linux-kernel - [RFC - PATCH] leave guard page for upwardly growing stacks too

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Fri, 20 Aug 2010 10:56:47 -0700
From:	"Luck, Tony" <tony.luck@...el.com>
To:	linux-kernel@...r.kernel.org
Cc:	linux-ia64@...r.kernel.org, linux-parisc@...r.kernel.org,
	"Kyle McMartin" <kyle@...artin.ca>, "Helge Deller" <deller@....de>,
	"James E.J. Bottomley" <jejb@...isc-linux.org>,
	"Matthew Wilcox" <willy@...ux.intel.com>
Subject: [RFC - PATCH] leave guard page for upwardly growing stacks too

In commit 320b2b8de12698082609ebbc1a17165727f4c893
   mm: keep a guard page below a grow-down stack segment

we prevented stacks from growing downwards into other vma areas.
But some arhictectures (ia64 and pa-risc) have stacks that
grow upwards. Provide the same protection for them.

Signed-off-by: Tony Luc <tony.luck@...el.com>

---

Pointed out to me by Matthew Wilcox.

DANGER, DANGER - NOT TESTED on pa-risc yet DO NOT APPLY WITHOUT AN ACK FROM PA-RISC LAND!

Are there any other architectures with upward growing stacks?

diff --git a/mm/memory.c b/mm/memory.c
index b6e5fd2..9dcef72 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2760,21 +2760,35 @@ out_release:
 }
 
 /*
- * This is like a special single-page "expand_downwards()",
- * except we must first make sure that 'address-PAGE_SIZE'
+ * This is like a special single-page "expand_{down|up}wards()",
+ * except we must first make sure that 'address{-|+}PAGE_SIZE'
  * doesn't hit another vma.
  *
  * The "find_vma()" will do the right thing even if we wrap
  */
 static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
 {
-	address &= PAGE_MASK;
-	if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
-		address -= PAGE_SIZE;
-		if (find_vma(vma->vm_mm, address) != vma)
-			return -ENOMEM;
+	struct vm_area_struct *v;
+
+	if (vma->vm_flags & VM_GROWSDOWN) {
+		address &= PAGE_MASK;
+		if (address == vma->vm_start) {
+			address -= PAGE_SIZE;
+			if (find_vma(vma->vm_mm, address) != vma)
+				return -ENOMEM;
 
-		expand_stack(vma, address);
+			expand_stack(vma, address);
+		}
+	} else if (vma->vm_flags & VM_GROWSUP) {
+		address = PAGE_ALIGN(address + 1);
+		if (address == vma->vm_end) {
+			address += PAGE_SIZE;
+			if ((v = find_vma(vma->vm_mm, address)) &&
+				v->vm_start <= address) {
+				return -ENOMEM;
+			}
+			expand_upwards(vma, address);
+		}
 	}
 	return 0;
 }
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/