Re: [PATCH 2/2] x86/mmap: handle worst-case heap randomization in mmap_base

[Saidi, Ali]

ïOn 3/21/19, 9:11 AM, "linux-arm-kernel on behalf of Thomas Gleixner" <linux-arm-kernel-bounces@xxxxxxxxxxxxxxxxxxx on behalf of tglx@xxxxxxxxxxxxx> wrote:

    On Tue, 12 Mar 2019, Ali Saidi wrote:
    
    > Increase mmap_base by the worst-case brk randomization so that
    > the stack and heap remain apart.
    > 
    > In Linux 4.13 a change was committed that special cased the kernel ELF
    > loader when the loader is invoked directly (eab09532d400; binfmt_elf: use
    > ELF_ET_DYN_BASE only for PIE). Generally, the loader isnât invoked
    > directly and this issue is limited to cases where it is, (e.g to set a
    > non-inheritable LD_LIBRARY_PATH, testing new versions of the loader). In
    > those rare cases, the loader doesn't take into account the amount of brk
    > randomization that will be applied by arch_randomize_brk(). This can
    > lead to the stack and heap being arbitrarily close to each other.
    
    That explains not why you need this change. What's the consequence of them
    being close to each other?
    
The process doesn't get it's requested stack size and stack allocations could end up scribbling on the heap.

Thanks,
Ali