linux-kernel - Re: [PATCH v2] ipc/shm: fix the historical/wrong mm->start

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140826143227.GA30900@redhat.com>
Date:	Tue, 26 Aug 2014 16:32:27 +0200
From:	Oleg Nesterov <oleg@...hat.com>
To:	Hugh Dickins <hughd@...gle.com>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	Cyrill Gorcunov <gorcunov@...nvz.org>,
	Manfred Spraul <manfred@...orfullife.com>,
	Davidlohr Bueso <davidlohr.bueso@...com>,
	Kees Cook <keescook@...omium.org>, Tejun Heo <tj@...nel.org>,
	Andrew Vagin <avagin@...nvz.org>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	Serge Hallyn <serge.hallyn@...onical.com>,
	Pavel Emelyanov <xemul@...allels.com>,
	Vasiliy Kulikov <segoon@...nwall.com>,
	KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com>,
	Michael Kerrisk <mtk.manpages@...il.com>,
	Julien Tinnes <jln@...gle.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] ipc/shm: fix the historical/wrong mm->start_stack
	check

On 08/25, Hugh Dickins wrote:
>
> On Mon, 25 Aug 2014, Oleg Nesterov wrote:
>
> >    As Hugh pointed out, we actually need to require the additional
> >    guard page, but this code was written before linux had it.
> >
> > 3. This wrongly assumes that the stack can only grown down.
> >
> > Personally I think we should simply kill this check, but I did not
> > dare to do this. So the patch only fixes the 1st problem (mostly to
> > avoid the usage of mm->start_stack) and ignores the VM_GROWSUP case.
> >
> > Signed-off-by: Oleg Nesterov <oleg@...hat.com>
>
> Sorry, I cannot ack this,

Hugh, I appreciate you nack even more. Thanks!

> because your comment below "at least 4 pages
> plus a guard page enforced by check_stack_guard_page()" makes no sense
> to me as an explanation for the 5.  The guard page (gap) enforced by
> check_stack_guard_page() is already at vma->vm_start
                              ^^^^^^^^^^^^^^^^^^^^^^^^
Ahh. Yes I misunderstood this logic. And yes, you tried to explain it
twice but I was too stupid.

> I did come across 2.6.34's 128k stack_expand inherited from 2.6.11's
> 20 page EXTRA_STACK_VM_PAGES.  With Linus's guard page enforcing a
> page gap since 2.6.36.

OK, and setup_arg_pages() still does expand_stack() although stack_expand
depends on RLIMIT_STACK. But I think this doesn't matter. The room was
already reserved, in general mm->start_stack points into the middle of
the stack.

So that check in do_shmat() can only help if the stack was not expanded
due to the low RLIMIT_STACK, then this application raises RLIMIT_STACK,
then does do_shmat(). But in this case it should likely crash when exec
returns to usermode.

> and our difficulty
> in communicating a sensible way of updating and describing the test,

I like your polite interpretation of my ignorance and inability to listen ;)

> now drives me to agree with you.  Please just rip out the start_stack
> test and the comment defending it.

Great. Will do.

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/