Re: [PATCH v2] mm/vmalloc: widen guard region to defeat ENTER-based stack pivot

[Dave Hansen <dave.hansen@intel.com>]

On 7/1/26 14:04, Xiang Mei wrote:
> Peter's explanation is correct: this technique makes CFH->ACE easier.
> 
> I think both ways can mitigate it, but I would like to hear your
> (maintainers') idea of which one we should proceed:
> 
> 1. supervisor-ENTER-#UD + Peter's objtool check. Cleanest for ENTER,
> but it needs a new bit from Intel/AMD, so future CPUs only.
> 2. Kill the landing zone with a 0x11-page guard area.

Or:

3. Do nothing. Normal kernel IBT is good enough.

The hardest part of #1 IMNHO is convincing people that we need "a new
bit" *PLUS* the two CET technologies (indirect branch tracking and
shadow stacks). If I were a hardware guy, I'd be complaining that those
silly kernel developers aren't even doing supervisor shadow stacks, so
maybe they should use what they have before we starting building new things.

Also, I kinda gave you a route forward. I think someone can both make
the vmalloc gaps more flexible, less hacky, simpler and cleaner. Then,
once that has been done, it's dirt simple for any individual vmalloc
user to have a custom-sized gap. Or, to have a universal, larger,
tunable vmalloc gap.

Get that series put together and I'm open to an 0x11-page gap that x86
pokes in to place in some way.