Commit 641fbf59 authored by Linus Torvalds's avatar Linus Torvalds Committed by Ben Hutchings

mm: do not grow the stack vma just because of an overrun on preceding vma

commit 09884964 upstream.

The stack vma is designed to grow automatically (marked with VM_GROWSUP
or VM_GROWSDOWN depending on architecture) when an access is made beyond
the existing boundary.  However, particularly if you have not limited
your stack at all ("ulimit -s unlimited"), this can cause the stack to
grow even if the access was really just one past *another* segment.

And that's wrong, especially since we first grow the segment, but then
immediately later enforce the stack guard page on the last page of the
segment.  So _despite_ first growing the stack segment as a result of
the access, the kernel will then make the access cause a SIGSEGV anyway!

So do the same logic as the guard page check does, and consider an
access to within one page of the next segment to be a bad access, rather
than growing the stack to abut the next segment.
Reported-and-tested-by: default avatarHeiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
parent 8ff47baf
...@@ -1802,9 +1802,28 @@ int expand_downwards(struct vm_area_struct *vma, ...@@ -1802,9 +1802,28 @@ int expand_downwards(struct vm_area_struct *vma,
return error; return error;
} }
/*
* Note how expand_stack() refuses to expand the stack all the way to
* abut the next virtual mapping, *unless* that mapping itself is also
* a stack mapping. We want to leave room for a guard page, after all
* (the guard page itself is not added here, that is done by the
* actual page faulting logic)
*
* This matches the behavior of the guard page logic (see mm/memory.c:
* check_stack_guard_page()), which only allows the guard page to be
* removed under these circumstances.
*/
#ifdef CONFIG_STACK_GROWSUP #ifdef CONFIG_STACK_GROWSUP
int expand_stack(struct vm_area_struct *vma, unsigned long address) int expand_stack(struct vm_area_struct *vma, unsigned long address)
{ {
struct vm_area_struct *next;
address &= PAGE_MASK;
next = vma->vm_next;
if (next && next->vm_start == address + PAGE_SIZE) {
if (!(next->vm_flags & VM_GROWSUP))
return -ENOMEM;
}
return expand_upwards(vma, address); return expand_upwards(vma, address);
} }
...@@ -1827,6 +1846,14 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr) ...@@ -1827,6 +1846,14 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr)
#else #else
int expand_stack(struct vm_area_struct *vma, unsigned long address) int expand_stack(struct vm_area_struct *vma, unsigned long address)
{ {
struct vm_area_struct *prev;
address &= PAGE_MASK;
prev = vma->vm_prev;
if (prev && prev->vm_end == address) {
if (!(prev->vm_flags & VM_GROWSDOWN))
return -ENOMEM;
}
return expand_downwards(vma, address); return expand_downwards(vma, address);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment