Commit d4712eb7 authored by Hugh Dickins's avatar Hugh Dickins Committed by Greg Kroah-Hartman

mm: larger stack guard gap, between vmas

commit 1be7107f upstream.

Stack guard page is a useful feature to reduce a risk of stack smashing
into a different mapping. We have been using a single page gap which
is sufficient to prevent having stack adjacent to a different mapping.
But this seems to be insufficient in the light of the stack usage in
userspace. E.g. glibc uses as large as 64kB alloca() in many commonly
used functions. Others use constructs liks gid_t buffer[NGROUPS_MAX]
which is 256kB or stack strings with MAX_ARG_STRLEN.

This will become especially dangerous for suid binaries and the default
no limit for the stack size limit because those applications can be
tricked to consume a large portion of the stack and a single glibc call
could jump over the guard page. These attacks are not theoretical,
unfortunatelly.

Make those attacks less probable by increasing the stack guard gap
to 1MB (on systems with 4k pages; but make it depend on the page size
because systems with larger base pages might cap stack allocations in
the PAGE_SIZE units) which should cover larger alloca() and VLA stack
allocations. It is obviously not a full fix because the problem is
somehow inherent, but it should reduce attack space a lot.

One could argue that the gap size should be configurable from userspace,
but that can be done later when somebody finds that the new 1MB is wrong
for some special case applications.  For now, add a kernel command line
option (stack_guard_gap) to specify the stack gap size (in page units).

Implementation wise, first delete all the old code for stack guard page:
because although we could get away with accounting one extra page in a
stack vma, accounting a larger gap can break userspace - case in point,
a program run with "ulimit -S -v 20000" failed when the 1MB gap was
counted for RLIMIT_AS; similar problems could come with RLIMIT_MLOCK
and strict non-overcommit mode.

Instead of keeping gap inside the stack vma, maintain the stack guard
gap as a gap between vmas: using vm_start_gap() in place of vm_start
(or vm_end_gap() in place of vm_end if VM_GROWSUP) in just those few
places which need to respect the gap - mainly arch_get_unmapped_area(),
and and the vma tree's subtree_gap support for that.
Original-patch-by: default avatarOleg Nesterov <oleg@redhat.com>
Original-patch-by: default avatarMichal Hocko <mhocko@suse.com>
Signed-off-by: default avatarHugh Dickins <hughd@google.com>
Acked-by: default avatarMichal Hocko <mhocko@suse.com>
Tested-by: Helge Deller <deller@gmx.de> # parisc
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
[wt: backport to 4.11: adjust context]
[wt: backport to 4.9: adjust context ; kernel doc was not in admin-guide]
[wt: backport to 4.4: adjust context ; drop ppc hugetlb_radix changes]
[wt: backport to 3.18: adjust context ; no FOLL_POPULATE ;
     s390 uses generic arch_get_unmapped_area()]
Signed-off-by: default avatarWilly Tarreau <w@1wt.eu>
[gkh: minor build fixes for 3.18]
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 09d9a41e
...@@ -3324,6 +3324,13 @@ bytes respectively. Such letter suffixes can also be entirely omitted. ...@@ -3324,6 +3324,13 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
spia_pedr= spia_pedr=
spia_peddr= spia_peddr=
stack_guard_gap= [MM]
override the default stack gap protection. The value
is in page units and it defines how many pages prior
to (for stacks growing down) resp. after (for stacks
growing up) the main stack are reserved for no other
mapping. Default value is 256 pages.
stacktrace [FTRACE] stacktrace [FTRACE]
Enabled the stack tracer on boot up. Enabled the stack tracer on boot up.
......
...@@ -64,7 +64,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, ...@@ -64,7 +64,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
vma = find_vma(mm, addr); vma = find_vma(mm, addr);
if (TASK_SIZE - len >= addr && if (TASK_SIZE - len >= addr &&
(!vma || addr + len <= vma->vm_start)) (!vma || addr + len <= vm_start_gap(vma)))
return addr; return addr;
} }
......
...@@ -89,7 +89,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, ...@@ -89,7 +89,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
vma = find_vma(mm, addr); vma = find_vma(mm, addr);
if (TASK_SIZE - len >= addr && if (TASK_SIZE - len >= addr &&
(!vma || addr + len <= vma->vm_start)) (!vma || addr + len <= vm_start_gap(vma)))
return addr; return addr;
} }
...@@ -140,7 +140,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, ...@@ -140,7 +140,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
addr = PAGE_ALIGN(addr); addr = PAGE_ALIGN(addr);
vma = find_vma(mm, addr); vma = find_vma(mm, addr);
if (TASK_SIZE - len >= addr && if (TASK_SIZE - len >= addr &&
(!vma || addr + len <= vma->vm_start)) (!vma || addr + len <= vm_start_gap(vma)))
return addr; return addr;
} }
......
