From owner-freebsd-current@freebsd.org Sat Jul 1 22:48:36 2017 Return-Path: Delivered-To: freebsd-current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 61201D94695 for ; Sat, 1 Jul 2017 22:48:36 +0000 (UTC) (envelope-from kostikbel@gmail.com) Received: from kib.kiev.ua (kib.kiev.ua [IPv6:2001:470:d5e7:1::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id EB2CC7560B for ; Sat, 1 Jul 2017 22:48:35 +0000 (UTC) (envelope-from kostikbel@gmail.com) Received: from tom.home (kib@localhost [127.0.0.1]) by kib.kiev.ua (8.15.2/8.15.2) with ESMTPS id v61MmTVC075754 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sun, 2 Jul 2017 01:48:29 +0300 (EEST) (envelope-from kostikbel@gmail.com) DKIM-Filter: OpenDKIM Filter v2.10.3 kib.kiev.ua v61MmTVC075754 Received: (from kostik@localhost) by tom.home (8.15.2/8.15.2/Submit) id v61MmTjM075753; Sun, 2 Jul 2017 01:48:29 +0300 (EEST) (envelope-from kostikbel@gmail.com) X-Authentication-Warning: tom.home: kostik set sender to kostikbel@gmail.com using -f Date: Sun, 2 Jul 2017 01:48:29 +0300 From: Konstantin Belousov To: Shawn Webb Cc: freebsd-current@freebsd.org Subject: Re: Reproducible panic with MAP_GUARD and security.bsd.stack_guard_page > 1 Message-ID: <20170701224829.GB1935@kib.kiev.ua> References: <20170701172847.v5hwzn6vhbrbiz2i@mutt-hbsd> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170701172847.v5hwzn6vhbrbiz2i@mutt-hbsd> User-Agent: Mutt/1.8.3 (2017-05-23) X-Spam-Status: No, score=-2.0 required=5.0 tests=ALL_TRUSTED,BAYES_00, DKIM_ADSP_CUSTOM_MED,FREEMAIL_FROM,NML_ADSP_CUSTOM_MED autolearn=no autolearn_force=no version=3.4.1 X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on tom.home X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 01 Jul 2017 22:48:36 -0000 On Sat, Jul 01, 2017 at 01:28:47PM -0400, Shawn Webb wrote: > When running my Stack Clash PoC on a vanilla FreeBSD 12-CURRENT/amd64 VM > and security.bsd.stack_guard_page is > 1: > > https://goo.gl/photos/vZQY4B9jKJRLrNwP7 > > The PoC doesn't need to be run as root on vanilla FreeBSD with a default > configuration. I cannot make much sense from the last sentence, esp. after mention of the setting of stack_guard_page to greater than one value in the first sentence. Anyway, there could be some situation where max_grow calculation overflows. Indeed only possible when guard > 1. Try this. diff --git a/sys/vm/vm_map.c b/sys/vm/vm_map.c index 114e4b34a90..9c9b781db2d 100644 --- a/sys/vm/vm_map.c +++ b/sys/vm/vm_map.c @@ -3684,7 +3684,7 @@ vm_map_growstack(vm_map_t map, vm_offset_t addr, vm_map_entry_t gap_entry) struct proc *p; struct vmspace *vm; struct ucred *cred; - vm_offset_t gap_end, gap_start, grow_start; + vm_offset_t gap_end, gap_start, grow_start, sgp; size_t grow_amount, max_grow; rlim_t lmemlim, stacklim, vmemlim; int rv, rv1; @@ -3727,8 +3727,11 @@ retry: } else { return (KERN_FAILURE); } - max_grow = gap_entry->end - gap_entry->start - stack_guard_page * - PAGE_SIZE; + sgp = stack_guard_page * PAGE_SIZE; + max_grow = gap_entry->end - gap_entry->start; + if (max_grow < sgp) + return (KERN_NO_SPACE); + max_grow -= sgp; if (grow_amount > max_grow) return (KERN_NO_SPACE);