Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752854AbdGEUxu (ORCPT ); Wed, 5 Jul 2017 16:53:50 -0400 Received: from mail-pg0-f48.google.com ([74.125.83.48]:35284 "EHLO mail-pg0-f48.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752253AbdGEUxs (ORCPT ); Wed, 5 Jul 2017 16:53:48 -0400 Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) Subject: Re: [PATCH] mm: larger stack guard gap, between vmas From: Andy Lutomirski X-Mailer: iPhone Mail (14F89) In-Reply-To: <1499283163.2707.52.camel@decadent.org.uk> Date: Wed, 5 Jul 2017 13:53:46 -0700 Cc: Andy Lutomirski , Linus Torvalds , Michal Hocko , Willy Tarreau , Hugh Dickins , Oleg Nesterov , "Jason A. Donenfeld" , Rik van Riel , Larry Woodman , "Kirill A. Shutemov" , Tony Luck , "James E.J. Bottomley" , Helge Diller , James Hogan , Laura Abbott , Greg KH , "security@kernel.org" , Qualys Security Advisory , LKML , Ximin Luo Message-Id: References: <1499126133.2707.20.camel@decadent.org.uk> <20170704084122.GC14722@dhcp22.suse.cz> <20170704093538.GF14722@dhcp22.suse.cz> <20170704094728.GB22013@1wt.eu> <20170704104211.GG14722@dhcp22.suse.cz> <20170704113611.GA4732@decadent.org.uk> <1499209315.2707.29.camel@decadent.org.uk> <1499257180.2707.34.camel@decadent.org.uk> <20170705142354.GB21220@dhcp22.suse.cz> <1499283163.2707.52.camel@decadent.org.uk> To: Ben Hutchings Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by nfs id v65Krwgd009263 Content-Length: 2111 Lines: 49 > On Jul 5, 2017, at 12:32 PM, Ben Hutchings wrote: > >> On Wed, 2017-07-05 at 10:23 -0700, Andy Lutomirski wrote: >> [...] >> Looking at it that way, I think a new inherited-on-exec flag is nucking futs. >> >> I'm starting to think that the right approach is to mostly revert all >> this stuff (the execve fixes are fine). Then start over and think >> about it as hardening. I would suggest the following approach: >> >> - The stack gap is one page, just like it's been for years. > > Given that in the following points you say that something sounding like > a stack gap would be "64k or whatever", what does "the stack gap" mean > in this first point? I mean one page, with semantics as close to previous (4.11) behavior as practical. > >> - As a hardening feature, if the stack would expand within 64k or >> whatever of a non-MAP_FIXED mapping, refuse to expand it. (This might >> have to be a non-hinted mapping, not just a non-MAP_FIXED mapping.) >> The idea being that, if you deliberately place a mapping under the >> stack, you know what you're doing. If you're like LibreOffice and do >> something daft and are thus exploitable, you're on your own. >> - As a hardening measure, don't let mmap without MAP_FIXED position >> something within 64k or whatever of the bottom of the stack unless a >> MAP_FIXED mapping is between them. > > Having tested patches along these lines, I think the above would avoid > the reported regressions. > FWIW, even this last part may be problematic. It'll break anything that tries to allocate many small MAP_GROWSDOWN stacks on 32-bit. Hopefully nothing does this, but maybe Java does. > Ben. > >> And that's all. It's not like a 64k gap actually fixes these bugs for >> real -- it just makes them harder to exploit. >> >> [1] The code that GCC generates for char buf[bug number] and alloca() >> is flat-out wrong. Everyone who's ever thought about it all all knows >> it and has known about it for years, but no one cared to fix it. > -- > Ben Hutchings > Anthony's Law of Force: Don't force it, get a larger hammer. >