Re: [PATCH][RFA/RFC] Stack clash mitigation patch 02/08 - V3

2017-09-19 Thread Andreas Schwab
On Sep 19 2017, Jeff Law wrote: > I know some early bits had hardcoded "8" in some places, but I didn't > think those had ever been posted -- I may have given them to Matz for > him to play with. Are you using those perhaps? Yes, that looks like what's been happening. Andreas. -- Andreas Sch

Re: [PATCH][RFA/RFC] Stack clash mitigation patch 02/08 - V3

2017-09-19 Thread Jeff Law
On 09/19/2017 03:08 AM, Andreas Schwab wrote: > On Sep 18 2017, Jeff Law wrote: > >> On 09/18/2017 10:09 AM, Andreas Schwab wrote: >>> On Sep 18 2017, Jeff Law wrote: >>> Can you confirm if the probe was in the red zone vs the live areas on the stack? >>> >>> It overwrites a nearby var

Re: [PATCH][RFA/RFC] Stack clash mitigation patch 02/08 - V3

2017-09-19 Thread Andreas Schwab
On Sep 18 2017, Jeff Law wrote: > On 09/18/2017 10:09 AM, Andreas Schwab wrote: >> On Sep 18 2017, Jeff Law wrote: >> >>> Can you confirm if the probe was in the red zone vs the live areas on >>> the stack? >> >> It overwrites a nearby variable. sp + 8 happens to be the address of >> file_ent

Re: [PATCH][RFA/RFC] Stack clash mitigation patch 02/08 - V3

2017-09-18 Thread Jeff Law
On 09/18/2017 10:09 AM, Andreas Schwab wrote: > On Sep 18 2017, Jeff Law wrote: > >> Can you confirm if the probe was in the red zone vs the live areas on >> the stack? > > It overwrites a nearby variable. sp + 8 happens to be the address of > file_entries_new_size. > >0x000140e8 <+1172>:

Re: [PATCH][RFA/RFC] Stack clash mitigation patch 02/08 - V3

2017-09-18 Thread Jeff Law
On 09/18/2017 10:09 AM, Andreas Schwab wrote: > On Sep 18 2017, Jeff Law wrote: > >> Can you confirm if the probe was in the red zone vs the live areas on >> the stack? > > It overwrites a nearby variable. sp + 8 happens to be the address of > file_entries_new_size. > >0x000140e8 <+1172>:

Re: [PATCH][RFA/RFC] Stack clash mitigation patch 02/08 - V3

2017-09-18 Thread Andreas Schwab
On Sep 18 2017, Jeff Law wrote: > Can you confirm if the probe was in the red zone vs the live areas on > the stack? It overwrites a nearby variable. sp + 8 happens to be the address of file_entries_new_size. 0x000140e8 <+1172>: mov r6, sp 0x000140ec <+1176>: add r3, r3, #7

Re: [PATCH][RFA/RFC] Stack clash mitigation patch 02/08 - V3

2017-09-18 Thread Jeff Law
On 09/18/2017 03:29 AM, Andreas Schwab wrote: > On Jul 30 2017, Jeff Law wrote: > >> This patch introduces generic mechanisms to protect the dynamically >> allocated stack space against stack-clash attacks. >> >> Changes since V2: >> >> Dynamic allocations can be emitted as unrolled inlined probe

Re: [PATCH][RFA/RFC] Stack clash mitigation patch 02/08 - V3

2017-09-18 Thread Jeff Law
On 09/18/2017 03:29 AM, Andreas Schwab wrote: > On Jul 30 2017, Jeff Law wrote: > >> This patch introduces generic mechanisms to protect the dynamically >> allocated stack space against stack-clash attacks. >> >> Changes since V2: >> >> Dynamic allocations can be emitted as unrolled inlined probe

Re: [PATCH][RFA/RFC] Stack clash mitigation patch 02/08 - V3

2017-09-18 Thread Joseph Myers
On Mon, 18 Sep 2017, Andreas Schwab wrote: > Does that work correctly when the VLA is smaller than the probe size > (word_mode by default)? I see a failure in glibc on armv7 where > ldconfig is using a zero-size VLA, which is invalid in C, but it could > also end up using a VLA of size 1. FWIW,

Re: [PATCH][RFA/RFC] Stack clash mitigation patch 02/08 - V3

2017-09-18 Thread Jeff Law
On 09/18/2017 03:29 AM, Andreas Schwab wrote: > On Jul 30 2017, Jeff Law wrote: > >> This patch introduces generic mechanisms to protect the dynamically >> allocated stack space against stack-clash attacks. >> >> Changes since V2: >> >> Dynamic allocations can be emitted as unrolled inlined probe

Re: [PATCH][RFA/RFC] Stack clash mitigation patch 02/08 - V3

2017-09-18 Thread Andreas Schwab
On Jul 30 2017, Jeff Law wrote: > This patch introduces generic mechanisms to protect the dynamically > allocated stack space against stack-clash attacks. > > Changes since V2: > > Dynamic allocations can be emitted as unrolled inlined probes or with a > rotated loop. Blockage insns are also pro

Re: [PATCH][RFA/RFC] Stack clash mitigation patch 02/08 - V3

2017-08-22 Thread Jeff Law
On 08/18/2017 08:05 AM, Richard Biener wrote: > On Mon, Jul 31, 2017 at 7:38 AM, Jeff Law wrote: >> >> This patch introduces generic mechanisms to protect the dynamically >> allocated stack space against stack-clash attacks. >> >> Changes since V2: >> >> Dynamic allocations can be emitted as unrol

Re: [PATCH][RFA/RFC] Stack clash mitigation patch 02/08 - V3

2017-08-18 Thread Richard Biener
On Mon, Jul 31, 2017 at 7:38 AM, Jeff Law wrote: > > This patch introduces generic mechanisms to protect the dynamically > allocated stack space against stack-clash attacks. > > Changes since V2: > > Dynamic allocations can be emitted as unrolled inlined probes or with a > rotated loop. Blockage

[PATCH][RFA/RFC] Stack clash mitigation patch 02/08 - V3

2017-07-30 Thread Jeff Law
This patch introduces generic mechanisms to protect the dynamically allocated stack space against stack-clash attacks. Changes since V2: Dynamic allocations can be emitted as unrolled inlined probes or with a rotated loop. Blockage insns are also properly emitted for the dynamic area probes and