commit: cb463ff8b2189881a8ec5d3b2aecc283383b6227 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Tue Jul 4 12:46:06 2023 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Tue Jul 4 12:46:06 2023 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=cb463ff8
execve: always mark stack as growing down during early stack setup Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 ++ 1800_mm-execve-mark-stack-as-growing-down.patch | 82 +++++++++++++++++++++++++ 2 files changed, 86 insertions(+) diff --git a/0000_README b/0000_README index bda29555..38ee98e3 100644 --- a/0000_README +++ b/0000_README @@ -59,6 +59,10 @@ Patch: 1700_sparc-address-warray-bound-warnings.patch From: https://github.com/KSPP/linux/issues/109 Desc: Address -Warray-bounds warnings +Patch: 1800_mm-execve-mark-stack-as-growing-down.patch +From: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git +Desc: execve: always mark stack as growing down during early stack setup + Patch: 2000_BT-Check-key-sizes-only-if-Secure-Simple-Pairing-enabled.patch From: https://lore.kernel.org/linux-bluetooth/[email protected]/raw Desc: Bluetooth: Check key sizes only when Secure Simple Pairing is enabled. See bug #686758 diff --git a/1800_mm-execve-mark-stack-as-growing-down.patch b/1800_mm-execve-mark-stack-as-growing-down.patch new file mode 100644 index 00000000..07daf228 --- /dev/null +++ b/1800_mm-execve-mark-stack-as-growing-down.patch @@ -0,0 +1,82 @@ +From d7a7655b29081c053b1abe71f64a2928638dafc6 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds <[email protected]> +Date: Sun, 2 Jul 2023 23:20:17 -0700 +Subject: execve: always mark stack as growing down during early stack setup + +commit f66066bc5136f25e36a2daff4896c768f18c211e upstream. + +While our user stacks can grow either down (all common architectures) or +up (parisc and the ia64 register stack), the initial stack setup when we +copy the argument and environment strings to the new stack at execve() +time is always done by extending the stack downwards. + +But it turns out that in commit 8d7071af8907 ("mm: always expand the +stack with the mmap write lock held"), as part of making the stack +growing code more robust, 'expand_downwards()' was now made to actually +check the vma flags: + + if (!(vma->vm_flags & VM_GROWSDOWN)) + return -EFAULT; + +and that meant that this execve-time stack expansion started failing on +parisc, because on that architecture, the stack flags do not contain the +VM_GROWSDOWN bit. + +At the same time the new check in expand_downwards() is clearly correct, +and simplified the callers, so let's not remove it. + +The solution is instead to just codify the fact that yes, during +execve(), the stack grows down. This not only matches reality, it ends +up being particularly simple: we already have special execve-time flags +for the stack (VM_STACK_INCOMPLETE_SETUP) and use those flags to avoid +page migration during this setup time (see vma_is_temporary_stack() and +invalid_migration_vma()). + +So just add VM_GROWSDOWN to that set of temporary flags, and now our +stack flags automatically match reality, and the parisc stack expansion +works again. + +Note that the VM_STACK_INCOMPLETE_SETUP bits will be cleared when the +stack is finalized, so we only add the extra VM_GROWSDOWN bit on +CONFIG_STACK_GROWSUP architectures (ie parisc) rather than adding it in +general. + +Link: https://lore.kernel.org/all/[email protected]/ +Link: https://lore.kernel.org/all/[email protected]/ +Fixes: 8d7071af8907 ("mm: always expand the stack with the mmap write lock held") +Reported-by: John David Anglin <[email protected]> +Reported-and-tested-by: Helge Deller <[email protected]> +Reported-and-tested-by: Guenter Roeck <[email protected]> +Signed-off-by: Linus Torvalds <[email protected]> +Signed-off-by: Greg Kroah-Hartman <[email protected]> +--- + include/linux/mm.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/include/linux/mm.h b/include/linux/mm.h +index 6cbcc55a80b02..9e10485f37e7f 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -377,7 +377,7 @@ extern unsigned int kobjsize(const void *objp); + #endif /* CONFIG_HAVE_ARCH_USERFAULTFD_MINOR */ + + /* Bits set in the VMA until the stack is in its final location */ +-#define VM_STACK_INCOMPLETE_SETUP (VM_RAND_READ | VM_SEQ_READ) ++#define VM_STACK_INCOMPLETE_SETUP (VM_RAND_READ | VM_SEQ_READ | VM_STACK_EARLY) + + #define TASK_EXEC ((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) + +@@ -399,8 +399,10 @@ extern unsigned int kobjsize(const void *objp); + + #ifdef CONFIG_STACK_GROWSUP + #define VM_STACK VM_GROWSUP ++#define VM_STACK_EARLY VM_GROWSDOWN + #else + #define VM_STACK VM_GROWSDOWN ++#define VM_STACK_EARLY 0 + #endif + + #define VM_STACK_FLAGS (VM_STACK | VM_STACK_DEFAULT_FLAGS | VM_ACCOUNT) +-- +cgit +
