From: Andrey Ryabinin <ryabinin.a.a@gmail.com>
To: Rik van Riel <riel@redhat.com>
Cc: kernel-hardening@lists.openwall.com,
Andy Lutomirski <luto@amacapital.net>,
Jann Horn <jannh@google.com>, Andy Lutomirski <luto@kernel.org>,
X86 ML <x86@kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
linux-arch <linux-arch@vger.kernel.org>,
Borislav Petkov <bp@alien8.de>, Nadav Amit <nadav.amit@gmail.com>,
Brian Gerst <brgerst@gmail.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
Josh Poimboeuf <jpoimboe@redhat.com>, Jann Horn <jann@thejh.net>,
Heiko Carstens <heiko.carstens@de.ibm.com>
Subject: Re: [kernel-hardening] Re: [PATCH v3 06/13] fork: Add generic vmalloced stack support
Date: Mon, 11 Jul 2016 20:00:43 +0300 [thread overview]
Message-ID: <CAPAsAGzOyOvfiZZArra2JhCeaa7pd9tnva28rD7L8Yx-2BDj-w@mail.gmail.com> (raw)
In-Reply-To: <1466533948.2756.56.camel@redhat.com>
2016-06-21 21:32 GMT+03:00 Rik van Riel <riel@redhat.com>:
> On Tue, 2016-06-21 at 10:13 -0700, Kees Cook wrote:
>> On Tue, Jun 21, 2016 at 9:59 AM, Andy Lutomirski <luto@amacapital.net
>> > wrote:
>> >
>> > I'm tempted to explicitly disallow VM_NO_GUARD in the vmalloc
>> > range.
>> > It has no in-tree users for non-fixed addresses right now.
>> What about the lack of pre-range guard page? That seems like a
>> critical feature for this. :)
>
> If VM_NO_GUARD is disallowed, and every vmalloc area has
> a guard area behind it, then every subsequent vmalloc area
> will have a guard page ahead of it.
>
> I think disallowing VM_NO_GUARD will be all that is required.
>
VM_NO_GUARD is a flag of vm_struct. But some vmalloc areas don't have
vm_struct (see vm_map_ram())
and don't have guard pages too. Once, vm_map_ram() had guard pages,
but they were removed in
248ac0e1943a ("mm/vmalloc: remove guard page from between vmap blocks")
due to exhaustion of vmalloc space on 32-bits. I guess we can
resurrect guard page on 64bits without any problems.
AFAICS per-cpu vmap blocks also don't have guard pages. pcpu vmaps
have vm_struct *without* VM_NO_GUARD, but
don't actually have the guard pages. It seems to be a harmless bug,
because pcpu vmaps use their own alloc/free paths
(pcp_get_vm_areas()/pcpu_free_vm_areas())
and just don't care about vm->flags content.
Fortunately, pcpu_get_vm_areas() allocates from top of vmalloc, so the
gap between pcpu vmap and regular vmalloc() should be huge.
> The only thing we may want to verify on the architectures that
> we care about is that there is nothing mapped immediately before
> the start of the vmalloc range, otherwise the first vmalloced
> area will not have a guard page below it.
>
> I suspect all the 64 bit architectures are fine in that regard,
> with enormous gaps between kernel memory ranges.
>
> --
> All Rights Reversed.
>
next prev parent reply other threads:[~2016-07-11 17:00 UTC|newest]
Thread overview: 89+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-20 23:43 [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 01/13] x86/mm/hotplug: Don't remove PGD entries in remove_pagetable() Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 02/13] x86/cpa: In populate_pgd, don't set the pgd entry until it's populated Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 03/13] x86/mm: Remove kernel_unmap_pages_in_pgd() and efi_cleanup_page_tables() Andy Lutomirski
2016-06-21 9:53 ` Matt Fleming
2016-06-20 23:43 ` [PATCH v3 04/13] mm: Track NR_KERNEL_STACK in KiB instead of number of stacks Andy Lutomirski
2016-06-21 9:46 ` Vladimir Davydov
2016-06-22 7:35 ` Michal Hocko
2016-06-20 23:43 ` [PATCH v3 05/13] mm: Fix memcg stack accounting for sub-page stacks Andy Lutomirski
2016-06-21 9:54 ` Vladimir Davydov
2016-06-22 7:38 ` Michal Hocko
2016-06-20 23:43 ` [PATCH v3 06/13] fork: Add generic vmalloced stack support Andy Lutomirski
2016-06-21 7:30 ` Jann Horn
