From: Radu Caragea <[email protected]> Subject: x86 get_unmapped_area(): use proper mmap base for bottom-up direction
When the stack is set to unlimited, the bottomup direction is used for mmap-ings but the mmap_base is not used and thus effectively renders ASLR for mmapings along with PIE useless. Cc: Michel Lespinasse <[email protected]> Cc: Oleg Nesterov <[email protected]> Reviewed-by: Rik van Riel <[email protected]> Acked-by: Ingo Molnar <[email protected]> Cc: Adrian Sendroiu <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> --- arch/x86/kernel/sys_x86_64.c | 2 +- arch/x86/mm/mmap.c | 2 +- include/linux/sched.h | 1 + 3 files changed, 3 insertions(+), 2 deletions(-) diff -puN arch/x86/kernel/sys_x86_64.c~x86-get_unmapped_area-use-proper-mmap-base-for-bottom-up-direction arch/x86/kernel/sys_x86_64.c --- a/arch/x86/kernel/sys_x86_64.c~x86-get_unmapped_area-use-proper-mmap-base-for-bottom-up-direction +++ a/arch/x86/kernel/sys_x86_64.c @@ -101,7 +101,7 @@ static void find_start_end(unsigned long *begin = new_begin; } } else { - *begin = TASK_UNMAPPED_BASE; + *begin = mmap_legacy_base(); *end = TASK_SIZE; } } diff -puN arch/x86/mm/mmap.c~x86-get_unmapped_area-use-proper-mmap-base-for-bottom-up-direction arch/x86/mm/mmap.c --- a/arch/x86/mm/mmap.c~x86-get_unmapped_area-use-proper-mmap-base-for-bottom-up-direction +++ a/arch/x86/mm/mmap.c @@ -98,7 +98,7 @@ static unsigned long mmap_base(void) * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64 * does, but not when emulating X86_32 */ -static unsigned long mmap_legacy_base(void) +unsigned long mmap_legacy_base(void) { if (mmap_is_ia32()) return TASK_UNMAPPED_BASE; diff -puN include/linux/sched.h~x86-get_unmapped_area-use-proper-mmap-base-for-bottom-up-direction include/linux/sched.h --- a/include/linux/sched.h~x86-get_unmapped_area-use-proper-mmap-base-for-bottom-up-direction +++ a/include/linux/sched.h @@ -314,6 +314,7 @@ struct nsproxy; struct user_namespace; #ifdef CONFIG_MMU +extern unsigned long mmap_legacy_base(void); extern void arch_pick_mmap_layout(struct mm_struct *mm); extern unsigned long arch_get_unmapped_area(struct file *, unsigned long, unsigned long, _ -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
