Hugh Dickins
1be7107fbe
mm: larger stack guard gap, between vmas ...
Stack guard page is a useful feature to reduce a risk of stack smashing
into a different mapping. We have been using a single page gap which
is sufficient to prevent having stack adjacent to a different mapping.
But this seems to be insufficient in the light of the stack usage in
userspace. E.g. glibc uses as large as 64kB alloca() in many commonly
used functions. Others use constructs liks gid_t buffer[NGROUPS_MAX]
which is 256kB or stack strings with MAX_ARG_STRLEN.
This will become especially dangerous for suid binaries and the default
no limit for the stack size limit because those applications can be
tricked to consume a large portion of the stack and a single glibc call
could jump over the guard page. These attacks are not theoretical,
unfortunatelly.
Make those attacks less probable by increasing the stack guard gap
to 1MB (on systems with 4k pages; but make it depend on the page size
because systems with larger base pages might cap stack allocations in
the PAGE_SIZE units) which should cover larger alloca() and VLA stack
allocations. It is obviously not a full fix because the problem is
somehow inherent, but it should reduce attack space a lot.
One could argue that the gap size should be configurable from userspace,
but that can be done later when somebody finds that the new 1MB is wrong
for some special case applications. For now, add a kernel command line
option (stack_guard_gap) to specify the stack gap size (in page units).
Implementation wise, first delete all the old code for stack guard page:
because although we could get away with accounting one extra page in a
stack vma, accounting a larger gap can break userspace - case in point,
a program run with "ulimit -S -v 20000" failed when the 1MB gap was
counted for RLIMIT_AS; similar problems could come with RLIMIT_MLOCK
and strict non-overcommit mode.
Instead of keeping gap inside the stack vma, maintain the stack guard
gap as a gap between vmas: using vm_start_gap() in place of vm_start
(or vm_end_gap() in place of vm_end if VM_GROWSUP) in just those few
places which need to respect the gap - mainly arch_get_unmapped_area(),
and and the vma tree's subtree_gap support for that.
Original-patch-by: Oleg Nesterov <oleg@redhat.com>
Original-patch-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Tested-by: Helge Deller <deller@gmx.de> # parisc
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-06-19 21:50:20 +08:00
9p: Convert to separately allocated bdi
2017-04-20 12:09:55 -06:00
fs/affs: add rename exchange
2017-05-05 15:24:52 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2017-05-02 16:40:27 -07:00
Fix dead URLs to ftp.kernel.org
2017-03-28 16:16:52 +02:00
befs: make export work with cold dcache
2017-05-05 11:35:35 +01:00
Tigran has moved
2017-05-12 15:57:15 -07:00
Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
2017-06-15 17:54:51 +09:00
sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h>
2017-03-02 08:42:31 +01:00
ceph: unify inode i_ctime update
2017-06-14 19:37:23 +02:00
[CIFS] Minor cleanup of xattr query function
2017-05-12 20:59:10 -05:00
coda: Convert to separately allocated bdi
2017-04-20 12:09:55 -06:00
configfs: Introduce config_item_get_unless_zero()
2017-06-12 13:20:20 +02:00
fscrypt: introduce helper function for filename matching
2017-05-04 11:44:37 -04:00
fs: constify tree_descr arrays passed to simple_fill_super()
2017-04-26 23:54:06 -04:00
net: Work around lockdep limitation in sockets that use sockets
2017-03-09 18:23:27 -08:00
ecryptfs: Convert to separately allocated bdi
2017-04-20 12:09:55 -06:00
Replace <asm/uaccess.h> with <linux/uaccess.h> globally
2016-12-24 11:46:01 -08:00
fs: semove set but not checked AOP_FLAG_UNINTERRUPTIBLE flag
2017-05-08 17:15:14 -07:00
Merge branch 'rebased-statx' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-03-03 11:38:56 -08:00
dax, xfs, ext4: compile out iomap-dax paths in the FS_DAX=n case
2017-05-13 17:52:16 -07:00
ext4: fix fdatasync(2) after extent manipulation operations
2017-05-29 13:24:55 -04:00
crypto: Work around deallocated stack frame reference gcc bug on sparc.
