lkml.org 
[lkml]   [2023]   [Oct]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v2] x86: test that userspace stack is in fact NX

* Alexey Dobriyan <adobriyan@gmail.com> wrote:

> Here is how it works:
>
> * fault and fill the stack from rsp with int3 down until rlimit allows,
> * fill upwards with int3 too, overwrite libc stuff, argv, envp,
> * try to exec int3 on each page and catch it in either SIGSEGV or
> SIGTRAP handler.
>
> Note: trying to execute _every_ int3 on a 8 MiB stack takes 30-40 seconds
> even on fast machine which is too much for kernel selftesting
> (not for LTP!) so only 1 int3 per page is tried.
>
> Tested on F37 kernel and on a custom kernel which does
>
> vm_flags |= VM_EXEC;
>
> to stack VMA.
>
> Report from the buggy kernel:
>
> $ ./nx_stack_32
> stack min ff007000
> stack max ff807000
> FAIL executable page on the stack: eip ff806001
>
> $ ./nx_stack_64
> stack min 7ffe65bb0000
> stack max 7ffe663b0000
> FAIL executable page on the stack: rip 7ffe663af001

Nice, thanks!

Ingo

\
 
 \ /
  Last update: 2023-10-03 21:01    [W:0.084 / U:1.968 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site