summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--kernel.spec3
-rw-r--r--linux-2.6-i386-nx-emulation.patch22
2 files changed, 25 insertions, 0 deletions
diff --git a/kernel.spec b/kernel.spec
index 8342c4a7c..114580fac 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -1877,6 +1877,9 @@ fi
%changelog
* Fri Sep 03 2010 Dave Jones <davej@redhat.com>
+- exec-randomization: brk away from exec rand area (Kees Cook)
+
+* Fri Sep 03 2010 Dave Jones <davej@redhat.com>
- Remove the execshield boot parameter.
Based on a patch from Kees Cook
diff --git a/linux-2.6-i386-nx-emulation.patch b/linux-2.6-i386-nx-emulation.patch
index 2ea7645a1..e36bb5ecc 100644
--- a/linux-2.6-i386-nx-emulation.patch
+++ b/linux-2.6-i386-nx-emulation.patch
@@ -591,3 +591,25 @@
mmu_notifier_invalidate_range_start(mm, start, end);
if (is_vm_hugetlb_page(vma))
hugetlb_change_protection(vma, start, end, vma->vm_page_prot);
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index 57d1868..29c0c35 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -669,6 +669,16 @@ unsigned long arch_align_stack(unsigned long sp)
+ unsigned long arch_randomize_brk(struct mm_struct *mm)
+ {
+ unsigned long range_end = mm->brk + 0x02000000;
+- return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
++ unsigned long bump = 0;
++#ifdef CONFIG_X86_32
++ /* in the case of NX emulation, shove the brk segment way out of the
++ way of the exec randomization area, since it can collide with
++ future allocations if not. */
++ if ( (mm->get_unmapped_exec_area == arch_get_unmapped_exec_area) &&
++ (mm->brk < 0x08000000) ) {
++ bump = (TASK_SIZE/6);
++ }
++#endif
++ return bump + (randomize_range(mm->brk, range_end, 0) ? : mm->brk);
+ }
+