2017-06-08 17:36:03 +08:00
fat: fix using uninitialized fields of fat_inode/fsinfo_inode
2017-03-09 17:01:10 -08:00
KEYS: Differentiate uses of rcu_dereference_key() and user_key_payload()
2017-03-02 10:09:00 +11:00
Merge branch 'for-linus' of git://git.kernel.dk/linux-block
2017-05-20 16:12:30 -07:00
gfs2: Make flush bios explicitely sync
2017-05-24 13:35:20 +02:00
fs: semove set but not checked AOP_FLAG_UNINTERRUPTIBLE flag
2017-05-08 17:15:14 -07:00
fs: semove set but not checked AOP_FLAG_UNINTERRUPTIBLE flag
2017-05-08 17:15:14 -07:00
vfs: remove ".readlink = generic_readlink" assignments
2016-12-09 16:45:04 +01:00
sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>
2017-03-02 08:42:32 +01:00
mm: larger stack guard gap, between vmas
2017-06-19 21:50:20 +08:00
sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h>
2017-03-02 08:42:31 +01:00
jbd2: preserve original nofs flag during journal restart
2017-05-21 22:32:23 -04:00
jffs2: fix spelling mistake: "requestied" -> "requested"
2017-04-19 11:35:55 -07:00
jfs: Remove jfs_get_inode_flags()
2017-04-19 14:21:23 +02:00
kernfs: Check KERNFS_HAS_RELEASE before calling kernfs_release_file()
2017-03-17 10:25:59 +09:00
Another RDMA update from Chuck Lever, and a bunch of miscellaneous
2017-05-10 13:29:23 -07:00
statx: Add a system call to make enhanced file info available
2017-03-02 20:51:15 -05:00
ncpfs: Convert to separately allocated bdi
2017-04-20 12:09:55 -06:00
NFS client bugfixes for Linux 4.12
2017-06-04 11:56:53 -07:00
nfsd4: fix null dereference on replay
2017-05-23 14:20:58 -04:00
fs: Remove SB_I_DYNBDI flag
2017-04-20 12:09:55 -06:00
fanotify: don't expose EOPENSTALE to userspace
2017-04-25 15:48:06 +02:00
ntfs: Use ERR_CAST() to avoid cross-structure cast
2017-05-28 10:11:48 -07:00
ocfs2: Use ERR_CAST() to avoid cross-structure cast
2017-05-28 10:11:49 -07:00
sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h>
2017-03-02 08:42:31 +01:00
Replace <asm/uaccess.h> with <linux/uaccess.h> globally
2016-12-24 11:46:01 -08:00
Some cleanups:
2017-05-05 13:36:10 -07:00
ovl: filter trusted xattr for non-admin
2017-05-29 15:15:27 +02:00
mm: larger stack guard gap, between vmas
2017-06-19 21:50:20 +08:00
Annotation of module parameters that specify device settings
2017-05-10 19:13:03 -07:00
ext4: fix quota charging for shared xattr blocks
2017-05-24 18:24:07 -04:00
Replace <asm/uaccess.h> with <linux/uaccess.h> globally
2016-12-24 11:46:01 -08:00
reiserfs: Make flush bios explicitely sync
2017-05-24 13:35:20 +02:00
romfs: use different way to generate fsid for BLOCK or MTD
2017-01-24 16:26:14 -08:00
fs/pstore: fs/squashfs: change usage of LZ4 to work with new LZ4 version
2017-02-24 17:46:57 -08:00
sysfs: be careful of error returns from ops->show()
2017-04-08 17:33:32 +02:00
statx: Add a system call to make enhanced file info available
2017-03-02 20:51:15 -05:00
fs: constify tree_descr arrays passed to simple_fill_super()
2017-04-26 23:54:06 -04:00
This pull request contains updates for both UBI and UBIFS:
2017-05-13 10:23:12 -07:00
udf: use kmap_atomic for memcpy copying
2017-04-24 16:28:02 +02:00
Merge branch 'ufs-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-06-17 17:30:07 +09:00
Changes since last update:
2017-06-17 17:34:41 +09:00
Merge branch 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2017-03-03 10:16:38 -08:00
Replace <asm/uaccess.h> with <linux/uaccess.h> globally
2016-12-24 11:46:01 -08:00
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>
2017-03-02 08:42:29 +01:00
statx: Add a system call to make enhanced file info available
2017-03-02 20:51:15 -05:00
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task_stack.h>
2017-03-02 08:42:36 +01:00
sched/headers: Prepare to move cputime functionality from <linux/sched.h> into <linux/sched/cputime.h>
2017-03-02 08:42:39 +01:00
sched/headers: Prepare to move cputime functionality from <linux/sched.h> into <linux/sched/cputime.h>
2017-03-02 08:42:39 +01:00
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task_stack.h>
2017-03-02 08:42:36 +01:00
fs: constify tree_descr arrays passed to simple_fill_super()
2017-04-26 23:54:06 -04:00
Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm
2017-05-12 15:43:10 -07:00
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-05-09 09:12:53 -07:00
chardev: add helper function to register char devs with a struct device
2017-03-21 06:44:32 +01:00
fs/compat.c: trim unused includes
2017-04-17 12:52:27 -04:00
fs/binfmt: Convert obsolete cputime type to nsecs
2017-02-01 09:13:51 +01:00
fs: compat: Remove warning from COMPATIBLE_IOCTL
2017-04-29 17:47:19 -04:00
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task_stack.h>
2017-03-02 08:42:36 +01:00
dax: fix race between colliding PMD & PTE entries
2017-06-02 15:07:37 -07:00
Hang/soft lockup in d_invalidate with simultaneous calls
2017-06-15 06:52:09 -04:00
Replace <asm/uaccess.h> with <linux/uaccess.h> globally
2016-12-24 11:46:01 -08:00
fs: add i_blocksize()
2017-02-27 18:43:46 -08:00
sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>
2017-03-02 08:42:32 +01:00
epoll: Add busy poll support to epoll with socket fds.
