Hugh Dickins 1be7107fbe mm: larger stack guard gap, between vmas ... Stack guard page is a useful feature to reduce a risk of stack smashing into a different mapping. We have been using a single page gap which is sufficient to prevent having stack adjacent to a different mapping. But this seems to be insufficient in the light of the stack usage in userspace. E.g. glibc uses as large as 64kB alloca() in many commonly used functions. Others use constructs liks gid_t buffer[NGROUPS_MAX] which is 256kB or stack strings with MAX_ARG_STRLEN. This will become especially dangerous for suid binaries and the default no limit for the stack size limit because those applications can be tricked to consume a large portion of the stack and a single glibc call could jump over the guard page. These attacks are not theoretical, unfortunatelly. Make those attacks less probable by increasing the stack guard gap to 1MB (on systems with 4k pages; but make it depend on the page size because systems with larger base pages might cap stack allocations in the PAGE_SIZE units) which should cover larger alloca() and VLA stack allocations. It is obviously not a full fix because the problem is somehow inherent, but it should reduce attack space a lot. One could argue that the gap size should be configurable from userspace, but that can be done later when somebody finds that the new 1MB is wrong for some special case applications. For now, add a kernel command line option (stack_guard_gap) to specify the stack gap size (in page units). Implementation wise, first delete all the old code for stack guard page: because although we could get away with accounting one extra page in a stack vma, accounting a larger gap can break userspace - case in point, a program run with "ulimit -S -v 20000" failed when the 1MB gap was counted for RLIMIT_AS; similar problems could come with RLIMIT_MLOCK and strict non-overcommit mode. Instead of keeping gap inside the stack vma, maintain the stack guard gap as a gap between vmas: using vm_start_gap() in place of vm_start (or vm_end_gap() in place of vm_end if VM_GROWSUP) in just those few places which need to respect the gap - mainly arch_get_unmapped_area(), and and the vma tree's subtree_gap support for that. Original-patch-by: Oleg Nesterov <oleg@redhat.com> Original-patch-by: Michal Hocko <mhocko@suse.com> Signed-off-by: Hugh Dickins <hughd@google.com> Acked-by: Michal Hocko <mhocko@suse.com> Tested-by: Helge Deller <deller@gmx.de> # parisc Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2017-06-19 21:50:20 +08:00
..
ABI	pci-v4.12-changes	2017-05-08 19:03:25 -07:00
DocBook	char/misc patches for 4.12-rc1	2017-05-04 19:15:35 -07:00
EDID	drm: use .hword to represent 16-bit numbers	2017-03-30 10:15:19 +02:00
PCI	pci-v4.12-changes	2017-05-08 19:03:25 -07:00
RCU	Merge branches 'doc.2017.04.12a', 'fixes.2017.04.19a' and 'srcu.2017.04.21a' into HEAD	2017-04-21 06:00:13 -07:00
accounting	tools: move accounting tool from Documentation	2016-09-23 13:07:15 -06:00
acpi	Merge branches 'acpi-button' and 'acpi-tools'	2017-05-22 20:29:06 +02:00
admin-guide	mm: larger stack guard gap, between vmas	2017-06-19 21:50:20 +08:00
aoe	…
arm	ARM: SoC platform updates	2017-05-09 09:49:36 -07:00
arm64	arm64: documentation: document tagged pointer stack constraints	2017-05-09 17:43:18 +01:00
auxdisplay	samples: move auxdisplay example code from Documentation	2016-09-23 11:52:32 -06:00
backlight	…
blackfin	samples: move blackfin gptimers-example from Documentation	2016-10-10 07:12:02 -06:00
block	block, bfq: stress that low_latency must be off to get max throughput	2017-05-10 07:39:43 -06:00
blockdev	remove the mg_disk driver	2017-04-14 14:00:49 -06:00
bus-devices	…
cdrom	cdrom: Make device operations read-only	2017-02-14 08:29:56 -07:00
cgroup-v1	Merge branch 'for-4.11' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup	2017-02-27 21:41:08 -08:00
