Re: [PATCH 09/10] mm: Prevent madvise from changing shadow stack
From: Nadav Amit <hidden>
Date: 2018-06-07 21:09:21
Also in:
linux-doc, linux-mm, lkml
Yu-cheng Yu [off-list ref] wrote:
quoted hunk ↗ jump to hunk
Signed-off-by: Yu-cheng Yu <redacted> --- mm/madvise.c | 9 +++++++++ 1 file changed, 9 insertions(+)diff --git a/mm/madvise.c b/mm/madvise.c index 4d3c922ea1a1..2a6988badd6b 100644 --- a/mm/madvise.c +++ b/mm/madvise.c@@ -839,6 +839,14 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)if (vma && start > vma->vm_start) prev = vma; + /* + * Don't do anything on shadow stack. + */ + if (vma->vm_flags & VM_SHSTK) { + error = -EINVAL; + goto out_no_plug; + } + blk_start_plug(&plug); for (;;) { /* Still start < end. */
What happens if the madvise() revolves multiple VMAs, the first one is not VM_SHSTK, but the another one is? Shouldn’t the test be done inside the loop, potentially in madvise_vma() ?