mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-12-10 00:05:14 -05:00
701 lines
21 KiB
Diff
701 lines
21 KiB
Diff
|
From 45c60e595758ce93431e72051c52552ee57af3a1 Mon Sep 17 00:00:00 2001
|
||
|
From: Hugh Dickins <hughd@google.com>
|
||
|
Date: Mon, 19 Jun 2017 04:03:24 -0700
|
||
|
Subject: [PATCH] mm: larger stack guard gap, between vmas
|
||
|
|
||
|
commit 1be7107fbe18eed3e319a6c3e83c78254b693acb upstream.
|
||
|
|
||
|
Stack guard page is a useful feature to reduce a risk of stack smashing
|
||
|
into a different mapping. We have been using a single page gap which
|
||
|
is sufficient to prevent having stack adjacent to a different mapping.
|
||
|
But this seems to be insufficient in the light of the stack usage in
|
||
|
userspace. E.g. glibc uses as large as 64kB alloca() in many commonly
|
||
|
used functions. Others use constructs liks gid_t buffer[NGROUPS_MAX]
|
||
|
which is 256kB or stack strings with MAX_ARG_STRLEN.
|
||
|
|
||
|
This will become especially dangerous for suid binaries and the default
|
||
|
no limit for the stack size limit because those applications can be
|
||
|
tricked to consume a large portion of the stack and a single glibc call
|
||
|
could jump over the guard page. These attacks are not theoretical,
|
||
|
unfortunatelly.
|
||
|
|
||
|
Make those attacks less probable by increasing the stack guard gap
|
||
|
to 1MB (on systems with 4k pages; but make it depend on the page size
|
||
|
because systems with larger base pages might cap stack allocations in
|
||
|
the PAGE_SIZE units) which should cover larger alloca() and VLA stack
|
||
|
allocations. It is obviously not a full fix because the problem is
|
||
|
somehow inherent, but it should reduce attack space a lot.
|
||
|
|
||
|
One could argue that the gap size should be configurable from userspace,
|
||
|
but that can be done later when somebody finds that the new 1MB is wrong
|
||
|
for some special case applications. For now, add a kernel command line
|
||
|
option (stack_guard_gap) to specify the stack gap size (in page units).
|
||
|
|
||
|
Implementation wise, first delete all the old code for stack guard page:
|
||
|
because although we could get away with accounting one extra page in a
|
||
|
stack vma, accounting a larger gap can break userspace - case in point,
|
||
|
a program run with "ulimit -S -v 20000" failed when the 1MB gap was
|
||
|
counted for RLIMIT_AS; similar problems could come with RLIMIT_MLOCK
|
||
|
and strict non-overcommit mode.
|
||
|
|
||
|
Instead of keeping gap inside the stack vma, maintain the stack guard
|
||
|
gap as a gap between vmas: using vm_start_gap() in place of vm_start
|
||
|
(or vm_end_gap() in place of vm_end if VM_GROWSUP) in just those few
|
||
|
places which need to respect the gap - mainly arch_get_unmapped_area(),
|
||
|
and and the vma tree's subtree_gap support for that.
|
||
|
|
||
|
Change-Id: I611023b0bfe1cab7b3e5da13e331a7baaaaf6eb0
|
||
|
Original-patch-by: Oleg Nesterov <oleg@redhat.com>
|
||
|
Original-patch-by: Michal Hocko <mhocko@suse.com>
|
||
|
Signed-off-by: Hugh Dickins <hughd@google.com>
|
||
|
[wt: backport to 4.11: adjust context]
|
||
|
[wt: backport to 4.9: adjust context ; kernel doc was not in admin-guide]
|
||
|
[wt: backport to 4.4: adjust context ; drop ppc hugetlb_radix changes]
|
||
|
[wt: backport to 3.18: adjust context ; no FOLL_POPULATE ;
|
||
|
s390 uses generic arch_get_unmapped_area()]
|
||
|
[wt: backport to 3.16: adjust context]
|
||
|
[wt: backport to 3.10: adjust context ; code logic in PARISC's
|
||
|
arch_get_unmapped_area() wasn't found ; code inserted into
|
||
|
expand_upwards() and expand_downwards() runs under anon_vma lock;
|
||
|
changes for gup.c:faultin_page go to memory.c:__get_user_pages();
|
||
|
included Hugh Dickins' fixes]
|
||
|
Signed-off-by: Willy Tarreau <w@1wt.eu>
|
||
|
Signed-off-by: Flex1911 <dedsa2002@gmail.com>
|
||
|
---
|
||
|
|
||
|
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
|
||
|
index 9a1c759..53be2c9 100644
|
||
|
--- a/Documentation/kernel-parameters.txt
|
||
|
+++ b/Documentation/kernel-parameters.txt
|
||
|
@@ -2550,6 +2550,13 @@
|
||
|
spia_pedr=
|
||
|
spia_peddr=
|
||
|
|
||
|
+ stack_guard_gap= [MM]
|
||
|
+ override the default stack gap protection. The value
|
||
|
+ is in page units and it defines how many pages prior
|
||
|
+ to (for stacks growing down) resp. after (for stacks
|
||
|
+ growing up) the main stack are reserved for no other
|
||
|
+ mapping. Default value is 256 pages.
