From patchwork Mon Nov 13 10:12:57 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Helge Deller X-Patchwork-Id: 164396 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b909:0:b0:403:3b70:6f57 with SMTP id t9csp1105670vqg; Mon, 13 Nov 2023 02:13:26 -0800 (PST) X-Google-Smtp-Source: AGHT+IHmfidNTfwoUQq1eqOa/nNSmQnZCmJSxt23EZNOnLG0v9lc4widyxmmGav7vWf7dpcQ7h6I X-Received: by 2002:a17:902:d301:b0:1cc:9215:497f with SMTP id b1-20020a170902d30100b001cc9215497fmr3954922plc.69.1699870406663; Mon, 13 Nov 2023 02:13:26 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1699870406; cv=none; d=google.com; s=arc-20160816; b=qbNH2AaRMVT626xM10pCaEVqJrhh+W1Zym09yA441TCV0Ef2SZtEH3PsvSJAiKjcsN Z3QNIjA7R/vQnjZk2xyTmri0Mzl3ofJNBhAQKOwn9837n5zzsmCEuj9K8HPYFy3T338R b8tHIamc4GHn/6jEW07P3ynEoYjEdVn6MpjHqWmEXdGglxU13KWmgMOw+ZchQhiE9X4R DnlFWZpbdp4nl1jvxChXbg8mf9QCOIDBjuF5spnTMVz3Yp27N3fcpeHPqQd1antasnXL HkzUEAnqDtLCGdufKbwyWF5l/Q/d982tQJNsEcz3AaegOcy5GXjEaOqPQNttYPomAHOj yD3A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-disposition:mime-version:message-id :subject:cc:to:from:date; bh=+NZcE0idT0kZsvnI2MCkJfEXeXKFWe89WHPiD80m90g=; fh=NZOjDdD0yz95u6bePtKEPtZ0f05Ls4ozWa4PNpbBgC0=; b=E+f0nJjQdkpyIbKlA7B3F07LLUd4ZGKjYiiQEOIos2ISQHLClsyKmVCw0RG3CEa0XM Y/Ok/oUjP/8wxil/9rbgI9eentv8l8vc6krMI93wH96Dm92ITpYiOWcOStCPUc8SCrvw 8lYNneF6bP3YUGT7LqNw9qmVo/iLIivAPlI/IJJwpDQ7T8I+Den8HnS3WhL21gzZr1ve itpBN9mRlTZdZFNQP6aflD2dyAvQhxSnUAh/Oq7EWKXWnROOuFczhRwTqZFCumIU3RXI WPCbTGjV+lYUY2txOTVtqzRxW/Mblc32ntjf6pATbIOWtS0QQAMsns/QKRju1T4lLRdS BtnA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:2 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=gmx.de Received: from agentk.vger.email (agentk.vger.email. [2620:137:e000::3:2]) by mx.google.com with ESMTPS id ju14-20020a170903428e00b001ca529e3d29si5004994plb.168.2023.11.13.02.13.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Nov 2023 02:13:26 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:2 as permitted sender) client-ip=2620:137:e000::3:2; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:2 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=gmx.de Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by agentk.vger.email (Postfix) with ESMTP id 3AF0F805EADD; Mon, 13 Nov 2023 02:13:24 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at agentk.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229489AbjKMKNJ (ORCPT + 29 others); Mon, 13 Nov 2023 05:13:09 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37210 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229546AbjKMKNI (ORCPT ); Mon, 13 Nov 2023 05:13:08 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 38327D79; Mon, 13 Nov 2023 02:13:02 -0800 (PST) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 67EA3C433C8; Mon, 13 Nov 2023 10:13:00 +0000 (UTC) Date: Mon, 13 Nov 2023 11:12:57 +0100 From: Helge Deller To: Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-parisc@vger.kernel.org Cc: matoro Subject: [PATCH] parisc: Fix mmap_base calculation when stack grows upwards Message-ID: MIME-Version: 1.0 Content-Disposition: inline X-Spam-Status: No, score=-0.5 required=5.0 tests=FREEMAIL_FORGED_FROMDOMAIN, FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on agentk.