...@@ -74,7 +74,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi ...@@ -74,7 +74,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
addr = PAGE_ALIGN(addr); addr = PAGE_ALIGN(addr);
vma = find_vma(current->mm, addr); vma = find_vma(current->mm, addr);
if (TASK_SIZE - len >= addr && if (TASK_SIZE - len >= addr &&
(!vma || addr + len <= vma->vm_start)) (!vma || addr + len <= vm_start_gap(vma)))
goto success; goto success;
} }
......
...@@ -92,7 +92,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp, ...@@ -92,7 +92,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
vma = find_vma(mm, addr); vma = find_vma(mm, addr);
if (TASK_SIZE - len >= addr && if (TASK_SIZE - len >= addr &&
(!vma || addr + len <= vma->vm_start)) (!vma || addr + len <= vm_start_gap(vma)))
return addr; return addr;
} }
......
...@@ -88,7 +88,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, ...@@ -88,7 +88,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
unsigned long len, unsigned long pgoff, unsigned long flags) unsigned long len, unsigned long pgoff, unsigned long flags)
{ {
struct mm_struct *mm = current->mm; struct mm_struct *mm = current->mm;
struct vm_area_struct *vma; struct vm_area_struct *vma, *prev;
unsigned long task_size = TASK_SIZE; unsigned long task_size = TASK_SIZE;
int do_color_align, last_mmap; int do_color_align, last_mmap;
struct vm_unmapped_area_info info; struct vm_unmapped_area_info info;
...@@ -115,9 +115,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, ...@@ -115,9 +115,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
else else
addr = PAGE_ALIGN(addr); addr = PAGE_ALIGN(addr);
vma = find_vma(mm, addr); vma = find_vma_prev(mm, addr, &prev);
if (task_size - len >= addr && if (task_size - len >= addr &&
(!vma || addr + len <= vma->vm_start)) (!vma || addr + len <= vm_start_gap(vma)) &&
(!prev || addr >= vm_end_gap(prev)))
goto found_addr; goto found_addr;
} }
...@@ -141,7 +142,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, ...@@ -141,7 +142,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
const unsigned long len, const unsigned long pgoff, const unsigned long len, const unsigned long pgoff,
const unsigned long flags) const unsigned long flags)
{ {
struct vm_area_struct *vma; struct vm_area_struct *vma, *prev;
struct mm_struct *mm = current->mm; struct mm_struct *mm = current->mm;
unsigned long addr = addr0; unsigned long addr = addr0;
int do_color_align, last_mmap; int do_color_align, last_mmap;
...@@ -175,9 +176,11 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, ...@@ -175,9 +176,11 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
addr = COLOR_ALIGN(addr, last_mmap, pgoff); addr = COLOR_ALIGN(addr, last_mmap, pgoff);
else else
addr = PAGE_ALIGN(addr); addr = PAGE_ALIGN(addr);
vma = find_vma(mm, addr);
vma = find_vma_prev(mm, addr, &prev);
if (TASK_SIZE - len >= addr && if (TASK_SIZE - len >= addr &&
(!vma || addr + len <= vma->vm_start)) (!vma || addr + len <= vm_start_gap(vma)) &&
(!prev || addr >= vm_end_gap(prev)))
goto found_addr; goto found_addr;
} }
......
...@@ -105,7 +105,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr, ...@@ -105,7 +105,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr,
if ((mm->task_size - len) < addr) if ((mm->task_size - len) < addr)
return 0; return 0;
vma = find_vma(mm, addr); vma = find_vma(mm, addr);
return (!vma || (addr + len) <= vma->vm_start); return (!vma || (addr + len) <= vm_start_gap(vma));
} }
static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice) static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
......
...@@ -63,7 +63,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, ...@@ -63,7 +63,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
vma = find_vma(mm, addr); vma = find_vma(mm, addr);
if (TASK_SIZE - len >= addr && if (TASK_SIZE - len >= addr &&
(!vma || addr + len <= vma->vm_start)) (!vma || addr + len <= vm_start_gap(vma)))
return addr; return addr;
} }
...@@ -113,7 +113,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, ...@@ -113,7 +113,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
vma = find_vma(mm, addr); vma = find_vma(mm, addr);
if (TASK_SIZE - len >= addr && if (TASK_SIZE - len >= addr &&
(!vma || addr + len <= vma->vm_start)) (!vma || addr + len <= vm_start_gap(vma)))
return addr; return addr;
} }
......