2016-06-21 16:59 ` Andy Lutomirski
2016-06-21 17:13 ` Kees Cook
2016-06-21 17:28 ` Andy Lutomirski
2016-06-21 18:32 ` [kernel-hardening] " Rik van Riel
2016-06-21 19:44 ` Arnd Bergmann
2016-06-21 19:43 ` Andy Lutomirski
2016-07-11 17:00 ` Andrey Ryabinin [this message]
2016-06-20 23:43 ` [PATCH v3 07/13] x86/die: Don't try to recover from an OOPS on a non-default stack Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 08/13] x86/dumpstack: When OOPSing, rewind the stack before do_exit Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 09/13] x86/dumpstack: When dumping stack bytes due to OOPS, start with regs->sp Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 10/13] x86/dumpstack: Try harder to get a call trace on stack overflow Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 11/13] x86/dumpstack/64: Handle faults when printing the "Stack:" part of an OOPS Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 12/13] x86/mm/64: Enable vmapped stacks Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 13/13] x86/mm: Improve stack-overflow #PF handling Andy Lutomirski
2016-06-21 4:01 ` [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) Linus Torvalds
2016-06-21 16:45 ` Andy Lutomirski
2016-06-21 17:16 ` Linus Torvalds
2016-06-21 17:27 ` Andy Lutomirski
2016-06-21 18:12 ` Kees Cook
2016-06-21 18:19 ` [kernel-hardening] " Rik van Riel
2016-06-23 1:22 ` Andy Lutomirski
2016-06-23 6:02 ` Linus Torvalds
2016-06-23 14:31 ` Oleg Nesterov
2016-06-23 16:30 ` Linus Torvalds
2016-06-23 16:41 ` Andy Lutomirski
2016-06-23 17:10 ` Oleg Nesterov
2016-09-06 16:19 ` Jann Horn
2016-09-06 16:40 ` Andy Lutomirski
2016-06-23 17:03 ` Oleg Nesterov
2016-06-23 17:44 ` Linus Torvalds
2016-06-23 17:52 ` Linus Torvalds
2016-06-23 18:00 ` Kees Cook
2016-06-23 18:54 ` Peter Zijlstra
2016-06-23 18:12 ` Oleg Nesterov
2016-06-23 18:55 ` Peter Zijlstra
2016-06-23 18:46 ` Linus Torvalds
2016-06-23 19:08 ` Andy Lutomirski
2016-06-23 18:53 ` Peter Zijlstra
2016-06-23 19:09 ` Andy Lutomirski
2016-06-23 19:13 ` Peter Zijlstra
2016-06-23 19:17 ` Linus Torvalds
2016-06-24 6:17 ` Linus Torvalds
2016-06-24 12:25 ` Brian Gerst
2016-06-24 17:21 ` Linus Torvalds
2016-06-24 17:40 ` Linus Torvalds
2016-06-24 17:47 ` Andy Lutomirski
2016-06-24 17:56 ` Linus Torvalds
2016-06-24 18:36 ` Andy Lutomirski
2016-06-24 17:51 ` Linus Torvalds
2016-06-24 18:11 ` Linus Torvalds
2016-06-24 20:25 ` Josh Poimboeuf
2016-06-24 20:51 ` Josh Poimboeuf
2016-06-24 20:53 ` Andy Lutomirski
2016-06-24 21:06 ` Linus Torvalds
2016-06-24 21:25 ` Andy Lutomirski
2016-06-24 21:32 ` Linus Torvalds
2016-06-24 21:34 ` Andy Lutomirski
2016-06-25 2:41 ` Linus Torvalds
2016-06-25 23:19 ` Andy Lutomirski
2016-06-25 23:30 ` Andy Lutomirski
2016-06-26 1:23 ` Linus Torvalds
2016-06-23 18:52 ` Oleg Nesterov
2016-06-24 14:05 ` Michal Hocko
2016-06-24 15:06 ` Michal Hocko
2016-06-24 20:22 ` Oleg Nesterov
2016-06-27 10:36 ` Michal Hocko
2016-06-23 19:11 ` Peter Zijlstra
2016-06-23 19:34 ` Linus Torvalds
2016-06-23 19:46 ` Peter Zijlstra
2016-06-21 9:24 ` Arnd Bergmann
2016-06-21 17:16 ` Kees Cook
2016-06-21 18:02 ` [kernel-hardening] " Rik van Riel
2016-06-21 18:05 ` Andy Lutomirski
2016-06-21 19:47 ` Arnd Bergmann
2016-06-21 19:47 ` Andy Lutomirski
2016-06-21 20:18 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAPAsAGzOyOvfiZZArra2JhCeaa7pd9tnva28rD7L8Yx-2BDj-w@mail.gmail.com \
--to=ryabinin.a.a@gmail.com \
--cc=bp@alien8.de \
--cc=brgerst@gmail.com \
--cc=heiko.carstens@de.ibm.com \
--cc=jann@thejh.net \
--cc=jannh@google.com \
--cc=jpoimboe@redhat.com \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-arch@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=luto@kernel.org \
--cc=nadav.amit@gmail.com \
--cc=riel@redhat.com \
--cc=torvalds@linux-foundation.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).