| From 8a5e5e02fc83aaf67053ab53b359af08c6c49aaf Mon Sep 17 00:00:00 2001 |
| From: Vasily Kulikov <segoon@openwall.com> |
| Date: Wed, 9 Sep 2015 15:36:00 -0700 |
| Subject: include/linux/poison.h: fix LIST_POISON{1,2} offset |
| |
| From: Vasily Kulikov <segoon@openwall.com> |
| |
| commit 8a5e5e02fc83aaf67053ab53b359af08c6c49aaf upstream. |
| |
| Poison pointer values should be small enough to find a room in |
| non-mmap'able/hardly-mmap'able space. E.g. on x86 "poison pointer space" |
| is located starting from 0x0. Given unprivileged users cannot mmap |
| anything below mmap_min_addr, it should be safe to use poison pointers |
| lower than mmap_min_addr. |
| |
| The current poison pointer values of LIST_POISON{1,2} might be too big for |
| mmap_min_addr values equal or less than 1 MB (common case, e.g. Ubuntu |
| uses only 0x10000). There is little point to use such a big value given |
| the "poison pointer space" below 1 MB is not yet exhausted. Changing it |
| to a smaller value solves the problem for small mmap_min_addr setups. |
| |
| The values are suggested by Solar Designer: |
| http://www.openwall.com/lists/oss-security/2015/05/02/6 |
| |
| Signed-off-by: Vasily Kulikov <segoon@openwall.com> |
| Cc: Solar Designer <solar@openwall.com> |
| Cc: Thomas Gleixner <tglx@linutronix.de> |
| Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> |
| Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
| Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| include/linux/poison.h | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/include/linux/poison.h |
| +++ b/include/linux/poison.h |
| @@ -19,8 +19,8 @@ |
| * under normal circumstances, used to verify that nobody uses |
| * non-initialized list entries. |
| */ |
| -#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA) |
| -#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA) |
| +#define LIST_POISON1 ((void *) 0x100 + POISON_POINTER_DELTA) |
| +#define LIST_POISON2 ((void *) 0x200 + POISON_POINTER_DELTA) |
| |
| /********** include/linux/timer.h **********/ |
| /* |