...@@ -118,7 +118,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi ...@@ -118,7 +118,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
vma = find_vma(mm, addr); vma = find_vma(mm, addr);
if (task_size - len >= addr && if (task_size - len >= addr &&
(!vma || addr + len <= vma->vm_start)) (!vma || addr + len <= vm_start_gap(vma)))
return addr; return addr;
} }
...@@ -181,7 +181,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, ...@@ -181,7 +181,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
vma = find_vma(mm, addr); vma = find_vma(mm, addr);
if (task_size - len >= addr && if (task_size - len >= addr &&
(!vma || addr + len <= vma->vm_start)) (!vma || addr + len <= vm_start_gap(vma)))
return addr; return addr;
} }
......
...@@ -115,7 +115,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr, ...@@ -115,7 +115,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
addr = ALIGN(addr, HPAGE_SIZE); addr = ALIGN(addr, HPAGE_SIZE);
vma = find_vma(mm, addr); vma = find_vma(mm, addr);
if (task_size - len >= addr && if (task_size - len >= addr &&
(!vma || addr + len <= vma->vm_start)) (!vma || addr + len <= vm_start_gap(vma)))
return addr; return addr;
} }
if (mm->get_unmapped_area == arch_get_unmapped_area) if (mm->get_unmapped_area == arch_get_unmapped_area)
......
...@@ -237,7 +237,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, ...@@ -237,7 +237,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
addr = ALIGN(addr, huge_page_size(h)); addr = ALIGN(addr, huge_page_size(h));
vma = find_vma(mm, addr); vma = find_vma(mm, addr);
if (TASK_SIZE - len >= addr && if (TASK_SIZE - len >= addr &&
(!vma || addr + len <= vma->vm_start)) (!vma || addr + len <= vm_start_gap(vma)))
return addr; return addr;
} }
if (current->mm->get_unmapped_area == arch_get_unmapped_area) if (current->mm->get_unmapped_area == arch_get_unmapped_area)
......
...@@ -127,7 +127,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, ...@@ -127,7 +127,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
addr = PAGE_ALIGN(addr); addr = PAGE_ALIGN(addr);
vma = find_vma(mm, addr); vma = find_vma(mm, addr);
if (end - len >= addr && if (end - len >= addr &&
(!vma || addr + len <= vma->vm_start)) (!vma || addr + len <= vm_start_gap(vma)))
return addr; return addr;
} }
...@@ -166,7 +166,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, ...@@ -166,7 +166,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
addr = PAGE_ALIGN(addr); addr = PAGE_ALIGN(addr);
vma = find_vma(mm, addr); vma = find_vma(mm, addr);
if (TASK_SIZE - len >= addr && if (TASK_SIZE - len >= addr &&
(!vma || addr + len <= vma->vm_start)) (!vma || addr + len <= vm_start_gap(vma)))
return addr; return addr;
} }
......
...@@ -144,7 +144,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr, ...@@ -144,7 +144,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
addr = ALIGN(addr, huge_page_size(h)); addr = ALIGN(addr, huge_page_size(h));
vma = find_vma(mm, addr); vma = find_vma(mm, addr);
if (TASK_SIZE - len >= addr && if (TASK_SIZE - len >= addr &&
(!vma || addr + len <= vma->vm_start)) (!vma || addr + len <= vm_start_gap(vma)))
return addr; return addr;
} }
if (mm->get_unmapped_area == arch_get_unmapped_area) if (mm->get_unmapped_area == arch_get_unmapped_area)
......
...@@ -86,7 +86,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, ...@@ -86,7 +86,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
/* At this point: (!vmm || addr < vmm->vm_end). */ /* At this point: (!vmm || addr < vmm->vm_end). */
if (TASK_SIZE - len < addr) if (TASK_SIZE - len < addr)
return -ENOMEM; return -ENOMEM;
if (!vmm || addr + len <= vmm->vm_start) if (!vmm || addr + len <= vm_start_gap(vmm))
return addr; return addr;
addr = vmm->vm_end; addr = vmm->vm_end;
if (flags & MAP_SHARED) if (flags & MAP_SHARED)
......
...@@ -171,7 +171,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr, ...@@ -171,7 +171,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
addr = ALIGN(addr, huge_page_size(h)); addr = ALIGN(addr, huge_page_size(h));
vma = find_vma(mm, addr); vma = find_vma(mm, addr);
if (TASK_SIZE - len >= addr && if (TASK_SIZE - len >= addr &&
(!vma || addr + len <= vma->vm_start)) (!vma || addr + len <= vm_start_gap(vma)))
return addr; return addr;
} }
......
