Fix compatible mmap() return pointer over 4Gb
Subsystems (6)
v3 cover Fix compatible mmap() return pointer over 4Gb
Changes since v2:
- don't distinguish native and compat tasks by TIF_ADDR32, introduced mmap_compat{_legacy,}_base which allows to treat them the same
- fixed kbuild errors
Changes since v1:
- Recalculate mmap_base instead of using max possible virtual address for compat/native syscall. That will make policy for allocation the same in 32-bit binaries and in 32-bit syscalls in 64-bit binaries. I need this because sys_mmap() in restored 32-bit process shouldn't hit the stack area.
- Fixed mmap() with MAP_32BIT flag in the same usecases
- used in_compat_syscall() helper rather TS_COMPAT check (Andy noticed)
- introduced find_top() helper as suggested by Andy to simplify code
- fixed test error-handeling: it checked the result of sys_mmap() with MMAP_FAILED, which is not correct, as it calls raw syscall - now checks return value to be aligned to PAGE_SIZE.
Description from v1 [2]:
A fix for bug in mmap() that I referenced in [1].
Also selftest for it.
I would like to mark the fix as for stable v4.9 kernel if it'll be accepted, as I try to support compatible 32-bit C/R after v4.9 and working compatible mmap() is really wanted there.
[1]: https://marc.info/?l=linux-kernel&m=148311451525315
[2]: https://marc.info/?l=linux-kernel&m=148415888707662
Dmitry Safonov (5):
x86/mm: split arch_mmap_rnd() on compat/native versions x86/mm: introduce mmap{,_legacy}_base
x86/mm: fix 32-bit mmap() for 64-bit ELF x86/mm: check in_compat_syscall() instead TIF_ADDR32 for
mmap(MAP_32BIT)
selftests/x86: add test to check compat mmap() return addr
arch/Kconfig | 7 + arch/x86/Kconfig | 1 + arch/x86/include/asm/elf.h | 4 +- arch/x86/include/asm/processor.h | 3 +- arch/x86/kernel/sys_x86_64.c | 32 +++- arch/x86/mm/mmap.c | 80 ++++++---- include/linux/mm_types.h | 5 + tools/testing/selftests/x86/Makefile | 2 +- tools/testing/selftests/x86/test_compat_mmap.c | 208 +++++++++++++++++++++++++ 9 files changed, 307 insertions(+), 35 deletions(-) create mode 100644 tools/testing/selftests/x86/test_compat_mmap.c
Signature · 7 lines
2.11.0 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
PATCH v3 1/5 x86/mm: split arch_mmap_rnd() on compat/native versions
I need those arch_{native,compat}_rnd() to compute separately random factor for mmap() in compat syscalls for 64-bit binaries and vice-versa for native syscall in 32-bit compat binaries. They will be used in the following patches.
--- arch/x86/mm/mmap.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-)
arch/x86/mm/mmap.c +16 -9
@@ -65,20 +65,27 @@ static int mmap_is_legacy(void)return sysctl_legacy_va_layout; } -unsigned long arch_mmap_rnd (void ) +#ifdef CONFIG_COMPAT +static unsigned long arch_compat_rnd (void ) { -unsigned long rnd; +return (get_random_long () & ((1UL << mmap_rnd_compat_bits) -1 )) + <<PAGE_SHIFT ; +} +#endif - if (mmap_is_ia32()) +static unsigned long arch_native_rnd (void ) +{ +return (get_random_long () & ((1UL << mmap_rnd_bits) -1 )) <<PAGE_SHIFT ; +} + +unsigned long arch_mmap_rnd (void ) +{#ifdef CONFIG_COMPAT - rnd =get_random_long () & ((1UL << mmap_rnd_compat_bits) -1 ); -#else - rnd =get_random_long () & ((1UL << mmap_rnd_bits) -1 ); +if (mmap_is_ia32 ()) +return arch_compat_rnd ();#endif - else - rnd =get_random_long () & ((1UL << mmap_rnd_bits) -1 ); -return rnd <<PAGE_SHIFT ; +return arch_native_rnd (); }static unsigned long mmap_base (unsigned long rnd)
Signature · 7 lines
2.11.0 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
PATCH v3 2/5 x86/mm: introduce mmap{,_legacy}_base
In reply to Dmitry SafonovIn the following patch they will be used to compute:
- mmap{,_legacy}_base for 64-bit mmap()
- mmap_compat{,_legacy}_base for 32-bit mmap()
This patch makes it possible to calculate mmap bases for any specified task_size, which is needed to correctly choose the base address for mmap in 32-bit syscalls and 64-bit syscalls.