|
||
|
+
|
||
|
stacktrace [FTRACE]
|
||
|
Enabled the stack tracer on boot up.
|
||
|
|
||
|
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
|
||
|
index a26960a..f058ca2 100644
|
||
|
--- a/arch/arm/mm/mmap.c
|
||
|
+++ b/arch/arm/mm/mmap.c
|
||
|
@@ -101,7 +101,7 @@
|
||
|
|
||
|
vma = find_vma(mm, addr);
|
||
|
if (TASK_SIZE - len >= addr &&
|
||
|
- (!vma || addr + len <= vma->vm_start))
|
||
|
+ (!vma || addr + len <= vm_start_gap(vma)))
|
||
|
return addr;
|
||
|
}
|
||
|
if (len > mm->cached_hole_size) {
|
||
|
@@ -183,7 +183,7 @@
|
||
|
addr = PAGE_ALIGN(addr);
|
||
|
vma = find_vma(mm, addr);
|
||
|
if (TASK_SIZE - len >= addr &&
|
||
|
- (!vma || addr + len <= vma->vm_start))
|
||
|
+ (!vma || addr + len <= vm_start_gap(vma)))
|
||
|
return addr;
|
||
|
}
|
||
|
|
||
|
diff --git a/arch/frv/mm/elf-fdpic.c b/arch/frv/mm/elf-fdpic.c
|
||
|
index 385fd30..cd76056 100644
|
||
|
--- a/arch/frv/mm/elf-fdpic.c
|
||
|
+++ b/arch/frv/mm/elf-fdpic.c
|
||
|
@@ -74,7 +74,7 @@
|
||
|
addr = PAGE_ALIGN(addr);
|
||
|
vma = find_vma(current->mm, addr);
|
||
|
if (TASK_SIZE - len >= addr &&
|
||
|
- (!vma || addr + len <= vma->vm_start))
|
||
|
+ (!vma || addr + len <= vm_start_gap(vma)))
|
||
|
goto success;
|
||
|
}
|
||
|
|
||
|
diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
|
||
|
index 302d779..63c07bd 100644
|
||
|
--- a/arch/mips/mm/mmap.c
|
||
|
+++ b/arch/mips/mm/mmap.c
|
||
|
@@ -103,7 +103,7 @@
|
||
|
|
||
|
vma = find_vma(mm, addr);
|
||
|
if (TASK_SIZE - len >= addr &&
|
||
|
- (!vma || addr + len <= vma->vm_start))
|
||
|
+ (!vma || addr + len <= vm_start_gap(vma)))
|
||
|
return addr;
|
||
|
}
|
||
|
|
||
|
diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
|
||
|
index 73709f7..9cf001f 100644
|
||
|
--- a/arch/powerpc/mm/slice.c
|
||
|
+++ b/arch/powerpc/mm/slice.c
|
||
|
@@ -98,7 +98,7 @@
|
||
|
if ((mm->task_size - len) < addr)
|
||
|
return 0;
|
||
|
vma = find_vma(mm, addr);
|
||
|
- return (!vma || (addr + len) <= vma->vm_start);
|
||
|
+ return (!vma || (addr + len) <= vm_start_gap(vma));
|
||
|
}
|
||
|
|
||
|
static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
|
||
|
diff --git a/arch/sh/mm/mmap.c b/arch/sh/mm/mmap.c
|
||
|
index afeb710..d027416 100644
|
||
|
--- a/arch/sh/mm/mmap.c
|
||
|
+++ b/arch/sh/mm/mmap.c
|
||
|
@@ -75,7 +75,7 @@
|
||
|
|
||
|
vma = find_vma(mm, addr);
|
||
|
if (TASK_SIZE - len >= addr &&
|
||
|
- (!vma || addr + len <= vma->vm_start))
|
||
|
+ (!vma || addr + len <= vm_start_gap(vma)))
|
||
|
return addr;
|
||
|
}
|
||
|
|
||
|
@@ -158,7 +158,7 @@
|
||
|
|
||
|
vma = find_vma(mm, addr);
|
||
|
if (TASK_SIZE - len >= addr &&
|
||
|
- (!vma || addr + len <= vma->vm_start))
|
||
|
+ (!vma || addr + len <= vm_start_gap(vma)))
|
||
|
return addr;
|
||
|
}
|
||
|
|
||
|
diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
|
||
|
index 3ee51f1..10a83ac 100644
|
||
|
--- a/arch/sparc/kernel/sys_sparc_64.c
|
||
|
