Move ps_strings "after" the random stackgap. This makes its location a

per-process value, and therefpore turns the VM_PSSTRINGS sysctl into a
per-process one as well.  This gets rid of a pointer to the bottom of the
stack at a fixed location.  Also clears the road for unmapping the stackgap.

ok deraadt@

4 files changed, 21 insertions, 13 deletions

diff --git a/sys/kern/exec_elf.c b/sys/kern/exec_elf.c
index 4fcedcf6c1e..8954eabca0e 100644
--- a/sys/kern/exec_elf.c
+++ b/sys/kern/exec_elf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: exec_elf.c,v 1.108 2014/12/22 15:05:24 kettenis Exp $	*/
+/*	$OpenBSD: exec_elf.c,v 1.109 2015/01/20 19:43:21 kettenis Exp $	*/
 
 /*
  * Copyright (c) 1996 Per Fogelstrom
@@ -1200,7 +1200,7 @@ ELFNAMEEND(coredump_notes)(struct proc *p, void *iocookie, size_t *sizep)
 		iov.iov_len = sizeof(pss);
 		uio.uio_iov = &iov;
 		uio.uio_iovcnt = 1;
-		uio.uio_offset = (off_t)(vaddr_t)PS_STRINGS;
+		uio.uio_offset = (off_t)pr->ps_strings;
 		uio.uio_resid = sizeof(pss);
 		uio.uio_segflg = UIO_SYSSPACE;
 		uio.uio_rw = UIO_READ;
diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c
index 2f92dc9f7a1..811d8e7fa5c 100644
--- a/sys/kern/kern_exec.c
+++ b/sys/kern/kern_exec.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_exec.c,v 1.155 2015/01/15 16:31:19 kettenis Exp $	*/
+/*	$OpenBSD: kern_exec.c,v 1.156 2015/01/20 19:43:21 kettenis Exp $	*/
 /*	$NetBSD: kern_exec.c,v 1.75 1996/02/09 18:59:28 christos Exp $	*/
 
 /*-
@@ -466,7 +466,12 @@ sys_execve(struct proc *p, void *v, register_t *retval)
 		goto exec_abort;
 
 	/* copy out the process's ps_strings structure */
-	if (copyout(&arginfo, (char *)PS_STRINGS, sizeof(arginfo)))
+#ifdef MACHINE_STACK_GROWS_UP
+	pr->ps_strings = (vaddr_t)PS_STRINGS + sgap;
+#else
+	pr->ps_strings = (vaddr_t)PS_STRINGS - sgap;
+#endif
+	if (copyout(&arginfo, (char *)pr->ps_strings, sizeof(arginfo)))
 		goto exec_abort;
 
 	stopprofclock(pr);	/* stop profiling */
diff --git a/sys/kern/kern_sysctl.c b/sys/kern/kern_sysctl.c
index 04e08d21fbe..1b6df9ea98b 100644
--- a/sys/kern/kern_sysctl.c
+++ b/sys/kern/kern_sysctl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_sysctl.c,v 1.278 2015/01/13 10:07:58 mpf Exp $	*/
+/*	$OpenBSD: kern_sysctl.c,v 1.279 2015/01/20 19:43:21 kettenis Exp $	*/
 /*	$NetBSD: kern_sysctl.c,v 1.17 1996/05/20 17:49:05 mrg Exp $	*/
 
 /*-
@@ -1566,6 +1566,7 @@ sysctl_proc_args(int *name, u_int namelen, void *oldp, size_t *oldlenp,
 	char **rargv, **vargv;		/* reader vs. victim */
 	char *rarg, *varg, *buf;
 	struct vmspace *vm;
+	vaddr_t ps_strings;
 
 	if (namelen > 2)
 		return (ENOTDIR);
@@ -1610,6 +1611,7 @@ sysctl_proc_args(int *name, u_int namelen, void *oldp, size_t *oldlenp,
 	    (error = suser(cp, 0)) != 0))
 		return (error);
 
+	ps_strings = vpr->ps_strings;
 	vm = vpr->ps_vmspace;
 	vm->vm_refcnt++;
 	vpr = NULL;
@@ -1619,8 +1621,8 @@ sysctl_proc_args(int *name, u_int namelen, void *oldp, size_t *oldlenp,
 	iov.iov_base = &pss;
 	iov.iov_len = sizeof(pss);
 	uio.uio_iov = &iov;
-	uio.uio_iovcnt = 1;	
-	uio.uio_offset = (off_t)(vaddr_t)PS_STRINGS;
+	uio.uio_iovcnt = 1;
+	uio.uio_offset = (off_t)ps_strings;
 	uio.uio_resid = sizeof(pss);
 	uio.uio_segflg = UIO_SYSSPACE;
 	uio.uio_rw = UIO_READ;
diff --git a/sys/kern/sys_process.c b/sys/kern/sys_process.c
index 31de7a1d2de..67866a24551 100644
--- a/sys/kern/sys_process.c
+++ b/sys/kern/sys_process.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sys_process.c,v 1.66 2014/12/12 07:45:46 tedu Exp $	*/
+/*	$OpenBSD: sys_process.c,v 1.67 2015/01/20 19:43:21 kettenis Exp $	*/
 /*	$NetBSD: sys_process.c,v 1.55 1996/05/15 06:17:47 tls Exp $	*/
 
 /*-
@@ -748,6 +748,7 @@ process_domem(struct proc *curp, struct proc *p, struct uio *uio, int req)
 int
 process_auxv_offset(struct proc *curp, struct proc *p, struct uio *uiop)
 {
+	struct process *pr = p->p_p;
 	struct ps_strings pss;
 	struct iovec iov;
 	struct uio uio;
@@ -757,7 +758,7 @@ process_auxv_offset(struct proc *curp, struct proc *p, struct uio *uiop)
 	iov.iov_len = sizeof(pss);
 	uio.uio_iov = &iov;
 	uio.uio_iovcnt = 1;	
-	uio.uio_offset = (off_t)(vaddr_t)PS_STRINGS;
+	uio.uio_offset = (off_t)pr->ps_strings;
 	uio.uio_resid = sizeof(pss);
 	uio.uio_segflg = UIO_SYSSPACE;
 	uio.uio_rw = UIO_READ;
@@ -771,13 +772,13 @@ process_auxv_offset(struct proc *curp, struct proc *p, struct uio *uiop)
 
 	uiop->uio_offset += (off_t)(vaddr_t)(pss.ps_envstr + pss.ps_nenvstr + 1);
 #ifdef MACHINE_STACK_GROWS_UP
-	if (uiop->uio_offset < (off_t)(vaddr_t)PS_STRINGS)
+	if (uiop->uio_offset < (off_t)pr->ps_strings)
 		return (EIO);
 #else
-	if (uiop->uio_offset > (off_t)(vaddr_t)PS_STRINGS)
+	if (uiop->uio_offset > (off_t)pr->ps_strings)
 		return (EIO);
-	if ((uiop->uio_offset + uiop->uio_resid) > (off_t)(vaddr_t)PS_STRINGS)
-		uiop->uio_resid = (off_t)(vaddr_t)PS_STRINGS - uiop->uio_offset;
+	if ((uiop->uio_offset + uiop->uio_resid) > (off_t)pr->ps_strings)
+		uiop->uio_resid = (off_t)pr->ps_strings - uiop->uio_offset;
 #endif
 
 	return (0);