Stable update request: kernel changes to fix PIE with large stack

On Thu, 2017-03-23 at 17:06 +0000, James Cowgill wrote:
[...]
> The reason the program and the heap are at these very high addresses is
> that xsltproc is built with PIE and the kernel is treating the
> executable like a mmap and grouping it with all the other libraries. In
> d1fd836dcf00 ("mm: split ET_DYN ASLR from mmap ASLR") the behavior
> changed and now the program and it's heap will be mapped at a lower
> address so the bug does not affect newer kernels. Using "setarch -L" or
> "setarch -R" is another workaround for this bug because that moves the
> program so that there is a much larger gap between the heap and the stack.
> 
> This might affect other applications as well. Effectively it means that
> PIE executables which use lots of stack space might not work properly
> with jessie's kernel. The chances the bug will be hit seems to vary
> between arches however (depending on what each arch does in
> arch_pick_mmap_layout and arch_randomize_brk) - mips64el seems to be hit
> pretty frequently. In xsltproc's case, PIE was enabled some time ago
> which is why this bug is quite old.
> 
> I believe any of the following will fix this (but have not all been tested):
> - Reduce the stack usage in xsltproc (the upstream bug)
> - Upgrade the relevant buildds to Linux >= 4.1
> - Apply d1fd836dcf00 to jessie's kernel

That's part of a series of 10 commits covering multiple architectures. 
I already picked one of them as a dependency for fixing CVE-2016-3672,
which leaves 9 to do.  I think it is worth doing this in stable to
support chroots and partial upgrades, but I would like to hear the
release team ack/nak this in principle before I start preparing the
change for Debian stable.

Kees Cook quotes the list of commits here:
http://lists.openwall.net/linux-kernel/2015/07/27/964
(I can't find the original message).

Ben.

> - Disable PIE in xsltproc.
> - Run xsltproc inside setarch -L / setarch -R
[...]

-- 
Ben Hutchings
The first rule of tautology club is the first rule of tautology club.

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAljUPb8ACgkQ57/I7JWG
EQn9Qw/+JMQML6WEQ3kY7YOkWhUO3YTefGanyAHUo2hX/D3eNPC5w7jtuOrfu78G
D8imbKyhosUp7Fe7MZiHnBiZqBAZQN0Qs6B8uwJvLircrhaKTlVThZgBmoYgORTq
cCYuyUmE0yHD2Q2RqDsuPm6swkD5Mzi+K6ZbdsMbT5uHcNIiHPGA1/nu5ShsFYGT
RCJrkI85aNDOHgezk4JV8qrX1Wl8X5/WXwtKtRxWxwwanz6uZrTxwk8C86DTnVWJ
n43xOxlhiLjB+ZL5A5osWY/nXpPEkag6r0EyOcQJT5YcsFuAMwiT+cZ19C3WTNV7
hjBvrjRQicYaW5IM9mlMuuWaiPz+GqMT8x5dXohB+SD9Q/AFuwqXy1R8dF/4g88g
d3PJslAJ42Xf/Lg0kbIv0Liua5X8M2BdZgdTjc5Jk1BYUBwt8sB3PNVNudGxSuNw
dZPner+eopd5EEzz04fHlWpKWDCLVOlhoHe4apjjaarfg9cE1VvBv9w8PZzU39/+
n28zHiQ8dm2gNhKedpCCUYKS6zMz0dRay1w4YV6Q1D/c3S7RY56W0dC8k7GPpnmJ
fA2cxF1FqoFmGorsdGCE08Xz6vhJAALdQek5Z29Y9BmQh4N5cU2LYvbLZCYs6CrB
keb0UNJtIbRG8rNJY8llI9jL6+SEhqTAd80JB0Ht5EUDZYWXyQk=
=VGeu
-----END PGP SIGNATURE-----