linux-kernel - [PATCH 3.19.y-ckt 04/54] arm: factor out mmap ASLR into mmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Mon,  9 May 2016 17:04:23 -0700
From:	Kamal Mostafa <kamal@...onical.com>
To:	linux-kernel@...r.kernel.org, stable@...r.kernel.org,
	kernel-team@...ts.ubuntu.com
Cc:	Kees Cook <keescook@...omium.org>,
	Hector Marco-Gisbert <hecmargi@....es>,
	Russell King <linux@....linux.org.uk>,
	Catalin Marinas <catalin.marinas@....com>,
	Will Deacon <will.deacon@....com>,
	Ralf Baechle <ralf@...ux-mips.org>,
	Benjamin Herrenschmidt <benh@...nel.crashing.org>,
	Paul Mackerras <paulus@...ba.org>,
	Michael Ellerman <mpe@...erman.id.au>,
	Martin Schwidefsky <schwidefsky@...ibm.com>,
	Heiko Carstens <heiko.carstens@...ibm.com>,
	Alexander Viro <viro@...iv.linux.org.uk>,
	Oleg Nesterov <oleg@...hat.com>,
	Andy Lutomirski <luto@...capital.net>,
	"David A. Long" <dave.long@...aro.org>,
	Andrey Ryabinin <a.ryabinin@...sung.com>,
	Arun Chandran <achandran@...sta.com>,
	Yann Droneaud <ydroneaud@...eya.com>,
	Min-Hua Chen <orca.chen@...il.com>,
	Paul Burton <paul.burton@...tec.com>,
	Alex Smith <alex@...x-smith.me.uk>,
	Markos Chandras <markos.chandras@...tec.com>,
	Vineeth Vijayan <vvijayan@...sta.com>,
	Jeff Bailey <jeffbailey@...gle.com>,
	Michael Holzheu <holzheu@...ux.vnet.ibm.com>,
	Ben Hutchings <ben@...adent.org.uk>,
	Behan Webster <behanw@...verseincode.com>,
	Ismael Ripoll <iripoll@....es>, Jan-Simon Mller <dl9pf@....de>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Kamal Mostafa <kamal@...onical.com>
Subject: [PATCH 3.19.y-ckt 04/54] arm: factor out mmap ASLR into mmap_rnd

3.19.8-ckt21 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Kees Cook <keescook@...omium.org>

commit fbbc400f3924ce095b466c776dc294727ec0a202 upstream.

To address the "offset2lib" ASLR weakness[1], this separates ET_DYN ASLR
from mmap ASLR, as already done on s390.  The architectures that are
already randomizing mmap (arm, arm64, mips, powerpc, s390, and x86), have
their various forms of arch_mmap_rnd() made available via the new
CONFIG_ARCH_HAS_ELF_RANDOMIZE.  For these architectures,
arch_randomize_brk() is collapsed as well.

This is an alternative to the solutions in:
https://lkml.org/lkml/2015/2/23/442

I've been able to test x86 and arm, and the buildbot (so far) seems happy
with building the rest.

[1] http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html

This patch (of 10):

In preparation for splitting out ET_DYN ASLR, this moves the ASLR
calculations for mmap on ARM into a separate routine, similar to x86.
This also removes the redundant check of personality (PF_RANDOMIZE is
already set before calling arch_pick_mmap_layout).

Signed-off-by: Kees Cook <keescook@...omium.org>
Cc: Hector Marco-Gisbert <hecmargi@....es>
Cc: Russell King <linux@....linux.org.uk>
Reviewed-by: Ingo Molnar <mingo@...nel.org>
Cc: Catalin Marinas <catalin.marinas@....com>
Cc: Will Deacon <will.deacon@....com>
Cc: Ralf Baechle <ralf@...ux-mips.org>
Cc: Benjamin Herrenschmidt <benh@...nel.crashing.org>
Cc: Paul Mackerras <paulus@...ba.org>
Cc: Michael Ellerman <mpe@...erman.id.au>
Cc: Martin Schwidefsky <schwidefsky@...ibm.com>
Cc: Heiko Carstens <heiko.carstens@...ibm.com>
Cc: Alexander Viro <viro@...iv.linux.org.uk>
Cc: Oleg Nesterov <oleg@...hat.com>
Cc: Andy Lutomirski <luto@...capital.net>
Cc: "David A. Long" <dave.long@...aro.org>
Cc: Andrey Ryabinin <a.ryabinin@...sung.com>
Cc: Arun Chandran <achandran@...sta.com>
Cc: Yann Droneaud <ydroneaud@...eya.com>
Cc: Min-Hua Chen <orca.chen@...il.com>
Cc: Paul Burton <paul.burton@...tec.com>
Cc: Alex Smith <alex@...x-smith.me.uk>
Cc: Markos Chandras <markos.chandras@...tec.com>
Cc: Vineeth Vijayan <vvijayan@...sta.com>
Cc: Jeff Bailey <jeffbailey@...gle.com>
Cc: Michael Holzheu <holzheu@...ux.vnet.ibm.com>
Cc: Ben Hutchings <ben@...adent.org.uk>
Cc: Behan Webster <behanw@...verseincode.com>
Cc: Ismael Ripoll <iripoll@....es>
Cc: Jan-Simon Mller <dl9pf@....de>
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@...ux-foundation.org>
Signed-off-by: Kamal Mostafa <kamal@...onical.com>
---
 arch/arm/mm/mmap.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index 5e85ed3..15a8160 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -169,14 +169,22 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
 	return addr;
 }
 
+static unsigned long mmap_rnd(void)
+{
+	unsigned long rnd;
+
+	/* 8 bits of randomness in 20 address space bits */
+	rnd = (unsigned long)get_random_int() % (1 << 8);
+
+	return rnd << PAGE_SHIFT;
+}
+
 void arch_pick_mmap_layout(struct mm_struct *mm)
 {
 	unsigned long random_factor = 0UL;
 
-	/* 8 bits of randomness in 20 address space bits */
-	if ((current->flags & PF_RANDOMIZE) &&
-	    !(current->personality & ADDR_NO_RANDOMIZE))
-		random_factor = (get_random_int() % (1 << 8)) << PAGE_SHIFT;
+	if (current->flags & PF_RANDOMIZE)
+		random_factor = mmap_rnd();
 
 	if (mmap_is_legacy()) {
 		mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
-- 
2.7.4