Re: [PATCH] arm: fix integer overflow in ELF_ET_DYN_BASE

2015-03-26 Thread Andrey Ryabinin
On 03/26/2015 06:05 PM, Russell King - ARM Linux wrote: > On Fri, Mar 20, 2015 at 02:12:52PM +0300, Andrey Ryabinin wrote: >> Usually ELF_ET_DYN_BASE is 2/3 of TASK_SIZE. With 3G/1G user/kernel >> split this is not so, because 2*TASK_SIZE overflows 32 bits, >> so the actual value of ELF_ET_DYN_BASE

Re: [PATCH] arm: fix integer overflow in ELF_ET_DYN_BASE

2015-03-26 Thread Russell King - ARM Linux
On Fri, Mar 20, 2015 at 02:12:52PM +0300, Andrey Ryabinin wrote: > Usually ELF_ET_DYN_BASE is 2/3 of TASK_SIZE. With 3G/1G user/kernel > split this is not so, because 2*TASK_SIZE overflows 32 bits, > so the actual value of ELF_ET_DYN_BASE is: > (2 * TASK_SIZE / 3) = 0x2a00 > > When ASLR

Re: [PATCH] arm: fix integer overflow in ELF_ET_DYN_BASE

2015-03-23 Thread Kees Cook
On Fri, Mar 20, 2015 at 4:12 AM, Andrey Ryabinin wrote: > Usually ELF_ET_DYN_BASE is 2/3 of TASK_SIZE. With 3G/1G user/kernel > split this is not so, because 2*TASK_SIZE overflows 32 bits, > so the actual value of ELF_ET_DYN_BASE is: > (2 * TASK_SIZE / 3) = 0x2a00 > > When ASLR is disa

Re: [PATCH] arm: fix integer overflow in ELF_ET_DYN_BASE

2015-03-20 Thread Andrey Ryabinin
On 03/20/2015 02:31 PM, Yury Gribov wrote: > On 03/20/2015 02:12 PM, Andrey Ryabinin wrote: >> Usually ELF_ET_DYN_BASE is 2/3 of TASK_SIZE. With 3G/1G user/kernel >> split this is not so, because 2*TASK_SIZE overflows 32 bits, >> so the actual value of ELF_ET_DYN_BASE is: >> (2 * TASK_SIZE / 3)

Re: [PATCH] arm: fix integer overflow in ELF_ET_DYN_BASE

2015-03-20 Thread Yury Gribov
On 03/20/2015 02:12 PM, Andrey Ryabinin wrote: Usually ELF_ET_DYN_BASE is 2/3 of TASK_SIZE. With 3G/1G user/kernel split this is not so, because 2*TASK_SIZE overflows 32 bits, so the actual value of ELF_ET_DYN_BASE is: (2 * TASK_SIZE / 3) = 0x2a00 AFAIK on most platforms (e.g. Intel

[PATCH] arm: fix integer overflow in ELF_ET_DYN_BASE

2015-03-20 Thread Andrey Ryabinin
Usually ELF_ET_DYN_BASE is 2/3 of TASK_SIZE. With 3G/1G user/kernel split this is not so, because 2*TASK_SIZE overflows 32 bits, so the actual value of ELF_ET_DYN_BASE is: (2 * TASK_SIZE / 3) = 0x2a00 When ASLR is disabled PIE binaries will load at ELF_ET_DYN_BASE address. On 32bit pla