...@@ -284,11 +284,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid) ...@@ -284,11 +284,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
/* We don't show the stack guard page in /proc/maps */ /* We don't show the stack guard page in /proc/maps */
start = vma->vm_start; start = vma->vm_start;
if (stack_guard_page_start(vma, start))
start += PAGE_SIZE;
end = vma->vm_end; end = vma->vm_end;
if (stack_guard_page_end(vma, end))
end -= PAGE_SIZE;
seq_setwidth(m, 25 + sizeof(void *) * 6 - 1); seq_setwidth(m, 25 + sizeof(void *) * 6 - 1);
seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu ", seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu ",
......
...@@ -1242,34 +1242,6 @@ int set_page_dirty_lock(struct page *page); ...@@ -1242,34 +1242,6 @@ int set_page_dirty_lock(struct page *page);
int clear_page_dirty_for_io(struct page *page); int clear_page_dirty_for_io(struct page *page);
int get_cmdline(struct task_struct *task, char *buffer, int buflen); int get_cmdline(struct task_struct *task, char *buffer, int buflen);
/* Is the vma a continuation of the stack vma above it? */
static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
{
return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
}
static inline int stack_guard_page_start(struct vm_area_struct *vma,
unsigned long addr)
{
return (vma->vm_flags & VM_GROWSDOWN) &&
(vma->vm_start == addr) &&
!vma_growsdown(vma->vm_prev, addr);
}
/* Is the vma a continuation of the stack vma below it? */
static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
{
return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
}
static inline int stack_guard_page_end(struct vm_area_struct *vma,
unsigned long addr)
{
return (vma->vm_flags & VM_GROWSUP) &&
(vma->vm_end == addr) &&
!vma_growsup(vma->vm_next, addr);
}
extern struct task_struct *task_of_stack(struct task_struct *task, extern struct task_struct *task_of_stack(struct task_struct *task,
struct vm_area_struct *vma, bool in_group); struct vm_area_struct *vma, bool in_group);
...@@ -1930,6 +1902,7 @@ void page_cache_async_readahead(struct address_space *mapping, ...@@ -1930,6 +1902,7 @@ void page_cache_async_readahead(struct address_space *mapping,
unsigned long max_sane_readahead(unsigned long nr); unsigned long max_sane_readahead(unsigned long nr);
extern unsigned long stack_guard_gap;
/* Generic expand stack which grows the stack according to GROWS{UP,DOWN} */ /* Generic expand stack which grows the stack according to GROWS{UP,DOWN} */
extern int expand_stack(struct vm_area_struct *vma, unsigned long address); extern int expand_stack(struct vm_area_struct *vma, unsigned long address);
...@@ -1958,6 +1931,30 @@ static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * m ...@@ -1958,6 +1931,30 @@ static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * m
return vma; return vma;
} }
static inline unsigned long vm_start_gap(struct vm_area_struct *vma)
{
unsigned long vm_start = vma->vm_start;
if (vma->vm_flags & VM_GROWSDOWN) {
vm_start -= stack_guard_gap;
if (vm_start > vma->vm_start)
vm_start = 0;
}
return vm_start;
}
static inline unsigned long vm_end_gap(struct vm_area_struct *vma)
{
unsigned long vm_end = vma->vm_end;
if (vma->vm_flags & VM_GROWSUP) {
vm_end += stack_guard_gap;
if (vm_end < vma->vm_end)
vm_end = -PAGE_SIZE;
}
return vm_end;
}
static inline unsigned long vma_pages(struct vm_area_struct *vma) static inline unsigned long vma_pages(struct vm_area_struct *vma)
{ {
return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT; return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
......
...@@ -275,11 +275,6 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma, ...@@ -275,11 +275,6 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
unsigned int fault_flags = 0; unsigned int fault_flags = 0;
int ret; int ret;
/* For mlock, just skip the stack guard page. */
if ((*flags & FOLL_MLOCK) &&
(stack_guard_page_start(vma, address) ||
stack_guard_page_end(vma, address + PAGE_SIZE)))
return -ENOENT;
if (*flags & FOLL_WRITE) if (*flags & FOLL_WRITE)
fault_flags |= FAULT_FLAG_WRITE; fault_flags |= FAULT_FLAG_WRITE;
if (nonblocking) if (nonblocking)
......
...@@ -2579,40 +2579,6 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma, ...@@ -2579,40 +2579,6 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
return ret; return ret;
} }
/*
* This is like a special single-page "expand_{down|up}wards()",
* except we must first make sure that 'address{-|+}PAGE_SIZE'
* doesn't hit another vma.
*/
static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
{
address &= PAGE_MASK;
if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
struct vm_area_struct *prev = vma->vm_prev;
/*
* Is there a mapping abutting this one below?
*
* That's only ok if it's the same stack mapping
* that has gotten split..
