leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
b409946b2a
linux/arch/powerpc/mm
History
Michael Ellerman b409946b2a powerpc/mm: Fix possible out-of-bounds shift in arch_mmap_rnd() 
The recent patch to add runtime configuration of the ASLR limits added a bug in
arch_mmap_rnd() where we may shift an integer (32-bits) by up to 33 bits,
leading to undefined behaviour.

In practice it exhibits as every process seg faulting instantly, presumably
because the rnd value hasn't been restricited by the modulus at all. We didn't
notice because it only happens under certain kernel configurations and if the
number of bits is actually set to a large value.

Fix it by switching to unsigned long.

Fixes: 9fea59bd7c ("powerpc/mm: Add support for runtime configuration of ASLR limits")
Reported-by: Balbir Singh <bsingharora@gmail.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2017-04-26 15:35:01 +10:00
..
8xx_mmu.c powerpc/8xx: add CONFIG_PIN_TLB_IMMR 2016-07-09 02:02:48 -05:00
40x_mmu.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
44x_mmu.c powerpc: Delete __cpuinit usage from all users 2013-07-01 11:10:36 +10:00
copro_fault.c powerpc/mm: Update PROTFAULT handling in the page fault path 2017-02-15 20:02:39 +11:00
dma-noncoherent.c powerpc: Simplify test in __dma_sync() 2016-03-11 17:20:12 -06:00
dump_hashpagetable.c powerpc/mm: Fix hash table dump when memory is not contiguous 2017-04-12 23:03:32 +10:00
dump_linuxpagetables.c powerpc/mm: Add physical address to Linux page table dump 2017-04-12 23:00:25 +10:00
fault.c powerpc: Avoid taking a data miss on every userspace instruction miss 2017-04-03 23:33:05 +10:00
fsl_booke_mmu.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
hash64_4k.c powerpc/mm: Fix lazy icache flush on pre-POWER5 2016-11-29 23:59:40 +11:00
hash64_64k.c powerpc/mm: Fix lazy icache flush on pre-POWER5 2016-11-29 23:59:40 +11:00
hash_low_32.S powerpc/32: Remove Mac-on-Linux/rtlinux hooks 2017-03-21 22:09:26 +11:00
hash_native_64.c Merge branch 'topic/ppc-kvm' into next 2016-11-24 22:14:52 +11:00
hash_utils_64.c powerpc: Create asm/debugfs.h and move powerpc_debugfs_root there 2017-04-11 07:46:03 +10:00
highmem.c sched/preempt, mm/kmap: Explicitly disable/enable preemption in kmap_atomic_* 2015-05-19 08:39:14 +02:00
hugepage-hash64.c powerpc/mm: Move hash table ops to a separate structure 2016-07-21 18:59:09 +10:00
hugetlbpage-book3e.c powerpc/mm/nohash: MM_SLICE is only used by book3s 64 2017-03-31 23:09:47 +11:00
hugetlbpage-hash64.c powerpc/mm: Remove the debug hugepd_ok check 2017-01-23 19:19:28 +11:00
hugetlbpage-radix.c powerpc/mm/radix: Use mm->task_size for boundary checking instead of addr_limit 2017-04-19 20:00:18 +10:00
hugetlbpage.c powerpc/mm/hugetlb: Filter out hugepage size not supported by page table layout 2017-03-31 23:09:50 +11:00
icswx_pid.c
icswx.c powerpc: Fix typo "CONFIG_ICSWX_PID" 2013-04-18 13:03:54 +10:00
icswx.h powerpc/icswx: Fix race condition with IPI setting ACOP 2012-03-07 17:06:09 +11:00
init_32.c powerpc/32: Add missing \n and switch to pr_warn() 2016-09-13 17:37:11 +10:00
init_64.c powerpc/mm: Remove checks that TASK_SIZE_USER64 is too small 2017-03-31 23:09:55 +11:00
init-common.c Merge branch 'topic/ppc-kvm' into next 2017-02-14 17:18:29 +11:00
Makefile Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/scottwood/linux into next 2016-12-16 15:05:38 +11:00
mem.c powerpc/pseries: Automatically resize HPT for memory hot add/remove 2017-02-10 13:28:02 +11:00
mmap.c powerpc/mm: Fix possible out-of-bounds shift in arch_mmap_rnd() 2017-04-26 15:35:01 +10:00
mmu_context_book3s64.c powerpc/powernv: Introduce address translation services for Nvlink2 2017-04-04 13:27:26 +10:00
mmu_context_hash32.c powerpc: Remove power3 from comments 2014-07-28 14:10:26 +10:00
mmu_context_iommu.c powerpc/iommu: Do not call PageTransHuge() on tail pages 2017-04-19 20:00:20 +10:00
mmu_context_nohash.c powerpc/mm/nohash: MM_SLICE is only used by book3s 64 2017-03-31 23:09:47 +11:00
mmu_decl.h powerpc/8xx: Map IMMR area with 512k page at a fixed address 2016-07-09 02:02:48 -05:00
numa.c powerpc/mm: Remove reduntant initmem information from log 2017-04-11 07:46:05 +10:00
pgtable_32.c powerpc: port 64 bits pgtable_cache to 32 bits 2016-12-09 22:48:01 -06:00
pgtable_64.c Merge branch 'topic/ppc-kvm' into next 2017-02-14 17:18:29 +11:00
pgtable-book3e.c powerpc/mm: Make page table size a variable 2016-05-01 18:32:48 +10:00
pgtable-book3s64.c sched/headers: Prepare to remove the <linux/mm_types.h> dependency from <linux/sched.h> 2017-03-02 08:42:37 +01:00
pgtable-hash64.c sched/headers: Prepare to remove the <linux/mm_types.h> dependency from <linux/sched.h> 2017-03-02 08:42:37 +01:00
pgtable-radix.c powerpc fixes for 4.11 #3 2017-03-07 10:46:10 -08:00
pgtable.c powerpc/mm: Fix typo in set_pte_at() 2017-02-17 22:16:25 +11:00
ppc_mmu_32.c powerpc32: refactor x_mapped_by_bats() and x_mapped_by_tlbcam() together 2016-03-11 17:18:02 -06:00
slb_low.S powerpc/mm/hash: Store addr_limit in PACA 2017-04-01 21:12:27 +11:00
slb.c powerpc/mm/hash: Don't open code VMALLOC_INDEX 2017-04-13 23:34:31 +10:00
slice.c powerpc/mmap: Any hint > 128TB searches the full VA space 2017-04-19 20:00:19 +10:00
subpage-prot.c powerpc/mm/radix: Use mm->task_size for boundary checking instead of addr_limit 2017-04-19 20:00:18 +10:00
tlb_hash32.c powerpc/mm: remove flush_tlb_page_nohash 2016-08-01 11:15:13 +10:00
tlb_hash64.c powerpc/mm: Hash abstraction for tlbflush routines 2016-05-01 18:33:08 +10:00
tlb_low_64e.S powerpc: Fix misspellings in comments. 2016-03-01 19:27:20 +11:00
tlb_nohash_low.S powerpc: Fix misspellings in comments. 2016-03-01 19:27:20 +11:00
tlb_nohash.c powerpc/nohash: Fix use of mmu_has_feature() in setup_initial_memory_limit() 2017-04-11 07:46:04 +10:00
tlb-radix.c powerpc/mm/radix: Remove unnecessary ptesync 2017-04-11 07:46:02 +10:00
vphn.c powerpc/vphn: parsing code rewrite 2015-03-18 10:48:59 +11:00
vphn.h powerpc/vphn: parsing code rewrite 2015-03-18 10:48:59 +11:00