From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f52.google.com (mail-pj1-f52.google.com [209.85.216.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E9ECD32B110 for ; Tue, 30 Jun 2026 23:48:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=209.85.216.52 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782863320; cv=pass; b=piEl1p2mpGGDF+jTHKplA1YVbhU6zhORzU5kAdv4XnQYeY9Cq2EMWE3ZFOsqSkgp/MekLQXfDa8jSO5hkY6hlq9QsYNlXcRdc32zd8FrMg+rN5Jart7X+pYvuavPcelBg9rRTOsoUtRKPemoALltPIrkdt0USPIZMXW/b4I568A= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782863320; c=relaxed/simple; bh=Kt2DBulMpkq3yuN2l3tu6FacmANttLzW0MCd7Z/rlSg=; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=TGExSiPko1DI3TKPjWRgkw3dLSU7G67FlXWa5T+HPKiAIXdcPacJboaxejjY6F+l41v0bddGvDp2hNhM8q+Zov3SfjRFlEINwx6ymRvq3AERmdj++jO9Kwh4U2J0tuK7qn57sx5L2gNRenubpuaxQ15dK1gX8bCiaNOZUub51a8= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu; spf=pass smtp.mailfrom=asu.edu; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b=RyKFrPfY; arc=pass smtp.client-ip=209.85.216.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=asu.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b="RyKFrPfY" Received: by mail-pj1-f52.google.com with SMTP id 98e67ed59e1d1-37ff8e0ad0fso37036a91.2 for ; Tue, 30 Jun 2026 16:48:38 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1782863318; cv=none; d=google.com; s=arc-20260327; b=EGzCkrZeQzMuxx0cEgzPEIDb25hKGLGG4iInaQr+dwUFaYSOQhre5RD7bR0r61cwGk F0ZiopUuN+RB2qY55S235dQEW5OxvUWoCLZT5D4y2O4Ip6dAnYCz3OxrDSP/ltcEZGYP vkpT7uyaZODwETKzl1p2PjdtU2GkZ43PBxkdRdoZMZPMTYbqgX+WFiIgiU+FfbxPkEvu F+0ku/YPDQZXUKPpvZOjnGpPDtUSvR9Jv5XbGUP5bK1rJ8/p9W2BP32DKPVu2CkzdWwm DKL5CamFOEnfrMbUl8fz9ysHuN7E8t7S8uTbFHgFf7BwFmRS2v12s0TfNtZA6DPaYwqW hdsA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=Kt2DBulMpkq3yuN2l3tu6FacmANttLzW0MCd7Z/rlSg=; fh=khbnAkFxbIUjQV2qnJ+ljylhJPYFYDhbtUVRanCB44o=; b=FMYOU+Dnskp3MZ4h69OsXa1R55X83vgxXH2+Cbsx1AcIoCN34UWoCSavXVKpFo4eML 0qrocj1W6xhWkizCtGRqJrkkbLQhiOMeyZw6sJTUbpGqWDC1CNXZ+GM4IEsey/iiTUN1 7/9B0BojIfjQKv4e4LNIettT4hhMYmaF31mkWdavAw4a/fJ68MOPXGfUb5QZ8FQkBUu1 nFPrGUGN2sM7V/E291pOHj32TYHgM5b7pvNJp5DmUUMaDXNEpYBYXy/WAo86UYJIeV6+ QNTzzngLFUp9KpUE/9rwsjvuEEOuWBvUl2Nlv4pFM0IhTbfW4nlZlg8L3CLp0clfD1uF vAaw==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=asu.edu; s=google; t=1782863318; x=1783468118; darn=vger.kernel.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=Kt2DBulMpkq3yuN2l3tu6FacmANttLzW0MCd7Z/rlSg=; b=RyKFrPfYN7X2JSl4+Ef7c7Ghv+QFw2fephvKawzmDYoI442zR9OAd4FxSJYW91iMFV zHBb+2ICjJjU1DonHtM7OBy1xLCeQryUR0OJdmhb5i5qb5M5hexmEyL3380Cfb2VDvT9 zL+7ftI46S9mWZRav+ku7DR67M0GHHd1JTWBxQju3oV44OsoADK9Zi4BKVKnuy229GHz iRAIX9yyVVAUfw7yBmL+o3GvFc1uZbOXCXQyIHkPGw9kUdJR6LcMZ6igThtvXknuCksE KJ6mWXMEGTPxGrx4BuSXQWlzoWDAM+UGVv5nL/kivsbNJnhjn8b1/bXAtxGfdhbuq2rg nFlA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782863318; x=1783468118; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=Kt2DBulMpkq3yuN2l3tu6FacmANttLzW0MCd7Z/rlSg=; b=T5EuO1o9Ytco09+OjPXf40z9IyL11Pqdoe2scy3855FETG3sCwfbeuIZ1Fu626kX8F