Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752190AbdGEGgy (ORCPT ); Wed, 5 Jul 2017 02:36:54 -0400 Received: from mx2.suse.de ([195.135.220.15]:33956 "EHLO mx1.suse.de" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750868AbdGEGgx (ORCPT ); Wed, 5 Jul 2017 02:36:53 -0400 Date: Wed, 5 Jul 2017 08:36:46 +0200 From: Michal Hocko To: Linus Torvalds Cc: Ben Hutchings , Willy Tarreau , Hugh Dickins , Oleg Nesterov , "Jason A. Donenfeld" , Rik van Riel , Larry Woodman , "Kirill A. Shutemov" , Tony Luck , "James E.J. Bottomley" , Helge Diller , James Hogan , Laura Abbott , Greg KH , "security@kernel.org" , linux-distros@vs.openwall.org, Qualys Security Advisory , LKML , Ximin Luo Subject: Re: [PATCH] mm: larger stack guard gap, between vmas Message-ID: <20170705063645.GA10354@dhcp22.suse.cz> References: <1498042057.2655.8.camel@decadent.org.uk> <1499126133.2707.20.camel@decadent.org.uk> <20170704084122.GC14722@dhcp22.suse.cz> <20170704093538.GF14722@dhcp22.suse.cz> <20170704094728.GB22013@1wt.eu> <20170704104211.GG14722@dhcp22.suse.cz> <20170704113611.GA4732@decadent.org.uk> <1499209315.2707.29.camel@decadent.org.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1420 Lines: 36 On Tue 04-07-17 16:31:52, Linus Torvalds wrote: > On Tue, Jul 4, 2017 at 4:01 PM, Ben Hutchings wrote: > > > > We have: > > > > bottom = 0xff803fff > > sp = 0xffffb178 > > > > The relevant mappings are: > > > > ff7fc000-ff7fd000 rwxp 00000000 00:00 0 > > fffdd000-ffffe000 rw-p 00000000 00:00 0 [stack] > > Ugh. So that stack is actually 8MB in size, but the alloca() is about > to use up almost all of it, and there's only about 28kB left between > "bottom" and that 'rwx' mapping. > > Still, that rwx mapping is interesting: it is a single page, and it > really is almost exactly 8MB below the stack. > > In fact, the top of stack (at 0xffffe000) is *exactly* 8MB+4kB from > the top of that odd one-page allocation (0xff7fd000). Very interesting! I would be really curious whether changing ulimit to something bigger changes the picture. And if this is really the case what we are going to do here. We can special case a single page mapping under the stack but that sounds quite dangerous for something that is dubious in itself. PROT_NONE would explicitly fault but we would simply run over this mapping too easily and who knows what might end up below it. So to me the guard gap does its job here. Do you want me to post the earier patch to ignore PROT_NONE mapping or we should rather wait for this one to get more details? -- Michal Hocko SUSE Labs