--- arch/x86/include/asm/elf.h | 4 +++- arch/x86/include/asm/processor.h | 3 ++- arch/x86/mm/mmap.c | 32 ++++++++++++++++++++------------ 3 files changed, 25 insertions(+), 14 deletions(-)
arch/x86/include/asm/elf.h +3 -1
@@ -286,6 +286,7 @@ do { \#ifdef CONFIG_X86_32 +#define STACK_RND_MASK_MODE (native) (0x7ff)#define STACK_RND_MASK (0x7ff)#define ARCH_DLINFO ARCH_DLINFO_IA32
@@ -295,7 +296,8 @@ do { \#else /* CONFIG_X86_32 */ /* 1GB for 64bit, 8MB for 32bit */ -#define STACK_RND_MASK (test_thread_flag(TIF_ADDR32) ? 0x7ff : 0x3fffff) +#define STACK_RND_MASK_MODE (native) ((native) ? 0x3fffff : 0x7ff) +#define STACK_RND_MASK STACK_RND_MASK_MODE(!test_thread_flag(TIF_ADDR32))#define ARCH_DLINFO \ do { \
arch/x86/include/asm/processor.h +2 -1
@@ -862,7 +862,8 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip,* This decides where the kernel will search for a free chunk of vm * space during mmap's. */ -#define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3)) +#define _TASK_UNMAPPED_BASE (task_size) (PAGE_ALIGN(task_size / 3)) +#define TASK_UNMAPPED_BASE _TASK_UNMAPPED_BASE(TASK_SIZE)#define KSTK_EIP (task) (task_pt_regs(task)->ip)
arch/x86/mm/mmap.c +20 -12
@@ -35,12 +35,14 @@ struct va_alignment __read_mostly va_align = { .flags = -1, }; -static unsigned long stack_maxrandom_size (void ) +static unsigned long stack_maxrandom_size (unsigned long task_size) {unsigned long max =0 ;if ((current->flags &PF_RANDOMIZE ) && !(current->personality &ADDR_NO_RANDOMIZE )) { - max = ((-1UL ) &STACK_RND_MASK ) <<PAGE_SHIFT ; + max = (-1UL ); + max &=STACK_RND_MASK_MODE (task_size ==TASK_SIZE_MAX ); + max <<=PAGE_SHIFT ; }return max;
@@ -51,8 +53,8 @@ static unsigned long stack_maxrandom_size(void)* * Leave an at least ~128 MB hole with possible stack randomization. */ -#define MIN_GAP (128*1024*1024UL + stack_maxrandom_size()) -#define MAX_GAP (TASK_SIZE/6*5) +#define MIN_GAP (task_size) (128*1024*1024UL + stack_maxrandom_size(task_size)) +#define MAX_GAP (task_size) (task_size/6*5)static int mmap_is_legacy (void ) {
@@ -88,16 +90,22 @@ unsigned long arch_mmap_rnd(void)return arch_native_rnd (); } -static unsigned long mmap_base (unsigned long rnd) +static unsigned long mmap_base (unsigned long rnd,unsigned long task_size) {unsigned long gap =rlimit (RLIMIT_STACK ); -if (gap <MIN_GAP ) - gap =MIN_GAP ; -else if (gap >MAX_GAP ) - gap =MAX_GAP ; +if (gap <MIN_GAP (task_size)) + gap =MIN_GAP (task_size); +else if (gap >MAX_GAP (task_size)) + gap =MAX_GAP (task_size); -return PAGE_ALIGN (TASK_SIZE - gap - rnd); +return PAGE_ALIGN (task_size - gap - rnd); +} + +static unsigned long mmap_legacy_base (unsigned long rnd, +unsigned long task_size) +{ +return _TASK_UNMAPPED_BASE (task_size) + rnd; }/*
@@ -111,13 +119,13 @@ void arch_pick_mmap_layout(struct mm_struct *mm)if (current->flags &PF_RANDOMIZE ) random_factor =arch_mmap_rnd (); - mm->mmap_legacy_base =TASK_UNMAPPED_BASE + random_factor; + mm->mmap_legacy_base =mmap_legacy_base (random_factor,TASK_SIZE );if (mmap_is_legacy ()) { mm->mmap_base = mm->mmap_legacy_base; mm->get_unmapped_area = arch_get_unmapped_area; }else { - mm->mmap_base =mmap_base (random_factor); + mm->mmap_base =mmap_base (random_factor,TASK_SIZE ); mm->get_unmapped_area = arch_get_unmapped_area_topdown; } }
Signature · 7 lines
2.11.0 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
PATCH v3 3/5 x86/mm: fix 32-bit mmap() for 64-bit ELF
In reply to Dmitry SafonovFix 32-bit compat_sys_mmap() mapping VMA over 4Gb in 64-bit binaries and 64-bit sys_mmap() mapping VMA only under 4Gb in 32-bit binaries. Introduced new bases for compat syscalls in mm_struct:mmap_compat_base and mmap_compat_legacy_base for top-down and bottom-up allocations accordingly.
