From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9462E30F80C for ; Tue, 30 Jun 2026 01:22:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=209.85.214.177 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782782586; cv=pass; b=se6pb03/9Ys05yhmTHi3w4wVUB/NbbcDapkfuKhJoS7yNbDHfXKIOyaxGgISkeaAPwxDb4+kVKoh4ZvIvPeY1Yd5PNBYSL895sQtp2xfkxxpmEh1qVzXTFbUHkjDU7MdSz+mUMqZCOd/sNARp955St4mKWWnxelZNwNbsRASUZQ= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782782586; c=relaxed/simple; bh=3mJfRZYUuuihM6LVzR7jlhUxtHuYi9//80+qlG/kJg8=; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=Xc9SUjG8IN3EEegYOYLPEFR5C35capOx55uXUMZwd0imf1V8cQGHzV3Qv/eYCx0mMrUxJVkn2QW04dMXB4t6cX2cNhi5YOEsZCxDN7OB6mysXVYQ31hgkVbMUjeLRebl8yfBt4FSi9K4tz0IWBuj3g086E9MwoTc/4wLdhObwCU= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu; spf=pass smtp.mailfrom=asu.edu; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b=Zc52rtZG; arc=pass smtp.client-ip=209.85.214.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=asu.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b="Zc52rtZG" Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2c82538b6c0so22766355ad.2 for ; Mon, 29 Jun 2026 18:22:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1782782575; cv=none; d=google.com; s=arc-20260327; b=iJ7d58Ep3zafoJs/AZsnHYdViSzRAySi7Wytp9cQsBCnc8AT0GMK/F/KiY4Zhukpew v197SC6nDaiwII08K8NnoVvkVY8hrdZKGitXbazSG1wu4xKgj+HATI/SdLsP+VBNea4G b+bvn4CqAiD6/3kQo/2CuMhl91/7uu+f+h10An/FVToZpmxOG7M+m2Q0ptTEBR//158M DXpBQU+35xkkprUFE72hn0hm0g0TkE5oDxstMbTRzYZAp3nX7rN7jD/lz0/NxQPPW37N vO6HNCcdi4Yb+qpXj9WUx5+W1GNvJYkA/bXau01VRGFTNfrNH/BqNX9Sb7CDuLDgV9n+ j1Ow== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=3mJfRZYUuuihM6LVzR7jlhUxtHuYi9//80+qlG/kJg8=; fh=ZCcrr+8sJjwC7tZoknjCv8TJWRc8rBsIhSjPbp9cejI=; b=YHTGttDeCZ78AOuaa/7oeWjB0HW1n+7Ytyio9iHzJtlkZJNfo9nO8AtVTJPHiDFFR1 A1+4XdVck8Ys1Xn21UGYQWjv6iJLM+Rhm0CltCPD6FfzgcX0DtZO7dlmE+fPAJ3Rz+Rx wMppI93ek5opaaG7zuRpj0oAljnXsq4LEs9o+iN9ui2Iq6/zp3F+cs6y12W4nrHu8LFJ /A7daeApoujymmvfC8Vhw0zA0BPfSCHwJ3bbAcsi9rH8PIY5NssKfQ0kidocJTEQMVLA p40TDbYZ/+45dVf3Ok5DwgvuibOKzMc2bdgFJ1xeRht1rgM02M3+vchOla1AmSxSqMWg tl9g==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=asu.edu; s=google; t=1782782575; x=1783387375; darn=vger.kernel.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=3mJfRZYUuuihM6LVzR7jlhUxtHuYi9//80+qlG/kJg8=; b=Zc52rtZGG/m2FbhKzugSlY8h1OwUugeU7VyzeWGM8qzoCjLCb+T6gNwL3KewpXgD59 sCtm2v7WvyLZhvct6O5KokwZ4JOWEmN1uW3AUAIJoDYspdL+lQZWvcuNVCtrSGBV9xh8 yM5DgypdHqKd122/bjWXGkzU7fNupgzNCSR7hvIAXKSFcrE5RN5RyCc0QK618QOOhObs 6z/DaVs1b6LUU6RQNMrpoC0kTpIpHgx2yQLRxuAi9Kb9x5p6P0PcOE50bMCKCEr7knEU SumTuvUsLi9Ck5Mfn1NtFtAxjhnJrSdRr/ZIt6ag4UOfjmE7NqczeCGQVnraObTbmpl/ HItw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782782575; x=1783387375; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=3mJfRZYUuuihM6LVzR7jlhUxtHuYi9//80+qlG/kJg8=; b=YJBvnFjlNu/GTbtLTOnRm8aTFn0Bmf3puw3WyMwu/RCq8lIBUQ5bOieDDoLC4KGvx9 d3QImrbJZ1WGD7sVGsV/ZgyMAqJv4ffW031oMtgYaFdMSlsZs8S4bebyEYLN3f+vtFsu sBs/gjx/Z96uxgyaWNKsb5sL1A/lWnG7tjDP7ZmMNgHU1E0vLMNOz6gWLRs37bmawR0A CoHYksyqbaONDWjcK6OEp/uSyB+sEXZQNQnK2vwJZ/ZQkpp0nil2FUHDycMiPH48ABGt zjrbgAz502NIwSHVk9VuNUhmLkxg6CDqTKWKJW+0xENp+aJeVgdPtw7CI2ngMcK8MfiP plhA== X-Forwarded-Encrypted: i=1; AHgh+RpvgtgfdmeuKF7eAvMv1Hj1Ud7DwAI3D1nwMaN7Kmll+G3cS91ADMVzbyHktxRoSwvPf3A1S5VpNG51Bi8=@vger.kernel.org X-Gm-Message-State: AOJu0Yyz2NVx/AqKtDSLQVE8U0Pw2piW87p7Jocx93mxXplPpXEEgZyU