*/
if (prev && prev->vm_end == address)
return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
return expand_downwards(vma, address - PAGE_SIZE);
}
if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
struct vm_area_struct *next = vma->vm_next;
/* As VM_GROWSDOWN but s/below/above/ */
if (next && next->vm_start == address + PAGE_SIZE)
return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
return expand_upwards(vma, address + PAGE_SIZE);
}
return 0;
}
/* /*
* We enter with non-exclusive mmap_sem (to exclude vma changes, * We enter with non-exclusive mmap_sem (to exclude vma changes,
* but allow concurrent faults), and pte mapped but not yet locked. * but allow concurrent faults), and pte mapped but not yet locked.
...@@ -2633,10 +2599,6 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, ...@@ -2633,10 +2599,6 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
if (vma->vm_flags & VM_SHARED) if (vma->vm_flags & VM_SHARED)
return VM_FAULT_SIGBUS; return VM_FAULT_SIGBUS;
/* Check if we need to add a guard page to the stack */
if (check_stack_guard_page(vma, address) < 0)
return VM_FAULT_SIGSEGV;
/* Use the zero-page for reads */ /* Use the zero-page for reads */
if (!(flags & FAULT_FLAG_WRITE)) { if (!(flags & FAULT_FLAG_WRITE)) {
entry = pte_mkspecial(pfn_pte(my_zero_pfn(address), entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
......
...@@ -290,6 +290,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk) ...@@ -290,6 +290,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
unsigned long retval; unsigned long retval;
unsigned long newbrk, oldbrk; unsigned long newbrk, oldbrk;
struct mm_struct *mm = current->mm; struct mm_struct *mm = current->mm;
struct vm_area_struct *next;
unsigned long min_brk; unsigned long min_brk;
bool populate; bool populate;
...@@ -334,7 +335,8 @@ SYSCALL_DEFINE1(brk, unsigned long, brk) ...@@ -334,7 +335,8 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
} }
/* Check against existing mmap mappings. */ /* Check against existing mmap mappings. */
if (find_vma_intersection(mm, oldbrk, newbrk+PAGE_SIZE)) next = find_vma(mm, oldbrk);
if (next && newbrk + PAGE_SIZE > vm_start_gap(next))
goto out; goto out;
/* Ok, looks good - let it rip. */ /* Ok, looks good - let it rip. */
...@@ -357,10 +359,22 @@ SYSCALL_DEFINE1(brk, unsigned long, brk) ...@@ -357,10 +359,22 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
static long vma_compute_subtree_gap(struct vm_area_struct *vma) static long vma_compute_subtree_gap(struct vm_area_struct *vma)
{ {
unsigned long max, subtree_gap; unsigned long max, prev_end, subtree_gap;
max = vma->vm_start;
if (vma->vm_prev) /*
max -= vma->vm_prev->vm_end; * Note: in the rare case of a VM_GROWSDOWN above a VM_GROWSUP, we
* allow two stack_guard_gaps between them here, and when choosing
* an unmapped area; whereas when expanding we only require one.
* That's a little inconsistent, but keeps the code here simpler.
*/
max = vm_start_gap(vma);
if (vma->vm_prev) {
prev_end = vm_end_gap(vma->vm_prev);
if (max > prev_end)
max -= prev_end;
else
max = 0;
}
if (vma->vm_rb.rb_left) { if (vma->vm_rb.rb_left) {
subtree_gap = rb_entry(vma->vm_rb.rb_left, subtree_gap = rb_entry(vma->vm_rb.rb_left,
struct vm_area_struct, vm_rb)->rb_subtree_gap; struct vm_area_struct, vm_rb)->rb_subtree_gap;
...@@ -453,7 +467,7 @@ static void validate_mm(struct mm_struct *mm) ...@@ -453,7 +467,7 @@ static void validate_mm(struct mm_struct *mm)
anon_vma_unlock_read(anon_vma); anon_vma_unlock_read(anon_vma);
} }
highest_address = vma->vm_end; highest_address = vm_end_gap(vma);
vma = vma->vm_next; vma = vma->vm_next;
i++; i++;
} }
...@@ -622,7 +636,7 @@ void __vma_link_rb(struct mm_struct *mm, struct vm_area_struct *vma, ...@@ -622,7 +636,7 @@ void __vma_link_rb(struct mm_struct *mm, struct vm_area_struct *vma,
if (vma->vm_next) if (vma->vm_next)
vma_gap_update(vma->vm_next); vma_gap_update(vma->vm_next);
else else
mm->highest_vm_end = vma->vm_end; mm->highest_vm_end = vm_end_gap(vma);
/* /*
