Messages in this thread | | | From | Kees Cook <> | Date | Wed, 12 Sep 2018 13:42:08 -0700 | Subject | Re: get_arg_page() && ptr_size accounting |
| |
On Wed, Sep 12, 2018 at 5:27 AM, Oleg Nesterov <oleg@redhat.com> wrote: > On 09/11, Kees Cook wrote: >> >> Oh, I like this patch! This is much cleaner. > > it's pity. cause this means I will have to actually test this change and > (worse) write the changelog ;)
Hehe. I know this pain well! :)
>> > @@ -410,11 +365,6 @@ static int bprm_mm_init(struct linux_binprm *bprm) >> > if (!mm) >> > goto err; >> > >> > - /* Save current stack limit for all calculations made during exec. */ >> > - task_lock(current->group_leader); >> > - bprm->rlim_stack = current->signal->rlim[RLIMIT_STACK]; >> > - task_unlock(current->group_leader); >> > - >> >> I would prefer this hunk stay here since it will be more robust >> against weird arch-specific things happening against rlim_stack. I had >> to clean up some of these tests in arch code, so I'm nervous about >> moving this further away. Here is before we call arch_bprm_mm_init(), >> and I think it's better to do this as early as possible. > > Well, I don't reaally agree but I won't argue, this is cosmetic at least > right now.
Probably what it deserves is a better comment to capture what I said above. Maybe:
- /* Save current stack limit for all calculations made during exec. */ + /* Do this before any arch-specific calls, like arch_bprm_mm_init(), + * so that bprm->rlim_stack is available for the architecture to use + * in case it needs it earlier that mm layout time. + */
>> BTW, in re-reading create_elf_tables() and its calculation of "items", >> I realize the above should actually include the trailing NULL pointers >> and argc, so it should be: >> >> ptr_size = (1 + bprm->argc + 1 + bprm->envc + 1) * sizeof(void *); > > Yes, I noticed this too. But can we do this later please?
Sure!
>> > - unsigned long p; /* current top of mem */ >> > + unsigned long p, p_min; /* current top of mem */ >> >> Can you split this out to a separate line (with a new comment) to >> avoid comment-confusion? Something like: >> >> unsigned long p; /* current top of mem */ >> unsigned long p_min; /* the minimum allowed mem position */ > > OK, but "minimum allowed mem position" explains nothing... The comment > should explain that ->p_min (can you suggest a better name?) is artificial > marker pre-computed for rlim-like checks in copy_strings()...
How about something like:
... p; /* top of memory array reserved for stack */ ... p_min; /* bottom of stack as computed in prepare_arg_pages() */
(Is "p" really only used for stack reservation tracking?)
> BTW. I think we can simply kill count(). But this needs another cleanup > and dicsussion.
Hm, I think we need count for doing the sanity checking and allowing the cond_resched() calls.
-Kees
-- Kees Cook Pixel Security
| |