+++ b/arch/sparc/kernel/sys_sparc_64.c
|
||
|
@@ -147,7 +147,7 @@
|
||
|
|
||
|
vma = find_vma(mm, addr);
|
||
|
if (task_size - len >= addr &&
|
||
|
- (!vma || addr + len <= vma->vm_start))
|
||
|
+ (!vma || addr + len <= vm_start_gap(vma)))
|
||
|
return addr;
|
||
|
}
|
||
|
|
||
|
@@ -237,7 +237,7 @@
|
||
|
|
||
|
vma = find_vma(mm, addr);
|
||
|
if (task_size - len >= addr &&
|
||
|
- (!vma || addr + len <= vma->vm_start))
|
||
|
+ (!vma || addr + len <= vm_start_gap(vma)))
|
||
|
return addr;
|
||
|
}
|
||
|
|
||
|
diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
|
||
|
index 07e1453..9f07641 100644
|
||
|
--- a/arch/sparc/mm/hugetlbpage.c
|
||
|
+++ b/arch/sparc/mm/hugetlbpage.c
|
||
|
@@ -182,7 +182,7 @@
|
||
|
addr = ALIGN(addr, HPAGE_SIZE);
|
||
|
vma = find_vma(mm, addr);
|
||
|
if (task_size - len >= addr &&
|
||
|
- (!vma || addr + len <= vma->vm_start))
|
||
|
+ (!vma || addr + len <= vm_start_gap(vma)))
|
||
|
return addr;
|
||
|
}
|
||
|
if (mm->get_unmapped_area == arch_get_unmapped_area)
|
||
|
diff --git a/arch/tile/mm/hugetlbpage.c b/arch/tile/mm/hugetlbpage.c
|
||
|
index 42cfcba..d659736 100644
|
||
|
--- a/arch/tile/mm/hugetlbpage.c
|
||
|
+++ b/arch/tile/mm/hugetlbpage.c
|
||
|
@@ -312,7 +312,7 @@
|
||
|
addr = ALIGN(addr, huge_page_size(h));
|
||
|
vma = find_vma(mm, addr);
|
||
|
if (TASK_SIZE - len >= addr &&
|
||
|
- (!vma || addr + len <= vma->vm_start))
|
||
|
+ (!vma || addr + len <= vm_start_gap(vma)))
|
||
|
return addr;
|
||
|
}
|
||
|
if (current->mm->get_unmapped_area == arch_get_unmapped_area)
|
||
|
diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
|
||
|
index b4d3c39..996378b 100644
|
||
|
--- a/arch/x86/kernel/sys_x86_64.c
|
||
|
+++ b/arch/x86/kernel/sys_x86_64.c
|
||
|
@@ -141,7 +141,7 @@
|
||
|
addr = PAGE_ALIGN(addr);
|
||
|
vma = find_vma(mm, addr);
|
||
|
if (end - len >= addr &&
|
||
|
- (!vma || addr + len <= vma->vm_start))
|
||
|
+ (!vma || addr + len <= vm_start_gap(vma)))
|
||
|
return addr;
|
||
|
}
|
||
|
if (((flags & MAP_32BIT) || test_thread_flag(TIF_ADDR32))
|
||
|
@@ -213,7 +213,7 @@
|
||
|
addr = PAGE_ALIGN(addr);
|
||
|
vma = find_vma(mm, addr);
|
||
|
if (TASK_SIZE - len >= addr &&
|
||
|
- (!vma || addr + len <= vma->vm_start))
|
||
|
+ (!vma || addr + len <= vm_start_gap(vma)))
|
||
|
return addr;
|
||
|
}
|
||
|
|
||
|
diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
|
||
|
index f6679a7..dbc90e6 100644
|
||
|
--- a/arch/x86/mm/hugetlbpage.c
|
||
|
+++ b/arch/x86/mm/hugetlbpage.c
|
||
|
@@ -411,7 +411,7 @@
|
||
|
addr = ALIGN(addr, huge_page_size(h));
|
||
|
vma = find_vma(mm, addr);
|
||
|
if (TASK_SIZE - len >= addr &&
|
||
|
- (!vma || addr + len <= vma->vm_start))
|
||
|
+ (!vma || addr + len <= vm_start_gap(vma)))
|
||
|
return addr;
|
||
|
}
|
||
|
if (mm->get_unmapped_area == arch_get_unmapped_area)
|
||
|
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
|
||
|
index 001ef01..628b324 100644
|
||
|
