From mboxrd@z Thu Jan 1 00:00:00 1970 From: Rik van Riel Subject: Re: Re: [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) Date: Tue, 21 Jun 2016 14:19:49 -0400 Message-ID: <1466533189.2756.52.camel@redhat.com> References: Reply-To: kernel-hardening@lists.openwall.com Mime-Version: 1.0 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="=-iRBwSazlTytAWjIbeDno" Return-path: List-Post: List-Help: List-Unsubscribe: List-Subscribe: In-Reply-To: To: kernel-hardening@lists.openwall.com, Andy Lutomirski , Herbert Xu Cc: Linus Torvalds , Andy Lutomirski , the arch/x86 maintainers , Linux Kernel Mailing List , "linux-arch@vger.kernel.org" , Borislav Petkov , Nadav Amit , Brian Gerst , Josh Poimboeuf , Jann Horn , Heiko Carstens List-Id: linux-arch.vger.kernel.org --=-iRBwSazlTytAWjIbeDno Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, 2016-06-21 at 11:12 -0700, Kees Cook wrote: > On Tue, Jun 21, 2016 at 10:27 AM, Andy Lutomirski > wrote: > > FWIW, it may be a while before this can be enabled in distro > > kernels. > > There are some code paths (*cough* crypto users *cough*) that think > > that calling sg_init_one with a stack address is a reasonable thing > > to > > do, and it doesn't work with a vmalloced stack.=C2=A0=C2=A0grsecurity w= orks > ... O_o ... >=20 > Why does it not work on a vmalloced stack?? Because virt_to_page() does not work on vmalloced memory. --=20 All Rights Reversed. --=-iRBwSazlTytAWjIbeDno Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAABCAAGBQJXaYVFAAoJEM553pKExN6DW9wIAJGaNx+6WeMQkYnYyi+B9CVI 2Oc9YIw237LfSNkFqzsa1awGA5Z2C6m1qwaT3MoDJlKem4/em4xjdbWKdkTbM3lP nSINT0cqztExGZDLVNFtiLpjypp1mJsLYsywlZP8n4gGDR5T0qIqXY2JQSlhJcAd dH8A1x9GgMke0l/WkALesvEuRqIFNWAMBUFI7LJ4J4Zs0Tt4lvJAioT4XlLqDFKG a0AUxkKaoeRmpUYrRgSMHBgY1WzUkd6YI6Hjbr0U8rk3Mis/pQ+9Bgnr8bj29bRv BqwQOtO4EC9ZQ+yZCg6RMfxEZ3ARqtGAyKTekvP/RQUxjmopjwuhLkdSPGMIPMI= =1NxW -----END PGP SIGNATURE----- --=-iRBwSazlTytAWjIbeDno-- From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx1.redhat.com ([209.132.183.28]:60811 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751748AbcFUSUa (ORCPT ); Tue, 21 Jun 2016 14:20:30 -0400 Message-ID: <1466533189.2756.52.camel@redhat.com> Subject: Re: [kernel-hardening] Re: [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) From: Rik van Riel Date: Tue, 21 Jun 2016 14:19:49 -0400 In-Reply-To: References: Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="=-iRBwSazlTytAWjIbeDno" Mime-Version: 1.0 Sender: linux-arch-owner@vger.kernel.org List-ID: To: kernel-hardening@lists.openwall.com, Andy Lutomirski , Herbert Xu Cc: Linus Torvalds , Andy Lutomirski , the arch/x86 maintainers , Linux Kernel Mailing List , "linux-arch@vger.kernel.org" , Borislav Petkov , Nadav Amit , Brian Gerst , Josh Poimboeuf , Jann Horn , Heiko Carstens Message-ID: <20160621181949.TMbCDYjmeuGjKWo4lUfc5kjeN8wJPqk_UGD8myr1KmM@z> --=-iRBwSazlTytAWjIbeDno Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, 2016-06-21 at 11:12 -0700, Kees Cook wrote: > On Tue, Jun 21, 2016 at 10:27 AM, Andy Lutomirski > wrote: > > FWIW, it may be a while before this can be enabled in distro > > kernels. > > There are some code paths (*cough* crypto users *cough*) that think > > that calling sg_init_one with a stack address is a reasonable thing > > to > > do, and it doesn't work with a vmalloced stack.=C2=A0=C2=A0grsecurity w= orks > ... O_o ... >=20 > Why does it not work on a vmalloced stack?? Because virt_to_page() does not work on vmalloced memory. --=20 All Rights Reversed. --=-iRBwSazlTytAWjIbeDno Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAABCAAGBQJXaYVFAAoJEM553pKExN6DW9wIAJGaNx+6WeMQkYnYyi+B9CVI 2Oc9YIw237LfSNkFqzsa1awGA5Z2C6m1qwaT3MoDJlKem4/em4xjdbWKdkTbM3lP nSINT0cqztExGZDLVNFtiLpjypp1mJsLYsywlZP8n4gGDR5T0qIqXY2JQSlhJcAd dH8A1x9GgMke0l/WkALesvEuRqIFNWAMBUFI7LJ4J4Zs0Tt4lvJAioT4XlLqDFKG a0AUxkKaoeRmpUYrRgSMHBgY1WzUkd6YI6Hjbr0U8rk3Mis/pQ+9Bgnr8bj29bRv BqwQOtO4EC9ZQ+yZCg6RMfxEZ3ARqtGAyKTekvP/RQUxjmopjwuhLkdSPGMIPMI= =1NxW -----END PGP SIGNATURE----- --=-iRBwSazlTytAWjIbeDno--