Re: [regression v2.6.38] Re: [PATCH v2] brk: fix min_brk lower boundcomputation for COMPAT_BRK

[Geert Uytterhoeven]

On Wed, Apr 6, 2011 at 22:08, Jiri Kosina <jkosina@xxxxxxx> wrote:
> On Tue, 29 Mar 2011, Geert Uytterhoeven wrote:
>
>> I managed to reproduce it inside ARAnyM, by chrooting into the ramdisk image.
>> After adding strace, "strace /sbin/init" for the success case gives:

[...]

>> Seems like the binary doesn't like brk() rounding up the requested
>> value to the next page...
>
> Could you please test with the patch below? Thanks.

This seems to work. Thanks!

> From: Jiri Kosina <jkosina@xxxxxxx>
> Subject: [PATCH] brk: COMPAT_BRK needs more special handling of legacy applications
>
> 5520e89 ("brk: fix min_brk lower bound computation for COMPAT_BRK")
> tried to get the whole logic of brk randomization for legacy (libc5-based)
> applications finally right.
>
> It turns out that the way to detect whether brk has actually been
> randomized or not introduced by that patch still doesn't work for those
> binaries, as reported by Geert.
>
> I don't like it, but currently see no better option than a bit flag in
> task_struct to catch the CONFIG_COMPAT_BRK && randomize_va_space == 2
> case.
>
> Reported-by: Geert Uytterhoeven <geert@xxxxxxxxxxxxxx>
> NOT-YET-Signed-off-by: Jiri Kosina <jkosina@xxxxxxx>
> ---
> Âfs/binfmt_elf.c    |  Â6 +++++-
> Âinclude/linux/sched.h | Â Â3 +++
> Âmm/mmap.c       |  Â2 +-
> Â3 files changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> index f34078d..303983f 100644
> --- a/fs/binfmt_elf.c
> +++ b/fs/binfmt_elf.c
> @@ -941,9 +941,13 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
> Â Â Â Âcurrent->mm->start_stack = bprm->p;
>
> Â#ifdef arch_randomize_brk
> - Â Â Â if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1))
> + Â Â Â if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
> Â Â Â Â Â Â Â Âcurrent->mm->brk = current->mm->start_brk =
> Â Â Â Â Â Â Â Â Â Â Â Âarch_randomize_brk(current->mm);
> +#ifdef CONFIG_COMPAT_BRK
> + Â Â Â Â Â Â Â current->brk_randomized = 1;
> +#endif
> + Â Â Â }
> Â#endif
>
> Â Â Â Âif (current->personality & MMAP_PAGE_ZERO) {
> diff --git a/include/linux/sched.h b/include/linux/sched.h
> index 83bd2e2..239d2fe 100644
> --- a/include/linux/sched.h
> +++ b/include/linux/sched.h
> @@ -1254,6 +1254,9 @@ struct task_struct {
> Â#endif
>
> Â Â Â Âstruct mm_struct *mm, *active_mm;
> +#ifdef CONFIG_COMPAT_BRK
> + Â Â Â unsigned brk_randomized:1;
> +#endif
> Â#if defined(SPLIT_RSS_COUNTING)
>    Âstruct task_rss_stat  Ârss_stat;
> Â#endif
> diff --git a/mm/mmap.c b/mm/mmap.c
> index 2ec8eb5..318ed2d 100644
> --- a/mm/mmap.c
> +++ b/mm/mmap.c
> @@ -259,7 +259,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
> Â Â Â Â * randomize_va_space to 2, which will still cause mm->start_brk
> Â Â Â Â * to be arbitrarily shifted
> Â Â Â Â */
> - Â Â Â if (mm->start_brk > PAGE_ALIGN(mm->end_data))
> + Â Â Â if (current->brk_randomized)
> Â Â Â Â Â Â Â Âmin_brk = mm->start_brk;
> Â Â Â Âelse
> Â Â Â Â Â Â Â Âmin_brk = mm->end_data;
> --
> 1.7.3.1

Gr{oetje,eeting}s,

            Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@xxxxxxxxxxxxxx

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
             Â Â -- Linus Torvalds
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/