[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1477949185.8761.13.camel@gmail.com>
Date: Mon, 31 Oct 2016 17:26:25 -0400
From: Daniel Micay <danielmicay@...il.com>
To: Jann Horn <jann@...jh.net>, Florian Weimer <fw@...eb.enyo.de>
Cc: Kees Cook <keescook@...omium.org>, kernel-hardening@...ts.openwall.com,
Andrew Morton <akpm@...ux-foundation.org>, Michal Hocko <mhocko@...e.com>,
Ingo Molnar <mingo@...nel.org>, Andy Lutomirski <luto@...nel.org>, LKML
<linux-kernel@...r.kernel.org>
Subject: Re: Re: [PATCH] fork: make whole stack_canary
random
On Mon, 2016-10-31 at 22:22 +0100, Jann Horn wrote:
> On Mon, Oct 31, 2016 at 10:10:41PM +0100, Florian Weimer wrote:
> > * Daniel Micay:
> >
> > > > It makes a lot of sense on x86_64 where it means the canary is
> > > > still 56 bits. Also, you want -fstack-check for protecting again
> > > > stack overflows rather than stack *buffer* overflow. SSP won't
> > > > really help you in that regard. Sadly, while -fstack-check now
> > > > works well in GCC 6 with little performance cost, it's not
> > > > really a
> >
> > I think GCC still does not treat the return address push on
> > architectures which have such a CALL instruction as an implicit
> > stack
> > probe.
> >
> > > > complete feature (and Clang impls it as a no-op!).
> >
> > How many guard pages at the end of the stack does the kernel
> > guarantee? I saw some -fstack-check-generated code which seemed to
> > jump over a single guard page.
>
> Until recently: Zero, no guard pages below stacks, stack overflow
> goes straight into some other allocation.
> Now: One guard page, thanks to a lot of work by Andy Lutomirski.
> (I think that change is in the current 4.9-rc3 kernel, but not in
> any stable kernel yet.)
I think Florian is talking about the main thread stack in userspace.
Thus the next part about how it doesn't actually *guarantee* a guard
page at all right now for that. Userspace has to work around that if
it's worried about it (it can't really happen in practice though, but
it's not great that mmap with a hint + no MAP_FIXED can break it).
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
