Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1946083AbaD3UFx (ORCPT ); Wed, 30 Apr 2014 16:05:53 -0400 Received: from mail-oa0-f41.google.com ([209.85.219.41]:58463 "EHLO mail-oa0-f41.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1946002AbaD3UFv (ORCPT ); Wed, 30 Apr 2014 16:05:51 -0400 MIME-Version: 1.0 In-Reply-To: References: <53554CDA.1060806@mentor.com> <5357EABB.3070400@zytor.com> <5357F310.8090600@mentor.com> Date: Wed, 30 Apr 2014 13:05:51 -0700 Message-ID: Subject: Re: randomized placement of x86_64 vdso From: Kees Cook To: Andy Lutomirski Cc: Nathan Lynch , "H. Peter Anvin" , "x86@kernel.org" , LKML Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Apr 30, 2014 at 11:30 AM, Andy Lutomirski wrote: > On Wed, Apr 30, 2014 at 11:13 AM, Kees Cook wrote: >> On Wed, Apr 30, 2014 at 10:52 AM, Andy Lutomirski wrote: >>> On Wed, Apr 30, 2014 at 10:47 AM, Kees Cook wrote: >>>> On Wed, Apr 23, 2014 at 10:06 AM, Nathan Lynch wrote: >>>>> On 04/23/2014 11:30 AM, H. Peter Anvin wrote: >>>>>> On 04/21/2014 09:52 AM, Nathan Lynch wrote: >>>>>>> Hi x86/vdso people, >>>>>>> >>>>>>> I've been working on adding a vDSO to 32-bit ARM, and Kees suggested I >>>>>>> look at x86_64's algorithm for placing the vDSO at a randomized offset >>>>>>> above the stack VMA. I found that when the stack top occupies the >>>>>>> last slot in the PTE (is that the right term?), the vdso_addr routine >>>>>>> returns an address below mm->start_stack, equivalent to >>>>>>> (mm->start_stack & PAGE_MASK). For instance if mm->start_stack is >>>>>>> 0x7fff3ffffc96, vdso_addr returns 0x7fff3ffff000. >>>>>>> >>>>>>> Since the address returned is always already occupied by the stack, >>>>>>> get_unmapped_area detects the collision and falls back to >>>>>>> vm_unmapped_area. This results in the vdso being placed in the >>>>>>> address space next to libraries etc. While this is generally >>>>>>> unnoticeable and doesn't break anything, it does mean that the vdso is >>>>>>> placed below the stack when there is actually room above the stack. >>>>>>> To me it also seems uncomfortably close to placing the vdso in the way >>>>>>> of downward expansion of the stack. >>>>>>> >>>>>>> I don't have a patch because I'm not sure what the algorithm should >>>>>>> be, but thought I would bring it up as vdso_addr doesn't seem to be >>>>>>> behaving as intended in all cases. >>>>>>> >>>>>> >>>>>> If the stack occupies the last possible page, how can you say there is >>>>>> "space above the stack"? >>>>> >>>>> Sorry for being unclear. I probably am getting terminology wrong. What >>>>> I'm trying to express is that if the stack top is in the last page of >>>>> its last-level page table (which may be the last possible page, but >>>>> that's not really the interesting case), vdso_addr returns an address >>>>> below mm->start_stack. >>>> >>>> It seems like this is avoidable, then? From your example, it seems >>>> like we lose the separated randomization in this case, but we don't >>>> need to? Do you have a suggestion for what could be done to fix this? >>> >>> I don't understand why the vDSO should be special here. Either the >>> standard logic for randomizing the placement of DSOs is good, in which >>> case it should be good for the vDSO too, or I think we should fix it >>> for everything. >> >> The issue is specific to the vdso randomizing-near-the-stack code; >> regular mmap randomization is operating correctly. The reason for >> randomizing stack, vdso, and mmap separately is to avoid correlation >> of leaked offsets in one to the other regions. > > I understand why the offset from the stack to the vDSO should be > randomized, and why the offset from the stack to, say, glibc should be > randomized. What I don't get is why the offset from glibc to the vDSO > should be randomized but the offset from glibc to openssl should be > deterministic. Or am I misunderstanding? Sure, I agree. In a perfect world, every DSO would have unrelated offsets. Ignoring that for the moment, my take on this is that stack, vDSO, and mmap have their locations tracked/exposed separately (SP register, AUXV, and syscall return respectively). As such, they should have separate randomization to avoid having any one method lead to the discovery of all the offsets (i.e. the vDSO location is communicated to the process in a different way than other DSOs that come into the process via the mmap syscall). As for per-mmap randomization, I would love this, but no one has proposed algorithms that aren't worse than single base offset randomization. This is especially true under 32-bit where attempting to balance the randomization against fragmentation just leads to non-random locations under certain situations/processes/DSOs, etc. It could be worth revisiting this for 64-bit, but I feel like it's not a high priority. -Kees -- Kees Cook Chrome OS Security -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/