cma	…
connector	…
console	…
core-api	docs-rst: core_api: move driver-specific stuff to drivers_api	2017-04-02 14:17:43 -06:00
cpu-freq	cpufreq: intel_pstate: Document the current behavior and user interface	2017-05-14 02:06:03 +02:00
cpuidle	…
cris	…
crypto	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2017-05-03 08:50:52 -07:00
dev-tools	scripts/spelling.txt: add "disble(d)" pattern and fix typo instances	2017-03-09 17:01:09 -08:00
device-mapper	- A major update for DM cache that reduces the latency for deciding	2017-05-03 10:31:20 -07:00
devicetree	USB fixes for 4.12-rc5	2017-06-11 11:23:10 -07:00
dmaengine	dmaengine: Documentation: Fix typo in pxa_dma.txt	2016-11-14 08:14:24 +05:30
doc-guide	docs-rst: automatically convert Graphviz and SVG images	2017-03-09 02:59:26 -07:00
driver-api	char/misc patches for 4.12-rc1	2017-05-04 19:15:35 -07:00
driver-model	PCI: Implement devm_pci_remap_cfgspace()	2017-04-24 13:53:13 -05:00
early-userspace	Documentation: Fix dead URLs to ftp.kernel.org	2017-03-29 15:46:06 -06:00
extcon	extcon: Remove porting compatibility of swich class	2017-04-06 10:55:24 +09:00
fault-injection	…
fb	…
features	powerpc updates for 4.12 part 1.	2017-05-05 11:36:44 -07:00
filesystems	Tigran has moved	2017-05-12 15:57:15 -07:00
firmware_class	firmware: revamp firmware documentation	2017-01-11 09:42:59 +01:00
fmc	…
fpga	fpga: Add scatterlist based programming	2017-02-10 15:20:44 +01:00
frv	docs: fix locations of several documents that got moved	2016-10-24 08:12:35 -02:00
gpio	gpio: return NULL from gpiod_get_optional when GPIOLIB is disabled	2017-03-15 11:16:30 +01:00
gpu	drm: Document code of conduct	2017-05-05 11:48:17 +10:00
hid	Documentation: hid: fix path to input bus definitions	2017-03-13 17:15:19 -06:00
hwmon	drivers: hwmon: Support for ASPEED PWM/Fan tach	2017-04-10 13:12:18 -07:00
i2c	i2c: i801: Add support for Intel Gemini Lake	2017-02-09 17:39:16 +01:00
ia64	selftests: move ia64 tests from Documentation/ia64	2016-09-20 09:58:12 -06:00
ide	…
iio	iio: Documentation: Correct the path used to create triggers.	2016-10-01 00:49:58 -06:00
infiniband	IB/opa-vnic: Virtual Network Interface Controller (VNIC) documentation	2017-04-20 12:01:06 -04:00
input	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input	2017-05-26 16:45:13 -07:00
ioctl	TEE driver infrastructure and OP-TEE drivers	2017-05-10 11:20:09 -07:00
isdn	docs: fix locations of several documents that got moved	2016-10-24 08:12:35 -02:00
kbuild	uapi: export all arch specifics directories	2017-05-11 00:22:17 +09:00
kdump	Documentation: kdump: describe arm64 port	2017-04-05 18:32:32 +01:00
laptops	platform/x86: thinkpad_acpi: Add support for X1 Yoga (2016) Tablet Mode	2016-12-13 09:29:06 -08:00
leds	Documentaion: leds: leds-lp55xx.txt: Fix typos	2017-03-17 13:06:14 -06:00
lightnvm	lightnvm: physical block device (pblk) target	2017-04-16 10:06:33 -06:00
livepatch	livepatch: allow removal of a disabled patch	2017-03-08 09:38:43 +01:00
locking	locking/ww_mutex/Documentation: Update the design document	2017-01-14 11:14:55 +01:00
m68k	docs: fix locations of several documents that got moved	2016-10-24 08:12:35 -02:00
md	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md	2017-05-03 10:05:38 -07:00
media	media updates for v4.12-rc1	2017-05-05 17:34:57 -07:00
memory-devices	…
metag	…
mic	samples: move mic/mpssd example code from Documentation	2016-09-20 12:38:48 -06:00
mips	…
misc-devices	Documentation: misc-devices: Add Documentation for pci-endpoint-test driver	2017-04-28 10:23:19 -05:00
mmc	MMC core:	2017-05-02 17:34:32 -07:00
mn10300	…
mtd	spi-nor: Add support for Intel SPI serial flash controller	2017-01-03 17:33:36 +00:00
namespaces	…
netlabel	…
networking	net: fix up hash documentation	2017-06-07 13:00:41 -04:00
nfc	…
nios2	…
