On Fri, Mar 20, 2015 at 4:12 AM, Andrey Ryabinin <a.ryabi...@samsung.com> wrote: > Usually ELF_ET_DYN_BASE is 2/3 of TASK_SIZE. With 3G/1G user/kernel > split this is not so, because 2*TASK_SIZE overflows 32 bits, > so the actual value of ELF_ET_DYN_BASE is: > (2 * TASK_SIZE / 3) = 0x2a000000 > > When ASLR is disabled PIE binaries will load at ELF_ET_DYN_BASE address. > On 32bit platforms AddressSanitzer uses addresses [0x20000000 - 0x40000000] > for shadow memory [1]. So ASan doesn't work for PIE binaries when ASLR > disabled > as it fails to map shadow memory. > Also after Kees's 'split ET_DYN ASLR from mmap ASLR' patchset PIE binaries > has a high chance of loading somewhere in between [0x2a000000 - 0x40000000] > even if ASLR enabled. This makes ASan with PIE absolutely incompatible. > > Fix overflow by dividing TASK_SIZE prior to multiplying. > After this patch ELF_ET_DYN_BASE equals to (for CONFIG_VMSPLIT_3G=y): > (TASK_SIZE / 3 * 2) = 0x7f555554 > > [1] > https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm#Mapping > > Signed-off-by: Andrey Ryabinin <a.ryabi...@samsung.com> > Reported-by: Maria Guseva <m.gus...@samsung.com> > Cc: sta...@vger.kernel.org > --- > arch/arm/include/asm/elf.h | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h > index c1ff8ab..1984a92 100644 > --- a/arch/arm/include/asm/elf.h > +++ b/arch/arm/include/asm/elf.h > @@ -115,7 +115,7 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t > *elfregs); > the loader. We need to make sure that it is out of the way of the program > that it will "exec", and that there is sufficient room for the brk. */ > > -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3) > +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2) > > /* When the program starts, a1 contains a pointer to a function to be > registered with atexit, as per the SVR4 ABI. A value of 0 means we
Acked-by: Kees Cook <keesc...@chromium.org> Though, yes, as mentioned in the other replies, please send fixes for the other architectures too. Thanks for catching this! -Kees -- Kees Cook Chrome OS Security -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
