[lkml]   [2019]   [Feb]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject[RFC PATCH 0/4] Allow tasks to have their user stack pointer sanity checked
Hi all,

I attended an interesting talk at LCA last month that described some of the
security features deployed in OpenBSD [1]. One hardening feature that piqued
my interest was, on syscall entry and page faults from userspace, checking
that the user stack pointer for a task points at pages that were either
allocated by the kernel for the initial process stack of mapped with mmap()
using the MAP_STACK flag. This acts as a basic defense against stack
pivoting attacks.

The problem with this checking is that it is a retrospective tightening
of the ABI, but that hasn't stopped me hacking it together behind a couple
of prctl() options.

Anyway, it was fun to implement so I figured I'd post it as an RFC.



Cc: Kees Cook <>
Cc: Jann Horn <>
Cc: Andrew Morton <>
Cc: Matthew Wilcox <>
Cc: Michal Hocko <>
Cc: Peter Zijlstra <>


Will Deacon (4):
mm: Check user stack pointer is mapped with MAP_STACK
mm: Expose user stack pointer checking via prctl()
mm: Add kconfig entries for user stack pointer checking
arm64: Check user stack pointer on syscall entry

arch/arm64/Kconfig | 1 +
arch/arm64/kernel/syscall.c | 4 +++
include/linux/mm.h | 15 +++++++++-
include/linux/mman.h | 3 +-
include/linux/sched.h | 4 +++
include/uapi/linux/prctl.h | 5 ++++
kernel/sys.c | 5 ++++
mm/Kconfig | 17 ++++++++++++
mm/memory.c | 67 +++++++++++++++++++++++++++++++++++++++++++++
9 files changed, 119 insertions(+), 2 deletions(-)


 \ /
  Last update: 2019-02-11 19:00    [W:0.074 / U:9.860 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site