--- a/fs/hugetlbfs/inode.c
|
||
|
+++ b/fs/hugetlbfs/inode.c
|
||
|
@@ -169,7 +169,7 @@
|
||
|
addr = ALIGN(addr, huge_page_size(h));
|
||
|
vma = find_vma(mm, addr);
|
||
|
if (TASK_SIZE - len >= addr &&
|
||
|
- (!vma || addr + len <= vma->vm_start))
|
||
|
+ (!vma || addr + len <= vm_start_gap(vma)))
|
||
|
return addr;
|
||
|
}
|
||
|
|
||
|
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
|
||
|
index ef5c7e2..6234004 100644
|
||
|
--- a/fs/proc/task_mmu.c
|
||
|
+++ b/fs/proc/task_mmu.c
|
||
|
@@ -283,11 +283,7 @@
|
||
|
|
||
|
/* We don't show the stack guard page in /proc/maps */
|
||
|
start = vma->vm_start;
|
||
|
- if (stack_guard_page_start(vma, start))
|
||
|
- start += PAGE_SIZE;
|
||
|
end = vma->vm_end;
|
||
|
- if (stack_guard_page_end(vma, end))
|
||
|
- end -= PAGE_SIZE;
|
||
|
|
||
|
seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
|
||
|
start,
|
||
|
diff --git a/include/linux/mm.h b/include/linux/mm.h
|
||
|
index ce57fd0..e597775 100644
|
||
|
--- a/include/linux/mm.h
|
||
|
+++ b/include/linux/mm.h
|
||
|
@@ -1030,34 +1030,6 @@
|
||
|
int set_page_dirty_lock(struct page *page);
|
||
|
int clear_page_dirty_for_io(struct page *page);
|
||
|
|
||
|
-/* Is the vma a continuation of the stack vma above it? */
|
||
|
-static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
|
||
|
-{
|
||
|
- return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
|
||
|
-}
|
||
|
-
|
||
|
-static inline int stack_guard_page_start(struct vm_area_struct *vma,
|
||
|
- unsigned long addr)
|
||
|
-{
|
||
|
- return (vma->vm_flags & VM_GROWSDOWN) &&
|
||
|
- (vma->vm_start == addr) &&
|
||
|
- !vma_growsdown(vma->vm_prev, addr);
|
||
|
-}
|
||
|
-
|
||
|
-/* Is the vma a continuation of the stack vma below it? */
|
||
|
-static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
|
||
|
-{
|
||
|
- return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
|
||
|
-}
|
||
|
-
|
||
|
-static inline int stack_guard_page_end(struct vm_area_struct *vma,
|
||
|
- unsigned long addr)
|
||
|
-{
|
||
|
- return (vma->vm_flags & VM_GROWSUP) &&
|
||
|
- (vma->vm_end == addr) &&
|
||
|
- !vma_growsup(vma->vm_next, addr);
|
||
|
-}
|
||
|
-
|
||
|
extern pid_t
|
||
|
vm_is_stack(struct task_struct *task, struct vm_area_struct *vma, int in_group);
|
||
|
|
||
|
@@ -1467,6 +1439,7 @@
|
||
|
struct address_space *mapping,
|
||
|
struct file *filp);
|
||
|
|
||
|
+extern unsigned long stack_guard_gap;
|
||
|
/* Generic expand stack which grows the stack according to GROWS{UP,DOWN} */
|
||
|
extern int expand_stack(struct vm_area_struct *vma, unsigned long address);
|
||
|
|
||
|
@@ -1495,6 +1468,30 @@
|
||
|
return vma;
|
||
|
}
|
||
|
|
||
|
+static inline unsigned long vm_start_gap(struct vm_area_struct *vma)
|
||
|
+{
|
||
|
+ unsigned long vm_start = vma->vm_start;
|
||
|
+
|
||
|
+ if (vma->vm_flags & VM_GROWSDOWN) {
|
||
|
+ vm_start -= stack_guard_gap;
|
||
|
+ if (vm_start > vma->vm_start)
