From: riel@redhat.com
To: linux-kernel@vger.kernel.org
Cc: kernel-hardening@lists.openwall.com, akpm@linux-foundation.org,
mingo@kernel.org, oleg@redhat.com, lwoodman@redhat.com,
mhocko@suse.de, danielmicay@gmail.com, will.deacon@arm.com,
benh@kernel.crashing.org
Subject: [PATCH 5/6] arm64: move COMPAT_ELF_ET_DYN_BASE lower in the address space
Date: Fri, 2 Jun 2017 11:20:09 -0400 [thread overview]
Message-ID: <20170602152010.2064-6-riel@redhat.com> (raw)
In-Reply-To: <20170602152010.2064-1-riel@redhat.com>
From: Rik van Riel <riel@redhat.com>
When setting up mmap_base, we take care to start the mmap base
below the maximum extent to which the stack will grow. However,
we take no such precautions with PIE binaries, which are placed
at 2/3 of TASK_SIZE plus a random offset. As a result, 32 bit PIE
binaries can end up smack in the middle of where the stack (which
is randomized down) is supposed to go.
That problem can be avoided by putting the 32 bit ELF_ET_DYN_BASE
at 256MB, which is a value linux-hardened and grsecurity have used
for a long time now without any known (to me) bug reports.
Signed-off-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Daniel Micay <danielmicay@gmail.com>
---
arch/arm64/include/asm/elf.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index 5d1700425efe..88808a761816 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -173,7 +173,7 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
#ifdef CONFIG_COMPAT
-#define COMPAT_ELF_ET_DYN_BASE (2 * TASK_SIZE_32 / 3)
+#define COMPAT_ELF_ET_DYN_BASE (0x10000000UL)
/* AArch32 registers. */
#define COMPAT_ELF_NGREG 18
--
2.9.3
next prev parent reply other threads:[~2017-06-02 15:28 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-06-02 15:20 [PATCH 0/6] move mmap_area and PIE binaries away from the stack riel
2017-06-02 15:20 ` [PATCH 1/6] binfmt_elf: document load_bias a little bit riel
2017-06-02 19:27 ` [kernel-hardening] " Kees Cook
2017-06-02 15:20 ` [PATCH 2/6] x86/elf: move 32 bit ELF_ET_DYN_BASE to 256MB riel
2017-06-03 4:22 ` Kees Cook
2017-06-03 11:57 ` Daniel Micay
2017-06-05 13:54 ` Rik van Riel
2017-06-02 15:20 ` [PATCH 3/6] x86/mmap: properly account for stack randomization in mmap_base riel
2017-06-03 4:46 ` [kernel-hardening] " Kees Cook
2017-06-03 12:16 ` Daniel Micay
2017-06-02 15:20 ` [PATCH 4/6] arm64/mmap: " riel
2017-06-02 15:20 ` riel [this message]
2017-06-02 15:20 ` [PATCH 6/6] powerpc,mmap: " riel
2017-06-03 4:37 ` [kernel-hardening] [PATCH 0/6] move mmap_area and PIE binaries away from the stack Kees Cook
2017-06-03 12:14 ` Daniel Micay
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170602152010.2064-6-riel@redhat.com \
--to=riel@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=benh@kernel.crashing.org \
--cc=danielmicay@gmail.com \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lwoodman@redhat.com \
--cc=mhocko@suse.de \
--cc=mingo@kernel.org \
--cc=oleg@redhat.com \
--cc=will.deacon@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).