Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-08 14:13:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

mm: keep a guard page below a grow-down stack segment

Browse Source 
commit 320b2b8de1 upstream.

This is a rather minimally invasive patch to solve the problem of the
user stack growing into a memory mapped area below it.  Whenever we fill
the first page of the stack segment, expand the segment down by one
page.

Now, admittedly some odd application might _want_ the stack to grow down
into the preceding memory mapping, and so we may at some point need to
make this a process tunable (some people might also want to have more
than a single page of guarding), but let's try the minimal approach
first.

Tested with trivial application that maps a single page just below the
stack, and then starts recursing.  Without this, we will get a SIGSEGV
_after_ the stack has smashed the mapping.  With this patch, we'll get a
nice SIGBUS just as the stack touches the page just above the mapping.

Requested-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Linus Torvalds 2010-08-12 17:54:33 -07:00 committed by Greg Kroah-Hartman
parent 7ee47d833e
commit 7a9f6ef422
1 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
mm/memory.c
View File

@ -2395,6 +2395,26 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
return ret;
}
/*
* This is like a special single-page "expand_downwards()",
* except we must first make sure that 'address-PAGE_SIZE'
* doesn't hit another vma.
*
* The "find_vma()" will do the right thing even if we wrap
*/
static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
{
address &= PAGE_MASK;
if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
address -= PAGE_SIZE;
if (find_vma(vma->vm_mm, address) != vma)
return -ENOMEM;
expand_stack(vma, address);
}
return 0;
}
/*
* We enter with non-exclusive mmap_sem (to exclude vma changes,
* but allow concurrent faults), and pte mapped but not yet locked.
@ -2408,6 +2428,9 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
spinlock_t *ptl;
pte_t entry;
if (check_stack_guard_page(vma, address) < 0)
return VM_FAULT_SIGBUS;
/* Allocate our own private page. */
pte_unmap(page_table);