Re: [RFC] mlock/stack guard interaction fixup

Tony Luck
2010-08-23T16:34:17Z

On Sat, Aug 21, 2010 at 9:08 AM, Sam Ravnborg <sam@ravnborg.org> wrote:
> Tony Luck already provided a VM_GROWSUP version.
>
>    See: http://lkml.org/lkml/2010/8/20/325
>
> [It is signed off by Tony Luc - but I guess they know each other ;-) ]

Tony Luc spends too much time looking at the To: and Cc: to make
sure that he spelled *other* peoples names correctly.

That patch doesn't apply any more because of the latest change to look
at vm_prev instead of calling find_vma() [N.B. the block comment above
check_stack_guard_page() still talks about find_vma()]. I can fix up my
patch ... but I have to wonder whether the new code doesn't leave a
hole again. It assumes that any VM_GROWSDOWN object that is
found below the current one is the result of the stack vma having been
split. But couldn't an attacker have used MAP_GROWSDOWN when
placing their sneaky stack smashing mapping just below the stack?

-Tony