x86/mm: Introduce mmap_compat_base() for 32-bit mmap()

mmap() uses a base address, from which it starts to look for a free space
for allocation.

The base address is stored in mm->mmap_base, which is calculated during
exec(). The address depends on task's size, set rlimit for stack, ASLR
randomization. The base depends on the task size and the number of random
bits which are different for 64-bit and 32bit applications.

Due to the fact, that the base address is fixed, its mmap() from a compat
(32bit) syscall issued by a 64bit task will return a address which is based
on the 64bit base address and does not fit into the 32bit address space
(4GB). The returned pointer is truncated to 32bit, which results in an
invalid address.

To solve store a seperate compat address base plus a compat legacy address
base in mm_struct. These bases are calculated at exec() time and can be
used later to address the 32bit compat mmap() issued by 64 bit
applications.

As a consequence of this change 32-bit applications issuing a 64-bit
syscall (after doing a long jump) will get a 64-bit mapping now. Before
this change 32-bit applications always got a 32bit mapping.

[ tglx: Massaged changelog and added a comment ]

Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com>
Cc: 0x7f454c46@gmail.com
Cc: linux-mm@kvack.org
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Cyrill Gorcunov <gorcunov@openvz.org>
Cc: Borislav Petkov <bp@suse.de>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Link: http://lkml.kernel.org/r/20170306141721.9188-4-dsafonov@virtuozzo.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

diff --git a/arch/Kconfig b/arch/Kconfig
index cd211a14a88f7774bec3abbe3b371f0302e624a0..c4d6833aacd98a75a226d337be0d6fb67d80fcd0 100644 (file)
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -700,6 +700,13 @@ config ARCH_MMAP_RND_COMPAT_BITS
          This value can be changed after boot using the
          /proc/sys/vm/mmap_rnd_compat_bits tunable
 
+config HAVE_ARCH_COMPAT_MMAP_BASES
+       bool
+       help
+         This allows 64bit applications to invoke 32-bit mmap() syscall
+         and vice-versa 32-bit applications to call 64-bit mmap().
+         Required for applications doing different bitness syscalls.
+
 config HAVE_COPY_THREAD_TLS
        bool
        help

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index cc98d5a294eee25c56209d92e38bdb08f379780d..2bab9d093b51f24bab576b4c78b9353cbe68a3ec 100644 (file)
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -106,6 +106,7 @@ config X86
        select HAVE_ARCH_KMEMCHECK
        select HAVE_ARCH_MMAP_RND_BITS          if MMU
        select HAVE_ARCH_MMAP_RND_COMPAT_BITS   if MMU && COMPAT
+       select HAVE_ARCH_COMPAT_MMAP_BASES      if MMU && COMPAT
        select HAVE_ARCH_SECCOMP_FILTER
        select HAVE_ARCH_TRACEHOOK
        select HAVE_ARCH_TRANSPARENT_HUGEPAGE

diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index b908141cf0c47388ff8df273883b60b0086391da..ac5be5ba8527921a55cf998c0b3f0f899a737e2e 100644 (file)
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -303,6 +303,9 @@ static inline int mmap_is_ia32(void)
                test_thread_flag(TIF_ADDR32));
 }
 
+extern unsigned long tasksize_32bit(void);
+extern unsigned long tasksize_64bit(void);
+
 #ifdef CONFIG_X86_32
 
 #define __STACK_RND_MASK(is32bit) (0x7ff)

diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
index 50215a4b9347441deb5bb76eb0b5870fc0d60273..c54817baabc7b41dd25cf80b154a25750bcbf1bd 100644 (file)
--- a/arch/x86/kernel/sys_x86_64.c
+++ b/arch/x86/kernel/sys_x86_64.c
@@ -17,6 +17,8 @@
 #include <linux/uaccess.h>
 #include <linux/elf.h>
 
+#include <asm/elf.h>
+#include <asm/compat.h>
 #include <asm/ia32.h>
 #include <asm/syscalls.h>
 
@@ -98,6 +100,18 @@ out:
        return error;
 }
 
+static unsigned long get_mmap_base(int is_legacy)
+{
+       struct mm_struct *mm = current->mm;
+
+#ifdef CONFIG_HAVE_ARCH_COMPAT_MMAP_BASES
+       if (in_compat_syscall())
+               return is_legacy ? mm->mmap_compat_legacy_base
+                                : mm->mmap_compat_base;
+#endif
+       return is_legacy ? mm->mmap_legacy_base : mm->mmap_base;
+}
+
 static void find_start_end(unsigned long flags, unsigned long *begin,
                           unsigned long *end)
 {
@@ -114,10 +128,11 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
                if (current->flags & PF_RANDOMIZE) {
                        *begin = randomize_page(*begin, 0x02000000);
                }
-       } else {
-               *begin = current->mm->mmap_legacy_base;
-               *end = TASK_SIZE;
+               return;
        }
+
+       *begin  = get_mmap_base(1);
+       *end    = in_compat_syscall() ? tasksize_32bit() : tasksize_64bit();
 }
 