nvdimm	…
nvmem	…
parisc	…
pcmcia	tools: move pcmcia crc32hash tool from Documentation	2016-09-23 13:07:27 -06:00
perf	perf: qcom: Add L3 cache PMU driver	2017-04-03 18:53:50 +01:00
phy	…
platform	…
power	A reasonably busy cycle for documentation this time around. There is a new	2017-05-02 10:21:17 -07:00
powerpc	powerpc/fadump: update documentation about crashkernel parameter reuse	2017-05-08 17:15:11 -07:00
pps	Doc: clarify source of jitter in USB1.1, and USB2.0	2017-01-04 14:40:52 -07:00
prctl	selftests: move prctl tests from Documentation/prctl	2016-09-20 09:09:09 -06:00
process	docs: complete bumping minimal GNU Make version to 3.81	2017-05-06 18:49:09 -07:00
pti	…
ptp	selftests: move ptp tests from Documentation/ptp	2016-09-20 09:54:38 -06:00
rapidio	rapidio/documentation/mport_cdev: add missing parameter description	2016-09-01 17:52:02 -07:00
s390	docs: add documentation for vfio-ccw	2017-03-31 12:55:11 +02:00
scheduler	sched/Documentation: Add 'sched-pelt' tool	2017-04-14 10:26:35 +02:00
scsi	scsi: make asynchronous aborts mandatory	2017-04-06 13:07:33 -04:00
security	KEYS: add SP800-56A KDF support for DH	2017-04-04 22:33:38 +01:00
serial	Documentation: rs485: Do not define manually the ioctl	2016-08-18 11:08:33 -06:00
sh	…
sound	ALSA: hda - Update the list of quirk models	2017-05-22 16:42:02 +02:00
sparc	Documentation/sparc: Steps for sending break on sunhv console	2017-02-23 08:27:25 -08:00
sphinx	tmplcvt: make the tool more robust	2017-04-11 14:35:15 -06:00
sphinx-static	This is the documentation update pull for the 4.9 merge window.	2016-10-04 13:54:07 -07:00
spi	spi: spi-ep93xx: simplify GPIO chip selects	2017-02-16 20:10:26 +00:00
sysctl	Replace 2 jiffies with sysctl netdev_budget_usecs to enable softirq tuning	2017-04-21 13:22:34 -04:00
target	Documentation/target: add an example script to configure an iSCSI target	2017-05-01 22:21:35 -07:00
thermal	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux	2017-05-12 11:58:45 -07:00
timers	time: Remove CONFIG_TIMER_STATS	2017-02-10 11:15:08 +01:00
trace	New features for this release:	2017-05-03 18:41:21 -07:00
translations	docs: update references to the device io book	2017-05-09 13:44:56 -06:00
usb	doc-rst: fixed kernel-doc directives in usb/typec.rst	2017-05-17 11:52:44 +02:00
userspace-api	docs: Convert unshare.txt to RST and add to the user-space API manual	2017-04-02 15:18:32 -06:00
virtual	Second round of KVM/ARM Changes for v4.12.	2017-05-09 12:51:49 +02:00
vm	Documentation/vm/transhuge.txt: fix trivial typos	2017-05-08 17:15:14 -07:00
w1	w1: add documentation for w1_ds2438	2017-03-17 15:10:49 +09:00
watchdog	iTCO_wdt: all versions count down twice	2017-05-19 10:42:11 +02:00
wimax	…
x86	x86/intel_rdt: Fix a typo in Documentation	2017-05-09 09:41:42 +02:00
xtensa	xtensa: cleanup MMU setup and kernel layout macros	2016-07-24 06:33:58 +03:00
.gitignore	…
00-INDEX	Documentation: tee subsystem and op-tee driver	2017-03-10 14:51:57 +01:00
Changes	docs: add back 'Documentation/Changes' file (as symlink)	2016-12-14 16:30:12 -08:00
CodingStyle	doc: re-add CodingStyle and SubmittingPatches	2016-10-24 08:12:35 -02:00
DMA-API-HOWTO.txt	Documentation: DMA-API-HOWTO: Fix a typo	2016-09-20 17:58:46 -06:00
DMA-API.txt	dma-mapping: add dma_{map,unmap}_resource	2016-09-26 22:16:41 +05:30
DMA-ISA-LPC.txt	Documentation: DMA-ISA-LPC.txt	2017-02-12 15:20:07 -07:00
DMA-attributes.txt	common: DMA-mapping: add DMA_ATTR_PRIVILEGED attribute	2017-01-19 15:56:19 +00:00
IPMI.txt	Documentation: Fix a typo in IPMI.txt.	2017-01-05 15:01:54 -06:00
IRQ-affinity.txt	…
IRQ-domain.txt	…
IRQ.txt	…
Intel-IOMMU.txt	…
Makefile	samples: move blackfin gptimers-example from Documentation	2016-10-10 07:12:02 -06:00
Makefile.sphinx	Add a target to check broken external links in the Documentation	2017-02-15 15:22:47 -07:00
SAK.txt	…
SM501.txt	…
