From: Rik van Riel <riel@redhat.com>
To: kernel-hardening@lists.openwall.com,
Andy Lutomirski <luto@amacapital.net>,
Herbert Xu <herbert@gondor.apana.org.au>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
Andy Lutomirski <luto@kernel.org>,
the arch/x86 maintainers <x86@kernel.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
"linux-arch@vger.kernel.org" <linux-arch@vger.kernel.org>,
Borislav Petkov <bp@alien8.de>, Nadav Amit <nadav.amit@gmail.com>,
Brian Gerst <brgerst@gmail.com>,
Josh Poimboeuf <jpoimboe@redhat.com>, Jann Horn <jann@thejh.net>,
Heiko Carstens <heiko.carstens@de.ibm.com>
Subject: Re: Re: [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core)
Date: Tue, 21 Jun 2016 14:19:49 -0400 [thread overview]
Message-ID: <1466533189.2756.52.camel@redhat.com> (raw)
In-Reply-To: <CAGXu5jLQk8zha3cx158GU6AGN+XDManurTmuC08XjYcJBJhvfg@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 604 bytes --]
On Tue, 2016-06-21 at 11:12 -0700, Kees Cook wrote:
> On Tue, Jun 21, 2016 at 10:27 AM, Andy Lutomirski
> <luto@amacapital.net> wrote:
> > FWIW, it may be a while before this can be enabled in distro
> > kernels.
> > There are some code paths (*cough* crypto users *cough*) that think
> > that calling sg_init_one with a stack address is a reasonable thing
> > to
> > do, and it doesn't work with a vmalloced stack. grsecurity works
> ... O_o ...
>
> Why does it not work on a vmalloced stack??
Because virt_to_page() does not work on vmalloced
memory.
--
All Rights Reversed.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 473 bytes --]
WARNING: multiple messages have this Message-ID (diff)
From: Rik van Riel <riel@redhat.com>
To: kernel-hardening@lists.openwall.com,
Andy Lutomirski <luto@amacapital.net>,
Herbert Xu <herbert@gondor.apana.org.au>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
Andy Lutomirski <luto@kernel.org>,
the arch/x86 maintainers <x86@kernel.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
"linux-arch@vger.kernel.org" <linux-arch@vger.kernel.org>,
Borislav Petkov <bp@alien8.de>, Nadav Amit <nadav.amit@gmail.com>,
Brian Gerst <brgerst@gmail.com>,
Josh Poimboeuf <jpoimboe@redhat.com>, Jann Horn <jann@thejh.net>,
Heiko Carstens <heiko.carstens@de.ibm.com>
Subject: Re: [kernel-hardening] Re: [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core)
Date: Tue, 21 Jun 2016 14:19:49 -0400 [thread overview]
Message-ID: <1466533189.2756.52.camel@redhat.com> (raw)
Message-ID: <20160621181949.TMbCDYjmeuGjKWo4lUfc5kjeN8wJPqk_UGD8myr1KmM@z> (raw)
In-Reply-To: <CAGXu5jLQk8zha3cx158GU6AGN+XDManurTmuC08XjYcJBJhvfg@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 604 bytes --]
On Tue, 2016-06-21 at 11:12 -0700, Kees Cook wrote:
> On Tue, Jun 21, 2016 at 10:27 AM, Andy Lutomirski
> <luto@amacapital.net> wrote:
> > FWIW, it may be a while before this can be enabled in distro
> > kernels.
> > There are some code paths (*cough* crypto users *cough*) that think
> > that calling sg_init_one with a stack address is a reasonable thing
> > to
> > do, and it doesn't work with a vmalloced stack. grsecurity works
> ... O_o ...
>
> Why does it not work on a vmalloced stack??
Because virt_to_page() does not work on vmalloced
memory.