 unsigned long
@@ -191,7 +206,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
        info.flags = VM_UNMAPPED_AREA_TOPDOWN;
        info.length = len;
        info.low_limit = PAGE_SIZE;
-       info.high_limit = mm->mmap_base;
+       info.high_limit = get_mmap_base(0);
        info.align_mask = 0;
        info.align_offset = pgoff << PAGE_SHIFT;
        if (filp) {

diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index 1e9cb945dca1ff8c3a934372265ed5518f7f24cc..529ab79800afdbe3cc551e1f3c124684227e38b8 100644 (file)
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -36,11 +36,16 @@ struct va_alignment __read_mostly va_align = {
        .flags = -1,
 };
 
-static inline unsigned long tasksize_32bit(void)
+unsigned long tasksize_32bit(void)
 {
        return IA32_PAGE_OFFSET;
 }
 
+unsigned long tasksize_64bit(void)
+{
+       return TASK_SIZE_MAX;
+}
+
 static unsigned long stack_maxrandom_size(unsigned long task_size)
 {
        unsigned long max = 0;
@@ -81,6 +86,8 @@ static unsigned long arch_rnd(unsigned int rndbits)
 
 unsigned long arch_mmap_rnd(void)
 {
+       if (!(current->flags & PF_RANDOMIZE))
+               return 0;
        return arch_rnd(mmap_is_ia32() ? mmap32_rnd_bits : mmap64_rnd_bits);
 }
 
@@ -114,22 +121,36 @@ static unsigned long mmap_legacy_base(unsigned long rnd,
  * This function, called very early during the creation of a new
  * process VM image, sets up which VM layout function to use:
  */
-void arch_pick_mmap_layout(struct mm_struct *mm)
+static void arch_pick_mmap_base(unsigned long *base, unsigned long *legacy_base,
+               unsigned long random_factor, unsigned long task_size)
 {
-       unsigned long random_factor = 0UL;
-
-       if (current->flags & PF_RANDOMIZE)
-               random_factor = arch_mmap_rnd();
-
-       mm->mmap_legacy_base = mmap_legacy_base(random_factor, TASK_SIZE);
+       *legacy_base = mmap_legacy_base(random_factor, task_size);
+       if (mmap_is_legacy())
+               *base = *legacy_base;
+       else
+               *base = mmap_base(random_factor, task_size);
+}
 
-       if (mmap_is_legacy()) {
-               mm->mmap_base = mm->mmap_legacy_base;
+void arch_pick_mmap_layout(struct mm_struct *mm)
+{
+       if (mmap_is_legacy())
                mm->get_unmapped_area = arch_get_unmapped_area;
-       } else {
-               mm->mmap_base = mmap_base(random_factor, TASK_SIZE);
+       else
                mm->get_unmapped_area = arch_get_unmapped_area_topdown;
-       }
+
+       arch_pick_mmap_base(&mm->mmap_base, &mm->mmap_legacy_base,
+                       arch_rnd(mmap64_rnd_bits), tasksize_64bit());
+
+#ifdef CONFIG_HAVE_ARCH_COMPAT_MMAP_BASES
+       /*
+        * The mmap syscall mapping base decision depends solely on the
+        * syscall type (64-bit or compat). This applies for 64bit
+        * applications and 32bit applications. The 64bit syscall uses
+        * mmap_base, the compat syscall uses mmap_compat_base.
+        */
+       arch_pick_mmap_base(&mm->mmap_compat_base, &mm->mmap_compat_legacy_base,
+                       arch_rnd(mmap32_rnd_bits), tasksize_32bit());
+#endif
 }
 
 const char *arch_vma_name(struct vm_area_struct *vma)

diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index f60f45fe226fcad85590b1eda3fafb1d170e943a..45cdb27791a33ff8d494549ce92f080a93434889 100644 (file)
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -367,6 +367,11 @@ struct mm_struct {
 #endif
        unsigned long mmap_base;                /* base of mmap area */
        unsigned long mmap_legacy_base;         /* base of mmap area in bottom-up allocations */
+#ifdef CONFIG_HAVE_ARCH_COMPAT_MMAP_BASES
+       /* Base adresses for compatible mmap() */
+       unsigned long mmap_compat_base;
+       unsigned long mmap_compat_legacy_base;
+#endif
        unsigned long task_size;                /* size of task vm space */
        unsigned long highest_vm_end;           /* highest vma end address */
        pgd_t * pgd;