Jann Horn

I find stack overflow security bugs fascinating; and on Linux, compilers still don't protect against stack overflows by default when stack frames are bigger than stack guard pages.

So I went looking around in Android, and thanks to how Android's RPC mechanism allows recursive synchronous callbacks in some cases, I managed to find a way to jump a thread guard page in system_server from shell context and (with very low success rate) get instruction pointer control:
https://project-zero.issues.chromium.org/issues/465827985

The Linux kernel "every subsystem has its own git tree" thing is so annoying.
Especially when one file is plausibly associated with multiple subsystems and patches get routed through more than one.

I guess it probably works reasonably well for people who only ever touch stuff in the one subsystem they specialize in, but for anything else...