Re: [PATCH] [RESEND] i386 and x86_64: randomize brk()

[Andrew Morton <akpm@linux-foundation.org>]

On Tue, 11 Sep 2007 14:17:24 +0200 (CEST) Jiri Kosina <jkosina@suse.cz> wrote:

> From: Jiri Kosina <jkosina@suse.cz>
> 
> i386 and x86_64: randomize brk()
> 
> This patch randomizes the location of the heap (brk) for i386 and x86_64.
> The range is randomized in the range starting at current brk location up
> to 0x02000000 offset for both architectures. This, together with
> pie-executable-randomization.patch and
> pie-executable-randomization-fix.patch, should make the address space
> randomization on i386 and x86_64 complete.
> 
> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
> 
> diff --git a/arch/i386/kernel/process.c b/arch/i386/kernel/process.c
> index 8466471..8e0624d 100644
> --- a/arch/i386/kernel/process.c
> +++ b/arch/i386/kernel/process.c
> @@ -949,3 +949,17 @@ unsigned long arch_align_stack(unsigned long sp)
>  		sp -= get_random_int() % 8192;
>  	return sp & ~0xf;
>  }
> +
> +unsigned long arch_randomize_brk(unsigned long brk)
> +{
> +	unsigned long new_brk;
> +	unsigned long range_end;
> +
> +	range_end = brk + 0x02000000;
> +	new_brk = randomize_range(brk, range_end, 0);
> +	if (new_brk)
> +		return new_brk;
> +	else
> +		return brk;
> +}
> +
> diff --git a/arch/x86_64/kernel/process.c b/arch/x86_64/kernel/process.c
> index 2842f50..b20f0eb 100644
> --- a/arch/x86_64/kernel/process.c
> +++ b/arch/x86_64/kernel/process.c
> @@ -902,3 +902,17 @@ unsigned long arch_align_stack(unsigned long sp)
>  		sp -= get_random_int() % 8192;
>  	return sp & ~0xf;
>  }
> +
> +unsigned long arch_randomize_brk(unsigned long brk)
> +{
> +	unsigned long new_brk;
> +	unsigned long range_end;
> +
> +	range_end = brk + 0x02000000;
> +	new_brk = randomize_range(brk, range_end, 0);
> +	if (new_brk)
> +		return new_brk;
> +	else
> +		return brk;
> +}
> +
> diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> index d65f1d9..7afec71 100644
> --- a/fs/binfmt_elf.c
> +++ b/fs/binfmt_elf.c
> @@ -47,6 +47,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs);
>  static int load_elf_library(struct file *);
>  static unsigned long elf_map (struct file *, unsigned long, struct elf_phdr *, int, int, unsigned long);
>  
> +/* overriden by architectures supporting brk randomization */
> +unsigned long __weak arch_randomize_brk(unsigned long brk) { return brk; }
> +
>  /*
>   * If we don't support core dumping, then supply a NULL so we
>   * don't even try.
> @@ -1073,6 +1076,10 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
>  	current->mm->end_data = end_data;
>  	current->mm->start_stack = bprm->p;
>  
> +	if (current->flags & PF_RANDOMIZE)
> +		current->mm->brk = current->mm->start_brk = 
> +			arch_randomize_brk(current->mm->brk);
> +
>  	if (current->personality & MMAP_PAGE_ZERO) {
>  		/* Why this, you ask???  Well SVr4 maps page 0 as read-only,
>  		   and some applications "depend" upon this behavior.

We need a prototype of arch_randomize_brk() in scope for all callers and
implementations, so that the compiler can perform the appropriate
typechecking.

--- a/include/linux/mm.h~i386-and-x86_64-randomize-brk-fix
+++ a/include/linux/mm.h
@@ -1017,6 +1017,7 @@ out:
 extern int do_munmap(struct mm_struct *, unsigned long, size_t);
 
 extern unsigned long do_brk(unsigned long, unsigned long);
+extern unsigned long arch_randomize_brk(unsigned long brk);
 
 /* filemap.c */
 extern unsigned long page_unuse(struct page *);
_