--
All Rights Reversed.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 473 bytes --]
next prev parent reply other threads:[~2016-06-21 18:19 UTC|newest]
Thread overview: 150+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-20 23:43 [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 01/13] x86/mm/hotplug: Don't remove PGD entries in remove_pagetable() Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 02/13] x86/cpa: In populate_pgd, don't set the pgd entry until it's populated Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 03/13] x86/mm: Remove kernel_unmap_pages_in_pgd() and efi_cleanup_page_tables() Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-21 9:53 ` Matt Fleming
2016-06-21 9:53 ` Matt Fleming
2016-06-20 23:43 ` [PATCH v3 04/13] mm: Track NR_KERNEL_STACK in KiB instead of number of stacks Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-21 9:46 ` Vladimir Davydov
2016-06-21 9:46 ` Vladimir Davydov
2016-06-22 7:35 ` Michal Hocko
2016-06-22 7:35 ` Michal Hocko
2016-06-20 23:43 ` [PATCH v3 05/13] mm: Fix memcg stack accounting for sub-page stacks Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-21 9:54 ` Vladimir Davydov
2016-06-21 9:54 ` Vladimir Davydov
2016-06-22 7:38 ` Michal Hocko
2016-06-22 7:38 ` Michal Hocko
2016-06-20 23:43 ` [PATCH v3 06/13] fork: Add generic vmalloced stack support Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-21 7:30 ` Jann Horn
2016-06-21 16:59 ` Andy Lutomirski
2016-06-21 16:59 ` Andy Lutomirski
2016-06-21 17:13 ` Kees Cook
2016-06-21 17:13 ` Kees Cook
2016-06-21 17:28 ` Andy Lutomirski
2016-06-21 17:28 ` Andy Lutomirski
2016-06-21 18:32 ` Rik van Riel
2016-06-21 18:32 ` [kernel-hardening] " Rik van Riel
2016-06-21 19:44 ` Arnd Bergmann
2016-06-21 19:43 ` Andy Lutomirski
2016-06-21 19:43 ` [kernel-hardening] " Andy Lutomirski
2016-06-21 19:44 ` Arnd Bergmann
2016-07-11 17:00 ` Andrey Ryabinin
2016-06-20 23:43 ` [PATCH v3 07/13] x86/die: Don't try to recover from an OOPS on a non-default stack Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 08/13] x86/dumpstack: When OOPSing, rewind the stack before do_exit Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 09/13] x86/dumpstack: When dumping stack bytes due to OOPS, start with regs->sp Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 10/13] x86/dumpstack: Try harder to get a call trace on stack overflow Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 11/13] x86/dumpstack/64: Handle faults when printing the "Stack:" part of an OOPS Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 12/13] x86/mm/64: Enable vmapped stacks Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 13/13] x86/mm: Improve stack-overflow #PF handling Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-21 4:01 ` [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) Linus Torvalds
2016-06-21 4:01 ` Linus Torvalds
2016-06-21 16:45 ` Andy Lutomirski
2016-06-21 16:45 ` Andy Lutomirski
2016-06-21 17:16 ` Linus Torvalds
2016-06-21 17:16 ` Linus Torvalds
2016-06-21 17:27 ` Andy Lutomirski
2016-06-21 17:27 ` Andy Lutomirski
2016-06-21 18:12 ` Kees Cook
2016-06-21 18:12 ` Kees Cook
2016-06-21 18:19 ` Rik van Riel [this message]
2016-06-21 18:19 ` [kernel-hardening] " Rik van Riel
2016-06-23 1:22 ` Andy Lutomirski
2016-06-23 6:02 ` Linus Torvalds
2016-06-23 6:02 ` Linus Torvalds
