From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x225V/VI3ie3bzinoe8RNqZS6q/Gpce5JUyao06EHdGf6MLo7+tk0WW6mmWCk4rEAeUxT54lE ARC-Seal: i=1; a=rsa-sha256; t=1517256763; cv=none; d=google.com; s=arc-20160816; b=XH1y3B67dnu2qwT18SouE4Gj0SRRzwTbnIOM2bY2bMr7LNQlpUfKjuwC+ERaSLSmGO cAMUqK6LgPfwByMm/ljzJ2IRTXx3NVvL1Wsaym8PPJ9kVF/hfD1xHg34+3lXcBKG5lVo B2rSJGaGERpcc8tReOBguxa9aWDjZSqLMyB0PHXi7Wgotmex4572HPI0A2BiSEMEaG94 3b+IEMkxMh2cm2B/zZonbBGATzgvboQm0BdgUBk4p9VvZHsgwcxMq7Ynp8rHVwJZbwas 5cNbaW2ynxmZpGR4RHchi4Tk8+Sf95pZ/aBrlWlB4LidDuo1NPletx0Sr3yuo8pCjNAs yNvw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=PsvwCGZbpFPSBcXw/fvGiirPHIlaK1eikqb1KJomKJo=; b=I8kTqzTl9AV0Xqyqkj7rke9GZC2Tc/SdD3sROO0htRHbDKbfrVDrIO4fPgkywmMqZW D0QVA8C4y5uflN2StM8qQcEdGHt1pyffYgEHxx7+fN0xhhj79VtJuLcXDrCZsMJ565OW 1e3HR5oBNECgThkpEK9jvz5GaAlETuJnVIcLh0sGNVXnbmEnX9auzjb0X8UTOwlnyjPV 1Tsz794ILBY4OKctZZGxTfymdGZqYTQQnkHZi2h1GFQ09v3dxSEzvn5qc267SDWXQwQy 2x2rRuWqOmS+rYqe44VkJJOzXSjoWyFEuDqTAx/pfFEJEPtP4FAWQ5OH4z1tV9yOVTey Oodw== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michal Hocko , Ben Hutchings , Willy Tarreau , Oleg Nesterov , Rik van Riel , Hugh Dickins , Andrew Morton , Linus Torvalds Subject: [PATCH 4.4 21/74] mm/mmap.c: do not blow on PROT_NONE MAP_FIXED holes in the stack Date: Mon, 29 Jan 2018 13:56:26 +0100 Message-Id: <20180129123848.581429861@linuxfoundation.org> X-Mailer: git-send-email 2.16.1 In-Reply-To: <20180129123847.507563674@linuxfoundation.org> References: <20180129123847.507563674@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1590958973747128688?= X-GMAIL-MSGID: =?utf-8?q?1590959027853580673?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Michal Hocko commit 561b5e0709e4a248c67d024d4d94b6e31e3edf2f upstream. Commit 1be7107fbe18 ("mm: larger stack guard gap, between vmas") has introduced a regression in some rust and Java environments which are trying to implement their own stack guard page. They are punching a new MAP_FIXED mapping inside the existing stack Vma. This will confuse expand_{downwards,upwards} into thinking that the stack expansion would in fact get us too close to an existing non-stack vma which is a correct behavior wrt safety. It is a real regression on the other hand. Let's work around the problem by considering PROT_NONE mapping as a part of the stack. This is a gros hack but overflowing to such a mapping would trap anyway an we only can hope that usespace knows what it is doing and handle it propely. Fixes: 1be7107fbe18 ("mm: larger stack guard gap, between vmas") Link: http://lkml.kernel.org/r/20170705182849.GA18027@dhcp22.suse.cz Signed-off-by: Michal Hocko Debugged-by: Vlastimil Babka Cc: Ben Hutchings Cc: Willy Tarreau Cc: Oleg Nesterov Cc: Rik van Riel Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/mmap.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2188,7 +2188,8 @@ int expand_upwards(struct vm_area_struct gap_addr = TASK_SIZE; next = vma->vm_next; - if (next && next->vm_start < gap_addr) { + if (next && next->vm_start < gap_addr && + (next->vm_flags & (VM_WRITE|VM_READ|VM_EXEC))) { if (!(next->vm_flags & VM_GROWSUP)) return -ENOMEM; /* Check that both stack segments have the same anon_vma? */ @@ -2273,7 +2274,8 @@ int expand_downwards(struct vm_area_stru if (gap_addr > address) return -ENOMEM; prev = vma->vm_prev; - if (prev && prev->vm_end > gap_addr) { + if (prev && prev->vm_end > gap_addr && + (prev->vm_flags & (VM_WRITE|VM_READ|VM_EXEC))) { if (!(prev->vm_flags & VM_GROWSDOWN)) return -ENOMEM; /* Check that both stack segments have the same anon_vma? */