From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: ARC-Seal: i=1; a=rsa-sha256; t=1525265503; cv=none; d=google.com; s=arc-20160816; b=ZiO+cccCevqdQDFi3dm7XU2/NZPcd46X0GrdCfNcudAtxDfVm7WRy00X2Z7UOqnqKG i2JJG6KOKe46xfRJ/CTjMH7diBq9GL56W1hvLYqs9Gs9KcAeD6qfN35uZim+KmpSmd7V TxiZm51Q6Pa97ccLQ+B2OVfP0HR5xsnorkd6JKPpVqlqFoIHJrmtXklJcRKnPetlQepj QybCJyyC4yUzZuT5NcpaNfyY9ivv9AFaJb/GPFyBprD8dbrqYfAssA1Gw1Pz+1aRSbqX 6eaC5ic9uvV75YN9Hdz0wO07SaXFKoEWGXpi5zL1kxH2Kb+wk+jPAeL4dhygAi56fVp/ nifw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=cc:to:subject:message-id:date:from:references:in-reply-to:sender :mime-version:dkim-signature:dkim-signature :arc-authentication-results; bh=W04P6KGqjbMUB+gUCYq/tYQhRBd7ZDxFAkKDtVX9cig=; b=w8SFqSUNNBADTQVQTDdd32N4BVoNgFbiZMkjjgl62y9x2iL6b7wfzTevy3hGsh85A2 /K6Lyy0kT2wLfid47Z7v8BELOEtCO3dQsYm6X/viw0ccrbwH/YSSA1ze4rOJown90A4F gR7iVCcVn+X5BD/uLRsYzjzPMMXejXi8iLIi1l96cJpCOfxEjeY0fvn/yxhzIxkb2wN4 2QQokZx19b3vkDXEzFZlkAjDT6zUv3ecf5CxcUY2ph4w4UtirOE2+1do6HEpBSvctQQV roZ1tgJZe0JdI+BemcrcA+Dy4L6M52wq/hVBjzMZRO7az0vccFocItADOws/4KU5+d8w vLYg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=AkTug334; dkim=pass header.i=@chromium.org header.s=google header.b=MxI3bt5A; spf=pass (google.com: domain of keescook@google.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=keescook@google.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=AkTug334; dkim=pass header.i=@chromium.org header.s=google header.b=MxI3bt5A; spf=pass (google.com: domain of keescook@google.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=keescook@google.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org X-Google-Smtp-Source: AB8JxZolST/hkSep/YQ+ECEGVFoAJUBqFz8MUgrP7jeehWRBNAOuq5vJ0PfDFX+7bWca1ORfoUNu37YXGwiioeeZCcc= MIME-Version: 1.0 Sender: keescook@google.com In-Reply-To: References: <1523024546-6150-1-git-send-email-alex.popov@linux.com> <1523024546-6150-3-git-send-email-alex.popov@linux.com> <4e668302-8754-3f4e-3372-d0d7ba30cfa3@linux.intel.com> From: Kees Cook Date: Wed, 2 May 2018 05:51:42 -0700 X-Google-Sender-Auth: WikyI_-eknJaPQb2ONlI-BwtNaE Message-ID: Subject: Re: [PATCH v11 2/6] x86/entry: Add STACKLEAK erasing the kernel stack at the end of syscalls To: Thomas Gleixner Cc: Dave Hansen , Linus Torvalds , Alexander Popov , Kernel Hardening , PaX Team , Brad Spengler , Ingo Molnar , Andy Lutomirski , Tycho Andersen , Laura Abbott , Mark Rutland , Ard Biesheuvel , Borislav Petkov , Richard Sandiford , "H . Peter Anvin" , Peter Zijlstra , "Dmitry V . Levin" , Emese Revfy , Jonathan Corbet , Andrey Ryabinin , "Kirill A . Shutemov" , Thomas Garnier , Andrew Morton , Alexei Starovoitov , Josef Bacik , Masami Hiramatsu , Nicholas Piggin , Al Viro , "David S . Miller" , Ding Tianhong , David Woodhouse , Josh Poimboeuf , Steven Rostedt , Dominik Brodowski , Juergen Gross , Greg Kroah-Hartman , Dan Williams , Mathias Krause , Vikas Shivappa , Kyle Huey , Dmitry Safonov , Will Deacon , Arnd Bergmann , Florian Weimer , Boris Lukashev , X86 ML , LKML Content-Type: text/plain; charset="UTF-8" X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1597007022879408472?= X-GMAIL-MSGID: =?utf-8?q?1599356800610650868?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: On Wed, May 2, 2018 at 5:39 AM, Thomas Gleixner wrote: > On Wed, 2 May 2018, Kees Cook wrote: >> On Wed, May 2, 2018 at 1:42 AM, Thomas Gleixner wrote: >> > On Mon, 30 Apr 2018, Kees Cook wrote: >> > >> >> On Mon, Apr 23, 2018 at 9:23 PM, Dave Hansen >> >> wrote: >> >> > Hi Alexander, >> >> > >> >> > You can add: >> >> > >> >> > Reviewed-by: Dave Hansen >> >> > >> >> > for this patch if you like. I haven't taken a super close look at the >> >> > rest, but this is certainly minimally invasive from my point of view for >> >> > the entry code. Thanks, again for reworking it. >> >> >> >> Thanks Dave! >> >> >> >> Given this improvement and your review, I'm going to start carrying >> >> this for linux-next. Linus, if you're still opposed to this even after >> >> the changes here in v11, please let us know. I'd rather hash things >> >> out now instead of during a NAK in the 4.18 merge window. :) >> > >> > Kees, can we please route that x86/entry stuff through tip to avoid >> > conflicts as there are other changes in that area on the horizon. >> >> Sure, let me figure out how best to split up the patches, since it >> touch x86/entry, gcc-plugins, and lkdtm. Thanks! > > Are they independent or do they carry dependencies? They carry dependencies, as it interacts with the gcc plugin (and lkdtm). As I don't have other plugin changes for 4.18 queued, you could take the whole series for x86/entry if you want? Otherwise I can try to split out the x86 change so it's more self-contained. -Kees -- Kees Cook Pixel Security