Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (1.0)
Subject: Re: [RFC PATCH] x86/entry/64: randomize kernel stack offset upon syscall
From:   Andy Lutomirski <luto@amacapital.net>
In-Reply-To: <30998bcd55a34ed38b681f9bb3e3fb87@AcuMS.aculab.com>
Date:   Wed, 20 Mar 2019 07:51:01 -0700
Cc:     Andy Lutomirski <luto@kernel.org>,
        Elena Reshetova <elena.reshetova@intel.com>,
        Josh Poimboeuf <jpoimboe@redhat.com>,
        Kees Cook <keescook@chromium.org>,
        Jann Horn <jannh@google.com>,
        "Perla, Enrico" <enrico.perla@intel.com>,
        Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
        Thomas Gleixner <tglx@linutronix.de>,
        LKML <linux-kernel@vger.kernel.org>,
        Peter Zijlstra <peterz@infradead.org>,
        Greg KH <gregkh@linuxfoundation.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <25395187-837A-4689-9387-5ACCE78E4DF3@amacapital.net>
References: <20190318094128.1488-1-elena.reshetova@intel.com> <CALCETrUxhzHyUQCAjPQcPNWwAw5UTxUX4ZaeGxpbf9VSCDdcPg@mail.gmail.com> <30998bcd55a34ed38b681f9bb3e3fb87@AcuMS.aculab.com>
To:     David Laight <David.Laight@aculab.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


> On Mar 20, 2019, at 4:12 AM, David Laight <David.Laight@aculab.com> wrote:=

>=20
> From: Andy Lutomirski
>> Sent: 18 March 2019 20:16
> ...
>>> As a result this patch introduces 8 bits of randomness
>>> (bits 4 - 11 are randomized, bits 0-3 must be zero due to stack alignmen=
t)
>>> after pt_regs location on the thread stack.
>>> The amount of randomness can be adjusted based on how much of the
>>> stack space we wish/can trade for security.
>>=20
>> Why do you need four zero bits at the bottom?  x86_64 Linux only
>> maintains 8 byte stack alignment.
>=20
> ISTR that the gcc developers arbitrarily changed the alignment
> a few years ago.
> If the stack is only 8 byte aligned and you allocate a variable that
> requires 16 byte alignment you need gcc to generate the extra stack
> frame to align the stack.
> I don't remember seeing the relevant gcc options on the linux
> gcc command lines.
>=20


On older gcc, you *can=E2=80=99t* set the relevant command line options beca=
use gcc was daft.  So we just crossed out fingers and hope led for the best.=
  On newer gcc, we set the options.  Fortunately, 32-byte stack variable ali=
gnment works regardless.

AFAIK x86_64 Linux has never aligned the stack to 16 bytes.=