Re: [PATCH v2] mm/vmalloc: widen guard region to defeat ENTER-based stack pivot

[Xiang Mei <xmei5@asu.edu>]

On Wed, Jul 1, 2026 at 1:31 AM Peter Zijlstra <peterz@infradead.org> wrote:
>
> On Wed, Jul 01, 2026 at 12:58:12AM -0700, H. Peter Anvin wrote:
> > On July 1, 2026 12:48:34 AM PDT, Peter Zijlstra <peterz@infradead.org> wrote:
> > >On Wed, Jul 01, 2026 at 09:27:47AM +0200, Peter Zijlstra wrote:
> > >> On Mon, Jun 29, 2026 at 03:29:50PM -0700, Dave Hansen wrote:
> > >>
> > >> > But, really, if ENTER is so evil and nobody uses it, shouldn't we just
> > >> > have an MSR bit somewhere to tell the CPU to #UD for it rather than
> > >> > playing these stack games?
> > >>
> > >> For supervisor mode only, I suppose. We can't ever get rid of userspace
> > >> ENTER because legacy I suppose. But we can make sure the kernel is
> > >> clean.
> > >>
> > >> So yeah, having a knob to make supervisor-ENTER trap would be useful I
> > >> suppose.
> > >
> > >x86_64-defconfig builds clean with the below :-)
> > >
> > >
> > >diff --git a/tools/objtool/arch/x86/decode.c b/tools/objtool/arch/x86/decode.c
> > >index 1b387d5a195b..9e53db863203 100644
> > >--- a/tools/objtool/arch/x86/decode.c
> > >+++ b/tools/objtool/arch/x86/decode.c
> > >@@ -642,6 +642,10 @@ int arch_decode_instruction(struct objtool_file *file, const struct section *sec
> > >
> > >             break;
> > >
> > >+    case 0xc8:
> > >+            WARN("ENTER instruction at %s:%lx", sec->name, offset);
> > >+            break;
> > >+
> > >     case 0xc9:
> > >             /*
> > >              * leave
> >
> > The problem is that it being a single byte long it can appear in the middle of another instruction.
>
> I understand; this was in response to Dave's suggestion to make
> (supervisor) ENTER #UD, in which case we'd have to ensure no legit
> ENTERs exist.

Peter's explanation is correct: this technique makes CFH->ACE easier.

I think both ways can mitigate it, but I would like to hear your
(maintainers') idea of which one we should proceed:

1. supervisor-ENTER-#UD + Peter's objtool check. Cleanest for ENTER,
but it needs a new bit from Intel/AMD, so future CPUs only.
2. Kill the landing zone with a 0x11-page guard area.

Thanks,
Xiang