linux-kernel - Re: randomized placement of x86

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5357EABB.3070400@zytor.com>
Date:	Wed, 23 Apr 2014 09:30:51 -0700
From:	"H. Peter Anvin" <hpa@...or.com>
To:	Nathan Lynch <Nathan_Lynch@...tor.com>, x86@...nel.org
CC:	Kees Cook <keescook@...gle.com>, luto@...capital.net,
	linux-kernel@...r.kernel.org
Subject: Re: randomized placement of x86_64 vdso

On 04/21/2014 09:52 AM, Nathan Lynch wrote:
> Hi x86/vdso people,
> 
> I've been working on adding a vDSO to 32-bit ARM, and Kees suggested I
> look at x86_64's algorithm for placing the vDSO at a randomized offset
> above the stack VMA.  I found that when the stack top occupies the
> last slot in the PTE (is that the right term?), the vdso_addr routine
> returns an address below mm->start_stack, equivalent to
> (mm->start_stack & PAGE_MASK).  For instance if mm->start_stack is
> 0x7fff3ffffc96, vdso_addr returns 0x7fff3ffff000.
> 
> Since the address returned is always already occupied by the stack,
> get_unmapped_area detects the collision and falls back to
> vm_unmapped_area.  This results in the vdso being placed in the
> address space next to libraries etc.  While this is generally
> unnoticeable and doesn't break anything, it does mean that the vdso is
> placed below the stack when there is actually room above the stack.
> To me it also seems uncomfortably close to placing the vdso in the way
> of downward expansion of the stack.
> 
> I don't have a patch because I'm not sure what the algorithm should
> be, but thought I would bring it up as vdso_addr doesn't seem to be
> behaving as intended in all cases.
> 

If the stack occupies the last possible page, how can you say there is
"space above the stack"?

	-hpa


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/