Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753386AbdGEUlX (ORCPT ); Wed, 5 Jul 2017 16:41:23 -0400 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:32785 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752608AbdGEUlW (ORCPT ); Wed, 5 Jul 2017 16:41:22 -0400 Date: Wed, 5 Jul 2017 22:40:56 +0200 From: Willy Tarreau To: Ben Hutchings Cc: Andy Lutomirski , Linus Torvalds , Michal Hocko , Hugh Dickins , Oleg Nesterov , "Jason A. Donenfeld" , Rik van Riel , Larry Woodman , "Kirill A. Shutemov" , Tony Luck , "James E.J. Bottomley" , Helge Diller , James Hogan , Laura Abbott , Greg KH , "security@kernel.org" , Qualys Security Advisory , LKML , Ximin Luo Subject: Re: [PATCH] mm: larger stack guard gap, between vmas Message-ID: <20170705204056.GD24760@1wt.eu> References: <20170704104211.GG14722@dhcp22.suse.cz> <20170704113611.GA4732@decadent.org.uk> <1499209315.2707.29.camel@decadent.org.uk> <1499257180.2707.34.camel@decadent.org.uk> <20170705142354.GB21220@dhcp22.suse.cz> <1499283163.2707.52.camel@decadent.org.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <1499283163.2707.52.camel@decadent.org.uk> User-Agent: Mutt/1.6.1 (2016-04-27) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1152 Lines: 21 On Wed, Jul 05, 2017 at 08:32:43PM +0100, Ben Hutchings wrote: > > ?- As a hardening feature, if the stack would expand within 64k or > > whatever of a non-MAP_FIXED mapping, refuse to expand it.??(This might > > have to be a non-hinted mapping, not just a non-MAP_FIXED mapping.) > > The idea being that, if you deliberately place a mapping under the > > stack, you know what you're doing.??If you're like LibreOffice and do > > something daft and are thus exploitable, you're on your own. > > ?- As a hardening measure, don't let mmap without MAP_FIXED position > > something within 64k or whatever of the bottom of the stack unless a > > MAP_FIXED mapping is between them. > > Having tested patches along these lines, I think the above would avoid > the reported regressions. Stuff like this has already been proposed but Linus suspects that more software than we imagine uses MAP_FIXED and could break. I cannot infirm nor confirm, and that probably indicates that there's nothing fundamentally wrong with this approach from the userland's perspective and that it could indeed imply such software may be more common than we would like it. Willy