MIME-Version: 1.0
In-Reply-To: <CALCETrXze8cL8yr82E8VzoSm59DD04SGNC5AxYj9mS4+M8-uPg@mail.gmail.com>
References: <53554CDA.1060806@mentor.com>
	<5357EABB.3070400@zytor.com>
	<5357F310.8090600@mentor.com>
	<CAGXu5jKqvmn++UvaYxnN+QRxezv9W4E64ZaAbfTvVJmmyi9L6Q@mail.gmail.com>
	<CALCETrXze8cL8yr82E8VzoSm59DD04SGNC5AxYj9mS4+M8-uPg@mail.gmail.com>
Date: Wed, 30 Apr 2014 11:13:46 -0700
Message-ID: <CAGXu5j+96t-AgFj6cy1L1cOLM54nkiiWnpiqWgFemBaP80cR6Q@mail.gmail.com>
Subject: Re: randomized placement of x86_64 vdso
From: Kees Cook <keescook@google.com>
To: Andy Lutomirski <luto@amacapital.net>
Cc: Nathan Lynch <Nathan_Lynch@mentor.com>, "H. Peter Anvin" <hpa@zytor.com>,
        "x86@kernel.org" <x86@kernel.org>, LKML <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset=UTF-8
Sender: linux-kernel-owner@vger.kernel.org

On Wed, Apr 30, 2014 at 10:52 AM, Andy Lutomirski <luto@amacapital.net> wrote:
> On Wed, Apr 30, 2014 at 10:47 AM, Kees Cook <keescook@google.com> wrote:
>> On Wed, Apr 23, 2014 at 10:06 AM, Nathan Lynch <Nathan_Lynch@mentor.com> wrote:
>>> On 04/23/2014 11:30 AM, H. Peter Anvin wrote:
>>>> On 04/21/2014 09:52 AM, Nathan Lynch wrote:
>>>>> Hi x86/vdso people,
>>>>>
>>>>> I've been working on adding a vDSO to 32-bit ARM, and Kees suggested I
>>>>> look at x86_64's algorithm for placing the vDSO at a randomized offset
>>>>> above the stack VMA.  I found that when the stack top occupies the
>>>>> last slot in the PTE (is that the right term?), the vdso_addr routine
>>>>> returns an address below mm->start_stack, equivalent to
>>>>> (mm->start_stack & PAGE_MASK).  For instance if mm->start_stack is
>>>>> 0x7fff3ffffc96, vdso_addr returns 0x7fff3ffff000.
>>>>>
>>>>> Since the address returned is always already occupied by the stack,
>>>>> get_unmapped_area detects the collision and falls back to
>>>>> vm_unmapped_area.  This results in the vdso being placed in the
>>>>> address space next to libraries etc.  While this is generally
>>>>> unnoticeable and doesn't break anything, it does mean that the vdso is
>>>>> placed below the stack when there is actually room above the stack.
>>>>> To me it also seems uncomfortably close to placing the vdso in the way
>>>>> of downward expansion of the stack.
>>>>>
>>>>> I don't have a patch because I'm not sure what the algorithm should
>>>>> be, but thought I would bring it up as vdso_addr doesn't seem to be
>>>>> behaving as intended in all cases.
>>>>>
>>>>
>>>> If the stack occupies the last possible page, how can you say there is
>>>> "space above the stack"?
>>>
>>> Sorry for being unclear.  I probably am getting terminology wrong.  What
>>> I'm trying to express is that if the stack top is in the last page of
>>> its last-level page table (which may be the last possible page, but
>>> that's not really the interesting case), vdso_addr returns an address
>>> below mm->start_stack.
>>
>> It seems like this is avoidable, then? From your example, it seems
>> like we lose the separated randomization in this case, but we don't
>> need to? Do you have a suggestion for what could be done to fix this?
>
> I don't understand why the vDSO should be special here.  Either the
> standard logic for randomizing the placement of DSOs is good, in which
> case it should be good for the vDSO too, or I think we should fix it
> for everything.

The issue is specific to the vdso randomizing-near-the-stack code;
regular mmap randomization is operating correctly. The reason for
randomizing stack, vdso, and mmap separately is to avoid correlation
of leaked offsets in one to the other regions.

-Kees

-- 
Kees Cook
Chrome OS Security
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/