|
||
|
+ vm_start = 0;
|
||
|
+ }
|
||
|
+ return vm_start;
|
||
|
+}
|
||
|
+
|
||
|
+static inline unsigned long vm_end_gap(struct vm_area_struct *vma)
|
||
|
+{
|
||
|
+ unsigned long vm_end = vma->vm_end;
|
||
|
+
|
||
|
+ if (vma->vm_flags & VM_GROWSUP) {
|
||
|
+ vm_end += stack_guard_gap;
|
||
|
+ if (vm_end < vma->vm_end)
|
||
|
+ vm_end = -PAGE_SIZE;
|
||
|
+ }
|
||
|
+ return vm_end;
|
||
|
+}
|
||
|
+
|
||
|
static inline unsigned long vma_pages(struct vm_area_struct *vma)
|
||
|
{
|
||
|
return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
|
||
|
diff --git a/mm/memory.c b/mm/memory.c
|
||
|
index 60a7dfc..e722760 100644
|
||
|
--- a/mm/memory.c
|
||
|
+++ b/mm/memory.c
|
||
|
@@ -1619,12 +1619,6 @@
|
||
|
return page;
|
||
|
}
|
||
|
|
||
|
-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
|
||
|
-{
|
||
|
- return stack_guard_page_start(vma, addr) ||
|
||
|
- stack_guard_page_end(vma, addr+PAGE_SIZE);
|
||
|
-}
|
||
|
-
|
||
|
/**
|
||
|
* __get_user_pages() - pin user pages in memory
|
||
|
* @tsk: task_struct of target task
|
||
|
@@ -1775,11 +1769,6 @@
|
||
|
int ret;
|
||
|
unsigned int fault_flags = 0;
|
||
|
|
||
|
- /* For mlock, just skip the stack guard page. */
|
||
|
- if (foll_flags & FOLL_MLOCK) {
|
||
|
- if (stack_guard_page(vma, start))
|
||
|
- goto next_page;
|
||
|
- }
|
||
|
if (foll_flags & FOLL_WRITE)
|
||
|
fault_flags |= FAULT_FLAG_WRITE;
|
||
|
if (nonblocking)
|
||
|
@@ -3087,40 +3076,6 @@
|
||
|
}
|
||
|
|
||
|
/*
|
||
|
- * This is like a special single-page "expand_{down|up}wards()",
|
||
|
- * except we must first make sure that 'address{-|+}PAGE_SIZE'
|
||
|
- * doesn't hit another vma.
|
||
|
- */
|
||
|
-static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
|
||
|
-{
|
||
|
- address &= PAGE_MASK;
|
||
|
- if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
|
||
|
- struct vm_area_struct *prev = vma->vm_prev;
|
||
|
-
|
||
|
- /*
|
||
|
- * Is there a mapping abutting this one below?
|
||
|
- *
|
||
|
- * That's only ok if it's the same stack mapping
|
||
|
- * that has gotten split..
|
||
|
- */
|
||
|
- if (prev && prev->vm_end == address)
|
||
|
- return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
|
||
|
-
|
||
|
- expand_downwards(vma, address - PAGE_SIZE);
|
||
|
- }
|
||
|
- if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
|
||
|
- struct vm_area_struct *next = vma->vm_next;
|
||
|
-
|
||
|
- /* As VM_GROWSDOWN but s/below/above/ */
|
||
|
- if (next && next->vm_start == address + PAGE_SIZE)
|
||
|
- return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
|
||
|
-
|
||
|
- expand_upwards(vma, address + PAGE_SIZE);
|
||
|
- }
|
||
|
- return 0;
|
||
|
-}
|
||
|
-
|
||
|
-/*
|
||
|
* We enter with non-exclusive mmap_sem (to exclude vma changes,
|
||
|
* but allow concurrent faults), and pte mapped but not yet locked.
|
||
|
* We return with mmap_sem still held, but pte unmapped and unlocked.
