20 files changed, 504 insertions, 86 deletions

diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt
index 1d192565e182..8cfca173d4bc 100644
--- a/Documentation/sysctl/vm.txt
+++ b/Documentation/sysctl/vm.txt
@@ -31,6 +31,7 @@ Currently, these files are in /proc/sys/vm:
 - min_unmapped_ratio
 - min_slab_ratio
 - panic_on_oom
+- mmap_min_address
 
 ==============================================================
 
@@ -216,3 +217,17 @@ above-mentioned.
 The default value is 0.
 1 and 2 are for failover of clustering. Please select either
 according to your policy of failover.
+
+==============================================================
+
+mmap_min_addr
+
+This file indicates the amount of address space  which a user process will
+be restricted from mmaping.  Since kernel null dereference bugs could
+accidentally operate based on the information in the first couple of pages
+of memory userspace processes should not be allowed to write to them.  By
+default this value is set to 0 and no protections will be enforced by the
+security module.  Setting this value to something like 64k will allow the
+vast majority of applications to work correctly and provide defense in depth
+against future potential kernel bugs.
+
diff --git a/include/linux/security.h b/include/linux/security.h
index 9eb9e0fe0331..c11dc8aa0351 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -71,6 +71,7 @@ struct xfrm_user_sec_ctx;
 extern int cap_netlink_send(struct sock *sk, struct sk_buff *skb);
 extern int cap_netlink_recv(struct sk_buff *skb, int cap);
 
+extern unsigned long mmap_min_addr;
 /*
  * Values used in the task_security_ops calls
  */
@@ -1241,8 +1242,9 @@ struct security_operations {
         int (*file_ioctl) (struct file * file, unsigned int cmd,
                            unsigned long arg);
         int (*file_mmap) (struct file * file,
-                          unsigned long reqprot,
-                          unsigned long prot, unsigned long flags);
+                          unsigned long reqprot, unsigned long prot,
+                          unsigned long flags, unsigned long addr,
+                          unsigned long addr_only);
         int (*file_mprotect) (struct vm_area_struct * vma,
                               unsigned long reqprot,
                               unsigned long prot);
@@ -1814,9 +1816,12 @@ static inline int security_file_ioctl (struct file *file, unsigned int cmd,
 
 static inline int security_file_mmap (struct file *file, unsigned long reqprot,
                                       unsigned long prot,
-                                      unsigned long flags)
+                                      unsigned long flags,
+                                      unsigned long addr,
+                                      unsigned long addr_only)
 {
-        return security_ops->file_mmap (file, reqprot, prot, flags);
+        return security_ops->file_mmap (file, reqprot, prot, flags, addr,
+                                        addr_only);
 }
 
 static inline int security_file_mprotect (struct vm_area_struct *vma,
@@ -2489,7 +2494,9 @@ static inline int security_file_ioctl (struct file *file, unsigned int cmd,
 
 static inline int security_file_mmap (struct file *file, unsigned long reqprot,
                                       unsigned long prot,
-                                      unsigned long flags)
+                                      unsigned long flags,
+                                      unsigned long addr,
+                                      unsigned long addr_only)
 {
         return 0;
 }
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 51f5dac42a00..d93e13d93f24 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -949,6 +949,16 @@ static ctl_table vm_table[] = {
                 .strategy       = &sysctl_jiffies,
         },
 #endif
+#ifdef CONFIG_SECURITY
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "mmap_min_addr",
+                .data           = &mmap_min_addr,
+                .maxlen         = sizeof(unsigned long),
+                .mode           = 0644,
+                .proc_handler   = &proc_doulongvec_minmax,
+        },
+#endif
 #if defined(CONFIG_X86_32) || \
    (defined(CONFIG_SUPERH) && defined(CONFIG_VSYSCALL))
         {
diff --git a/mm/mmap.c b/mm/mmap.c
index 906ed402f7ca..9f70c8e8c871 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1023,10 +1023,10 @@ unsigned long do_mmap_pgoff(struct file * file, unsigned long addr,
                 }
         }
 
-        error = security_file_mmap(file, reqprot, prot, flags);
+        error = security_file_mmap(file, reqprot, prot, flags, addr, 0);
         if (error)
                 return error;
-                
+
         /* Clear old maps */
         error = -ENOMEM;
 munmap_back:
diff --git a/mm/mremap.c b/mm/mremap.c
index 5d4bd4f95b8e..bc7c52efc71b 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -291,6 +291,10 @@ unsigned long do_mremap(unsigned long addr,
                 if ((addr <= new_addr) && (addr+old_len) > new_addr)
                         goto out;
 
+                ret = security_file_mmap(0, 0, 0, 0, new_addr, 1);
+                if (ret)
+                        goto out;
+
                 ret = do_munmap(mm, new_addr, new_len);
                 if (ret)
                         goto out;
@@ -390,8 +394,13 @@ unsigned long do_mremap(unsigned long addr,
 
                         new_addr = get_unmapped_area(vma->vm_file, 0, new_len,
                                                 vma->vm_pgoff, map_flags);
-                        ret = new_addr;
-                        if (new_addr & ~PAGE_MASK)
+                        if (new_addr & ~PAGE_MASK) {
+                                ret = new_addr;
+                                goto out;
+                        }
+
+                        ret = security_file_mmap(0, 0, 0, 0, new_addr, 1);
+                        if (ret)
                                 goto out;
                 }
                 ret = move_vma(vma, addr, old_len, new_len, new_addr);
diff --git a/mm/nommu.c b/mm/nommu.c
index 2b16b00a5b11..989e2e9af5c3 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -639,7 +639,7 @@ static int validate_mmap_request(struct file *file,
         }
 
         /* allow the security API to have its say */
-        ret = security_file_mmap(file, reqprot, prot, flags);
+        ret = security_file_mmap(file, reqprot, prot, flags, addr, 0);
         if (ret < 0)
                 return ret;