lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 6 Dec 2017 00:06:52 -0800
From:   John Hubbard <>
To:     Florian Weimer <>,
        Matthew Wilcox <>,
        Michael Ellerman <>
CC:     Cyril Hrubis <>, Michal Hocko <>,
        Kees Cook <>,
        Linux API <>,
        Khalid Aziz <>,
        Andrew Morton <>,
        Russell King - ARM Linux <>,
        Andrea Arcangeli <>,
        Linux-MM <>,
        LKML <>,
        linux-arch <>,
        Abdul Haleem <>,
        Joel Stanley <>
Subject: Re: [PATCH 0/2] mm: introduce MAP_FIXED_SAFE

On 12/05/2017 11:35 PM, Florian Weimer wrote:
> On 12/06/2017 08:33 AM, John Hubbard wrote:
>> In that case, maybe:
>>      MAP_EXACT
>> ? ...because that's the characteristic behavior.
> Is that true?  mmap still silently rounding up the length to the page size, I assume, so even that name is misleading.

Hi Florian,

Not as far as I can tell, it's not doing that.

For both MAP_FIXED, and this new flag, the documented (and actual)
behavior is *not* to do any such rounding. Instead, the requested
input address is required to be page-aligned itself, and mmap()
should be honoring the exact addr.

>From the mmap(2) man page:

          Don't  interpret  addr  as  a  hint: place the mapping at
          exactly that address.  addr must be  a  multiple  of  the
          page  size. 

And from what I can see, the do_mmap() implementation leaves addr
unchanged, in the MAP_FIXED case:

        /* ... */
	if (!(flags & MAP_FIXED))
		addr = round_hint_to_min(addr);

...although it does look like device drivers have the opportunity
to break that:

		/* Can addr have changed??
		 * Answer: Yes, several device drivers can do it in their
		 *         f_op->mmap method. -DaveM
		 * Bug: If addr is changed, prev, rb_link, rb_parent should
		 *      be updated for vma_link()
		WARN_ON_ONCE(addr != vma->vm_start);

		addr = vma->vm_start;

John Hubbard

> Thanks,
> Florian

Powered by blists - more mailing lists