swh:1:snp:0424f14fb59df2ee63d8659da5115ce9de06a349
Revision 1b528181b2ffa14721fb28ad1bd539fe1732c583 authored by Roland McGrath on 08 September 2010, 02:35:49 UTC, committed by Linus Torvalds on 10 September 2010, 15:10:26 UTC
The CONFIG_STACK_GROWSDOWN variant of setup_arg_pages() does not
check the size of the argument/environment area on the stack.
When it is unworkably large, shift_arg_pages() hits its BUG_ON.
This is exploitable with a very large RLIMIT_STACK limit, to
create a crash pretty easily.

Check that the initial stack is not too large to make it possible
to map in any executable.  We're not checking that the actual
executable (or intepreter, for binfmt_elf) will fit.  So those
mappings might clobber part of the initial stack mapping.  But
that is just userland lossage that userland made happen, not a
kernel problem.

Signed-off-by: Roland McGrath <roland@redhat.com>
Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent be6200a
History
Tip revision: e8b0ccb2a787fb43f8091a1eaef9c28a79b00002 authored by Linus Torvalds on 05 April 2024, 17:05:42 UTC
Merge tag '9p-for-6.9-rc3' of https://github.com/martinetd/linux
Tip revision: e8b0ccb
File Mode Size
Documentation
arch
block
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.gitignore -rw-r--r-- 936 bytes
.mailmap -rw-r--r-- 3.9 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 91.8 KB
Kbuild -rw-r--r-- 2.4 KB
MAINTAINERS -rw-r--r-- 173.1 KB
Makefile -rw-r--r-- 50.5 KB
README -rw-r--r-- 17.0 KB
REPORTING-BUGS -rw-r--r-- 3.3 KB

README

back to top