Taught arch_get_unmapped_area{,_topdown}() to use the new mmap_bases in compat syscalls for high/low limits in vm_unmapped_area().
I discovered that bug on ZDTM tests for compat 32-bit C/R. Working compat sys_mmap() in 64-bit binaries is really needed for that purpose, as 32-bit applications are restored from 64-bit CRIU binary.
--- arch/Kconfig | 7 +++++++ arch/x86/Kconfig | 1 + arch/x86/kernel/sys_x86_64.c | 28 ++++++++++++++++++++++++---- arch/x86/mm/mmap.c | 27 ++++++++++++++++++++------- include/linux/mm_types.h | 5 +++++ 5 files changed, 57 insertions(+), 11 deletions(-)
arch/Kconfig +7 -0
@@ -671,6 +671,13 @@ config ARCH_MMAP_RND_COMPAT_BITS This value can be changed after boot using the /proc/sys/vm/mmap_rnd_compat_bits tunable +config HAVE_ARCH_COMPAT_MMAP_BASES + bool + help + If this is set, one program can do native and compatible syscall + mmap() on architecture. Thus kernel has different bases to + compute high and low virtual address limits for allocation. + config HAVE_COPY_THREAD_TLS bool help
arch/x86/Kconfig +1 -0
@@ -102,6 +102,7 @@ config X86 select HAVE_ARCH_KMEMCHECK select HAVE_ARCH_MMAP_RND_BITS if MMU select HAVE_ARCH_MMAP_RND_COMPAT_BITS if MMU && COMPAT + select HAVE_ARCH_COMPAT_MMAP_BASES if MMU && COMPAT select HAVE_ARCH_SECCOMP_FILTER select HAVE_ARCH_TRACEHOOK select HAVE_ARCH_TRANSPARENT_HUGEPAGE
arch/x86/kernel/sys_x86_64.c +24 -4
@@ -16,6 +16,7 @@#include <linux/uaccess.h> #include <linux/elf.h> +#include <asm/compat.h> #include <asm/ia32.h> #include <asm/syscalls.h>
@@ -113,10 +114,19 @@ static void find_start_end(unsigned long flags, unsigned long *begin,if (current->flags &PF_RANDOMIZE ) { *begin =randomize_page (*begin,0x02000000 ); } - }else { - *begin = current->mm->mmap_legacy_base; - *end =TASK_SIZE ; +return ; } + +#ifdef CONFIG_COMPAT +if (in_compat_syscall ()) { + *begin = current->mm->mmap_compat_legacy_base; + *end =IA32_PAGE_OFFSET ; +return ; + } +#endif + + *begin = current->mm->mmap_legacy_base; + *end =TASK_SIZE_MAX ; }unsigned long
@@ -157,6 +167,16 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,return vm_unmapped_area (&info); } +static unsigned long find_top (void ) +{ +#ifdef CONFIG_COMPAT +if (in_compat_syscall ()) +return current->mm->mmap_compat_base; + else +#endif +return current->mm->mmap_base; +} + unsigned long arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, const unsigned long len, const unsigned long pgoff,
@@ -190,7 +210,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, info.flags =VM_UNMAPPED_AREA_TOPDOWN ; info.length = len; info.low_limit =PAGE_SIZE ; - info.high_limit = mm->mmap_base; + info.high_limit =find_top (); info.align_mask =0 ; info.align_offset = pgoff <<PAGE_SHIFT ;if (filp) {
arch/x86/mm/mmap.c +20 -7
@@ -112,6 +112,16 @@ static unsigned long mmap_legacy_base(unsigned long rnd,* This function, called very early during the creation of a new * process VM image, sets up which VM layout function to use: */ +static void arch_pick_mmap_base (unsigned long *base,unsigned long *legacy_base, +unsigned long random_factor,unsigned long task_size) +{ + *legacy_base =mmap_legacy_base (random_factor, task_size); +if (mmap_is_legacy ()) + *base = *legacy_base; +else + *base =mmap_base (random_factor, task_size); +} +void arch_pick_mmap_layout (struct mm_struct *mm) {unsigned long random_factor =0UL ;
@@ -119,15 +129,18 @@ void arch_pick_mmap_layout(struct mm_struct *mm)if (current->flags &PF_RANDOMIZE ) random_factor =arch_mmap_rnd (); - mm->mmap_legacy_base =mmap_legacy_base (random_factor,TASK_SIZE ); - -if (mmap_is_legacy ()) { - mm->mmap_base = mm->mmap_legacy_base; +if (mmap_is_legacy ()) mm->get_unmapped_area = arch_get_unmapped_area; - }else { - mm->mmap_base =mmap_base (random_factor,TASK_SIZE ); +else mm->get_unmapped_area = arch_get_unmapped_area_topdown; - } + +arch_pick_mmap_base (&mm->mmap_base, &mm->mmap_legacy_base, + random_factor,TASK_SIZE_MAX ); + +#ifdef CONFIG_COMPAT +arch_pick_mmap_base (&mm->mmap_compat_base, &mm->mmap_compat_legacy_base, + random_factor,IA32_PAGE_OFFSET ); +#endif }const char *arch_vma_name (struct vm_area_struct *vma)