* vma->vm_prev wasn't known when we followed the rbtree to find the * vma->vm_prev wasn't known when we followed the rbtree to find the
...@@ -874,7 +888,7 @@ again: remove_next = 1 + (end > next->vm_end); ...@@ -874,7 +888,7 @@ again: remove_next = 1 + (end > next->vm_end);
vma_gap_update(vma); vma_gap_update(vma);
if (end_changed) { if (end_changed) {
if (!next) if (!next)
mm->highest_vm_end = end; mm->highest_vm_end = vm_end_gap(vma);
else if (!adjust_next) else if (!adjust_next)
vma_gap_update(next); vma_gap_update(next);
} }
...@@ -917,7 +931,7 @@ again: remove_next = 1 + (end > next->vm_end); ...@@ -917,7 +931,7 @@ again: remove_next = 1 + (end > next->vm_end);
else if (next) else if (next)
vma_gap_update(next); vma_gap_update(next);
else else
mm->highest_vm_end = end; VM_WARN_ON(mm->highest_vm_end != vm_end_gap(vma));
} }
if (insert && file) if (insert && file)
uprobe_mmap(insert); uprobe_mmap(insert);
...@@ -1740,7 +1754,7 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info) ...@@ -1740,7 +1754,7 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info)
while (true) { while (true) {
/* Visit left subtree if it looks promising */ /* Visit left subtree if it looks promising */
gap_end = vma->vm_start; gap_end = vm_start_gap(vma);
if (gap_end >= low_limit && vma->vm_rb.rb_left) { if (gap_end >= low_limit && vma->vm_rb.rb_left) {
struct vm_area_struct *left = struct vm_area_struct *left =
rb_entry(vma->vm_rb.rb_left, rb_entry(vma->vm_rb.rb_left,
...@@ -1751,7 +1765,7 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info) ...@@ -1751,7 +1765,7 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info)
} }
} }
gap_start = vma->vm_prev ? vma->vm_prev->vm_end : 0; gap_start = vma->vm_prev ? vm_end_gap(vma->vm_prev) : 0;
check_current: check_current:
/* Check if current node has a suitable gap */ /* Check if current node has a suitable gap */
if (gap_start > high_limit) if (gap_start > high_limit)
...@@ -1778,8 +1792,8 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info) ...@@ -1778,8 +1792,8 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info)
vma = rb_entry(rb_parent(prev), vma = rb_entry(rb_parent(prev),
struct vm_area_struct, vm_rb); struct vm_area_struct, vm_rb);
if (prev == vma->vm_rb.rb_left) { if (prev == vma->vm_rb.rb_left) {
gap_start = vma->vm_prev->vm_end; gap_start = vm_end_gap(vma->vm_prev);
gap_end = vma->vm_start; gap_end = vm_start_gap(vma);
goto check_current; goto check_current;
} }
} }
...@@ -1843,7 +1857,7 @@ unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info) ...@@ -1843,7 +1857,7 @@ unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info)
while (true) { while (true) {
/* Visit right subtree if it looks promising */ /* Visit right subtree if it looks promising */
gap_start = vma->vm_prev ? vma->vm_prev->vm_end : 0; gap_start = vma->vm_prev ? vm_end_gap(vma->vm_prev) : 0;
if (gap_start <= high_limit && vma->vm_rb.rb_right) { if (gap_start <= high_limit && vma->vm_rb.rb_right) {
struct vm_area_struct *right = struct vm_area_struct *right =
rb_entry(vma->vm_rb.rb_right, rb_entry(vma->vm_rb.rb_right,
...@@ -1856,7 +1870,7 @@ unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info) ...@@ -1856,7 +1870,7 @@ unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info)
check_current: check_current:
/* Check if current node has a suitable gap */ /* Check if current node has a suitable gap */
gap_end = vma->vm_start; gap_end = vm_start_gap(vma);
if (gap_end < low_limit) if (gap_end < low_limit)
return -ENOMEM; return -ENOMEM;
if (gap_start <= high_limit && gap_end - gap_start >= length) if (gap_start <= high_limit && gap_end - gap_start >= length)
...@@ -1882,7 +1896,7 @@ unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info) ...@@ -1882,7 +1896,7 @@ unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info)
struct vm_area_struct, vm_rb); struct vm_area_struct, vm_rb);
if (prev == vma->vm_rb.rb_right) { if (prev == vma->vm_rb.rb_right) {
gap_start = vma->vm_prev ? gap_start = vma->vm_prev ?