2017-03-24 20:49:31 -07:00
x86/arch_prctl: Add ARCH_[GET|SET]_CPUID
2017-03-20 16:10:34 +01:00
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-05-09 09:12:53 -07:00
fhandle: move compat syscalls from compat.c
2017-04-17 12:52:26 -04:00
mm, vmalloc: use __GFP_HIGHMEM implicitly
2017-05-08 17:15:13 -07:00
sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h>
2017-03-02 08:42:31 +01:00
Replace <asm/uaccess.h> with <linux/uaccess.h> globally
2016-12-24 11:46:01 -08:00
writeback: fix memory leak in wb_queue_work()
2017-03-13 08:27:34 -06:00
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>
2017-03-02 08:42:35 +01:00
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-05-09 09:12:53 -07:00
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-05-09 09:12:53 -07:00
sched/headers: Prepare for the reduction of <linux/sched.h>'s signal API dependency
2017-03-02 08:42:37 +01:00
fs: semove set but not checked AOP_FLAG_UNINTERRUPTIBLE flag
2017-05-08 17:15:14 -07:00
block, dax: move "select DAX" from BLOCK to FS_DAX
2017-05-08 10:55:27 -07:00
fs: constify tree_descr arrays passed to simple_fill_super()
2017-04-26 23:54:06 -04:00
locks: Set FL_CLOSE when removing flock locks on close()
2017-04-21 10:45:01 -04:00
logfs: remove from tree
2016-12-14 23:48:11 -05:00
mbcache: document that "find" functions only return reusable entries
2016-12-03 15:55:01 -05:00
fsnotify: Free fsnotify_mark_connector when there is no mark attached
2017-04-10 17:37:35 +02:00
fs: add i_blocksize()
2017-02-27 18:43:46 -08:00
Merge branch 'work.sane_pwd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-05-12 11:39:59 -07:00
fs: don't forget to put old mntns in mntns_install
2017-06-15 06:53:05 -04:00
ns: allow ns_entries to have custom symlink content
2017-05-08 17:15:12 -07:00
Merge branch 'work.sane_pwd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-05-12 11:39:59 -07:00
Replace <asm/uaccess.h> with <linux/uaccess.h> globally
2016-12-24 11:46:01 -08:00
mnt: Tuck mounts under others instead of creating shadow/side mounts.
2017-02-04 00:01:06 +13:00
mnt: Tuck mounts under others instead of creating shadow/side mounts.
2017-02-04 00:01:06 +13:00
sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h>
2017-03-02 08:42:31 +01:00
sched/headers: Prepare to move the task_lock()/unlock() APIs to <linux/sched/task.h>
2017-03-02 08:42:38 +01:00
fs: pass on flags in compat_writev
2017-06-16 18:40:51 +09:00
readdir: move compat syscalls from compat.c
2017-04-17 12:52:24 -04:00
treewide: use kv[mz]alloc* rather than opencoded variants
2017-05-08 17:15:13 -07:00
mm: introduce kv[mz]alloc helpers
2017-05-08 17:15:12 -07:00
mm: Rename SLAB_DESTROY_BY_RCU to SLAB_TYPESAFE_BY_RCU
2017-04-18 11:42:36 -07:00
Merge branch 'work.splice' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-05-02 11:38:06 -07:00
ufs: restore maintaining ->i_blocks
2017-06-09 16:28:01 -04:00
statfs: move compat syscalls from compat.c
2017-04-17 12:52:23 -04:00
bdi: Drop 'parent' argument from bdi_register[_va]()
2017-04-20 12:09:55 -06:00
vfs: use helper for calling f_op->fsync()
2017-02-20 16:51:23 +01:00
timerfd: Only check CAP_WAKE_ALARM when it is needed
2017-03-01 12:53:44 +01:00
userfaultfd: shmem: handle coredumping in handle_userfault()
2017-06-17 06:37:05 +09:00
utimes: move compat syscalls from compat.c
2017-04-17 12:52:23 -04:00
treewide: use kv[mz]alloc* rather than opencoded variants
2017-05-08 17:15:13 -07:00
1be7107fbe