|
||
|
@@ -3137,10 +3092,6 @@
|
||
|
|
||
|
/* File mapping without ->vm_ops ? */
|
||
|
if (vma->vm_flags & VM_SHARED)
|
||
|
- return VM_FAULT_SIGBUS;
|
||
|
-
|
||
|
- /* Check if we need to add a guard page to the stack */
|
||
|
- if (check_stack_guard_page(vma, address) < 0)
|
||
|
return VM_FAULT_SIGBUS;
|
||
|
|
||
|
/* Use the zero-page for reads */
|
||
|
diff --git a/mm/mmap.c b/mm/mmap.c
|
||
|
index e495a84..b94a982 100644
|
||
|
--- a/mm/mmap.c
|
||
|
+++ b/mm/mmap.c
|
||
|
@@ -259,6 +259,7 @@
|
||
|
unsigned long rlim, retval;
|
||
|
unsigned long newbrk, oldbrk;
|
||
|
struct mm_struct *mm = current->mm;
|
||
|
+ struct vm_area_struct *next;
|
||
|
unsigned long min_brk;
|
||
|
|
||
|
down_write(&mm->mmap_sem);
|
||
|
@@ -303,7 +304,8 @@
|
||
|
}
|
||
|
|
||
|
/* Check against existing mmap mappings. */
|
||
|
- if (find_vma_intersection(mm, oldbrk, newbrk+PAGE_SIZE))
|
||
|
+ next = find_vma(mm, oldbrk);
|
||
|
+ if (next && newbrk + PAGE_SIZE > vm_start_gap(next))
|
||
|
goto out;
|
||
|
|
||
|
/* Ok, looks good - let it rip. */
|
||
|
@@ -1426,8 +1428,8 @@
|
||
|
unsigned long len, unsigned long pgoff, unsigned long flags)
|
||
|
{
|
||
|
struct mm_struct *mm = current->mm;
|
||
|
- struct vm_area_struct *vma;
|
||
|
- unsigned long start_addr;
|
||
|
+ struct vm_area_struct *vma, *prev;
|
||
|
+ unsigned long start_addr, vm_start, prev_end;
|
||
|
|
||
|
if (len > TASK_SIZE)
|
||
|
return -ENOMEM;
|
||
|
@@ -1437,9 +1439,10 @@
|
||
|
|
||
|
if (addr) {
|
||
|
addr = PAGE_ALIGN(addr);
|
||
|
- vma = find_vma(mm, addr);
|
||
|
+ vma = find_vma_prev(mm, addr, &prev);
|
||
|
if (TASK_SIZE - len >= addr &&
|
||
|
- (!vma || addr + len <= vma->vm_start))
|
||
|
+ (!vma || addr + len <= vm_start_gap(vma)) &&
|
||
|
+ (!prev || addr >= vm_end_gap(prev)))
|
||
|
return addr;
|
||
|
}
|
||
|
if (len > mm->cached_hole_size) {
|
||
|
@@ -1450,7 +1453,17 @@
|
||
|
}
|
||
|
|
||
|
full_search:
|
||
|
- for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
|
||
|
+ for (vma = find_vma_prev(mm, addr, &prev); ; prev = vma,
|
||
|
+ vma = vma->vm_next) {
|
||
|
+ if (prev) {
|
||
|
+ prev_end = vm_end_gap(prev);
|
||
|
+ if (addr < prev_end) {
|
||
|
+ addr = prev_end;
|
||
|
+ /* If vma already violates gap, forget it */
|
||
|
+ if (vma && addr > vma->vm_start)
|
||
|
+ addr = vma->vm_start;
|
||
|
+ }
|
||
|
+ }
|
||
|
/* At this point: (!vma || addr < vma->vm_end). */
|
||
|
if (TASK_SIZE - len < addr) {
|
||
|
/*
|
||
|
@@ -1465,16 +1478,16 @@
|
||
|
}
|
||
|
return -ENOMEM;
|
||
|
}
|
||
|
- if (!vma || addr + len <= vma->vm_start) {
|
||
|
+ vm_start = vma ? vm_start_gap(vma) : TASK_SIZE;
|
||
|
+ if (addr + len <= vm_start) {
|
||
|
/*
|
||
|
* Remember the place where we stopped the search:
|
||
|
*/
|
||
|
mm->free_area_cache = addr + len;
|
||
|
return addr;
|
||
|
}
|
||
|
- if (addr + mm->cached_hole_size < vma->vm_start)
|
||
|
- mm->cached_hole_size = vma->vm_start - addr;
|
||
|
- addr = vma->vm_end;
|
||
|
+ if (addr + mm->cached_hole_size < vm_start)
|
||
|
+ mm->cached_hole_size = vm_start - addr;
|
||
|
}
|
||
|
}
|
||
|
#endif
|
||
|
@@ -1498,9 +1511,10 @@
|
||
|
const unsigned long len, const unsigned long pgoff,
|
||
|
