From: Shawn C <[email protected]>
Hi kernel maintainers,
It won't allow the address above the TASK_SIZE being mmap'ed( or mprotect'ed).
This patch is from PaX/Grsecurity.
Thanks for your review time!
Signed-off-by: Shawn C <[email protected]>
---
mm/madvise.c | 4 ++++
mm/mempolicy.c | 5 +++++
mm/mlock.c | 4 ++++
mm/mprotect.c | 5 +++++
4 files changed, 18 insertions(+)
diff --git a/mm/madvise.c b/mm/madvise.c
index d551475..3f5dd3d 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -484,6 +484,10 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
if (end < start)
return error;
+ /* We should never reach the kernel address space here */
+ if (end > TASK_SIZE)
+ return error;
+
error = 0;
if (end == start)
return error;
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index ede2629..56c2eed 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1161,6 +1161,11 @@ static long do_mbind(unsigned long start, unsigned long len,
if (end < start)
return -EINVAL;
+
+ /* We should never reach the kernel address space here */
+ if (end > TASK_SIZE)
+ return -EINVAL;
+
if (end == start)
return 0;
diff --git a/mm/mlock.c b/mm/mlock.c
index 6fd2cf1..c7f6785 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -566,6 +566,10 @@ static int do_mlock(unsigned long start, size_t len, int on)
return -EINVAL;
if (end == start)
return 0;
+
+ if (end > TASK_SIZE)
+ return -EINVAL;
+
vma = find_vma(current->mm, start);
if (!vma || vma->vm_start > start)
return -ENOMEM;
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 8858483..cd58a31 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -351,6 +351,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
end = start + len;
if (end <= start)
return -ENOMEM;
+
+ /* We should never reach the kernel address space here */
+ if (end > TASK_SIZE)
+ return -EINVAL;
+
if (!arch_validate_prot(prot))
return -EINVAL;
--
1.9.1
On 04/29/2015 08:39 AM, Shawn Chang wrote:
> From: Shawn C <[email protected]>
>
> Hi kernel maintainers,
>
> It won't allow the address above the TASK_SIZE being mmap'ed( or mprotect'ed).
> This patch is from PaX/Grsecurity.
>
> Thanks for your review time!
Does this actually reduce the attack surface of anything?
These functions all search for vmas. If there's a vma outside of the
user range, we have a problem.
Also, that use of TASK_SIZE is IMO ridiculous. Shouldn't be TASK_SIZE_MAX?
--Andy, who is annoyed every time another pointless TIF_IA32 reference,
even hidden in a macro, makes it into the kernel