vma->vm_prev->vm_end : 0; vm_end_gap(vma->vm_prev) : 0;
goto check_current; goto check_current;
} }
} }
...@@ -1920,7 +1934,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, ...@@ -1920,7 +1934,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
unsigned long len, unsigned long pgoff, unsigned long flags) unsigned long len, unsigned long pgoff, unsigned long flags)
{ {
struct mm_struct *mm = current->mm; struct mm_struct *mm = current->mm;
struct vm_area_struct *vma; struct vm_area_struct *vma, *prev;
struct vm_unmapped_area_info info; struct vm_unmapped_area_info info;
if (len > TASK_SIZE - mmap_min_addr) if (len > TASK_SIZE - mmap_min_addr)
...@@ -1931,9 +1945,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, ...@@ -1931,9 +1945,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
if (addr) { if (addr) {
addr = PAGE_ALIGN(addr); addr = PAGE_ALIGN(addr);
vma = find_vma(mm, addr); vma = find_vma_prev(mm, addr, &prev);
if (TASK_SIZE - len >= addr && addr >= mmap_min_addr && if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
(!vma || addr + len <= vma->vm_start)) (!vma || addr + len <= vm_start_gap(vma)) &&
(!prev || addr >= vm_end_gap(prev)))
return addr; return addr;
} }
...@@ -1956,7 +1971,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, ...@@ -1956,7 +1971,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
const unsigned long len, const unsigned long pgoff, const unsigned long len, const unsigned long pgoff,
const unsigned long flags) const unsigned long flags)
{ {
struct vm_area_struct *vma; struct vm_area_struct *vma, *prev;
struct mm_struct *mm = current->mm; struct mm_struct *mm = current->mm;
unsigned long addr = addr0; unsigned long addr = addr0;
struct vm_unmapped_area_info info; struct vm_unmapped_area_info info;
...@@ -1971,9 +1986,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, ...@@ -1971,9 +1986,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
/* requesting a specific address */ /* requesting a specific address */
if (addr) { if (addr) {
addr = PAGE_ALIGN(addr); addr = PAGE_ALIGN(addr);
vma = find_vma(mm, addr); vma = find_vma_prev(mm, addr, &prev);
if (TASK_SIZE - len >= addr && addr >= mmap_min_addr && if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
(!vma || addr + len <= vma->vm_start)) (!vma || addr + len <= vm_start_gap(vma)) &&
(!prev || addr >= vm_end_gap(prev)))
return addr; return addr;
} }
...@@ -2099,21 +2115,19 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr, ...@@ -2099,21 +2115,19 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
* update accounting. This is shared with both the * update accounting. This is shared with both the
* grow-up and grow-down cases. * grow-up and grow-down cases.
*/ */
static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, unsigned long grow) static int acct_stack_growth(struct vm_area_struct *vma,
unsigned long size, unsigned long grow)
{ {
struct mm_struct *mm = vma->vm_mm; struct mm_struct *mm = vma->vm_mm;
struct rlimit *rlim = current->signal->rlim; struct rlimit *rlim = current->signal->rlim;
unsigned long new_start, actual_size; unsigned long new_start;
/* address space limit tests */ /* address space limit tests */
if (!may_expand_vm(mm, grow)) if (!may_expand_vm(mm, grow))
return -ENOMEM; return -ENOMEM;
/* Stack limit test */ /* Stack limit test */
actual_size = size; if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
if (size && (vma->vm_flags & (VM_GROWSUP | VM_GROWSDOWN)))
actual_size -= PAGE_SIZE;
if (actual_size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
return -ENOMEM; return -ENOMEM;
/* mlock limit tests */ /* mlock limit tests */
...@@ -2154,17 +2168,30 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns ...@@ -2154,17 +2168,30 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
*/ */
int expand_upwards(struct vm_area_struct *vma, unsigned long address) int expand_upwards(struct vm_area_struct *vma, unsigned long address)
{ {
struct vm_area_struct *next;
unsigned long gap_addr;
int error = 0; int error = 0;
if (!(vma->vm_flags & VM_GROWSUP)) if (!(vma->vm_flags & VM_GROWSUP))
return -EFAULT; return -EFAULT;
/* Guard against wrapping around to address 0. */ /* Guard against wrapping around to address 0. */
if (address < PAGE_ALIGN(address+4)) address &= PAGE_MASK;
address = PAGE_ALIGN(address+4); address += PAGE_SIZE;
else if (!address)
return -ENOMEM; return -ENOMEM;
/* Enforce stack_guard_gap */
gap_addr = address + stack_guard_gap;
if (gap_addr < address)
return -ENOMEM;