const unsigned long flags)
|
||
|
{
|
||
|
- struct vm_area_struct *vma;
|
||
|
+ struct vm_area_struct *vma, *prev;
|
||
|
struct mm_struct *mm = current->mm;
|
||
|
unsigned long addr = addr0, start_addr;
|
||
|
+ unsigned long vm_start, prev_end;
|
||
|
|
||
|
/* requested length too big for entire address space */
|
||
|
if (len > TASK_SIZE)
|
||
|
@@ -1512,9 +1526,10 @@
|
||
|
/* requesting a specific address */
|
||
|
if (addr) {
|
||
|
addr = PAGE_ALIGN(addr);
|
||
|
- vma = find_vma(mm, addr);
|
||
|
+ vma = find_vma_prev(mm, addr, &prev);
|
||
|
if (TASK_SIZE - len >= addr &&
|
||
|
- (!vma || addr + len <= vma->vm_start))
|
||
|
+ (!vma || addr + len <= vm_start_gap(vma)) &&
|
||
|
+ (!prev || addr >= vm_end_gap(prev)))
|
||
|
return addr;
|
||
|
}
|
||
|
|
||
|
@@ -1538,18 +1553,21 @@
|
||
|
* else if new region fits below vma->vm_start,
|
||
|
* return with success:
|
||
|
*/
|
||
|
- vma = find_vma(mm, addr);
|
||
|
- if (!vma || addr+len <= vma->vm_start)
|
||
|
+ vma = find_vma_prev(mm, addr, &prev);
|
||
|
+ vm_start = vma ? vm_start_gap(vma) : mm->mmap_base;
|
||
|
+ prev_end = vm_end_gap(prev);
|
||
|
+
|
||
|
+ if (addr + len <= vm_start && addr >= prev_end)
|
||
|
/* remember the address as a hint for next time */
|
||
|
return (mm->free_area_cache = addr);
|
||
|
|
||
|
/* remember the largest hole we saw so far */
|
||
|
- if (addr + mm->cached_hole_size < vma->vm_start)
|
||
|
- mm->cached_hole_size = vma->vm_start - addr;
|
||
|
-
|
||
|
+ if (addr + mm->cached_hole_size < vm_start)
|
||
|
+ mm->cached_hole_size = vm_start - addr;
|
||
|
+
|
||
|
/* try just below the current vma->vm_start */
|
||
|
- addr = vma->vm_start-len;
|
||
|
- } while (len < vma->vm_start);
|
||
|
+ addr = vm_start - len;
|
||
|
+ } while (len < vm_start);
|
||
|
|
||
|
fail:
|
||
|
/*
|
||
|
@@ -1749,7 +1767,9 @@
|
||
|
*/
|
||
|
int expand_upwards(struct vm_area_struct *vma, unsigned long address)
|
||
|
{
|
||
|
- int error;
|
||
|
+ struct vm_area_struct *next;
|
||
|
+ unsigned long gap_addr;
|
||
|
+ int error = 0;
|
||
|
|
||
|
if (!(vma->vm_flags & VM_GROWSUP))
|
||
|
return -EFAULT;
|
||
|
@@ -1758,23 +1778,33 @@
|
||
|
* We must make sure the anon_vma is allocated
|
||
|
* so that the anon_vma locking is not a noop.
|
||
|
*/
|
||
|
+ /* Guard against wrapping around to address 0. */
|
||
|
+ address &= PAGE_MASK;
|
||
|
+ address += PAGE_SIZE;
|
||
|
+ if (!address)
|
||
|
+ return -ENOMEM;
|
||
|
+
|
||
|
+ /* Enforce stack_guard_gap */
|
||
|
+ gap_addr = address + stack_guard_gap;
|
||
|
+ if (gap_addr < address)
|
||
|
+ return -ENOMEM;
|
||
|
+ next = vma->vm_next;
|
||
|
+ if (next && next->vm_start < gap_addr) {
|
||
|
+ if (!(next->vm_flags & VM_GROWSUP))
|
||
|
+ return -ENOMEM;
|
||
|
+ /* Check that both stack segments have the same anon_vma? */
|
||
|
+ }
|
||
|
+
|
||
|
+ /* We must make sure the anon_vma is allocated. */
|
||
|
if (unlikely(anon_vma_prepare(vma)))
|
||
|
return -ENOMEM;
|
||
|
- vma_lock_anon_vma(vma);
|
||
|
|
||
|
/*
|
||
|
* vma->vm_start/vm_end cannot change under us because the caller
|
||
|
* is required to hold the mmap_sem in read mode. We need the
|
||
|
* anon_vma lock to serialize against concurrent expand_stacks.
