Since commit f101c5644771 ("arm64: Support ARM64_VA_BITS=52 when
setting ARCH_MMAP_RND_BITS_MAX"), arm64 supports up to 33, 31, and 29
bits of mmap ASLR entropy on 48-bit and 52-bit virtual address spaces
for 4K, 16K, and 64K pages respectively. However, ARCH_MMAP_RND_BITS
still defaults to ARCH_MMAP_RND_BITS_MIN (18, 16, and 14 bits), which
was set in commit 8f0d3aa9de57 ("arm64: mm: support ARCH_MMAP_RND_BITS")
when 39-bit VA was the 4K default.Set the default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA to 28 (4K pages), 26 (16K pages), and 24 (64K pages), matching x86_64's 1 TiB randomization range (5 bits below ARCH_MMAP_RND_BITS_MAX) while keeping ARCH_MMAP_RND_BITS_MIN unchanged for smaller VA configurations. Closes: https://github.com/KSPP/linux/issues/371 Reviewed-by: Kees Cook <[email protected]> Signed-off-by: Iurii Trukhin <[email protected]> --- Changes in v2: - Add a comment above ARCH_MMAP_RND_BITS explaining the 1 TiB default for 48/52-bit VA and the fallback to ARCH_MMAP_RND_BITS_MIN in arch/Kconfig for smaller VA sizes (Anshuman Khandual). - Collect Reviewed-by from Kees Cook. - Link to v1: https://lore.kernel.org/r/CAOx7e9Jm0N9O_ndL1UApMPrXUN=p4riptsnibddp+9prusn...@mail.gmail.com arch/arm64/Kconfig | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index cab741a695f5..7bca47269dd5 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -313,6 +313,14 @@ config ARCH_MMAP_RND_BITS_MAX default 16 if ARM64_16K_PAGES default 18 +# default to 1 TiB (5 bits below ARCH_MMAP_RND_BITS_MAX) on 48-bit and +# 52-bit VA; smaller VA sizes fall back to ARCH_MMAP_RND_BITS_MIN in +# arch/Kconfig +config ARCH_MMAP_RND_BITS + default 24 if (ARM64_VA_BITS=48 || ARM64_VA_BITS=52) && ARM64_64K_PAGES + default 26 if (ARM64_VA_BITS=48 || ARM64_VA_BITS=52) && ARM64_16K_PAGES + default 28 if (ARM64_VA_BITS=48 || ARM64_VA_BITS=52) + config ARCH_MMAP_RND_COMPAT_BITS_MIN default 7 if ARM64_64K_PAGES default 9 if ARM64_16K_PAGES -- 2.56.0
