Date: Sat, 23 Mar 2019 16:36:19 +0000 (UTC) From: Konstantin Belousov <kib@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r345452 - head/sys/vm Message-ID: <201903231636.x2NGaJ2d082948@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: kib Date: Sat Mar 23 16:36:18 2019 New Revision: 345452 URL: https://svnweb.freebsd.org/changeset/base/345452 Log: ASLR: check for max_addr after applying randomization, not before. Otherwise resulting address from vm_map_find() migh not satisfy the upper limit. For instance, it could affect MAP_32BIT flag from 64bit processes. Found by: Doug Moore <dougm@rice.edu> Reviewed by: alc, Doug Moore <dougm@rice.edu> Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D19688 Modified: head/sys/vm/vm_map.c Modified: head/sys/vm/vm_map.c ============================================================================== --- head/sys/vm/vm_map.c Sat Mar 23 16:30:50 2019 (r345451) +++ head/sys/vm/vm_map.c Sat Mar 23 16:36:18 2019 (r345452) @@ -1673,11 +1673,12 @@ again: (max_addr == 0 || max_addr > MAP_32BIT_MAX_ADDR) ? aslr_pages_rnd_64[pidx] : aslr_pages_rnd_32[pidx]; if (vm_map_findspace(map, curr_min_addr, length + - gap * pagesizes[pidx], addr) || - (max_addr != 0 && *addr + length > max_addr)) + gap * pagesizes[pidx], addr)) goto again; /* And randomize the start address. */ *addr += (arc4random() % gap) * pagesizes[pidx]; + if (max_addr != 0 && *addr + length > max_addr) + goto again; } else if (vm_map_findspace(map, curr_min_addr, length, addr) || (max_addr != 0 && *addr + length > max_addr)) { if (cluster) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201903231636.x2NGaJ2d082948>