From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751828AbcFXRvj (ORCPT ); Fri, 24 Jun 2016 13:51:39 -0400 Received: from mail-oi0-f54.google.com ([209.85.218.54]:33363 "EHLO mail-oi0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751479AbcFXRvh (ORCPT ); Fri, 24 Jun 2016 13:51:37 -0400 MIME-Version: 1.0 In-Reply-To: References: <20160623143126.GA16664@redhat.com> <20160623170352.GA17372@redhat.com> <20160623185340.GO30154@twins.programming.kicks-ass.net> From: Linus Torvalds Date: Fri, 24 Jun 2016 10:51:35 -0700 X-Google-Sender-Auth: JKz0PVjzv4Cjj2GereA9GA5RbGk Message-ID: Subject: Re: [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) To: Brian Gerst Cc: Peter Zijlstra , Oleg Nesterov , Andy Lutomirski , Andy Lutomirski , "the arch/x86 maintainers" , Linux Kernel Mailing List , "linux-arch@vger.kernel.org" , Borislav Petkov , Nadav Amit , Kees Cook , "kernel-hardening@lists.openwall.com" , Josh Poimboeuf , Jann Horn , Heiko Carstens Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Jun 24, 2016 at 10:40 AM, Linus Torvalds wrote: > > I think I have a few new places to look at.. Yeah, making the 'stack' pointer be 'unsigned long *' rather than 'void *' shows a number of places where we were very confused about things. And in particular, the init_task stack initialization initialized it to the init_thread pointer. Which was definitely deadly. Let's see if that was it.. Linus From mboxrd@z Thu Jan 1 00:00:00 1970 From: Linus Torvalds Subject: Re: [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) Date: Fri, 24 Jun 2016 10:51:35 -0700 Message-ID: References: <20160623143126.GA16664@redhat.com> <20160623170352.GA17372@redhat.com> <20160623185340.GO30154@twins.programming.kicks-ass.net> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Return-path: Received: from mail-oi0-f54.google.com ([209.85.218.54]:33363 "EHLO mail-oi0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751479AbcFXRvh (ORCPT ); Fri, 24 Jun 2016 13:51:37 -0400 In-Reply-To: Sender: linux-arch-owner@vger.kernel.org List-ID: To: Brian Gerst Cc: Peter Zijlstra , Oleg Nesterov , Andy Lutomirski , Andy Lutomirski , the arch/x86 maintainers , Linux Kernel Mailing List , "linux-arch@vger.kernel.org" , Borislav Petkov , Nadav Amit , Kees Cook , "kernel-hardening@lists.openwall.com" , Josh Poimboeuf , Jann Horn , Heiko Carstens On Fri, Jun 24, 2016 at 10:40 AM, Linus Torvalds wrote: > > I think I have a few new places to look at.. Yeah, making the 'stack' pointer be 'unsigned long *' rather than 'void *' shows a number of places where we were very confused about things. And in particular, the init_task stack initialization initialized it to the init_thread pointer. Which was definitely deadly. Let's see if that was it.. Linus From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com MIME-Version: 1.0 Sender: linus971@gmail.com In-Reply-To: References: <20160623143126.GA16664@redhat.com> <20160623170352.GA17372@redhat.com> <20160623185340.GO30154@twins.programming.kicks-ass.net> From: Linus Torvalds Date: Fri, 24 Jun 2016 10:51:35 -0700 Message-ID: Content-Type: text/plain; charset=UTF-8 Subject: [kernel-hardening] Re: [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) To: Brian Gerst Cc: Peter Zijlstra , Oleg Nesterov , Andy Lutomirski , Andy Lutomirski , the arch/x86 maintainers , Linux Kernel Mailing List , "linux-arch@vger.kernel.org" , Borislav Petkov , Nadav Amit , Kees Cook , "kernel-hardening@lists.openwall.com" , Josh Poimboeuf , Jann Horn , Heiko Carstens List-ID: On Fri, Jun 24, 2016 at 10:40 AM, Linus Torvalds wrote: > > I think I have a few new places to look at.. Yeah, making the 'stack' pointer be 'unsigned long *' rather than 'void *' shows a number of places where we were very confused about things. And in particular, the init_task stack initialization initialized it to the init_thread pointer. Which was definitely deadly. Let's see if that was it.. Linus