Re: [PATCH v3 3/4] selinux: use vma_is_initial_stack() and vma_is_initial_heap()

["Liam R. Howlett" <Liam.Howlett@oracle.com>]

* Marc Reisner <reisner.marc@gmail.com> [240808 11:03]:
> On Thu, Aug 08, 2024 at 09:12:59PM +0800, Kefeng Wang wrote:
> >
> > OK，revert patch is sent, but I am also curious about it.
> >
> > https://lore.kernel.org/all/20240808130909.1027860-1-wangkefeng.wang@huawei.com/
> 
> I am also curious. It seems like the "real" fix would be in mmap - my
> understanding is that it should not intersect with heap, even when heap
> is empty (start_brk == brk).
> 
> It looks like start_brk is fixed in place when the ELF is
> loaded in fs/binfmt_elf.c:load_elf_binary (line 1288).
> 
>         if ((current->flags & PF_RANDOMIZE) && (snapshot_randomize_va_space > 1)) {
>                 /*
>                  * For architectures with ELF randomization, when executing
>                  * a loader directly (i.e. no interpreter listed in ELF
>                  * headers), move the brk area out of the mmap region
>                  * (since it grows up, and may collide early with the stack
>                  * growing down), and into the unused ELF_ET_DYN_BASE region.
>                  */
>                 if (IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) &&
>                     elf_ex->e_type == ET_DYN && !interpreter) {
>                         mm->brk = mm->start_brk = ELF_ET_DYN_BASE;
>                 } else {
>                         /* Otherwise leave a gap between .bss and brk. */
>                         mm->brk = mm->start_brk = mm->brk + PAGE_SIZE;
>                 }
> 
>                 mm->brk = mm->start_brk = arch_randomize_brk(mm);
> #ifdef compat_brk_randomized
>                 current->brk_randomized = 1;
> #endif
>         }


Have a look at the mmapstress 3 test in ltp [1].  The tests pokes holes
and mmaps into those holes throughout the brk range.

[1]. https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/mem/mmapstress/mmapstress03.c