mm: do not grow the stack vma just because of an overrun on preceding vma (09884964) · Commits · 戴 / test

The stack vma is designed to grow automatically (marked with VM_GROWSUP or VM_GROWSDOWN depending on architecture) when an access is made beyond the existing boundary. However, particularly if you have not limited your stack at all ("ulimit -s unlimited"), this can cause the stack to grow even if the access was really just one past *another* segment. And that's wrong, especially since we first grow the segment, but then immediately later enforce the stack guard page on the last page of the segment. So _despite_ first growing the stack segment as a result of the access, the kernel will then make the access cause a SIGSEGV anyway! So do the same logic as the guard page check does, and consider an access to within one page of the next segment to be a bad access, rather than growing the stack to abut the next segment. Reported-and-tested-by:

Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

mm/mmap.c

+27 −0

Original line number	Diff line number	Diff line
		@@ -2185,9 +2185,28 @@ int expand_downwards(struct vm_area_struct *vma,
		return error;
		}

		/*
		* Note how expand_stack() refuses to expand the stack all the way to
		* abut the next virtual mapping, unless that mapping itself is also
		* a stack mapping. We want to leave room for a guard page, after all
		* (the guard page itself is not added here, that is done by the
		* actual page faulting logic)
		*
		* This matches the behavior of the guard page logic (see mm/memory.c:
		* check_stack_guard_page()), which only allows the guard page to be
		* removed under these circumstances.
		*/
		#ifdef CONFIG_STACK_GROWSUP
		int expand_stack(struct vm_area_struct *vma, unsigned long address)
		{
		struct vm_area_struct *next;

		address &= PAGE_MASK;
		next = vma->vm_next;
		if (next && next->vm_start == address + PAGE_SIZE) {
		if (!(next->vm_flags & VM_GROWSUP))
		return -ENOMEM;
		}
		return expand_upwards(vma, address);
		}

		@@ -2209,6 +2228,14 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr)
		#else
		int expand_stack(struct vm_area_struct *vma, unsigned long address)
		{
		struct vm_area_struct *prev;

		address &= PAGE_MASK;
		prev = vma->vm_prev;
		if (prev && prev->vm_end == address) {
		if (!(prev->vm_flags & VM_GROWSDOWN))
		return -ENOMEM;
		}
		return expand_downwards(vma, address);
		}

Admin message