linux-kernel - Re: [PATCH][v6][RFC] livepatch/ppc: Enable livepatching on powerpc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LNX.2.00.1603091110510.3656@cbobk.fhfr.pm>
Date:	Wed, 9 Mar 2016 11:13:05 +0100 (CET)
From:	Jiri Kosina <jikos@...nel.org>
To:	Torsten Duwe <duwe@....de>
cc:	Petr Mladek <pmladek@...e.com>,
	Balbir Singh <bsingharora@...il.com>, linuxppc-dev@...abs.org,
	linux-kernel@...r.kernel.org, rostedt@...dmis.org,
	kamalesh@...ux.vnet.ibm.com, jeyu@...hat.com,
	live-patching@...r.kernel.org, mbenes@...e.cz
Subject: Re: [PATCH][v6][RFC] livepatch/ppc: Enable livepatching on powerpc

On Wed, 9 Mar 2016, Torsten Duwe wrote:

> > find a solution that would work transparently. I mean that adding
> > an extra hacks into selected functions in the patch might be quite
> > error prone and problems hard to debug. I think that we all want this
> > but I wanted to be sure :-)
> 
> Full ACK. Again, the TOC restore needs to go _after_ the replacement function,
> and the klp_return_helper works as transparently as possible, so this
> was my first choice. Arguments on the stack? I thought we'll deal with them
> once we get there (e.g. _really_ need to patch a varargs function or one
> with a silly signature).

Well, the problem is, once such need arises, it's too late already.

You need to be able to patch the kernels which are already out there, 
running on machines potentially for ages once all of a sudden there is a 
CVE for >8args / varargs function.
At that time, only starting to put support in the kernel for that is waaay 
to late :)

Thanks,

-- 
Jiri Kosina
SUSE Labs