summaryrefslogtreecommitdiff
path: root/sys/compat/linux32
diff options
context:
space:
mode:
authormaxv <maxv@NetBSD.org>2016-08-06 15:13:13 +0000
committermaxv <maxv@NetBSD.org>2016-08-06 15:13:13 +0000
commite9652cc8f54db6dcd4c193f4e40483cb6584d55a (patch)
treefb8e61eadaef9418db6607ac35bf74a3fef7bb7a /sys/compat/linux32
parent0a5021b0b53c08657631480fee108c5c833635f9 (diff)
The way the kernel tries to prevent a userland process from allocating page
zero is hugely flawed. It is easy to demonstrate that one can trick UVM into chosing a NULL hint after the user_va0_disable check from uvm_map. Such a bypass allows kernel NULL pointer dereferences to be exploitable on architectures with a shared userland<->kernel VA, like amd64. Fix this by increasing the limit of the vm space made available for userland processes. This way, UVM will never chose a NULL hint, since it would be outside of the vm space. The user_va0_disable sysctl still controls this feature.
Diffstat (limited to 'sys/compat/linux32')
-rw-r--r--sys/compat/linux32/common/linux32_exec_elf32.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/compat/linux32/common/linux32_exec_elf32.c b/sys/compat/linux32/common/linux32_exec_elf32.c
index 24399aa6ae6..19ed2980f41 100644
--- a/sys/compat/linux32/common/linux32_exec_elf32.c
+++ b/sys/compat/linux32/common/linux32_exec_elf32.c
@@ -1,4 +1,4 @@
-/* $NetBSD: linux32_exec_elf32.c,v 1.18 2015/03/20 20:36:27 maxv Exp $ */
+/* $NetBSD: linux32_exec_elf32.c,v 1.19 2016/08/06 15:13:13 maxv Exp $ */
/*-
* Copyright (c) 1995, 1998, 2000, 2001,2006 The NetBSD Foundation, Inc.
@@ -31,7 +31,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: linux32_exec_elf32.c,v 1.18 2015/03/20 20:36:27 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: linux32_exec_elf32.c,v 1.19 2016/08/06 15:13:13 maxv Exp $");
#define ELFSIZE 32
@@ -93,7 +93,7 @@ ELFNAME2(linux32,probe)(struct lwp *l, struct exec_package *epp,
#endif
epp->ep_flags |= EXEC_32 | EXEC_FORCEAUX;
- epp->ep_vm_minaddr = VM_MIN_ADDRESS;
+ epp->ep_vm_minaddr = exec_vm_minaddr(VM_MIN_ADDRESS);
epp->ep_vm_maxaddr = USRSTACK32;
return 0;