From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: ARC-Seal: i=1; a=rsa-sha256; t=1522085541; cv=none; d=google.com; s=arc-20160816; b=eGpkLYGX8slGsL65tKTu5fShCDHdifLlxb61B8p6xQq2fHCQWoxQPk0FRwE7AeTaxD BulC0m0Ui3YVfvr6N9L6JOMWjujZ8iYIWgxtseMKrzxIG8FgvYPI/Z4Bt/TJgQV3emP6 Mg50G+6W3wLL+iy1zciKh64TFeDMgQms9xNHLOCoR9pl4GuKH7IjzBy7mUa1l+YsIc7E Y0LSsBNBcGMgD62FbJJ5AunhyObktBHcizxVA8y7uDs10Dg5BhkFYbq+rydSkiG5VI1M CnvJH/FPq2JPuae8W9RIE1kdvdCLzY/Vzgs37g403ZeOYsw3bBAxnpTv8p4SKTrP5wMS 8b2g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=cc:to:subject:message-id:date:from:references:in-reply-to:sender :mime-version:dkim-signature:dkim-signature :arc-authentication-results; bh=LUBgbgI7yvlMtf36cSs+cg/hvzlMvBPaHo/WoSGxD9k=; b=Uo+KAZgDxNnfH7obNLsSmLaEuenTfj4dSgvMunEx4fphD+JLXDCk+RbwBoH3zUYnD0 t7pf8rvusxJ2+qZSuHOih2ZQK/TEP2kPzlVEet9tTPzQmiVZvNdSlkqBu44MP7fI7GdY yIe0l8bZuANPUEHKexnwW3pV3u5PcyUPPGI23a2aIJEPmykB1eJGw1+n0e8ZzwcqaleD Kyx1TVanz64diXIxKJK8rdCODF8Tk3vXRI5cyTl5B5uUo+4HEHiGw+284RqBV7MybT5Z j1xWIUsXXMdmzBQWaQksyuj4ZkbaH5Qn/LsYYKDayXHETh5gnXy5HyzoVsroi1SGCugk T4hA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=Vwdh+5iZ; dkim=pass header.i=@chromium.org header.s=google header.b=GyQ0EuNy; spf=pass (google.com: domain of keescook@google.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=keescook@google.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=Vwdh+5iZ; dkim=pass header.i=@chromium.org header.s=google header.b=GyQ0EuNy; spf=pass (google.com: domain of keescook@google.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=keescook@google.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org X-Google-Smtp-Source: AIpwx4/P4bZAqatnpMbEVnBG2KQmzHT6rG0KwzId2p7jlAnv1Erpmv/QH66mQOvSd4szC1RVnRgYmWm+CrUPN1uD7Yw= MIME-Version: 1.0 Sender: keescook@google.com In-Reply-To: References: <1520107232-14111-1-git-send-email-alex.popov@linux.com> <1520107232-14111-3-git-send-email-alex.popov@linux.com> <94f268b2-31a4-620a-86ed-325d5bb33c57@redhat.com> <20180305202535.GX25201@hirez.programming.kicks-ass.net> <295a6830-fce9-ee00-f45d-7dafd74d11a1@linux.intel.com> From: Kees Cook Date: Mon, 26 Mar 2018 10:32:04 -0700 X-Google-Sender-Auth: 7jj-o8j2U-i7jBl9rc7FbycemMM Message-ID: Subject: Re: [PATCH RFC v9 2/7] x86/entry: Add STACKLEAK erasing the kernel stack at the end of syscalls To: alex.popov@linux.com, Dave Hansen Cc: Peter Zijlstra , Laura Abbott , Linus Torvalds , Andy Lutomirski , PaX Team , Brad Spengler , Ingo Molnar , Tycho Andersen , Mark Rutland , Ard Biesheuvel , Borislav Petkov , Richard Sandiford , Thomas Gleixner , "H . Peter Anvin" , "Dmitry V . Levin" , Emese Revfy , Jonathan Corbet , Andrey Ryabinin , "Kirill A . Shutemov" , Thomas Garnier , Andrew Morton , Alexei Starovoitov , Josef Bacik , Masami Hiramatsu , Nicholas Piggin , Al Viro , "David S . Miller" , Ding Tianhong , David Woodhouse , Josh Poimboeuf , Steven Rostedt , Dominik Brodowski , Juergen Gross , Greg Kroah-Hartman , Dan Williams , Mathias Krause , Vikas Shivappa , Kyle Huey , Dmitry Safonov , Will Deacon , Arnd Bergmann , x86@kernel.org, linux-kernel@vger.kernel.org, "kernel-hardening@lists.openwall.com" Content-Type: text/plain; charset="UTF-8" X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1593947982901315923?= X-GMAIL-MSGID: =?utf-8?q?1596022369017369603?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: On Thu, Mar 22, 2018 at 1:56 PM, Alexander Popov wrote: > By the way, during my work on STACKLEAK, I've found one case when we get to the > userspace directly from the thread stack. Please see sysret32_from_system_call > in entry_64_compat.S. I checked that. > > IMO it seems odd, can the adversary use that to bypass PTI? If it was missing the page table swap, shouldn't this mean that the missing NX bit would immediately crash userspace? -Kees -- Kees Cook Pixel Security