Messages in this thread |  | | Subject | Re: [PATCH v11 2/6] x86/entry: Add STACKLEAK erasing the kernel stack at the end of syscalls | From | Laura Abbott <> | Date | Wed, 18 Apr 2018 11:33:05 -0700 |
| |
On 04/16/2018 11:29 AM, Kees Cook wrote: > On Fri, Apr 6, 2018 at 7:22 AM, Alexander Popov <alex.popov@linux.com> wrote: >> This commit introduces the architecture-specific code filling the used >> part of the kernel stack with a poison value before returning to the >> userspace. Full STACKLEAK feature also contains the gcc plugin which >> comes in a separate commit. > > Thanks for sending this again! And thanks for the updated reasoning > for why this remains a valuable addition: > > https://lkml.kernel.org/r/1523024546-6150-1-git-send-email-alex.popov@linux.com > > I, too, remain convinced this is a good protection to have, even as we > slowly remove VLAs and try to improve the compiler's initialization of > stack variables. > > Dave, Ingo, Linus: how does this look? With the assembly rewritten > into C, the entry changes are very small: > >> arch/x86/entry/entry_32.S | 7 ++++++ >> arch/x86/entry/entry_64.S | 3 +++ >> arch/x86/entry/entry_64_compat.S | 5 ++++ >> arch/x86/entry/erase.c | 54 ++++++++++++++++++++++++++++++++++++++++ > > I'd really like to get people's Ack/Review. :) > > Laura, can this C version work for arm64 as well? > > Thanks, > > -Kees >
I did a quick port and it seems to work on a minimal system (passes LKDTM tests). I'll clean it up and do a few more tests to send out and see about give this series another review.
Thanks, Laura
|  |