From patchwork Thu Jun 22 18:06:29 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 9805075 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id B5C0560329 for ; Thu, 22 Jun 2017 18:07:53 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id ACFEA2870B for ; Thu, 22 Jun 2017 18:07:53 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A18FB2870D; Thu, 22 Jun 2017 18:07:53 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [65.50.211.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 282222870B for ; Thu, 22 Jun 2017 18:07:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=PjIbPs4rHWsT7bAWgtALXNRju0VPdV0GY4G5m1/YF8g=; b=VM74MwRRx32EzWg2Wh34Jbfjeg 4fz1JQds9PTjUDlNnjfEfAw5BO+Gk11lBIKYJsp8AMcOn8/GeP2kBSmW+TdqGF0Nk89SeXQe5YNEb hgmxlFljfno03djQ5ANCu/UGvvasIXnupg/lVMkDeZzZOJH0E0Gtrkvy5e2bJoH3p0b1KllPDwtm0 ikEZqOGbzjZ3fz6FjqTSsCY8pZXIsW/opNfP4+MQ124QofGHsi0Qme5lQDWDDydbSjkPM6ywBEpa/ r7E7DuiXAXu4BP3hian8cSU+HXlQz2nCmaes+JkeclOVAZSCyxPd8vUz0lunElcFfx3qsulJNyYHq h2FUlvkA==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.87 #1 (Red Hat Linux)) id 1dO6WE-0008JI-21; Thu, 22 Jun 2017 18:07:50 +0000 Received: from mail-pf0-x22f.google.com ([2607:f8b0:400e:c00::22f]) by bombadil.infradead.org with esmtps (Exim 4.87 #1 (Red Hat Linux)) id 1dO6VT-0007GJ-J8 for linux-arm-kernel@lists.infradead.org; Thu, 22 Jun 2017 18:07:05 +0000 Received: by mail-pf0-x22f.google.com with SMTP id s66so12099525pfs.1 for ; Thu, 22 Jun 2017 11:06:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=8wM+oph3TYL2oF4q0ZAWR3D3chNkuca6SyJ/2DwkoJ4=; b=dj3PvZXil5G6wIiMqRZnDGnphRKHS8wbcL3CJhY46+IseP4wgzIsooJUzkts8Fvm55 Hq3VTumxnwv0lb92wWBhtsAT4HrhQ6QBHdWyZf1o7dztTHc6pPZyg5tSAwEIuWJBt8n0 Nq/nTWJETloyjMlyuXFYZk5JeQFqkmMsfKo3U= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=8wM+oph3TYL2oF4q0ZAWR3D3chNkuca6SyJ/2DwkoJ4=; b=DmamBigeTivI+v5STGFxhahyBslV+vm/4q2upirUrXcezFpUslBRREHrTw8dOkUr8e sVGmR/pkNcJwIM4G35sF/VKQZoI2MdIYSlymwVddrUmSkvgfcfQFpRkkorK5xl+JZM1m yJElo52WN6PC9ZJCWm53dnNNp+FbCtJiynMF2gvMvxgCCjek27D8epuw2YGsKYydp0Ry R6xtVBqJ1aoKcjEOPPQxxv/rDP6aRo5e7tzhFdRpARI9KbmBbMrN6aOQbvlpY4veDxfU um07rrCxdCBZm4VtYAcB7XyPQpHo1fmt6V5A1fA2u5aSrTa4bYhVR53X+JGKD4287g7H KTKg== X-Gm-Message-State: AKS2vOzNLwX/AgyaKWHM7IKAO1WPLDcQuHe57t20vblWBWlxsuNt/46l H2yLhEiRJdgk2n3N X-Received: by 10.84.218.198 with SMTP id g6mr4289446plm.132.1498154802670; Thu, 22 Jun 2017 11:06:42 -0700 (PDT) Received: from www.outflux.net (173-164-112-133-Oregon.hfc.comcastbusiness.net. [173.164.112.133]) by smtp.gmail.com with ESMTPSA id y15sm732312pgs.33.2017.06.22.11.06.39 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 22 Jun 2017 11:06:40 -0700 (PDT) From: Kees Cook To: Andrew Morton Subject: [PATCH 1/4] arm: Reduce ELF_ET_DYN_BASE Date: Thu, 22 Jun 2017 11:06:29 -0700 Message-Id: <1498154792-49952-2-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1498154792-49952-1-git-send-email-keescook@chromium.org> References: <1498154792-49952-1-git-send-email-keescook@chromium.org> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20170622_110703_790368_25D2D752 X-CRM114-Status: GOOD ( 12.31 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Pratyush Anand , linux-s390@vger.kernel.org, James Hogan , Kees Cook , Heiko Carstens , kernel-hardening@lists.openwall.com, Catalin Marinas , Will Deacon , Russell King , linux-kernel@vger.kernel.org, Paul Mackerras , Michael Ellerman , Benjamin Herrenschmidt , Martin Schwidefsky , linux-arch@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, Ingo Molnar , linux-arm-kernel@lists.infradead.org MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP Now that explicitly executed loaders are loaded in the mmap region, position PIE binaries lower in the address space to avoid possible collisions with mmap or stack regions. Signed-off-by: Kees Cook --- arch/arm/include/asm/elf.h | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h index d2315ffd8f12..f13ae153fb24 100644 --- a/arch/arm/include/asm/elf.h +++ b/arch/arm/include/asm/elf.h @@ -112,12 +112,8 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs); #define CORE_DUMP_USE_REGSET #define ELF_EXEC_PAGESIZE 4096 -/* This is the location that an ET_DYN program is loaded if exec'ed. Typical - use of this is to invoke "./ld.so someprog" to test out a new version of - the loader. We need to make sure that it is out of the way of the program - that it will "exec", and that there is sufficient room for the brk. */ - -#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2) +/* This is the base location for PIE (ET_DYN with INTERP) loads. */ +#define ELF_ET_DYN_BASE 0x400000UL /* When the program starts, a1 contains a pointer to a function to be registered with atexit, as per the SVR4 ABI. A value of 0 means we