next = vma->vm_next;
if (next && next->vm_start < gap_addr) {
if (!(next->vm_flags & VM_GROWSUP))
return -ENOMEM;
/* Check that both stack segments have the same anon_vma? */
}
/* We must make sure the anon_vma is allocated. */ /* We must make sure the anon_vma is allocated. */
if (unlikely(anon_vma_prepare(vma))) if (unlikely(anon_vma_prepare(vma)))
return -ENOMEM; return -ENOMEM;
...@@ -2205,7 +2232,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address) ...@@ -2205,7 +2232,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
if (vma->vm_next) if (vma->vm_next)
vma_gap_update(vma->vm_next); vma_gap_update(vma->vm_next);
else else
vma->vm_mm->highest_vm_end = address; vma->vm_mm->highest_vm_end = vm_end_gap(vma);
spin_unlock(&vma->vm_mm->page_table_lock); spin_unlock(&vma->vm_mm->page_table_lock);
perf_event_mmap(vma); perf_event_mmap(vma);
...@@ -2225,6 +2252,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address) ...@@ -2225,6 +2252,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
int expand_downwards(struct vm_area_struct *vma, int expand_downwards(struct vm_area_struct *vma,
unsigned long address) unsigned long address)
{ {
struct vm_area_struct *prev;
unsigned long gap_addr;
int error; int error;
address &= PAGE_MASK; address &= PAGE_MASK;
...@@ -2232,6 +2261,17 @@ int expand_downwards(struct vm_area_struct *vma, ...@@ -2232,6 +2261,17 @@ int expand_downwards(struct vm_area_struct *vma,
if (error) if (error)
return error; return error;
/* Enforce stack_guard_gap */
gap_addr = address - stack_guard_gap;
if (gap_addr > address)
return -ENOMEM;
prev = vma->vm_prev;
if (prev && prev->vm_end > gap_addr) {
if (!(prev->vm_flags & VM_GROWSDOWN))
return -ENOMEM;
/* Check that both stack segments have the same anon_vma? */
}
/* We must make sure the anon_vma is allocated. */ /* We must make sure the anon_vma is allocated. */
if (unlikely(anon_vma_prepare(vma))) if (unlikely(anon_vma_prepare(vma)))
return -ENOMEM; return -ENOMEM;
...@@ -2283,28 +2323,25 @@ int expand_downwards(struct vm_area_struct *vma, ...@@ -2283,28 +2323,25 @@ int expand_downwards(struct vm_area_struct *vma,
return error; return error;
} }
/* /* enforced gap between the expanding stack and other mappings. */
* Note how expand_stack() refuses to expand the stack all the way to unsigned long stack_guard_gap = 256UL<<PAGE_SHIFT;
* abut the next virtual mapping, *unless* that mapping itself is also
* a stack mapping. We want to leave room for a guard page, after all static int __init cmdline_parse_stack_guard_gap(char *p)
* (the guard page itself is not added here, that is done by the {
* actual page faulting logic) unsigned long val;
* char *endptr;
* This matches the behavior of the guard page logic (see mm/memory.c:
* check_stack_guard_page()), which only allows the guard page to be val = simple_strtoul(p, &endptr, 10);
* removed under these circumstances. if (!*endptr)
*/ stack_guard_gap = val << PAGE_SHIFT;
return 0;
}
__setup("stack_guard_gap=", cmdline_parse_stack_guard_gap);
#ifdef CONFIG_STACK_GROWSUP #ifdef CONFIG_STACK_GROWSUP
int expand_stack(struct vm_area_struct *vma, unsigned long address) int expand_stack(struct vm_area_struct *vma, unsigned long address)
{ {
struct vm_area_struct *next;
address &= PAGE_MASK;
next = vma->vm_next;
if (next && next->vm_start == address + PAGE_SIZE) {
if (!(next->vm_flags & VM_GROWSUP))
return -ENOMEM;
}
return expand_upwards(vma, address); return expand_upwards(vma, address);
} }
...@@ -2326,14 +2363,6 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr) ...@@ -2326,14 +2363,6 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr)
#else #else
int expand_stack(struct vm_area_struct *vma, unsigned long address) int expand_stack(struct vm_area_struct *vma, unsigned long address)
{ {
struct vm_area_struct *prev;
address &= PAGE_MASK;
prev = vma->vm_prev;
if (prev && prev->vm_end == address) {
if (!(prev->vm_flags & VM_GROWSDOWN))
return -ENOMEM;
}
return expand_downwards(vma, address); return expand_downwards(vma, address);
} }
...@@ -2429,7 +2458,7 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma, ...@@ -2429,7 +2458,7 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
vma->vm_prev = prev; vma->vm_prev = prev;
vma_gap_update(vma); vma_gap_update(vma);
} else } else
mm->highest_vm_end = prev ? prev->vm_end : 0; mm->highest_vm_end = prev ? vm_end_gap(prev) : 0;
tail_vma->vm_next = NULL; tail_vma->vm_next = NULL;
/* Kill the cache */ /* Kill the cache */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment