[{"id":1764735,"web_url":"http://patchwork.ozlabs.org/comment/1764735/","msgid":"","list_archive_url":null,"date":"2017-09-07T13:54:05","subject":"ACK: [Xenial SRU][PATCH 1/1] mm: revert x86_64 and arm64\n\tELF_ET_DYN_BASE base changes","submitter":{"id":2900,"url":"http://patchwork.ozlabs.org/api/people/2900/","name":"Colin Ian King","email":"colin.king@canonical.com"},"content":"On 07/09/17 14:51, Kleber Sacilotto de Souza wrote:\n> From: Kees Cook \n> \n> BugLink: http://bugs.launchpad.net/bugs/1715636\n> \n> Moving the x86_64 and arm64 PIE base from 0x555555554000 to 0x000100000000\n> broke AddressSanitizer. This is a partial revert of:\n> \n> eab09532d400 (\"binfmt_elf: use ELF_ET_DYN_BASE only for PIE\")\n> 02445990a96e (\"arm64: move ELF_ET_DYN_BASE to 4GB / 4MB\")\n> \n> The AddressSanitizer tool has hard-coded expectations about where\n> executable mappings are loaded.\n> \n> The motivation for changing the PIE base in the above commits was to\n> avoid the Stack-Clash CVEs that allowed executable mappings to get too\n> close to heap and stack. This was mainly a problem on 32-bit, but the\n> 64-bit bases were moved too, in an effort to proactively protect those\n> systems (proofs of concept do exist that show 64-bit collisions, but\n> other recent changes to fix stack accounting and setuid behaviors will\n> minimize the impact).\n> \n> The new 32-bit PIE base is fine for ASan (since it matches the ET_EXEC\n> base), so only the 64-bit PIE base needs to be reverted to let x86 and\n> arm64 ASan binaries run again. Future changes to the 64-bit PIE base on\n> these architectures can be made optional once a more dynamic method for\n> dealing with AddressSanitizer is found. (e.g. always loading PIE into\n> the mmap region for marked binaries.)\n> \n> Link: http://lkml.kernel.org/r/20170807201542.GA21271@beast\n> Fixes: eab09532d400 (\"binfmt_elf: use ELF_ET_DYN_BASE only for PIE\")\n> Fixes: 02445990a96e (\"arm64: move ELF_ET_DYN_BASE to 4GB / 4MB\")\n> Signed-off-by: Kees Cook \n> Reported-by: Kostya Serebryany \n> Acked-by: Will Deacon \n> Cc: Ingo Molnar \n> Cc: \"H. Peter Anvin\" \n> Cc: Thomas Gleixner \n> Cc: \n> Signed-off-by: Andrew Morton \n> Signed-off-by: Linus Torvalds \n> (cherry picked from commit c715b72c1ba406f133217b509044c38d8e714a37)\n> Signed-off-by: Kleber Sacilotto de Souza \n> ---\n> arch/arm64/include/asm/elf.h | 4 ++--\n> arch/x86/include/asm/elf.h | 4 ++--\n> 2 files changed, 4 insertions(+), 4 deletions(-)\n> \n> diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h\n> index 9e11dbe1cec3..329c127e13dc 100644\n> --- a/arch/arm64/include/asm/elf.h\n> +++ b/arch/arm64/include/asm/elf.h\n> @@ -121,10 +121,10 @@ typedef struct user_fpsimd_state elf_fpregset_t;\n> \n> /*\n> * This is the base location for PIE (ET_DYN with INTERP) loads. On\n> - * 64-bit, this is raised to 4GB to leave the entire 32-bit address\n> + * 64-bit, this is above 4GB to leave the entire 32-bit address\n> * space open for things that want to use the area for 32-bit pointers.\n> */\n> -#define ELF_ET_DYN_BASE\t\t0x100000000UL\n> +#define ELF_ET_DYN_BASE\t\t(2 * TASK_SIZE_64 / 3)\n> \n> /*\n> * When the program starts, a1 contains a pointer to a function to be\n> diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h\n> index 07cf288b692e..bcd3d6199464 100644\n> --- a/arch/x86/include/asm/elf.h\n> +++ b/arch/x86/include/asm/elf.h\n> @@ -247,11 +247,11 @@ extern int force_personality32;\n> \n> /*\n> * This is the base location for PIE (ET_DYN with INTERP) loads. On\n> - * 64-bit, this is raised to 4GB to leave the entire 32-bit address\n> + * 64-bit, this is above 4GB to leave the entire 32-bit address\n> * space open for things that want to use the area for 32-bit pointers.\n> */\n> #define ELF_ET_DYN_BASE\t\t(mmap_is_ia32() ? 0x000400000UL : \\\n> -\t\t\t\t\t\t 0x100000000UL)\n> +\t\t\t\t\t\t (TASK_SIZE / 3 * 2))\n> \n> /* This yields a mask that user programs can use to figure out what\n> instruction set this CPU supports. This could be done in user space,\n> \n\nClean cherry pick. Seems to do the right thing.\n\nAcked-by: Colin Ian King ","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@bilbo.ozlabs.org","Authentication-Results":"ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=lists.ubuntu.com\n\t(client-ip=91.189.94.19; helo=huckleberry.canonical.com;\n\tenvelope-from=kernel-team-bounces@lists.ubuntu.com;\n\treceiver=)","Received":["from huckleberry.canonical.com (huckleberry.canonical.com\n\t[91.189.94.19])\n\tby ozlabs.org (Postfix) with ESMTP id 3xp24N1npBz9s8J;\n\tThu, 7 Sep 2017 23:54:12 +1000 (AEST)","from localhost ([127.0.0.1] helo=huckleberry.canonical.com)\n\tby huckleberry.canonical.com with esmtp (Exim 4.86_2)\n\t(envelope-from )\n\tid 1dpxFx-00046Q-0C; Thu, 07 Sep 2017 13:54:09 +0000","from youngberry.canonical.com ([91.189.89.112])\n\tby huckleberry.canonical.com with esmtps\n\t(TLS1.0:DHE_RSA_AES_128_CBC_SHA1:128)\n\t(Exim 4.86_2) (envelope-from )\n\tid 1dpxFu-000468-Mr\n\tfor kernel-team@lists.ubuntu.com; Thu, 07 Sep 2017 13:54:06 +0000","from 1.general.cking.uk.vpn ([10.172.193.212])\n\tby youngberry.canonical.com with esmtpsa\n\t(TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)\n\t(Exim 4.76) (envelope-from )\n\tid 1dpxFu-00068j-DU; Thu, 07 Sep 2017 13:54:06 +0000"],"Subject":"ACK: [Xenial SRU][PATCH 1/1] mm: revert x86_64 and arm64\n\tELF_ET_DYN_BASE base changes","To":"Kleber Sacilotto de Souza ,\n\tkernel-team@lists.ubuntu.com","References":"<20170907135138.2199-1-kleber.souza@canonical.com>\n\t<20170907135138.2199-2-kleber.souza@canonical.com>","From":"Colin Ian King ","Message-ID":"","Date":"Thu, 7 Sep 2017 14:54:05 +0100","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101\n\tThunderbird/45.8.0","MIME-Version":"1.0","In-Reply-To":"<20170907135138.2199-2-kleber.souza@canonical.com>","X-BeenThere":"kernel-team@lists.ubuntu.com","X-Mailman-Version":"2.1.20","Precedence":"list","List-Id":"Kernel team discussions ","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Content-Type":"text/plain; charset=\"utf-8\"","Content-Transfer-Encoding":"base64","Errors-To":"kernel-team-bounces@lists.ubuntu.com","Sender":"\"kernel-team\" "}},{"id":1764747,"web_url":"http://patchwork.ozlabs.org/comment/1764747/","msgid":"<4272af3a-e0e4-ee1b-3934-e5143b227b9a@canonical.com>","list_archive_url":null,"date":"2017-09-07T14:10:46","subject":"ACK: Re: [Xenial SRU][PATCH 1/1] mm: revert x86_64 and arm64\n\tELF_ET_DYN_BASE base changes","submitter":{"id":2898,"url":"http://patchwork.ozlabs.org/api/people/2898/","name":"Stefan Bader","email":"stefan.bader@canonical.com"},"content":"On 07.09.2017 15:51, Kleber Sacilotto de Souza wrote:\n> From: Kees Cook \n> \n> BugLink: http://bugs.launchpad.net/bugs/1715636\n> \n> Moving the x86_64 and arm64 PIE base from 0x555555554000 to 0x000100000000\n> broke AddressSanitizer. This is a partial revert of:\n> \n> eab09532d400 (\"binfmt_elf: use ELF_ET_DYN_BASE only for PIE\")\n> 02445990a96e (\"arm64: move ELF_ET_DYN_BASE to 4GB / 4MB\")\n> \n> The AddressSanitizer tool has hard-coded expectations about where\n> executable mappings are loaded.\n> \n> The motivation for changing the PIE base in the above commits was to\n> avoid the Stack-Clash CVEs that allowed executable mappings to get too\n> close to heap and stack. This was mainly a problem on 32-bit, but the\n> 64-bit bases were moved too, in an effort to proactively protect those\n> systems (proofs of concept do exist that show 64-bit collisions, but\n> other recent changes to fix stack accounting and setuid behaviors will\n> minimize the impact).\n> \n> The new 32-bit PIE base is fine for ASan (since it matches the ET_EXEC\n> base), so only the 64-bit PIE base needs to be reverted to let x86 and\n> arm64 ASan binaries run again. Future changes to the 64-bit PIE base on\n> these architectures can be made optional once a more dynamic method for\n> dealing with AddressSanitizer is found. (e.g. always loading PIE into\n> the mmap region for marked binaries.)\n> \n> Link: http://lkml.kernel.org/r/20170807201542.GA21271@beast\n> Fixes: eab09532d400 (\"binfmt_elf: use ELF_ET_DYN_BASE only for PIE\")\n> Fixes: 02445990a96e (\"arm64: move ELF_ET_DYN_BASE to 4GB / 4MB\")\n> Signed-off-by: Kees Cook \n> Reported-by: Kostya Serebryany \n> Acked-by: Will Deacon \n> Cc: Ingo Molnar \n> Cc: \"H. Peter Anvin\" \n> Cc: Thomas Gleixner \n> Cc: \n> Signed-off-by: Andrew Morton \n> Signed-off-by: Linus Torvalds \n> (cherry picked from commit c715b72c1ba406f133217b509044c38d8e714a37)\n> Signed-off-by: Kleber Sacilotto de Souza \nAcked-by: Stefan Bader \n\n> ---\n\nWould be part of 4.4.84 anyway\n\n> arch/arm64/include/asm/elf.h | 4 ++--\n> arch/x86/include/asm/elf.h | 4 ++--\n> 2 files changed, 4 insertions(+), 4 deletions(-)\n> \n> diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h\n> index 9e11dbe1cec3..329c127e13dc 100644\n> --- a/arch/arm64/include/asm/elf.h\n> +++ b/arch/arm64/include/asm/elf.h\n> @@ -121,10 +121,10 @@ typedef struct user_fpsimd_state elf_fpregset_t;\n> \n> /*\n> * This is the base location for PIE (ET_DYN with INTERP) loads. On\n> - * 64-bit, this is raised to 4GB to leave the entire 32-bit address\n> + * 64-bit, this is above 4GB to leave the entire 32-bit address\n> * space open for things that want to use the area for 32-bit pointers.\n> */\n> -#define ELF_ET_DYN_BASE\t\t0x100000000UL\n> +#define ELF_ET_DYN_BASE\t\t(2 * TASK_SIZE_64 / 3)\n> \n> /*\n> * When the program starts, a1 contains a pointer to a function to be\n> diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h\n> index 07cf288b692e..bcd3d6199464 100644\n> --- a/arch/x86/include/asm/elf.h\n> +++ b/arch/x86/include/asm/elf.h\n> @@ -247,11 +247,11 @@ extern int force_personality32;\n> \n> /*\n> * This is the base location for PIE (ET_DYN with INTERP) loads. On\n> - * 64-bit, this is raised to 4GB to leave the entire 32-bit address\n> + * 64-bit, this is above 4GB to leave the entire 32-bit address\n> * space open for things that want to use the area for 32-bit pointers.\n> */\n> #define ELF_ET_DYN_BASE\t\t(mmap_is_ia32() ? 0x000400000UL : \\\n> -\t\t\t\t\t\t 0x100000000UL)\n> +\t\t\t\t\t\t (TASK_SIZE / 3 * 2))\n> \n> /* This yields a mask that user programs can use to figure out what\n> instruction set this CPU supports. This could be done in user space,\n>","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@bilbo.ozlabs.org","Authentication-Results":"ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=lists.ubuntu.com\n\t(client-ip=91.189.94.19; helo=huckleberry.canonical.com;\n\tenvelope-from=kernel-team-bounces@lists.ubuntu.com;\n\treceiver=)","Received":["from huckleberry.canonical.com (huckleberry.canonical.com\n\t[91.189.94.19])\n\tby ozlabs.org (Postfix) with ESMTP id 3xp2Rn1zlBz9s9Y;\n\tFri, 8 Sep 2017 00:11:01 +1000 (AEST)","from localhost ([127.0.0.1] helo=huckleberry.canonical.com)\n\tby huckleberry.canonical.com with esmtp (Exim 4.86_2)\n\t(envelope-from )\n\tid 1dpxWB-0006DQ-TY; Thu, 07 Sep 2017 14:10:55 +0000","from youngberry.canonical.com ([91.189.89.112])\n\tby huckleberry.canonical.com with esmtps\n\t(TLS1.0:DHE_RSA_AES_128_CBC_SHA1:128)\n\t(Exim 4.86_2) (envelope-from )\n\tid 1dpxW9-0006D6-VH\n\tfor kernel-team@lists.ubuntu.com; Thu, 07 Sep 2017 14:10:53 +0000","from 1.general.smb.uk.vpn ([10.172.193.28])\n\tby youngberry.canonical.com with esmtpsa\n\t(TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16)\n\t(Exim 4.76) (envelope-from )\n\tid 1dpxW9-0007Pc-NN\n\tfor kernel-team@lists.ubuntu.com; Thu, 07 Sep 2017 14:10:53 +0000"],"Subject":"ACK: Re: [Xenial SRU][PATCH 1/1] mm: revert x86_64 and arm64\n\tELF_ET_DYN_BASE base changes","To":"kernel-team@lists.ubuntu.com","References":"<20170907135138.2199-1-kleber.souza@canonical.com>\n\t<20170907135138.2199-2-kleber.souza@canonical.com>","From":"Stefan Bader ","Message-ID":"<4272af3a-e0e4-ee1b-3934-e5143b227b9a@canonical.com>","Date":"Thu, 7 Sep 2017 16:10:46 +0200","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101\n\tThunderbird/52.2.1","MIME-Version":"1.0","In-Reply-To":"<20170907135138.2199-2-kleber.souza@canonical.com>","X-BeenThere":"kernel-team@lists.ubuntu.com","X-Mailman-Version":"2.1.20","Precedence":"list","List-Id":"Kernel team discussions ","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Content-Type":"multipart/mixed;\n\tboundary=\"===============7297450443292699807==\"","Errors-To":"kernel-team-bounces@lists.ubuntu.com","Sender":"\"kernel-team\" "}},{"id":1764754,"web_url":"http://patchwork.ozlabs.org/comment/1764754/","msgid":"","list_archive_url":null,"date":"2017-09-07T14:21:29","subject":"APPLIED: [Xenial SRU][PATCH 1/1] mm: revert x86_64 and arm64\n\tELF_ET_DYN_BASE base changes","submitter":{"id":71419,"url":"http://patchwork.ozlabs.org/api/people/71419/","name":"Kleber Sacilotto de Souza","email":"kleber.souza@canonical.com"},"content":"Applied to xenial/master-next branch. Thanks.","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@bilbo.ozlabs.org","Authentication-Results":"ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=lists.ubuntu.com\n\t(client-ip=91.189.94.19; helo=huckleberry.canonical.com;\n\tenvelope-from=kernel-team-bounces@lists.ubuntu.com;\n\treceiver=)","Received":["from