diff options
| author | maxv <maxv@NetBSD.org> | 2016-08-06 15:13:13 +0000 |
|---|---|---|
| committer | maxv <maxv@NetBSD.org> | 2016-08-06 15:13:13 +0000 |
| commit | e9652cc8f54db6dcd4c193f4e40483cb6584d55a (patch) | |
| tree | fb8e61eadaef9418db6607ac35bf74a3fef7bb7a /sys/compat/linux32 | |
| parent | 0a5021b0b53c08657631480fee108c5c833635f9 (diff) | |
The way the kernel tries to prevent a userland process from allocating page
zero is hugely flawed. It is easy to demonstrate that one can trick UVM
into chosing a NULL hint after the user_va0_disable check from uvm_map.
Such a bypass allows kernel NULL pointer dereferences to be exploitable on
architectures with a shared userland<->kernel VA, like amd64.
Fix this by increasing the limit of the vm space made available for
userland processes. This way, UVM will never chose a NULL hint, since it
would be outside of the vm space.
The user_va0_disable sysctl still controls this feature.
Diffstat (limited to 'sys/compat/linux32')
| -rw-r--r-- | sys/compat/linux32/common/linux32_exec_elf32.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/compat/linux32/common/linux32_exec_elf32.c b/sys/compat/linux32/common/linux32_exec_elf32.c index 24399aa6ae6..19ed2980f41 100644 --- a/sys/compat/linux32/common/linux32_exec_elf32.c +++ b/sys/compat/linux32/common/linux32_exec_elf32.c @@ -1,4 +1,4 @@ -/* $NetBSD: linux32_exec_elf32.c,v 1.18 2015/03/20 20:36:27 maxv Exp $ */ +/* $NetBSD: linux32_exec_elf32.c,v 1.19 2016/08/06 15:13:13 maxv Exp $ */ /*- * Copyright (c) 1995, 1998, 2000, 2001,2006 The NetBSD Foundation, Inc. @@ -31,7 +31,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: linux32_exec_elf32.c,v 1.18 2015/03/20 20:36:27 maxv Exp $"); +__KERNEL_RCSID(0, "$NetBSD: linux32_exec_elf32.c,v 1.19 2016/08/06 15:13:13 maxv Exp $"); #define ELFSIZE 32 @@ -93,7 +93,7 @@ ELFNAME2(linux32,probe)(struct lwp *l, struct exec_package *epp, #endif epp->ep_flags |= EXEC_32 | EXEC_FORCEAUX; - epp->ep_vm_minaddr = VM_MIN_ADDRESS; + epp->ep_vm_minaddr = exec_vm_minaddr(VM_MIN_ADDRESS); epp->ep_vm_maxaddr = USRSTACK32; return 0; |
