ASLR: check for max_addr after applying randomization, not before.
Otherwise resulting address from vm_map_find() migh not satisfy the upper limit. For instance, it could affect MAP_32BIT flag from 64bit processes. Found by: Doug Moore <dougm@rice.edu> Reviewed by: alc, Doug Moore <dougm@rice.edu> Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D19688
This commit is contained in:
parent
0bd4858ed3
commit
5019dac98a
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=345452
@ -1673,11 +1673,12 @@ vm_map_find(vm_map_t map, vm_object_t object, vm_ooffset_t offset,
|
||||
(max_addr == 0 || max_addr > MAP_32BIT_MAX_ADDR) ?
|
||||
aslr_pages_rnd_64[pidx] : aslr_pages_rnd_32[pidx];
|
||||
if (vm_map_findspace(map, curr_min_addr, length +
|
||||
gap * pagesizes[pidx], addr) ||
|
||||
(max_addr != 0 && *addr + length > max_addr))
|
||||
gap * pagesizes[pidx], addr))
|
||||
goto again;
|
||||
/* And randomize the start address. */
|
||||
*addr += (arc4random() % gap) * pagesizes[pidx];
|
||||
if (max_addr != 0 && *addr + length > max_addr)
|
||||
goto again;
|
||||
} else if (vm_map_findspace(map, curr_min_addr, length, addr) ||
|
||||
(max_addr != 0 && *addr + length > max_addr)) {
|
||||
if (cluster) {
|
||||
|
Loading…
Reference in New Issue
Block a user