From: Peter Zijlstra <peterz@infradead.org>
To: Xiang Mei <xmei5@asu.edu>
Cc: Kees Cook <kees@kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
Thomas Gleixner <tglx@kernel.org>, Ingo Molnar <mingo@redhat.com>,
Borislav Petkov <bp@alien8.de>,
Dave Hansen <dave.hansen@linux.intel.com>,
x86@kernel.org, linux-hardening@vger.kernel.org,
Uladzislau Rezki <urezki@gmail.com>,
"Gustavo A . R . Silva" <gustavoars@kernel.org>,
"H . Peter Anvin" <hpa@zytor.com>,
linux-mm@kvack.org, linux-kernel@vger.kernel.org,
Jennifer Miller <jmill@asu.edu>, Tiffany Bao <tbao@asu.edu>,
Ruoyu Wang <fishw@asu.edu>, Adam Doupe <doupe@asu.edu>,
Kyle Zeng <zengyhkyle@asu.edu>,
Yan Shoshitaishvili <yans@asu.edu>
Subject: Re: [PATCH] mm/vmalloc: widen guard region to defeat ENTER-based stack pivot
Date: Tue, 30 Jun 2026 09:12:57 +0200 [thread overview]
Message-ID: <20260630071257.GQ1181229@noisy.programming.kicks-ass.net> (raw)
In-Reply-To: <CAPpSM+Qwmv_wsNFnEjtk3GbLdZB_JtH5vW0v-Cj-CyiE8M_UEw@mail.gmail.com>
On Fri, Jun 26, 2026 at 10:48:46AM -0700, Xiang Mei wrote:
> > - The displacement is attacker-chosen (via the immediates) up to 0x100ff,
> > so the pivot can clear any guard narrower than that in one step.
> > - ENTER is reachable as a gadget, so a pivot of this size is available
> > without depending on register state at the hijack site.
> > - The pivot happens after the control transfer, so it is not constrained
> > by forward-edge CFI (kCFI / FineIBT).
> Please ignore this line; it is not related since we assume we already
> have a CFH primitive. Sorry for the confusion.
So I am still confused by all this. CFI does remove a ton of CFH
primitives. Until we have Shadow Stacks sorted, ROP will obviously be
the main alternative, but I'm really struggling to justify adding 16
guard pages rather than going after any actual control flow hijacking
primitives.
I mean, if you have a reliable CFH, we should be fixing that. But
somehow I'm thinking that if you do have one, ENTER isn't going to be
the worst of it.
Or am I missing something here?
next prev parent reply other threads:[~2026-06-30 7:13 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-26 17:34 [PATCH] mm/vmalloc: widen guard region to defeat ENTER-based stack pivot Xiang Mei
2026-06-26 17:46 ` Xiang Mei
2026-06-26 17:48 ` Xiang Mei
2026-06-30 7:12 ` Peter Zijlstra [this message]
2026-06-30 8:09 ` Xiang Mei
2026-06-26 19:39 ` Pedro Falcato
2026-06-26 20:05 ` Xiang Mei
2026-06-29 2:09 ` H. Peter Anvin
2026-06-29 4:43 ` Matthew Wilcox
2026-06-29 12:50 ` H. Peter Anvin
2026-06-29 17:21 ` Xiang Mei
2026-06-29 21:50 ` Xiang Mei
2026-06-29 21:51 ` Xiang Mei
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260630071257.GQ1181229@noisy.programming.kicks-ass.net \
--to=peterz@infradead.org \
--cc=akpm@linux-foundation.org \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=doupe@asu.edu \
--cc=fishw@asu.edu \
--cc=gustavoars@kernel.org \
--cc=hpa@zytor.com \
--cc=jmill@asu.edu \
--cc=kees@kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mingo@redhat.com \
--cc=tbao@asu.edu \
--cc=tglx@kernel.org \
--cc=urezki@gmail.com \
--cc=x86@kernel.org \
--cc=xmei5@asu.edu \
--cc=yans@asu.edu \
--cc=zengyhkyle@asu.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.