| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20090622153620.0fff5652.kamezawa.hiroyu@jp.fujitsu.com> Date: Mon, 22 Jun 2009 15:36:20 +0900 From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com> To: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org> Cc: kamezawa.hiroyu@...fujitsu.com, hugh.dickins@...cali.co.uk, jakub@...hat.com, roland@...hat.com, akpm@...ux-foundation.org Subject: [PATCH] limit max map count to safe value under ELF v2 This is a replacement for elf-reduce-default-max_map_count-to-be-safe-value.patch I think all necessary info are written in comments.. == From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com> With ELF, at generating coredump, some more headers other than used vmas are added. When, max_map_count == 65536, a core generated by following kinds of code can be unreadable because the number of ELF's program header is written in 16bit in Ehdr (please see elf.h) and the number overflows. == ... = mmap(); (munmap, mprotect, etc...) if (failed) abort(); == This can be happen in mmap/munmap/mprotect/etc...which calls split_vma(). I think 65536 is not safe as _default_ and reduce it to 65530 is good for avoiding unexpected corrupted core. Anyway, max_map_count can be enlarged by sysctl if a user is brave.. Changelog: v1 -> v2 - set limit to 65530 - added more comments for explaining the reason of value. Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com> --- fs/binfmt_elf.c | 5 ++++- include/linux/sched.h | 16 ++++++++++++++-- 2 files changed, 18 insertions(+), 3 deletions(-) Index: linux-2.6.30-git18/include/linux/sched.h =================================================================== --- linux-2.6.30-git18.orig/include/linux/sched.h +++ linux-2.6.30-git18/include/linux/sched.h @@ -349,8 +349,20 @@ extern int mutex_spin_on_owner(struct mu struct nsproxy; struct user_namespace; -/* Maximum number of active map areas.. This is a random (large) number */ -#define DEFAULT_MAX_MAP_COUNT 65536 +/* + * Default maximum number of active map areas, this limits the number of vmas + * per mm struct. Users can overwrite this number by sysctl but there is a + * problem. + * + * When a program's coredump is generated as ELF format, a section is created + * per a vma. In ELF, the number of sections is represented in unsigned short. + * This means the number of sections should be smaller than 65535 at coredump. + * Because the kernel adds some informative sections to a image of program at + * generating coredump, we need some margin. The number of extra sections is + * 1-3 now and depends on arch. We use "5" as safe margin, here. + */ +#define MAPCOUNT_ELF_CORE_MARGIN (5) +#define DEFAULT_MAX_MAP_COUNT (USHORT_MAX - MAPCOUNT_ELF_CORE_MARGIN) extern int sysctl_max_map_count; Index: linux-2.6.30-git18/fs/binfmt_elf.c =================================================================== --- linux-2.6.30-git18.orig/fs/binfmt_elf.c +++ linux-2.6.30-git18/fs/binfmt_elf.c @@ -1929,7 +1929,10 @@ static int elf_core_dump(long signr, str elf = kmalloc(sizeof(*elf), GFP_KERNEL); if (!elf) goto out; - + /* + * The number of segs are recored into ELF header as 16bit value. + * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here. + */ segs = current->mm->map_count; #ifdef ELF_CORE_EXTRA_PHDRS segs += ELF_CORE_EXTRA_PHDRS; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists