...@redhat.com> Cc: Andy Lutomirski <l...@amacapital.net> Cc: "David A. Long" <dave.l...@linaro.org> Cc: Andrey Ryabinin <a.ryabi...@samsung.com> Cc: Arun Chandran <achand...@mvista.com> Cc: Yann Droneaud <ydrone...@opteya.com> Cc: Min-Hua Chen <orca.c...@gmail.com> Cc: Paul Burton <paul.bur...@imgtec.com> Cc: Alex Smith <a...@alex-smith.me.uk> Cc: Markos Chandras <markos.chand...@imgtec.com> Cc: Vineeth Vijayan <vvija...@mvista.com> Cc: Jeff Bailey <jeffbai...@google.com> Cc: Michael Holzheu <holz...@linux.vnet.ibm.com> Cc: Ben Hutchings <b...@decadent.org.uk> Cc: Behan Webster <beh...@converseincode.com> Cc: Ismael Ripoll <irip...@upv.es> Cc: Jan-Simon Mller <dl...@gmx.de> Signed-off-by: Andrew Morton <a...@linux-foundation.org> Signed-off-by: Linus Torvalds <torva...@linux-foundation.org> Signed-off-by: Kamal Mostafa <ka...@canonical.com> --- arch/arm/mm/mmap.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c index 5e85ed3..15a8160 100644 --- a/arch/arm/mm/mmap.c +++ b/arch/arm/mm/mmap.c @@ -169,14 +169,22 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, return addr; } +static unsigned long mmap_rnd(void) +{ + unsigned long rnd; + + /* 8 bits of randomness in 20 address space bits */ + rnd = (unsigned long)get_random_int() % (1 << 8); + + return rnd << PAGE_SHIFT; +} + void arch_pick_mmap_layout(struct mm_struct *mm) { unsigned long random_factor = 0UL; - /* 8 bits of randomness in 20 address space bits */ - if ((current->flags & PF_RANDOMIZE) && - !(current->personality & ADDR_NO_RANDOMIZE)) - random_factor = (get_random_int() % (1 << 8)) << PAGE_SHIFT; + if (current->flags & PF_RANDOMIZE) + random_factor = mmap_rnd(); if (mmap_is_legacy()) { mm->mmap_base = TASK_UNMAPPED_BASE + random_factor; -- 2.7.4