include/linux/mm_types.h +5 -0
@@ -404,6 +404,11 @@ struct mm_struct {#endif unsigned long mmap_base;/* base of mmap area */ unsigned long mmap_legacy_base;/* base of mmap area in bottom-up allocations */ +#ifdef CONFIG_HAVE_ARCH_COMPAT_MMAP_BASES +/* Base addresses for compatible mmap() */ +unsigned long mmap_compat_base; +unsigned long mmap_compat_legacy_base; +#endif unsigned long task_size;/* size of task vm space */ unsigned long highest_vm_end;/* highest vma end address */ pgd_t * pgd;
Signature · 7 lines
2.11.0 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
PATCH v3 4/5 x86/mm: check in_compat_syscall() instead TIF_ADDR32 for mmap(MAP_32BIT)
In reply to Dmitry SafonovAt this momet, logic in arch_get_unmapped_area{,_topdown} for mmaps with MAP_32BIT flag checks TIF_ADDR32 which means:
o if 32-bit ELF changes mode to 64-bit on x86_64 and then tries to mmap() with MAP_32BIT it'll result in addr over 4Gb (as default is top-down allocation)
o if 64-bit ELF changes mode to 32-bit and tries mmap() with MAP_32BIT, it'll allocate only memory in 1GB space: [0x40000000, 0x80000000).
Fix it by handeling MAP_32BIT in 64-bit syscalls only. As a little bonus it'll make thread flag a little less used.
--- arch/x86/kernel/sys_x86_64.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/kernel/sys_x86_64.c +2 -2
@@ -101,7 +101,7 @@ SYSCALL_DEFINE6(mmap, unsigned long, addr, unsigned long, len,static void find_start_end (unsigned long flags,unsigned long *begin,unsigned long *end) { -if (!test_thread_flag (TIF_ADDR32 ) && (flags &MAP_32BIT )) { +if (!in_compat_syscall () && (flags &MAP_32BIT )) {/* This is usually used needed to map code in small model, so it needs to be in the first 31bit. Limit it to that. This means we need to move the
@@ -195,7 +195,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,return addr;/* for MAP_32BIT mappings we force the legacy mmap base */ -if (!test_thread_flag (TIF_ADDR32 ) && (flags &MAP_32BIT )) +if (!in_compat_syscall () && (flags &MAP_32BIT )) goto bottomup;/* requesting a specific address */
Signature · 7 lines
2.11.0 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
PATCH v3 5/5 selftests/x86: add test to check compat mmap() return addr
In reply to Dmitry SafonovWe can't just add segfault handler and use addr, returned by compat mmap() syscall, because the lower 4 bytes can be the same as already existed VMA. So, the test parses /proc/self/maps file, founds new VMAs those appeared after compatible sys_mmap() and checks if mmaped VMA is in that list.
On failure it prints:
[NOTE] Allocated mmap 0x6f36a000, sized 0x400000
[NOTE] New mapping appeared: 0x7f936f36a000
[FAIL] Found VMA [0x7f936f36a000, 0x7f936f76a000] in maps file, that was allocated with compat syscall
--- tools/testing/selftests/x86/Makefile | 2 +- tools/testing/selftests/x86/test_compat_mmap.c | 208 +++++++++++++++++++++++++ 2 files changed, 209 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/x86/test_compat_mmap.c
tools/testing/selftests/x86/Makefile +1 -1
@@ -10,7 +10,7 @@ TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt ptrace_sysc TARGETS_C_32BIT_ONLY := entry_from_vm86 syscall_arg_fault test_syscall_vdso unwind_vdso \ test_FCMOV test_FCOMI test_FISTTP \ vdso_restorer -TARGETS_C_64BIT_ONLY := fsgsbase +TARGETS_C_64BIT_ONLY := fsgsbase test_compat_mmap TARGETS_C_32BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_32BIT_ONLY) TARGETS_C_64BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_64BIT_ONLY)
tools/testing/selftests/x86/test_compat_mmap.c new file +208 -0
208 lines not on this page · raw message
Signature · 7 lines
2.11.0 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"[email protected]"> [email protected] </a>