[PATCH 0/2] exec: randomize the argument block's in-page offset

[Brian Witte <brianwitte@mailfence.com>]

Patch 1 randomizes where the argv, envp and execfn strings sit within
the first stack page, as KSPP issue 283 asks; today their low address
bits never change. Patch 2 adds a selftest.

Patch 1 repeats bprm_fill_uid()'s set-id checks; I can send a shared
helper as a preparatory patch if preferred.

Tested in QEMU, compared with unpatched for-next/execve (b36b990c50b1),
on x86_64 with ia32, arm64 (4K pages with AArch32, and 64K pages), and
parisc 32-bit and 64-bit (STACK_GROWSUP):

 - The selftest passes; unpatched, it fails.
 - 10000 execs give 3709-3764 distinct offsets with 4K pages and 9259
   with 64K, as a uniform draw predicts.
 - Cost: about 0.5 more minor page faults per exec on average, and up
   to a page of RLIMIT_STACK; exec time is within noise.
 - No change in LTP execve and execveat, CRIU dump and restore, or
   programs that rewrite argv[0] (setproctitle(), sshd, postgres), and
   no KASAN, UBSAN or lockdep reports under exec and chmod races.

The series is based on mainline (864c07de0c7d), which now includes
for-next/execve and the const mnt_idmap conversion. On that base it adds
no W=1 warnings with GCC 14 or clang 19 on x86_64 and arm64, and the
selftest passes on x86_64.

Brian Witte (2):
  exec: randomize the argument block's offset within its page
  selftests/exec: test the argument block's in-page offset

 fs/exec.c                                     |  32 +++
 tools/testing/selftests/exec/.gitignore       |   3 +
 tools/testing/selftests/exec/Makefile         |   5 +
 .../testing/selftests/exec/argblock-offset.c  | 214 ++++++++++++++++++
 .../testing/selftests/exec/argblock-report.c  |  24 ++
 5 files changed, 278 insertions(+)
 create mode 100644 tools/testing/selftests/exec/argblock-offset.c
 create mode 100644 tools/testing/selftests/exec/argblock-report.c


base-commit: 864c07de0c7dcbca58b61625dfa2e461ae63b242
-- 
2.47.3