SubmittingPatches	doc: re-add CodingStyle and SubmittingPatches	2016-10-24 08:12:35 -02:00
bcache.txt	…
bt8xxgpio.txt	…
btmrvl.txt	…
bus-virt-phys-mapping.txt	…
cachetlb.txt	…
cgroup-v2.txt	mm, docs: update memory.stat description with workingset* entries	2017-05-12 15:57:16 -07:00
circular-buffers.txt	Documentation: circular-buffers: use READ_ONCE()	2016-11-16 16:17:45 -07:00
clk.txt	Documentation: clk: update file names containing referenced structures	2016-08-14 12:12:36 -06:00
conf.py	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input	2017-05-03 12:38:20 -07:00
cpu-load.txt	…
cputopology.txt	docs: Fix a couple typos	2017-04-27 15:54:39 -06:00
crc32.txt	…
dcdbas.txt	…
debugging-modules.txt	…
debugging-via-ohci1394.txt	docs: Fix a couple typos	2017-04-27 15:54:39 -06:00
dell_rbu.txt	…
digsig.txt	…
docutils.conf	doc-rst: add docutils config file	2016-08-14 11:52:40 -06:00
dontdiff	Documentation: dontdiff: Update with additional entries	2017-01-26 15:08:06 -07:00
efi-stub.txt	…
eisa.txt	…
flexible-arrays.txt	…
futex-requeue-pi.txt	…
gcc-plugins.txt	gcc-plugins: update architecture list in documentation	2017-03-21 22:20:05 +11:00
highuid.txt	…
hw_random.txt	…
hwspinlock.txt	…
index.rst	docs-rst: add input docs at main index and use kernel-figure	2017-05-09 13:36:02 -06:00
intel_txt.txt	…
io-mapping.txt	…
io_ordering.txt	…
iostats.txt	…
irqflags-tracing.txt	…
isa.txt	…
isapnp.txt	…
kernel-doc-nano-HOWTO.txt	docs-rst: doc-guide: split the kernel-documentation.rst contents	2016-11-19 10:22:04 -07:00
kernel-per-CPU-kthreads.txt	docs: fix locations of several documents that got moved	2016-10-24 08:12:35 -02:00
kobject.txt	…
kprobes.txt	Documentation: kprobes: Document jprobes stack copying limitations	2016-08-15 10:19:11 -06:00
kref.txt	Revert "kref: double kref_put() in my_data_handler()"	2017-04-08 18:38:10 +02:00
kselftest.txt	scripts/spelling.txt: add "an user" pattern and fix typo instances	2017-02-27 18:43:46 -08:00
ldm.txt	…
lockup-watchdogs.txt	docs: fix locations of several documents that got moved	2016-10-24 08:12:35 -02:00
logo.gif	…
logo.txt	…
lzo.txt	…
mailbox.txt	…
memory-barriers.txt	Connect the newly RST-formatted documentation to the rest; this had to wait	2017-05-11 11:29:52 -07:00
memory-hotplug.txt	scripts/spelling.txt: add "followings" pattern and fix typo instances	2017-02-27 18:43:47 -08:00
men-chameleon-bus.txt	…
nommu-mmap.txt	…
ntb.txt	…
numastat.txt	…
padata.txt	…
parport-lowlevel.txt	…
percpu-rw-semaphore.txt	…
phy.txt	Documentation: phy: Fix repetition of word 'the'	2017-03-09 00:33:15 -07:00
pi-futex.txt	…
pinctrl.txt	pinctrl: core: Fix pinctrl_register_and_init() with pinctrl_enable()	2017-04-07 01:08:08 +02:00
pnp.txt	…
preempt-locking.txt	…
printk-formats.txt	…
pwm.txt	…
rbtree.txt	…
remoteproc.txt	remoteproc: Split driver and consumer dereferencing	2016-10-02 22:50:21 -07:00
rfkill.txt	docs: fix locations of several documents that got moved	2016-10-24 08:12:35 -02:00
robust-futex-ABI.txt	…
robust-futexes.txt	…
rpmsg.txt	…
rtc.txt	…
sgi-ioc4.txt	…
siphash.txt	siphash: implement HalfSipHash1-3 for hash tables	2017-01-09 13:58:57 -05:00
smsc_ece1099.txt	…
static-keys.txt	docs: Fix a couple typos	2017-04-27 15:54:39 -06:00
svga.txt	…
switchtec.txt	switchtec: Add IOCTLs to the Switchtec driver	2017-04-12 12:23:37 -05:00
sync_file.txt	Documentation: sync_file.txt: Fix typos	2017-03-17 13:03:36 -06:00
tee.txt	Documentation: tee subsystem and op-tee driver	2017-03-10 14:51:57 +01:00
this_cpu_ops.txt	…
unaligned-memory-access.txt	Documentation/unaligned-memory-access.txt: fix incorrect comparison operator	2016-12-27 13:08:42 -07:00
vfio-mediated-device.txt	docs: Fix a spelling error in vfio-mediated-device.txt	2017-04-27 15:54:39 -06:00
vfio.txt	…
video-output.txt	…
xillybus.txt	…
xz.txt	…
zorro.txt	docs: Fix a couple typos	2017-04-27 15:54:39 -06:00