4c390211d8
CVE-2017-1000364 (rather bugfix for the original CVE fix): * mm/mmap.c: expand_downwards: don't require the gap if !vm_prev * mm/mmap.c: do not blow on PROT_NONE MAP_FIXED holes in the stack CVE-2017-1000365: fs/exec.c: account for argv/envp pointers CVE-2017-10810: drm/virtio: don't leak bo on drm_gem_object_init failure CVE-2017-7482: rxrpc: Fix several cases where a padded len isn't checked in ticket decode Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
73 lines
2.8 KiB
Diff
73 lines
2.8 KiB
Diff
From 3e4f09eef73ad12d4876e24daf52a0dc0891d7da Mon Sep 17 00:00:00 2001
|
|
From: Michal Hocko <mhocko@suse.com>
|
|
Date: Mon, 17 Jul 2017 14:53:28 +0200
|
|
Subject: [PATCH 1/2] mm/mmap.c: do not blow on PROT_NONE MAP_FIXED holes in
|
|
the stack
|
|
|
|
Commit 1be7107fbe18 ("mm: larger stack guard gap, between vmas") has
|
|
introduced a regression in some rust and Java environments which are
|
|
trying to implement their own stack guard page. They are punching a new
|
|
MAP_FIXED mapping inside the existing stack Vma.
|
|
|
|
This will confuse expand_{downwards,upwards} into thinking that the
|
|
stack expansion would in fact get us too close to an existing non-stack
|
|
vma which is a correct behavior wrt safety. It is a real regression on
|
|
the other hand.
|
|
|
|
Let's work around the problem by considering PROT_NONE mapping as a part
|
|
of the stack. This is a gros hack but overflowing to such a mapping
|
|
would trap anyway an we only can hope that usespace knows what it is
|
|
doing and handle it propely.
|
|
|
|
Fixes: 1be7107fbe18 ("mm: larger stack guard gap, between vmas")
|
|
Link: http://lkml.kernel.org/r/20170705182849.GA18027@dhcp22.suse.cz
|
|
Signed-off-by: Michal Hocko <mhocko@suse.com>
|
|
Debugged-by: Vlastimil Babka <vbabka@suse.cz>
|
|
Cc: Ben Hutchings <ben@decadent.org.uk>
|
|
Cc: Willy Tarreau <w@1wt.eu>
|
|
Cc: Oleg Nesterov <oleg@redhat.com>
|
|
Cc: Rik van Riel <riel@redhat.com>
|
|
Cc: Hugh Dickins <hughd@google.com>
|
|
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
|
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
|
|
CVE-2017-1000364
|
|
|
|
(cherry picked from commit 561b5e0709e4a248c67d024d4d94b6e31e3edf2f)
|
|
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
|
|
Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
|
|
Acked-by: Kamal Mostafa <kamal@canonical.com>
|
|
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|
---
|
|
mm/mmap.c | 6 ++++--
|
|
1 file changed, 4 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/mm/mmap.c b/mm/mmap.c
|
|
index ef78a5ca5599..9fabd8c82f38 100644
|
|
--- a/mm/mmap.c
|
|
+++ b/mm/mmap.c
|
|
@@ -2240,7 +2240,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
|
|
gap_addr = TASK_SIZE;
|
|
|
|
next = vma->vm_next;
|
|
- if (next && next->vm_start < gap_addr) {
|
|
+ if (next && next->vm_start < gap_addr &&
|
|
+ (next->vm_flags & (VM_WRITE|VM_READ|VM_EXEC))) {
|
|
if (!(next->vm_flags & VM_GROWSUP))
|
|
return -ENOMEM;
|
|
/* Check that both stack segments have the same anon_vma? */
|
|
@@ -2324,7 +2325,8 @@ int expand_downwards(struct vm_area_struct *vma,
|
|
if (gap_addr > address)
|
|
return -ENOMEM;
|
|
prev = vma->vm_prev;
|
|
- if (prev && prev->vm_end > gap_addr) {
|
|
+ if (prev && prev->vm_end > gap_addr &&
|
|
+ (prev->vm_flags & (VM_WRITE|VM_READ|VM_EXEC))) {
|
|
if (!(prev->vm_flags & VM_GROWSDOWN))
|
|
return -ENOMEM;
|
|
/* Check that both stack segments have the same anon_vma? */
|
|
--
|
|
2.11.0
|
|
|