|
||
|
- * Also guard against wrapping around to address 0.
|
||
|
*/
|
||
|
- if (address < PAGE_ALIGN(address+4))
|
||
|
- address = PAGE_ALIGN(address+4);
|
||
|
- else {
|
||
|
- vma_unlock_anon_vma(vma);
|
||
|
- return -ENOMEM;
|
||
|
- }
|
||
|
- error = 0;
|
||
|
+ vma_lock_anon_vma(vma);
|
||
|
|
||
|
/* Somebody else might have raced and expanded it already */
|
||
|
if (address > vma->vm_end) {
|
||
|
@@ -1804,27 +1834,36 @@
|
||
|
int expand_downwards(struct vm_area_struct *vma,
|
||
|
unsigned long address)
|
||
|
{
|
||
|
+ struct vm_area_struct *prev;
|
||
|
+ unsigned long gap_addr;
|
||
|
int error;
|
||
|
-
|
||
|
- /*
|
||
|
- * We must make sure the anon_vma is allocated
|
||
|
- * so that the anon_vma locking is not a noop.
|
||
|
- */
|
||
|
- if (unlikely(anon_vma_prepare(vma)))
|
||
|
- return -ENOMEM;
|
||
|
|
||
|
address &= PAGE_MASK;
|
||
|
error = security_file_mmap(NULL, 0, 0, 0, address, 1);
|
||
|
if (error)
|
||
|
return error;
|
||
|
|
||
|
- vma_lock_anon_vma(vma);
|
||
|
+ /* Enforce stack_guard_gap */
|
||
|
+ gap_addr = address - stack_guard_gap;
|
||
|
+ if (gap_addr > address)
|
||
|
+ return -ENOMEM;
|
||
|
+ prev = vma->vm_prev;
|
||
|
+ if (prev && prev->vm_end > gap_addr) {
|
||
|
+ if (!(prev->vm_flags & VM_GROWSDOWN))
|
||
|
+ return -ENOMEM;
|
||
|
+ /* Check that both stack segments have the same anon_vma? */
|
||
|
+ }
|
||
|
+
|
||
|
+ /* We must make sure the anon_vma is allocated. */
|
||
|
+ if (unlikely(anon_vma_prepare(vma)))
|
||
|
+ return -ENOMEM;
|
||
|
|
||
|
/*
|
||
|
* vma->vm_start/vm_end cannot change under us because the caller
|
||
|
* is required to hold the mmap_sem in read mode. We need the
|
||
|
* anon_vma lock to serialize against concurrent expand_stacks.
|
||
|
*/
|
||
|
+ vma_lock_anon_vma(vma);
|
||
|
|
||
|
/* Somebody else might have raced and expanded it already */
|
||
|
if (address < vma->vm_start) {
|
||
|
@@ -1848,6 +1887,23 @@
|
||
|
return error;
|
||
|
}
|
||
|
|
||
|
+/* enforced gap between the expanding stack and other mappings. */
|
||
|
+unsigned long stack_guard_gap = 256UL<<PAGE_SHIFT;
|
||
|
+
|
||
|
+static int __init cmdline_parse_stack_guard_gap(char *p)
|
||
|
+{
|
||
|
+ unsigned long val;
|
||
|
+ char *endptr;
|
||
|
+
|
||
|
+ val = simple_strtoul(p, &endptr, 10);
|
||
|
+ if (!*endptr)
|
||
|
+ stack_guard_gap = val << PAGE_SHIFT;
|
||
|
+
|
||
|
+ return 0;
|
||
|
+}
|
||
|
+__setup("stack_guard_gap=", cmdline_parse_stack_guard_gap);
|
||
|
+
|
||
|
+
|
||
|
#ifdef CONFIG_STACK_GROWSUP
|
||
|
int expand_stack(struct vm_area_struct *vma, unsigned long address)
|
||
|
{
|