Skip to content

Commit

Permalink
arm: factor out mmap ASLR into mmap_rnd
Browse files Browse the repository at this point in the history
To address the "offset2lib" ASLR weakness[1], this separates ET_DYN ASLR
from mmap ASLR, as already done on s390.  The architectures that are
already randomizing mmap (arm, arm64, mips, powerpc, s390, and x86), have
their various forms of arch_mmap_rnd() made available via the new
CONFIG_ARCH_HAS_ELF_RANDOMIZE.  For these architectures,
arch_randomize_brk() is collapsed as well.

This is an alternative to the solutions in:
https://lkml.org/lkml/2015/2/23/442

I've been able to test x86 and arm, and the buildbot (so far) seems happy
with building the rest.

[1] http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html

This patch (of 10):

In preparation for splitting out ET_DYN ASLR, this moves the ASLR
calculations for mmap on ARM into a separate routine, similar to x86.
This also removes the redundant check of personality (PF_RANDOMIZE is
already set before calling arch_pick_mmap_layout).

Signed-off-by: Kees Cook <[email protected]>
Cc: Hector Marco-Gisbert <[email protected]>
Cc: Russell King <[email protected]>
Reviewed-by: Ingo Molnar <[email protected]>
Cc: Catalin Marinas <[email protected]>
Cc: Will Deacon <[email protected]>
Cc: Ralf Baechle <[email protected]>
Cc: Benjamin Herrenschmidt <[email protected]>
Cc: Paul Mackerras <[email protected]>
Cc: Michael Ellerman <[email protected]>
Cc: Martin Schwidefsky <[email protected]>
Cc: Heiko Carstens <[email protected]>
Cc: Alexander Viro <[email protected]>
Cc: Oleg Nesterov <[email protected]>
Cc: Andy Lutomirski <[email protected]>
Cc: "David A. Long" <[email protected]>
Cc: Andrey Ryabinin <[email protected]>
Cc: Arun Chandran <[email protected]>
Cc: Yann Droneaud <[email protected]>
Cc: Min-Hua Chen <[email protected]>
Cc: Paul Burton <[email protected]>
Cc: Alex Smith <[email protected]>
Cc: Markos Chandras <[email protected]>
Cc: Vineeth Vijayan <[email protected]>
Cc: Jeff Bailey <[email protected]>
Cc: Michael Holzheu <[email protected]>
Cc: Ben Hutchings <[email protected]>
Cc: Behan Webster <[email protected]>
Cc: Ismael Ripoll <[email protected]>
Cc: Jan-Simon Mller <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
  • Loading branch information
kees authored and torvalds committed Apr 14, 2015
1 parent a87938b commit fbbc400
Showing 1 changed file with 12 additions and 4 deletions.
16 changes: 12 additions & 4 deletions arch/arm/mm/mmap.c
Original file line number Diff line number Diff line change
Expand Up @@ -169,14 +169,22 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
return addr;
}

static unsigned long mmap_rnd(void)
{
unsigned long rnd;

/* 8 bits of randomness in 20 address space bits */
rnd = (unsigned long)get_random_int() % (1 << 8);

return rnd << PAGE_SHIFT;
}

void arch_pick_mmap_layout(struct mm_struct *mm)
{
unsigned long random_factor = 0UL;

/* 8 bits of randomness in 20 address space bits */
if ((current->flags & PF_RANDOMIZE) &&
!(current->personality & ADDR_NO_RANDOMIZE))
random_factor = (get_random_int() % (1 << 8)) << PAGE_SHIFT;
if (current->flags & PF_RANDOMIZE)
random_factor = mmap_rnd();

if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
Expand Down

0 comments on commit fbbc400

Please sign in to comment.