qNeoy1fjCtj6+M8sC0ZM8628REs6X7f1Snh9gQZNkCT3LhxQnbrn/QjPEkBVJPSNms+c 9zdb7g7y0e7hwRqq1E37M4WEbZQhqVLt8z20SdpsaoxDHxgsKLlSFUI/cQPwP+qAoxSZ rL1VtYiz5VZX3NKIX+Tx4qBk+OistZU7GK0Ozvm2lqWjGGgULcyCJwQ6qxdj5rHHdBlJ 8lUhExa3KOoTFldD3IL4vfsZ2+PqoRqj8wPrXDHTsUY2JBQkATIbRmLP0nspGMlWNjWP F8KQ== X-Forwarded-Encrypted: i=1; AHgh+RqgCQ4c6h5JRmRKhxWslsm0pkbk0cgmMIMShZrumx1daX9ZbOFYMp8cfgaj95/QchFdolr157kpapBIReg=@vger.kernel.org X-Gm-Message-State: AOJu0YySW3WH5zot6KzH4AJDBFZqxRb7IR7yaV9V988SvLtHBKmktrw9 IzQZq6e1CeMs9wjL1AU3Oqr1MQDq33OzT5jb1oJE/KRqug166rqMNwOAdV177BmjZ0FGQw/afsc wvpOox07e4nSQXt98N7Os2stpJdl8c0n9r75jWSMz X-Gm-Gg: AfdE7cmR2p09T+9f6yrBOnJUZrDk90L7UH3WSyiQfuryxGc5x8U/3KCSsk2cuz5vtBn Lzo2r9EMZNDoLxUZOTDvfRNf3G43T2ayZTxaQrlWcbqm8q9bfVc7z939nNriHZWylLS7XihjRIu gpY2qHJEf7DbDR8U89wQHg11s/rigO99UV7YDM7Vx7A4r97qRoAE1LSNKIAig7ipdKvy4JIjx7o XtFttLbIuYJXVMgoGWJr+jj5XwIfxFXDu028BJQuHhZHY2W4eJ4W68XWHSZIdpXOJqxFCNvOHZG XSCg0L30fu7ZkA95Zhqb3qr7L/YY X-Received: by 2002:a17:90b:3909:b0:377:424b:59e3 with SMTP id 98e67ed59e1d1-3808c0e139dmr2071252a91.24.1782863318168; Tue, 30 Jun 2026 16:48:38 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: <20260629214712.1198680-1-xmei5@asu.edu> <4e96acf4-25e7-4f30-8455-f9b3f49062be@intel.com> <86e805c9-ede0-473c-b8a4-8b20439eaa6b@zytor.com> <9ac1d214-aa8a-42e5-8903-15f8eac5cddd@intel.com> In-Reply-To: <9ac1d214-aa8a-42e5-8903-15f8eac5cddd@intel.com> From: Xiang Mei Date: Tue, 30 Jun 2026 16:48:26 -0700 X-Gm-Features: AVVi8Cf_WIqqKI8vqJ-7-zhFrDMx9ui8BwZRhh2LAk5C3DC2KmNyzSVaHSx24Vg Message-ID: Subject: Re: [PATCH v2] mm/vmalloc: widen guard region to defeat ENTER-based stack pivot To: Dave Hansen Cc: "H. Peter Anvin" , Kees Cook , Andrew Morton , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, linux-hardening@vger.kernel.org, Uladzislau Rezki , "Gustavo A . R . Silva" , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Jennifer Miller , Tiffany Bao , Ruoyu Wang , Adam Doupe , Kyle Zeng , Yan Shoshitaishvili Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Jun 30, 2026 at 4:40=E2=80=AFPM Dave Hansen = wrote: > > On 6/30/26 15:47, Xiang Mei wrote: > > On Tue, Jun 30, 2026 at 3:14=E2=80=AFPM H. Peter Anvin = wrote: > >> On 2026-06-30 15:05, Dave Hansen wrote: > >>> On 6/30/26 15:02, Xiang Mei wrote: > >>>> Please feel free to ask any questions; I am glad to help. > >>> How do the CET features: kernel IBT and the (theoretical for Linux) > >>> kernel shadow stacks impact the situation? > >> CET should prevent this from being the target of a JOP attack. > >> > > You are right; CET breaks the assumption that this technique needs a > > CFH primitive. > > I'm not sure what you're saying. > > Are you saying that this ENTER-based technique is worthless if IBT is in > play, so the new stack gap is a worthless mitigation too? IBT makes it hard to use a CFH primitive(including ENTER gadgets, which are a subset of CFH gadgets). Currently, it's worthless to enlarge the guard area for Fine-IBT/kCFI protected targets. Xiang