Re: [PATCH 00/13] Virtually mapped stacks with guard pages (x86, core)

2016-06-20 Thread Heiko Carstens
On Sun, Jun 19, 2016 at 11:01:48PM -0700, Andy Lutomirski wrote: > > The tmll instruction tests if any of the higher bits within the 16k > > stackframe address are set. In this specific case that would be bits 7-15 > > (mask 0x3f80). If no bit would be set we know that only up to 128 bytes > > woul

Re: [PATCH 00/13] Virtually mapped stacks with guard pages (x86, core)

2016-06-19 Thread Andy Lutomirski
On Sun, Jun 19, 2016 at 10:58 PM, Heiko Carstens wrote: > On Fri, Jun 17, 2016 at 10:38:24AM -0700, Andy Lutomirski wrote: >> > A disassembly looks like this (r15 is the stackpointer): >> > >> > 0670 : >> > 670: eb 6f f0 48 00 24 stmg%r6,%r15,72(%r15) >> > 676

Re: [PATCH 00/13] Virtually mapped stacks with guard pages (x86, core)

2016-06-19 Thread Heiko Carstens
On Fri, Jun 17, 2016 at 10:38:24AM -0700, Andy Lutomirski wrote: > > A disassembly looks like this (r15 is the stackpointer): > > > > 0670 : > > 670: eb 6f f0 48 00 24 stmg%r6,%r15,72(%r15) > > 676: c0 d0 00 00 00 00 larl%r13,676 > > 67c:

Re: [PATCH 00/13] Virtually mapped stacks with guard pages (x86, core)

2016-06-17 Thread Andy Lutomirski
On Jun 17, 2016 12:27 AM, "Heiko Carstens" wrote: > > On Thu, Jun 16, 2016 at 08:58:07PM -0700, Andy Lutomirski wrote: > > On Wed, Jun 15, 2016 at 11:05 PM, Heiko Carstens > > wrote: > > > On Wed, Jun 15, 2016 at 05:28:22PM -0700, Andy Lutomirski wrote: > > >> Since the dawn of time, a kernel sta

Re: [PATCH 00/13] Virtually mapped stacks with guard pages (x86, core)

2016-06-17 Thread Heiko Carstens
On Thu, Jun 16, 2016 at 08:58:07PM -0700, Andy Lutomirski wrote: > On Wed, Jun 15, 2016 at 11:05 PM, Heiko Carstens > wrote: > > On Wed, Jun 15, 2016 at 05:28:22PM -0700, Andy Lutomirski wrote: > >> Since the dawn of time, a kernel stack overflow has been a real PITA > >> to debug, has caused nond

Re: [PATCH 00/13] Virtually mapped stacks with guard pages (x86, core)

2016-06-16 Thread Andy Lutomirski
On Wed, Jun 15, 2016 at 11:05 PM, Heiko Carstens wrote: > On Wed, Jun 15, 2016 at 05:28:22PM -0700, Andy Lutomirski wrote: >> Since the dawn of time, a kernel stack overflow has been a real PITA >> to debug, has caused nondeterministic crashes some time after the >> actual overflow, and has genera

Re: [PATCH 00/13] Virtually mapped stacks with guard pages (x86, core)

2016-06-16 Thread Andy Lutomirski
On Thu, Jun 16, 2016 at 11:14 AM, Andy Lutomirski wrote: > Adding Paul, because RCU blew up. > > On Thu, Jun 16, 2016 at 10:50 AM, Andy Lutomirski wrote: >> On Wed, Jun 15, 2016 at 11:05 PM, Heiko Carstens >> wrote: >>> On Wed, Jun 15, 2016 at 05:28:22PM -0700, Andy Lutomirski wrote: Since

Re: [PATCH 00/13] Virtually mapped stacks with guard pages (x86, core)

2016-06-16 Thread Andy Lutomirski
Adding Paul, because RCU blew up. On Thu, Jun 16, 2016 at 10:50 AM, Andy Lutomirski wrote: > On Wed, Jun 15, 2016 at 11:05 PM, Heiko Carstens > wrote: >> On Wed, Jun 15, 2016 at 05:28:22PM -0700, Andy Lutomirski wrote: >>> Since the dawn of time, a kernel stack overflow has been a real PITA >>>

Re: [PATCH 00/13] Virtually mapped stacks with guard pages (x86, core)

2016-06-16 Thread Andy Lutomirski
On Wed, Jun 15, 2016 at 11:05 PM, Heiko Carstens wrote: > On Wed, Jun 15, 2016 at 05:28:22PM -0700, Andy Lutomirski wrote: >> Since the dawn of time, a kernel stack overflow has been a real PITA >> to debug, has caused nondeterministic crashes some time after the >> actual overflow, and has genera

Re: [PATCH 00/13] Virtually mapped stacks with guard pages (x86, core)

2016-06-16 Thread Kees Cook
On Wed, Jun 15, 2016 at 5:28 PM, Andy Lutomirski wrote: > Since the dawn of time, a kernel stack overflow has been a real PITA > to debug, has caused nondeterministic crashes some time after the > actual overflow, and has generally been easy to exploit for root. > > With this series, arches can en

Re: [PATCH 00/13] Virtually mapped stacks with guard pages (x86, core)

2016-06-15 Thread Heiko Carstens
On Wed, Jun 15, 2016 at 05:28:22PM -0700, Andy Lutomirski wrote: > Since the dawn of time, a kernel stack overflow has been a real PITA > to debug, has caused nondeterministic crashes some time after the > actual overflow, and has generally been easy to exploit for root. > > With this series, arch

[PATCH 00/13] Virtually mapped stacks with guard pages (x86, core)

2016-06-15 Thread Andy Lutomirski
Since the dawn of time, a kernel stack overflow has been a real PITA to debug, has caused nondeterministic crashes some time after the actual overflow, and has generally been easy to exploit for root. With this series, arches can enable HAVE_ARCH_VMAP_STACK. Arches that enable it (just x86 for no