1 /* 2 * flexible mmap layout support 3 * 4 * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina. 5 * All Rights Reserved. 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License as published by 9 * the Free Software Foundation; either version 2 of the License, or 10 * (at your option) any later version. 11 * 12 * This program is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 * GNU General Public License for more details. 16 * 17 * You should have received a copy of the GNU General Public License 18 * along with this program; if not, write to the Free Software 19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 20 * 21 * 22 * Started by Ingo Molnar <mingo@elte.hu> 23 */ 24 25 #include <linux/elf-randomize.h> 26 #include <linux/personality.h> 27 #include <linux/mm.h> 28 #include <linux/mman.h> 29 #include <linux/sched/signal.h> 30 #include <linux/sched/mm.h> 31 #include <linux/random.h> 32 #include <linux/compat.h> 33 #include <linux/security.h> 34 #include <asm/pgalloc.h> 35 #include <asm/elf.h> 36 37 static unsigned long stack_maxrandom_size(void) 38 { 39 if (!(current->flags & PF_RANDOMIZE)) 40 return 0; 41 if (current->personality & ADDR_NO_RANDOMIZE) 42 return 0; 43 return STACK_RND_MASK << PAGE_SHIFT; 44 } 45 46 /* 47 * Top of mmap area (just below the process stack). 48 * 49 * Leave at least a ~32 MB hole. 50 */ 51 #define MIN_GAP (32*1024*1024) 52 #define MAX_GAP (STACK_TOP/6*5) 53 54 static inline int mmap_is_legacy(void) 55 { 56 if (current->personality & ADDR_COMPAT_LAYOUT) 57 return 1; 58 if (rlimit(RLIMIT_STACK) == RLIM_INFINITY) 59 return 1; 60 return sysctl_legacy_va_layout; 61 } 62 63 unsigned long arch_mmap_rnd(void) 64 { 65 return (get_random_int() & MMAP_RND_MASK) << PAGE_SHIFT; 66 } 67 68 static unsigned long mmap_base_legacy(unsigned long rnd) 69 { 70 return TASK_UNMAPPED_BASE + rnd; 71 } 72 73 static inline unsigned long mmap_base(unsigned long rnd) 74 { 75 unsigned long gap = rlimit(RLIMIT_STACK); 76 77 if (gap < MIN_GAP) 78 gap = MIN_GAP; 79 else if (gap > MAX_GAP) 80 gap = MAX_GAP; 81 gap &= PAGE_MASK; 82 return STACK_TOP - stack_maxrandom_size() - rnd - gap; 83 } 84 85 unsigned long 86 arch_get_unmapped_area(struct file *filp, unsigned long addr, 87 unsigned long len, unsigned long pgoff, unsigned long flags) 88 { 89 struct mm_struct *mm = current->mm; 90 struct vm_area_struct *vma; 91 struct vm_unmapped_area_info info; 92 int rc; 93 94 if (len > TASK_SIZE - mmap_min_addr) 95 return -ENOMEM; 96 97 if (flags & MAP_FIXED) 98 goto check_asce_limit; 99 100 if (addr) { 101 addr = PAGE_ALIGN(addr); 102 vma = find_vma(mm, addr); 103 if (TASK_SIZE - len >= addr && addr >= mmap_min_addr && 104 (!vma || addr + len <= vm_start_gap(vma))) 105 goto check_asce_limit; 106 } 107 108 info.flags = 0; 109 info.length = len; 110 info.low_limit = mm->mmap_base; 111 info.high_limit = TASK_SIZE; 112 if (filp || (flags & MAP_SHARED)) 113 info.align_mask = MMAP_ALIGN_MASK << PAGE_SHIFT; 114 else 115 info.align_mask = 0; 116 info.align_offset = pgoff << PAGE_SHIFT; 117 addr = vm_unmapped_area(&info); 118 if (addr & ~PAGE_MASK) 119 return addr; 120 121 check_asce_limit: 122 if (addr + len > current->mm->context.asce_limit && 123 addr + len <= TASK_SIZE) { 124 rc = crst_table_upgrade(mm, addr + len); 125 if (rc) 126 return (unsigned long) rc; 127 } 128 129 return addr; 130 } 131 132 unsigned long 133 arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, 134 const unsigned long len, const unsigned long pgoff, 135 const unsigned long flags) 136 { 137 struct vm_area_struct *vma; 138 struct mm_struct *mm = current->mm; 139 unsigned long addr = addr0; 140 struct vm_unmapped_area_info info; 141 int rc; 142 143 /* requested length too big for entire address space */ 144 if (len > TASK_SIZE - mmap_min_addr) 145 return -ENOMEM; 146 147 if (flags & MAP_FIXED) 148 goto check_asce_limit; 149 150 /* requesting a specific address */ 151 if (addr) { 152 addr = PAGE_ALIGN(addr); 153 vma = find_vma(mm, addr); 154 if (TASK_SIZE - len >= addr && addr >= mmap_min_addr && 155 (!vma || addr + len <= vm_start_gap(vma))) 156 goto check_asce_limit; 157 } 158 159 info.flags = VM_UNMAPPED_AREA_TOPDOWN; 160 info.length = len; 161 info.low_limit = max(PAGE_SIZE, mmap_min_addr); 162 info.high_limit = mm->mmap_base; 163 if (filp || (flags & MAP_SHARED)) 164 info.align_mask = MMAP_ALIGN_MASK << PAGE_SHIFT; 165 else 166 info.align_mask = 0; 167 info.align_offset = pgoff << PAGE_SHIFT; 168 addr = vm_unmapped_area(&info); 169 170 /* 171 * A failed mmap() very likely causes application failure, 172 * so fall back to the bottom-up function here. This scenario 173 * can happen with large stack limits and large mmap() 174 * allocations. 175 */ 176 if (addr & ~PAGE_MASK) { 177 VM_BUG_ON(addr != -ENOMEM); 178 info.flags = 0; 179 info.low_limit = TASK_UNMAPPED_BASE; 180 info.high_limit = TASK_SIZE; 181 addr = vm_unmapped_area(&info); 182 if (addr & ~PAGE_MASK) 183 return addr; 184 } 185 186 check_asce_limit: 187 if (addr + len > current->mm->context.asce_limit && 188 addr + len <= TASK_SIZE) { 189 rc = crst_table_upgrade(mm, addr + len); 190 if (rc) 191 return (unsigned long) rc; 192 } 193 194 return addr; 195 } 196 197 /* 198 * This function, called very early during the creation of a new 199 * process VM image, sets up which VM layout function to use: 200 */ 201 void arch_pick_mmap_layout(struct mm_struct *mm) 202 { 203 unsigned long random_factor = 0UL; 204 205 if (current->flags & PF_RANDOMIZE) 206 random_factor = arch_mmap_rnd(); 207 208 /* 209 * Fall back to the standard layout if the personality 210 * bit is set, or if the expected stack growth is unlimited: 211 */ 212 if (mmap_is_legacy()) { 213 mm->mmap_base = mmap_base_legacy(random_factor); 214 mm->get_unmapped_area = arch_get_unmapped_area; 215 } else { 216 mm->mmap_base = mmap_base(random_factor); 217 mm->get_unmapped_area = arch_get_unmapped_area_topdown; 218 } 219 } 220