arm64: determine stack entropy based on mmap entropy
Stack mapping entropy is currently hard-wired to 11 bits of entropy on 32-bit and 18 bits of entropy on 64-bit. The stack itself gains an extra 8 bits of entropy from lower bit randomization within 16 byte alignment constraints. The argument block could have all lower bits randomized but it currently only gets the mapping randomization. Rather than hard-wiring values this switches to using the mmap entropy configuration like the mmap base and executable base, resulting in a range of 8 to 16 bits on 32-bit and 18 to 24 bits on 64-bit (with 4k pages and 3 level page tables) depending on kernel configuration and overridable via the sysctl entries. It's worth noting that since these kernel configuration options default to the minimum supported entropy value, the entropy on 32-bit will drop from 11 to 8 bits for builds using the defaults. However, following the configuration seems like the right thing to do regardless. At the very least, changing the defaults for COMPAT (32-bit processes on 64-bit) should be considered due to the larger address space compared to real 32-bit. Signed-off-by: Daniel Micay <danielmicay@gmail.com> Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
This commit is contained in:
parent
e3839126e6
commit
df64e52e41
1 changed files with 3 additions and 3 deletions
|
@ -193,10 +193,10 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
|
||||||
/* 1GB of VA */
|
/* 1GB of VA */
|
||||||
#ifdef CONFIG_COMPAT
|
#ifdef CONFIG_COMPAT
|
||||||
#define STACK_RND_MASK (test_thread_flag(TIF_32BIT) ? \
|
#define STACK_RND_MASK (test_thread_flag(TIF_32BIT) ? \
|
||||||
0x7ff >> (PAGE_SHIFT - 12) : \
|
((1UL << mmap_rnd_compat_bits) - 1) >> (PAGE_SHIFT - 12) : \
|
||||||
0x3ffff >> (PAGE_SHIFT - 12))
|
((1UL << mmap_rnd_bits) - 1) >> (PAGE_SHIFT - 12))
|
||||||
#else
|
#else
|
||||||
#define STACK_RND_MASK (0x3ffff >> (PAGE_SHIFT - 12))
|
#define STACK_RND_MASK (((1UL << mmap_rnd_bits) - 1) >> (PAGE_SHIFT - 12))
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
#ifdef __AARCH64EB__
|
#ifdef __AARCH64EB__
|
||||||
|
|
Loading…
Reference in a new issue