n5WRNKh3CzKXRzetyxbcUj9jKtoEoOOn4QU3NxPan5LhVLfqRFLnNhNLTGguQtd4ISHZp+xlB1b W/mZchI1HVWnVzB9sq44XQpJ8Z902MY9yKsCYZPSpLKAzjdcYCJJtuv3vRPs= X-Gm-Gg: AfdE7cnRm4sKJQTpUdE293mlP7ybj/ur3rycjbp4HMIms16S0eFGsEKiqiKjiWZq7NW /a26mmxQgP61/DSks5e9BMbo6DQdyPSlK+ki1jJjmPjFk2sWi18cDFGeDeapBxDrImiWLuVpCZe G+C78Pe0KX4S3buNXhqJhM2epOFe49+hOI//7EC11Z1DhTfwz20nVGI44U9pmKLRi7ZJdjadmck KJUqcMwuex7S74hdTg18xOOi89oNM2y1ue8tKm93chQ5nNYj1wO/b+8eN8LFDHPuEGIQiHHNpOX CUhuJHRAB4VxRexam9XThEXgI6PdQLLe624Waoh3 X-Received: by 2002:a17:902:e788:b0:2c7:f12d:5d37 with SMTP id d9443c01a7336-2ca2d564f4cmr12503945ad.17.1782782575601; Mon, 29 Jun 2026 18:22:55 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: <20260629214712.1198680-1-xmei5@asu.edu> <4e96acf4-25e7-4f30-8455-f9b3f49062be@intel.com> In-Reply-To: <4e96acf4-25e7-4f30-8455-f9b3f49062be@intel.com> From: Xiang Mei Date: Mon, 29 Jun 2026 18:22:44 -0700 X-Gm-Features: AVVi8CdJuTsl6a0UUGxPVPkpf9hXXLqmOnUrxku44YqGlDUi1EXbNbnfzfkvjS4 Message-ID: Subject: Re: [PATCH v2] mm/vmalloc: widen guard region to defeat ENTER-based stack pivot To: Dave Hansen Cc: Kees Cook , Andrew Morton , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, linux-hardening@vger.kernel.org, Uladzislau Rezki , "Gustavo A . R . Silva" , "H . Peter Anvin" , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Jennifer Miller , Tiffany Bao , Ruoyu Wang , Adam Doupe , Kyle Zeng , Yan Shoshitaishvili Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, Jun 29, 2026 at 4:37=E2=80=AFPM Dave Hansen = wrote: > > On 6/29/26 16:28, Xiang Mei wrote: > >>> That is more than enough to step off the current stack, across the > >>> one-page guard, and into the adjacent sprayed pages. When those pages > >>> contain a return sled feeding a ROP chain, reaching any ENTER gadget > >>> (opcode 0xc8, abundant as both intended and unintended gadgets) turns= a > >>> control-flow hijack into full ROP execution without any register cont= rol > >>> at the hijack site, making it a one-gadget-style primitive that > >>> significantly eases exploitation. The pivot happens after the control > >>> transfer, so it is not constrained by CFI (kCFI/FineIBT). > >> This all sounds super theoretical. > >> > >> I don't think we should mess with any of this without there being some > >> sign that this is an actual, practical juicy exploit target. > >> > > Yes, I am sorry to reuse some incorrect comments I copied from v1. > > I'll remove the CFI-related content since we assume we already have > > control flow hijacking. > > I think you missed the main point: this all sounds *SUPER* theoretical. > In other words, no real attacker would ever need to use ENTER like. Only > make-believe attackers in imaginary academic papers. Those imagined > attackers' only goal is to help mint PhD's. > > Upstream, we're concerned with practical attacks, not theoretical ones. > > You've done virtually nothing here to show that this is a practical > attack that someone might use in the real world, outside of the > PhD-minting industry. > > Please don't even try to send a v3 without addressing this. This is a demo exploiting CVE-2026-31419 with this technique: https://github.com/google/security-research/pull/397 I have no comment on your PhD-minting story. Let's keep this issue free from personal stuff. I would like to demo you that this technique is practical. Please tell me what you need to prove that this bug is practical. Thanks, Xiang