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (agentk.vger.email [0.0.0.0]); Mon, 13 Nov 2023 02:13:24 -0800 (PST) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1782443311206530326 X-GMAIL-MSGID: 1782443311206530326 Matoro reported various userspace crashes on the parisc platform with kernel 6.6 and bisected it to commit 3033cd430768 ("parisc: Use generic mmap top-down layout and brk randomization"). That commit switched parisc to use the common infrastructure to calculate mmap_base, but missed that the mmap_base() function takes care for architectures where the stack grows downwards only. Fix the mmap_base() calculation to include the stack-grows-upwards case and thus fix the userspace crashes on parisc. Reported-by: matoro Signed-off-by: Helge Deller Tested-by: matoro Fixes: 3033cd430768 ("parisc: Use generic mmap top-down layout and brk randomization") Cc: # v6.6+ diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig index fd69dfa0cdab..a7c9c0e69e5a 100644 --- a/arch/parisc/Kconfig +++ b/arch/parisc/Kconfig @@ -140,11 +140,11 @@ config ARCH_MMAP_RND_COMPAT_BITS_MIN default 8 config ARCH_MMAP_RND_BITS_MAX - default 24 if 64BIT - default 17 + default 18 if 64BIT + default 13 config ARCH_MMAP_RND_COMPAT_BITS_MAX - default 17 + default 13 # unless you want to implement ACPI on PA-RISC ... ;-) config PM diff --git a/arch/parisc/include/asm/elf.h b/arch/parisc/include/asm/elf.h index 140eaa97bf21..2d73d3c3cd37 100644 --- a/arch/parisc/include/asm/elf.h +++ b/arch/parisc/include/asm/elf.h @@ -349,15 +349,7 @@ struct pt_regs; /* forward declaration... */ #define ELF_HWCAP 0 -/* Masks for stack and mmap randomization */ -#define BRK_RND_MASK (is_32bit_task() ? 0x07ffUL : 0x3ffffUL) -#define MMAP_RND_MASK (is_32bit_task() ? 0x1fffUL : 0x3ffffUL) -#define STACK_RND_MASK MMAP_RND_MASK - -struct mm_struct; -extern unsigned long arch_randomize_brk(struct mm_struct *); -#define arch_randomize_brk arch_randomize_brk - +#define STACK_RND_MASK 0x7ff /* 8MB of VA */ #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1 struct linux_binprm; diff --git a/arch/parisc/include/asm/processor.h b/arch/parisc/include/asm/processor.h index c05d121cf5d0..982aca20f56f 100644 --- a/arch/parisc/include/asm/processor.h +++ b/arch/parisc/include/asm/processor.h @@ -47,6 +47,8 @@ #ifndef __ASSEMBLY__ +struct rlimit; +unsigned long mmap_upper_limit(struct rlimit *rlim_stack); unsigned long calc_max_stack_size(unsigned long stack_max); /* diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c index ab896eff7a1d..98af719d5f85 100644 --- a/arch/parisc/kernel/sys_parisc.c +++ b/arch/parisc/kernel/sys_parisc.c @@ -77,7 +77,7 @@ unsigned long calc_max_stack_size(unsigned long stack_max) * indicating that "current" should be used instead of a passed-in * value from the exec bprm as done with arch_pick_mmap_layout(). */ -static unsigned long mmap_upper_limit(struct rlimit *rlim_stack) +unsigned long mmap_upper_limit(struct rlimit *rlim_stack) { unsigned long stack_base; diff --git a/mm/util.c b/mm/util.c index aa01f6ea5a75..744b4d7e3fae 100644 --- a/mm/util.c +++ b/mm/util.c @@ -414,6 +414,15 @@ static int mmap_is_legacy(struct rlimit *rlim_stack) static unsigned long mmap_base(unsigned long rnd, struct rlimit *rlim_stack) { +#ifdef CONFIG_STACK_GROWSUP + /* + * For an upwards growing stack the calculation is much simpler. + * Memory for the maximum stack size is reserved at the top of the + * task. mmap_base starts directly below the stack and grows + * downwards. + */ + return PAGE_ALIGN_DOWN(mmap_upper_limit(rlim_stack) - rnd); +#else unsigned long gap = rlim_stack->rlim_cur; unsigned long pad = stack_guard_gap; @@ -431,6 +440,7 @@ static unsigned long mmap_base(unsigned long rnd, struct rlimit *rlim_stack) gap = MAX_GAP; return PAGE_ALIGN(STACK_TOP - gap - rnd); +#endif } void arch_pick_mmap_layout(struct mm_struct *mm, struct rlimit *rlim_stack)