huckleberry.canonical.com (huckleberry.canonical.com\n\t[91.189.94.19])\n\tby ozlabs.org (Postfix) with ESMTP id 3xp2h04KbVz9sPm;\n\tFri, 8 Sep 2017 00:21:36 +1000 (AEST)","from localhost ([127.0.0.1] helo=huckleberry.canonical.com)\n\tby huckleberry.canonical.com with esmtp (Exim 4.86_2)\n\t(envelope-from )\n\tid 1dpxgS-0007KA-Lh; Thu, 07 Sep 2017 14:21:32 +0000","from youngberry.canonical.com ([91.189.89.112])\n\tby huckleberry.canonical.com with esmtps\n\t(TLS1.0:DHE_RSA_AES_128_CBC_SHA1:128)\n\t(Exim 4.86_2) (envelope-from )\n\tid 1dpxgS-0007K4-56\n\tfor kernel-team@lists.ubuntu.com; Thu, 07 Sep 2017 14:21:32 +0000","from mail-wr0-f199.google.com ([209.85.128.199])\n\tby youngberry.canonical.com with esmtps\n\t(TLS1.0:RSA_AES_128_CBC_SHA1:16)\n\t(Exim 4.76) (envelope-from )\n\tid 1dpxgR-0007kU-UF\n\tfor kernel-team@lists.ubuntu.com; Thu, 07 Sep 2017 14:21:31 +0000","by mail-wr0-f199.google.com with SMTP id h16so2191495wrf.0\n\tfor ;\n\tThu, 07 Sep 2017 07:21:31 -0700 (PDT)","from [192.168.0.8] (ip5f5bd015.dynamic.kabel-deutschland.de.\n\t[95.91.208.21]) by smtp.gmail.com with ESMTPSA id\n\ti6sm2248527edl.61.2017.09.07.07.21.30\n\tfor \n\t(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);\n\tThu, 07 Sep 2017 07:21:30 -0700 (PDT)"],"X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:subject:from:to:references:message-id:date\n\t:user-agent:mime-version:in-reply-to:content-language\n\t:content-transfer-encoding;\n\tbh=hKEdCXOteELXFDlPnR9BYdAhbb7Vn6zUw0738Uw2IzM=;\n\tb=Fkj0VbIYYRZB4djEU3RGFCxXWuqUn0IUir6pr+TERKKcVOrC9KUm0hK4oNiejiqkKX\n\tZhOZN0T5nV52+bjeGa2Cu9FyGKmkSjhrvBO3Mq3a2wh5U/plOyHUJG4oB+oqHIFclvNG\n\to8XlRbH/ECBLFdUHutATWkxSku2qSsurXPxQ3LNKzpcubiP4s/PPi/CxZ2fYl0EMb1W9\n\tX1cCXIVRoTDfdnCrjYFQBfgl6uE+aQFjXTQxyoUeeewitwIooo7AgTPHnOUyTA65SBFw\n\tyX33pFe3MjpY145ReAKco/vOVACG04vKZK5fhJVIfQGVxChtAa92ZLCMI3i0+eJ3GrGK\n\tSwmw==","X-Gm-Message-State":"AHPjjUiScfmPYCDI6ANOtrrXvM/VnoAvHhCAn8CgKB+kSUsdgkhYI0Y4\n\tBcq29gDDJZkHEMJY+cAFUMe3iAw8zV+DyT9juCh6M9kfytIeCN4EpflPIA3B94P6nkUXI2gxQx3\n\tZ4vXklEJM8IqkeHXWCxmb7bDr5FqZy6J5","X-Received":["by 10.80.180.184 with SMTP id w53mr2653041edd.176.1504794091365; \n\tThu, 07 Sep 2017 07:21:31 -0700 (PDT)","by 10.80.180.184 with SMTP id w53mr2653037edd.176.1504794091205; \n\tThu, 07 Sep 2017 07:21:31 -0700 (PDT)"],"X-Google-Smtp-Source":"ADKCNb6daN1ycIGL0a6g17V08EBYZQ0OnWCywYQu7xkdRhKEq0P/X5Cg1mrevtKw90fv9sYCZuhUfA==","Subject":"APPLIED: [Xenial SRU][PATCH 1/1] mm: revert x86_64 and arm64\n\tELF_ET_DYN_BASE base changes","From":"Kleber Souza ","To":"kernel-team@lists.ubuntu.com","References":"<20170907135138.2199-1-kleber.souza@canonical.com>\n\t<20170907135138.2199-2-kleber.souza@canonical.com>","Message-ID":"","Date":"Thu, 7 Sep 2017 16:21:29 +0200","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101\n\tThunderbird/52.2.1","MIME-Version":"1.0","In-Reply-To":"<20170907135138.2199-2-kleber.souza@canonical.com>","Content-Language":"en-US","X-BeenThere":"kernel-team@lists.ubuntu.com","X-Mailman-Version":"2.1.20","Precedence":"list","List-Id":"Kernel team discussions ","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Content-Type":"text/plain; charset=\"utf-8\"","Content-Transfer-Encoding":"base64","Errors-To":"kernel-team-bounces@lists.ubuntu.com","Sender":"\"kernel-team\" "}}]