From mboxrd@z Thu Jan 1 00:00:00 1970 From: Arnd Bergmann Subject: Re: Re: [PATCH v3 06/13] fork: Add generic vmalloced stack support Date: Tue, 21 Jun 2016 21:44:13 +0200 Message-ID: <3742830.xcm4l8nxyl@wuerfel> References: <1466533948.2756.56.camel@redhat.com> Reply-To: kernel-hardening@lists.openwall.com Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7Bit Return-path: List-Post: List-Help: List-Unsubscribe: List-Subscribe: In-Reply-To: <1466533948.2756.56.camel@redhat.com> To: Rik van Riel Cc: kernel-hardening@lists.openwall.com, Andy Lutomirski , Jann Horn , Andy Lutomirski , X86 ML , "linux-kernel@vger.kernel.org" , linux-arch , Borislav Petkov , Nadav Amit , Brian Gerst , Linus Torvalds , Josh Poimboeuf , Jann Horn , Heiko Carstens List-Id: linux-arch.vger.kernel.org On Tuesday, June 21, 2016 2:32:28 PM CEST Rik van Riel wrote: > On Tue, 2016-06-21 at 10:13 -0700, Kees Cook wrote: > > On Tue, Jun 21, 2016 at 9:59 AM, Andy Lutomirski > > wrote: > > > > > > I'm tempted to explicitly disallow VM_NO_GUARD in the vmalloc > > > range. > > > It has no in-tree users for non-fixed addresses right now. > > What about the lack of pre-range guard page? That seems like a > > critical feature for this. > > If VM_NO_GUARD is disallowed, and every vmalloc area has > a guard area behind it, then every subsequent vmalloc area > will have a guard page ahead of it. > > I think disallowing VM_NO_GUARD will be all that is required. > > The only thing we may want to verify on the architectures that > we care about is that there is nothing mapped immediately before > the start of the vmalloc range, otherwise the first vmalloced > area will not have a guard page below it. FWIW, ARM has an 8MB guard area between the linear mapping of physical memory and the start of the vmalloc area. I have not checked any of the other architectures though. Arnd From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mout.kundenserver.de ([212.227.126.133]:55161 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752639AbcFUTuD (ORCPT ); Tue, 21 Jun 2016 15:50:03 -0400 From: Arnd Bergmann Subject: Re: [kernel-hardening] Re: [PATCH v3 06/13] fork: Add generic vmalloced stack support Date: Tue, 21 Jun 2016 21:44:13 +0200 Message-ID: <3742830.xcm4l8nxyl@wuerfel> In-Reply-To: <1466533948.2756.56.camel@redhat.com> References: <1466533948.2756.56.camel@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Sender: linux-arch-owner@vger.kernel.org List-ID: To: Rik van Riel Cc: kernel-hardening@lists.openwall.com, Andy Lutomirski , Jann Horn , Andy Lutomirski , X86 ML , "linux-kernel@vger.kernel.org" , linux-arch , Borislav Petkov , Nadav Amit , Brian Gerst , Linus Torvalds , Josh Poimboeuf , Jann Horn , Heiko Carstens Message-ID: <20160621194413.FSbh8G9CWm4Y5a40KqhBHaTVRu1kQ-nHNxxozsniYV4@z> On Tuesday, June 21, 2016 2:32:28 PM CEST Rik van Riel wrote: > On Tue, 2016-06-21 at 10:13 -0700, Kees Cook wrote: > > On Tue, Jun 21, 2016 at 9:59 AM, Andy Lutomirski > > wrote: > > > > > > I'm tempted to explicitly disallow VM_NO_GUARD in the vmalloc > > > range. > > > It has no in-tree users for non-fixed addresses right now. > > What about the lack of pre-range guard page? That seems like a > > critical feature for this. > > If VM_NO_GUARD is disallowed, and every vmalloc area has > a guard area behind it, then every subsequent vmalloc area > will have a guard page ahead of it. > > I think disallowing VM_NO_GUARD will be all that is required. > > The only thing we may want to verify on the architectures that > we care about is that there is nothing mapped immediately before > the start of the vmalloc range, otherwise the first vmalloced > area will not have a guard page below it. FWIW, ARM has an 8MB guard area between the linear mapping of physical memory and the start of the vmalloc area. I have not checked any of the other architectures though. Arnd