Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 24 Jul 2017 20:34:31 -0700
From: Kees Cook <>
To: Alexander Popov <>
Cc: Laura Abbott <>, Mark Rutland <>, 
	"" <>, 
	Ard Biesheuvel <>, Tycho Andersen <>, 
	PaX Team <>
Subject: Re: [RFC][PATCH 2/2] arm64: Clear the stack

On Mon, Jul 24, 2017 at 1:19 AM, Alexander Popov <> wrote:
> On 22.07.2017 03:23, Laura Abbott wrote:
>> On 07/21/2017 09:56 AM, Alexander Popov wrote:
>>> So let's keep it not to break CONFIG_SCHED_STACK_END_CHECK.
>> That makes sense, good find! I wonder if CONFIG_SCHED_STACK_END_CHECK
>> should go on the list of hardening options and/or if we can enhance
>> it somehow?
> Do you mean this list?
>> I'm not sure why it requires two words though since the
>> poison only seems to be 32-bits?
> On x86_64 end_of_stack() returns the pointer to unsigned long, so we need at
> least 8 bytes to avoid breaking CONFIG_SCHED_STACK_END_CHECK. Don't know about 8
> more bytes.

Seems like this should be a random value like the per-frame stack
canary, but it looks like a relatively cheap check. It's probably not
in the cache, though, since most stack operations should be pretty far
from the end of the stack...


Kees Cook
Pixel Security

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.