Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752324AbdGETTZ (ORCPT ); Wed, 5 Jul 2017 15:19:25 -0400 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:54163 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751784AbdGETTY (ORCPT ); Wed, 5 Jul 2017 15:19:24 -0400 Date: Wed, 5 Jul 2017 21:18:58 +0200 From: Willy Tarreau To: Linus Torvalds Cc: Ben Hutchings , Michal Hocko , Hugh Dickins , Oleg Nesterov , "Jason A. Donenfeld" , Rik van Riel , Larry Woodman , "Kirill A. Shutemov" , Tony Luck , "James E.J. Bottomley" , Helge Diller , James Hogan , Laura Abbott , Greg KH , "security@kernel.org" , Qualys Security Advisory , LKML , Ximin Luo Subject: Re: [PATCH] mm: larger stack guard gap, between vmas Message-ID: <20170705191858.GF24459@1wt.eu> References: <20170704093538.GF14722@dhcp22.suse.cz> <20170704094728.GB22013@1wt.eu> <20170704104211.GG14722@dhcp22.suse.cz> <20170704113611.GA4732@decadent.org.uk> <1499209315.2707.29.camel@decadent.org.uk> <1499257180.2707.34.camel@decadent.org.uk> <20170705185937.GB24459@1wt.eu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.6.1 (2016-04-27) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 824 Lines: 20 On Wed, Jul 05, 2017 at 12:17:20PM -0700, Linus Torvalds wrote: > On Wed, Jul 5, 2017 at 11:59 AM, Willy Tarreau wrote: > > > > Don't you think that the option of having a sysctl to relax the check > > per task wouldn't be easier for distros and safer overall ? Ie, emit > > a warning the first time the gap is hit instead of segfaulting, then > > reduce it to something that used to work (4k or 64k, I don't remember) > > and try again ? > > It used to be just 4k. > > .. and I think that might be a valid way to find these things, but > would it be safer? It basically disables the new stack gap entirely > apart from the warning. But only if the sysctl is set. It can simply be recommended to set it if any program fails. We've done this for many years with other ones like min_mmap_addr or tcp_ecn. Willy