Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757478AbbKRX0X (ORCPT ); Wed, 18 Nov 2015 18:26:23 -0500 Received: from mail-io0-f174.google.com ([209.85.223.174]:35723 "EHLO mail-io0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757400AbbKRXZy (ORCPT ); Wed, 18 Nov 2015 18:25:54 -0500 MIME-Version: 1.0 In-Reply-To: <1447886901-26098-5-git-send-email-dcashman@android.com> References: <1447886901-26098-1-git-send-email-dcashman@android.com> <1447886901-26098-2-git-send-email-dcashman@android.com> <1447886901-26098-3-git-send-email-dcashman@android.com> <1447886901-26098-4-git-send-email-dcashman@android.com> <1447886901-26098-5-git-send-email-dcashman@android.com> Date: Wed, 18 Nov 2015 15:25:52 -0800 X-Google-Sender-Auth: hRKcD88hjgASC8cZ-xTcPZNCEa0 Message-ID: Subject: Re: [PATCH 4/4] x86: mm: support ARCH_MMAP_RND_BITS. From: Kees Cook To: Daniel Cashman Cc: LKML , Russell King - ARM Linux , Andrew Morton , Ingo Molnar , "linux-arm-kernel@lists.infradead.org" , Jonathan Corbet , Don Zickus , "Eric W. Biederman" , Heinrich Schuchardt , jpoimboe@redhat.com, "Kirill A. Shutemov" , n-horiguchi@ah.jp.nec.com, Andrea Arcangeli , Mel Gorman , Thomas Gleixner , David Rientjes , Linux-MM , "linux-doc@vger.kernel.org" , Mark Salyzyn , Jeffrey Vander Stoep , Nick Kralevich , Catalin Marinas , Will Deacon , "H. Peter Anvin" , "x86@kernel.org" , Hector Marco , Borislav Petkov , Daniel Cashman Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3163 Lines: 97 On Wed, Nov 18, 2015 at 2:48 PM, Daniel Cashman wrote: > From: dcashman > > x86: arch_mmap_rnd() uses hard-coded values, 8 for 32-bit and 28 for > 64-bit, to generate the random offset for the mmap base address. > This value represents a compromise between increased ASLR > effectiveness and avoiding address-space fragmentation. Replace it > with a Kconfig option, which is sensibly bounded, so that platform > developers may choose where to place this compromise. Keep default > values as new minimums. > > Signed-off-by: Daniel Cashman > --- > arch/x86/Kconfig | 16 ++++++++++++++++ > arch/x86/mm/mmap.c | 12 ++++++------ > 2 files changed, 22 insertions(+), 6 deletions(-) > > diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig > index db3622f..12768c4 100644 > --- a/arch/x86/Kconfig > +++ b/arch/x86/Kconfig > @@ -82,6 +82,8 @@ config X86 > select HAVE_ARCH_KASAN if X86_64 && SPARSEMEM_VMEMMAP > select HAVE_ARCH_KGDB > select HAVE_ARCH_KMEMCHECK > + select HAVE_ARCH_MMAP_RND_BITS > + select HAVE_ARCH_MMAP_RND_COMPAT_BITS if COMPAT > select HAVE_ARCH_SECCOMP_FILTER > select HAVE_ARCH_SOFT_DIRTY if X86_64 > select HAVE_ARCH_TRACEHOOK > @@ -183,6 +185,20 @@ config HAVE_LATENCYTOP_SUPPORT > config MMU > def_bool y > > +config ARCH_MMAP_RND_BITS_MIN > + default 28 if 64BIT > + default 8 > + > +config ARCH_MMAP_RND_BITS_MAX > + default 32 if 64BIT > + default 16 > + > +config ARCH_MMAP_RND_COMPAT_BITS_MIN > + default 8 > + > +config ARCH_MMAP_RND_COMPAT_BITS_MAX > + default 16 > + > config SBUS > bool > > diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c > index 844b06d..647fecf 100644 > --- a/arch/x86/mm/mmap.c > +++ b/arch/x86/mm/mmap.c > @@ -69,14 +69,14 @@ unsigned long arch_mmap_rnd(void) > { > unsigned long rnd; > > - /* > - * 8 bits of randomness in 32bit mmaps, 20 address space bits > - * 28 bits of randomness in 64bit mmaps, 40 address space bits > - */ > if (mmap_is_ia32()) > - rnd = (unsigned long)get_random_int() % (1<<8); > +#ifdef CONFIG_COMPAT > + rnd = (unsigned long)get_random_int() % (1 << mmap_rnd_compat_bits); > +#else > + rnd = (unsigned long)get_random_int() % (1 << mmap_rnd_bits); > +#endif Oh, that is a weird side-effect of x86's compat: a 32-bit build isn't compat, so it needs the native bits. I'm trying to resist bikeshedding the names again, so probably this should stay as-is. -Kees > else > - rnd = (unsigned long)get_random_int() % (1<<28); > + rnd = (unsigned long)get_random_int() % (1 << mmap_rnd_bits); > > return rnd << PAGE_SHIFT; > } > -- > 2.6.0.rc2.230.g3dd15c0 > -- Kees Cook Chrome OS Security -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/