linux-kernel - Re: brk randomization breaks columns

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 5 Feb 2008 17:02:14 +0100
From:	Pavel Machek <pavel@....cz>
To:	Jiri Kosina <jkosina@...e.cz>
Cc:	kernel list <linux-kernel@...r.kernel.org>,
	Ingo Molnar <mingo@...e.hu>,
	Abel Bernabeu <abel.bernabeu@...il.com>,
	Hugh Dickins <hugh@...itas.com>,
	Arjan van de Ven <arjan@...radead.org>
Subject: Re: brk randomization breaks columns

Hi!

> Still, it will probably not fix your particular program crashes, just 
> because it will always assume that brk starts immediately after the end of 
> the bss, which is plain wrong and has never been assured. Could you please 
> check whether there is any compat-* package available for you 
> distribution, that upgrades libc.so.5 to any fixed version?

I got libc.so.5 as a binary from some Slackware-based system, IIRC,
and I can't find any relevant compat-* packages :-(.

> From: Jiri Kosina <jkosina@...e.cz>
> 
> brk: check the lower bound properly
> 
> There is a check in sys_brk(), that tries to make sure that we do not 
> underflow the area that is dedicated to brk heap.
> 
> The check is however wrong, as it assumes that brk area starts immediately 
> after the end of the code (+bss), which is wrong for example in 
> environments with randomized brk start. The proper way is to check whether 
> the address is not below the start_brk address.
> 
> Signed-off-by: Jiri Kosina <jkosina@...e.cz>

ACK.


> diff --git a/mm/mmap.c b/mm/mmap.c
> index 8295577..1c3b48f 100644
> --- a/mm/mmap.c
> +++ b/mm/mmap.c
> @@ -241,7 +241,7 @@ asmlinkage unsigned long sys_brk(unsigned long brk)
>  
>  	down_write(&mm->mmap_sem);
>  
> -	if (brk < mm->end_code)
> +	if (brk < mm->start_brk)
>  		goto out;
>  
>  	/*

-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/