2016-06-23 14:31 ` Oleg Nesterov
2016-06-23 16:30 ` Linus Torvalds
2016-06-23 16:41 ` Andy Lutomirski
2016-06-23 17:10 ` Oleg Nesterov
2016-06-23 17:10 ` Oleg Nesterov
2016-09-06 16:19 ` Jann Horn
2016-09-06 16:40 ` Andy Lutomirski
2016-09-06 16:40 ` Andy Lutomirski
2016-06-23 17:03 ` Oleg Nesterov
2016-06-23 17:44 ` Linus Torvalds
2016-06-23 17:44 ` Linus Torvalds
2016-06-23 17:52 ` Linus Torvalds
2016-06-23 18:00 ` Kees Cook
2016-06-23 18:00 ` Kees Cook
2016-06-23 18:54 ` Peter Zijlstra
2016-06-23 18:54 ` Peter Zijlstra
2016-06-23 18:12 ` Oleg Nesterov
2016-06-23 18:55 ` Peter Zijlstra
2016-06-23 18:46 ` Linus Torvalds
2016-06-23 19:08 ` Andy Lutomirski
2016-06-23 19:08 ` Andy Lutomirski
2016-06-23 18:53 ` Peter Zijlstra
2016-06-23 18:53 ` Peter Zijlstra
2016-06-23 19:09 ` Andy Lutomirski
2016-06-23 19:09 ` Andy Lutomirski
2016-06-23 19:13 ` Peter Zijlstra
2016-06-23 19:17 ` Linus Torvalds
2016-06-24 6:17 ` Linus Torvalds
2016-06-24 12:25 ` Brian Gerst
2016-06-24 17:21 ` Linus Torvalds
2016-06-24 17:40 ` Linus Torvalds
2016-06-24 17:40 ` Linus Torvalds
2016-06-24 17:47 ` Andy Lutomirski
2016-06-24 17:56 ` Linus Torvalds
2016-06-24 18:36 ` Andy Lutomirski
2016-06-24 18:36 ` Andy Lutomirski
2016-06-24 17:51 ` Linus Torvalds
2016-06-24 18:11 ` Linus Torvalds
2016-06-24 20:25 ` Josh Poimboeuf
2016-06-24 20:51 ` Josh Poimboeuf
2016-06-24 20:51 ` Josh Poimboeuf
2016-06-24 20:53 ` Andy Lutomirski
2016-06-24 20:53 ` Andy Lutomirski
2016-06-24 21:06 ` Linus Torvalds
2016-06-24 21:06 ` Linus Torvalds
2016-06-24 21:25 ` Andy Lutomirski
2016-06-24 21:25 ` Andy Lutomirski
2016-06-24 21:32 ` Linus Torvalds
2016-06-24 21:32 ` Linus Torvalds
2016-06-24 21:34 ` Andy Lutomirski
2016-06-24 21:34 ` Andy Lutomirski
2016-06-25 2:41 ` Linus Torvalds
2016-06-25 23:19 ` Andy Lutomirski
2016-06-25 23:19 ` Andy Lutomirski
2016-06-25 23:30 ` Andy Lutomirski
2016-06-26 1:23 ` Linus Torvalds
2016-06-23 18:52 ` Oleg Nesterov
2016-06-23 18:52 ` Oleg Nesterov
2016-06-24 14:05 ` Michal Hocko
2016-06-24 14:05 ` Michal Hocko
2016-06-24 15:06 ` Michal Hocko
2016-06-24 15:06 ` Michal Hocko
2016-06-24 20:22 ` Oleg Nesterov
2016-06-27 10:36 ` Michal Hocko
2016-06-23 19:11 ` Peter Zijlstra
2016-06-23 19:34 ` Linus Torvalds
2016-06-23 19:34 ` Linus Torvalds
2016-06-23 19:46 ` Peter Zijlstra
2016-06-23 19:46 ` Peter Zijlstra
2016-06-21 9:24 ` Arnd Bergmann
2016-06-21 9:24 ` Arnd Bergmann
2016-06-21 17:16 ` Kees Cook
2016-06-21 17:16 ` Kees Cook
2016-06-21 18:02 ` Rik van Riel
2016-06-21 18:02 ` [kernel-hardening] " Rik van Riel
2016-06-21 18:05 ` Andy Lutomirski
2016-06-21 18:05 ` [kernel-hardening] " Andy Lutomirski
2016-06-21 19:47 ` Arnd Bergmann
2016-06-21 19:47 ` Andy Lutomirski
2016-06-21 19:47 ` Andy Lutomirski
2016-06-21 20:18 ` Kees Cook
2016-06-21 20:18 ` Kees Cook
2016-06-21 19:47 ` Arnd Bergmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1466533189.2756.52.camel@redhat.com \
--to=riel@redhat.com \
--cc=bp@alien8.de \
--cc=brgerst@gmail.com \
--cc=heiko.carstens@de.ibm.com \
--cc=herbert@gondor.apana.org.au \
--cc=jann@thejh.net \
--cc=jpoimboe@redhat.com \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-arch@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=luto@kernel.org \
--cc=nadav.amit@gmail.com \
--cc=torvalds@linux-foundation.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).