linux-kernel - Re: [RFC PATCH] x86/mm/fault: Allow stack access below %rsp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <47b1c477-46a7-6b04-7537-378e2910611b@intel.com>
Date:   Fri, 2 Nov 2018 15:28:17 -0700
From:   Dave Hansen <dave.hansen@...el.com>
To:     Waiman Long <longman@...hat.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Andy Lutomirski <luto@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>
Cc:     "H. Peter Anvin" <hpa@...or.com>, x86@...nel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [RFC PATCH] x86/mm/fault: Allow stack access below %rsp

On 11/2/18 12:50 PM, Waiman Long wrote:
> On 11/02/2018 03:44 PM, Dave Hansen wrote:
>> On 11/2/18 12:40 PM, Waiman Long wrote:
>>> The 64k+ limit check is kind of arbitrary. So the check is now removed
>>> to just let expand_stack() decide if a segmentation fault should happen.
>> With the 64k check removed, what's the next limit that we bump into?  Is
>> it just the stack_guard_gap space above the next-lowest VMA?
> I think it is both the stack_guard_gap space above the next lowest VMA
> and the rlimit(RLIMIT_STACK).

The gap seems to be hundreds of megabytes, typically where RLIMIT_STACK
is 8MB by default, so RLIMIT_STACK is likely to be the practical limit
that will be hit.  So, practically, we've taken a ~64k area that we
would on-demand extend the stack into in one go, and turned that into a
the full ~8MB area that you could have expanded into anyway, but all at
once.

That doesn't seem too insane, especially since we don't physically back
the 8MB or anything.  Logically, it also seems like you *should* be able
to touch any bit of the stack within the rlimit.

But, on the other hand, as our comments say: "Accessing the stack below
%sp is always a bug."  Have we been unsuccessful in convincing our gcc
buddies of this?