From mboxrd@z Thu Jan  1 00:00:00 1970
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1753854AbeAIUX1 (ORCPT <rfc822;ralf@linux-mips.org> + 1 other);
        Tue, 9 Jan 2018 15:23:27 -0500
Received: from mail-pf0-f196.google.com ([209.85.192.196]:33397 "EHLO
        mail-pf0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1752797AbeAIUXU (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Tue, 9 Jan 2018 15:23:20 -0500
X-Google-Smtp-Source: ACJfBov08Mrs4MkLu1fnqPw98BFkxLNzhA8KKyQaD+VXIQfH31FqYrRnGt0hs08amRT/YVEXhlDYAg==
From: Kees Cook <keescook@chromium.org>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: Kees Cook <keescook@chromium.org>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Michal Hocko <mhocko@kernel.org>,
        Ben Hutchings <ben@decadent.org.uk>, Willy Tarreau <w@1wt.eu>,
        Hugh Dickins <hughd@google.com>,
        Oleg Nesterov <oleg@redhat.com>,
        "Jason A. Donenfeld" <Jason@zx2c4.com>,
        Rik van Riel <riel@redhat.com>,
        Laura Abbott <labbott@redhat.com>, Greg KH <greg@kroah.com>,
        Andy Lutomirski <luto@kernel.org>, linux-mm@kvack.org,
        linux-arch@vger.kernel.org, linux-kernel@vger.kernel.org,
        kernel-hardening@lists.openwall.com
Subject: [PATCH 0/3] exec: Pin stack limit during exec
Date: Tue,  9 Jan 2018 12:23:00 -0800
Message-Id: <1515529383-35695-1-git-send-email-keescook@chromium.org>
X-Mailer: git-send-email 2.7.4
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Return-Path: <linux-kernel-owner@vger.kernel.org>

Attempts to solve problems with the stack limit changing during exec             continue to be frustrated[1][2]. In addition to the specific issues              around the Stack Clash family of flaws, Andy Lutomirski pointed out[3]
other places during exec where the stack limit is used and is assumed
to be unchanging. Given the many places it gets used and the fact that
it can be manipulated/raced via setrlimit() and prlimit(), I think the
only way to handle this is to move away from the "current" view of the
stack limit and instead attach it to the bprm, and plumb this down into
the functions that need to know the stack limits. This series implements
the approach. I'd be curious to hear feedback on alternatives.

Thanks!

-Kees

[1] 04e35f4495dd ("exec: avoid RLIMIT_STACK races with prlimit()")
[2] 779f4e1c6c7c ("Revert "exec: avoid RLIMIT_STACK races with prlimit()"")
[3] to security@kernel.org, "Subject: existing rlimit races?"