exec-randomization: brk away from exec rand area

This is a fix for the NX emulation patch to force the brk area well
outside of the exec randomization area to avoid future allocation or brk
growth collisions. Normally this isn't a problem, except when the text
region has been loaded from a PIE binary and the CS limit can't be put
just above bss.

A test-case that will show failures without this patch can be found here:
http://bazaar.launchpad.net/~ubuntu-bugcontrol/qa-regression-testing/master/annotate/head%3A/scripts/kernel-aslr-collisions/explode-brk.c

Signed-off-by: Kees Cook <kees.cook@canonical.com>
Signed-off-by: Andy Whitcroft <apw@canonical.com>

diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index ff45541..f01abc7 100644 (file)
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -678,6 +678,16 @@ unsigned long arch_align_stack(unsigned long sp)
 unsigned long arch_randomize_brk(struct mm_struct *mm)
 {
        unsigned long range_end = mm->brk + 0x02000000;
-       return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
+       unsigned long bump = 0;
+#ifdef CONFIG_X86_32
+       /* in the case of NX emulation, shove the brk segment way out of the
+          way of the exec randomization area, since it can collide with
+          future allocations if not. */
+       if ( (mm->get_unmapped_exec_area == arch_get_unmapped_exec_area) &&
+            (mm->brk < 0x08000000) ) {
+               bump = (TASK_SIZE/6);
+       }
+#endif
+       return bump + (randomize_range(mm->brk, range_end, 0) ? : mm->brk);
 }