From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751936AbcFXRr3 (ORCPT ); Fri, 24 Jun 2016 13:47:29 -0400 Received: from mail-vk0-f42.google.com ([209.85.213.42]:36545 "EHLO mail-vk0-f42.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751898AbcFXRrZ (ORCPT ); Fri, 24 Jun 2016 13:47:25 -0400 MIME-Version: 1.0 In-Reply-To: References: <20160623143126.GA16664@redhat.com> <20160623170352.GA17372@redhat.com> <20160623185340.GO30154@twins.programming.kicks-ass.net> From: Andy Lutomirski Date: Fri, 24 Jun 2016 10:47:04 -0700 Message-ID: Subject: Re: [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) To: Linus Torvalds Cc: Brian Gerst , Peter Zijlstra , Oleg Nesterov , Andy Lutomirski , "the arch/x86 maintainers" , Linux Kernel Mailing List , "linux-arch@vger.kernel.org" , Borislav Petkov , Nadav Amit , Kees Cook , "kernel-hardening@lists.openwall.com" , Josh Poimboeuf , Jann Horn , Heiko Carstens Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Jun 24, 2016 at 10:40 AM, Linus Torvalds wrote: > On Fri, Jun 24, 2016 at 10:21 AM, Linus Torvalds > wrote: >> >> But as mentioned, I must have missed something. There were a number of >> places where the code used the task_stack_page() and >> task_thread_info() interchangably, which used to work and is no longer >> true. There might simply be cases I missed. > > .. and immediately as I wrote that, I went "Duh". > > One place I missed was free_thread_info(), which should now free the > stack, not the ti pointer. But it does > > struct page *page = virt_to_page(ti); > > and frees that, which is bogus. It turns out that we do do > > free_thread_info(tsk->stack); > > which is bogus too, and undoes it, but I think I have a few new places > to look at.. Try patching in this thing, which cleans up a bunch of that core crap: https://git.kernel.org/cgit/linux/kernel/git/luto/linux.git/commit/?h=x86/vmap_stack&id=7ca9fb6bbf2838cc94b2af41e94854d02649c58c It might not apply without the rest of my series, though. FWIW, your patch is much more lenient than my approach: I was planning prohibiting architectures from supplying their own struct thread_info if they put it in task_struct. To make that work, I have patches to remove everything but cpu, flags, and task from x86's thread_info first. I'm planning on tidying them up and sending them out after the vmap stack stuff lands in -tip -- I don't want to have big series that depend on each other flying around by email at the same time, because everyone will go nuts trying to figure out what applies where. --Andy From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andy Lutomirski Subject: Re: [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) Date: Fri, 24 Jun 2016 10:47:04 -0700 Message-ID: References: <20160623143126.GA16664@redhat.com> <20160623170352.GA17372@redhat.com> <20160623185340.GO30154@twins.programming.kicks-ass.net> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Return-path: Received: from mail-vk0-f51.google.com ([209.85.213.51]:32911 "EHLO mail-vk0-f51.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751883AbcFXRrZ (ORCPT ); Fri, 24 Jun 2016 13:47:25 -0400 Received: by mail-vk0-f51.google.com with SMTP id d185so160427682vkg.0 for ; Fri, 24 Jun 2016 10:47:24 -0700 (PDT) In-Reply-To: Sender: linux-arch-owner@vger.kernel.org List-ID: To: Linus Torvalds Cc: Brian Gerst , Peter Zijlstra , Oleg Nesterov , Andy Lutomirski , the arch/x86 maintainers , Linux Kernel Mailing List , "linux-arch@vger.kernel.org" , Borislav Petkov , Nadav Amit , Kees Cook , "kernel-hardening@lists.openwall.com" , Josh Poimboeuf , Jann Horn , Heiko Carstens On Fri, Jun 24, 2016 at 10:40 AM, Linus Torvalds wrote: > On Fri, Jun 24, 2016 at 10:21 AM, Linus Torvalds > wrote: >> >> But as mentioned, I must have missed something. There were a number of >> places where the code used the task_stack_page() and >> task_thread_info() interchangably, which used to work and is no longer >> true. There might simply be cases I missed. > > .. and immediately as I wrote that, I went "Duh". > > One place I missed was free_thread_info(), which should now free the > stack, not the ti pointer. But it does > > struct page *page = virt_to_page(ti); > > and frees that, which is bogus. It turns out that we do do > > free_thread_info(tsk->stack); > > which is bogus too, and undoes it, but I think I have a few new places > to look at.. Try patching in this thing, which cleans up a bunch of that core crap: https://git.kernel.org/cgit/linux/kernel/git/luto/linux.git/commit/?h=x86/vmap_stack&id=7ca9fb6bbf2838cc94b2af41e94854d02649c58c It might not apply without the rest of my series, though. FWIW, your patch is much more lenient than my approach: I was planning prohibiting architectures from supplying their own struct thread_info if they put it in task_struct. To make that work, I have patches to remove everything but cpu, flags, and task from x86's thread_info first. I'm planning on tidying them up and sending them out after the vmap stack stuff lands in -tip -- I don't want to have big series that depend on each other flying around by email at the same time, because everyone will go nuts trying to figure out what applies where. --Andy From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com MIME-Version: 1.0 In-Reply-To: References: <20160623143126.GA16664@redhat.com> <20160623170352.GA17372@redhat.com> <20160623185340.GO30154@twins.programming.kicks-ass.net> From: Andy Lutomirski Date: Fri, 24 Jun 2016 10:47:04 -0700 Message-ID: Content-Type: text/plain; charset=UTF-8 Subject: [kernel-hardening] Re: [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) To: Linus Torvalds Cc: Brian Gerst , Peter Zijlstra , Oleg Nesterov , Andy Lutomirski , the arch/x86 maintainers , Linux Kernel Mailing List , "linux-arch@vger.kernel.org" , Borislav Petkov , Nadav Amit , Kees Cook , "kernel-hardening@lists.openwall.com" , Josh Poimboeuf , Jann Horn , Heiko Carstens List-ID: On Fri, Jun 24, 2016 at 10:40 AM, Linus Torvalds wrote: > On Fri, Jun 24, 2016 at 10:21 AM, Linus Torvalds > wrote: >> >> But as mentioned, I must have missed something. There were a number of >> places where the code used the task_stack_page() and >> task_thread_info() interchangably, which used to work and is no longer >> true. There might simply be cases I missed. > > .. and immediately as I wrote that, I went "Duh". > > One place I missed was free_thread_info(), which should now free the > stack, not the ti pointer. But it does > > struct page *page = virt_to_page(ti); > > and frees that, which is bogus. It turns out that we do do > > free_thread_info(tsk->stack); > > which is bogus too, and undoes it, but I think I have a few new places > to look at.. Try patching in this thing, which cleans up a bunch of that core crap: https://git.kernel.org/cgit/linux/kernel/git/luto/linux.git/commit/?h=x86/vmap_stack&id=7ca9fb6bbf2838cc94b2af41e94854d02649c58c It might not apply without the rest of my series, though. FWIW, your patch is much more lenient than my approach: I was planning prohibiting architectures from supplying their own struct thread_info if they put it in task_struct. To make that work, I have patches to remove everything but cpu, flags, and task from x86's thread_info first. I'm planning on tidying them up and sending them out after the vmap stack stuff lands in -tip -- I don't want to have big series that depend on each other flying around by email at the same time, because everyone will go nuts trying to figure out what applies where. --Andy