On Wed, 9 Mar 2016, Torsten Duwe wrote:

quoted

find a solution that would work transparently. I mean that adding
an extra hacks into selected functions in the patch might be quite
error prone and problems hard to debug. I think that we all want this
but I wanted to be sure :-)

Full ACK. Again, the TOC restore needs to go _after_ the replacement function,
and the klp_return_helper works as transparently as possible, so this
was my first choice. Arguments on the stack? I thought we'll deal with them
once we get there (e.g. _really_ need to patch a varargs function or one
with a silly signature).

Well, the problem is, once such need arises, it's too late already.

You need to be able to patch the kernels which are already out there, 
running on machines potentially for ages once all of a sudden there is a 
CVE for >8args / varargs function.
At that time, only starting to put support in the kernel for that is waaay 
to late :)

Thanks,

-- 
Jiri Kosina
SUSE Labs