Re: [PATCH] s390/entry: add support for syscall stack randomization

[Sven Schnelle <svens@linux.ibm.com>]

Hi Kees,

Kees Cook <keescook@chromium.org> writes:

> On Thu, Apr 29, 2021 at 11:14:51AM +0200, Sven Schnelle wrote:
>> enough and has much less performance penalty compared to using
>> get_random_int(). The patch also adds randomization in pgm_check_handler()
>> as the sigreturn/rt_sigreturn system calls might be called from there.
>
> Ah, interesting. Is this path to syscalls unique to s390? (As in, should
> x86 and arm64 gain coverage over a path that got missed?)

Yes, it's unique to s390. So there should be no need to do anything
similar on other architectures.

>> +static inline void arch_exit_to_user_mode_prepare(struct pt_regs *regs,
>> +						  unsigned long ti_work)
>> +{
>> +	choose_random_kstack_offset(get_tod_clock_fast() & 0xff);
>
> What's the stack alignment on s390? Or, better question, what's the
> expected number of entropy bits?


The stack alignement on s390 is 8 bytes, so this should give us 5 bits
of entropy.