| From: |
| Kees Cook <keescook-AT-chromium.org> |
| To: |
| Alexander Popov <alex.popov-AT-linux.com>, Dave Hansen <dave.hansen-AT-linux.intel.com>, Borislav Petkov <bp-AT-alien8.de>, Andy Lutomirski <luto-AT-kernel.org> |
| Subject: |
| Re: [PATCH RFC v9 0/7] Introduce the STACKLEAK feature and a test for it |
| Date: |
| Mon, 5 Mar 2018 11:34:42 -0800 |
| Message-ID: |
| <CAGXu5jKvTUkU5qLf+j9aB8G2xqKm7n3QLPBXaGnk_ewhG6=i_g@mail.gmail.com> |
| Cc: |
| Kernel Hardening <kernel-hardening-AT-lists.openwall.com>, PaX Team <pageexec-AT-freemail.hu>, Brad Spengler <spender-AT-grsecurity.net>, Ingo Molnar <mingo-AT-kernel.org>, Tycho Andersen <tycho-AT-tycho.ws>, Laura Abbott <labbott-AT-redhat.com>, Mark Rutland <mark.rutland-AT-arm.com>, Ard Biesheuvel <ard.biesheuvel-AT-linaro.org>, Richard Sandiford <richard.sandiford-AT-arm.com>, Thomas Gleixner <tglx-AT-linutronix.de>, "H . Peter Anvin" <hpa-AT-zytor.com>, Peter Zijlstra <a.p.zijlstra-AT-chello.nl>, "Dmitry V . Levin" <ldv-AT-altlinux.org>, Emese Revfy <re.emese-AT-gmail.com>, Jonathan Corbet <corbet-AT-lwn.net>, Andrey Ryabinin <aryabinin-AT-virtuozzo.com>, "Kirill A . Shutemov" <kirill.shutemov-AT-linux.intel.com>, Thomas Garnier <thgarnie-AT-google.com>, Andrew Morton <akpm-AT-linux-foundation |
On Sat, Mar 3, 2018 at 12:00 PM, Alexander Popov <alex.popov@linux.com> wrote:
> This is the 9th version of the patch series introducing STACKLEAK to the
> mainline kernel. STACKLEAK is a security feature developed by Grsecurity/PaX
> (kudos to them), which:
> - reduces the information that can be revealed through kernel stack leak bugs;
> - blocks some uninitialized stack variable attacks (e.g. CVE-2017-17712,
> CVE-2010-2963);
> - introduces some runtime checks for kernel stack overflow detection.
Thanks for continuing to chip away at this! I wonder if it's time to
drop the "RFC" part of this? It seems like this should be ready to
land pretty soon. I can start carrying this in the kspp -next tree,
for example. I'd like to get some sign-off from x86, though.
Boris, Andy, and Dave (Hansen), you've all looked at this; would you
be willing to give an Ack on the x86 parts? (Though I do now see a new
comment from Dave was just sent.) And if not, what changes would you
like to see?
-Kees
--
Kees Cook
Pixel Security
