Patch "ARM: 8320/1: fix integer overflow in ELF_ET_DYN_BASE" has been added to the 3.10-stable tree

This is a note to let you know that I've just added the patch titled

ARM: 8320/1: fix integer overflow in ELF_ET_DYN_BASE

to the 3.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:

     arm-8320-1-fix-integer-overflow-in-elf_et_dyn_base.patch

and it can be found in the queue-3.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Andrey Ryabinin <[email protected]>
Date: Fri, 20 Mar 2015 15:42:27 +0100
Subject: ARM: 8320/1: fix integer overflow in ELF_ET_DYN_BASE

From: Andrey Ryabinin <[email protected]>

commit 8defb3367fcd19d1af64c07792aade0747b54e0f upstream.

Usually ELF_ET_DYN_BASE is 2/3 of TASK_SIZE. With 3G/1G user/kernel split this is not so, because 2*TASK_SIZE overflows 32 bits, so the actual value of ELF_ET_DYN_BASE is:

	(2 * TASK_SIZE / 3) = 0x2a000000

When ASLR is disabled PIE binaries will load at ELF_ET_DYN_BASE address. On 32bit platforms AddressSanitzer uses addresses [0x20000000 - 0x40000000] for shadow memory [1]. So ASan doesn't work for PIE binaries when ASLR disabled as it fails to map shadow memory.
Also after Kees's 'split ET_DYN ASLR from mmap ASLR' patchset PIE binaries has a high chance of loading somewhere in between [0x2a000000 - 0x40000000] even if ASLR enabled. This makes ASan with PIE absolutely incompatible.

Fix overflow by dividing TASK_SIZE prior to multiplying. After this patch ELF_ET_DYN_BASE equals to (for CONFIG_VMSPLIT_3G=y):

	(TASK_SIZE / 3 * 2) = 0x7f555554

[1] https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm#Mapping

---
 arch/arm/include/asm/elf.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -116,7 +116,7 @@ int dump_task_regs(struct task_struct *t
    the loader.  We need to make sure that it is out of the way of the program
    that it will "exec", and that there is sufficient room for the brk.  */
 
-#define ELF_ET_DYN_BASE	(2 * TASK_SIZE / 3)
+#define ELF_ET_DYN_BASE	(TASK_SIZE / 3 * 2)
 
 /* When the program starts, a1 contains a pointer to a function to be 
    registered with atexit, as per the SVR4 ABI.  A value of 0 means we 

Patches currently in stable-queue which might be from [email protected] are

queue-3.10/arm-8320-1-fix-integer-overflow-in-elf_et_dyn_base.patch