HP-UX on PA-RISC had an upward-growing stack. In practice, various exploits were developed which adapted to the changed direction of the stack.

One source from a few mins of searching: https://phrack.org/issues/58/11

▲

LukeShu 3 days ago | parent [-]

Linux on PA-RISC also has an upward-growing stack (AFAIK, it's the only architecture Linux has ever had an upward-growing stack on; it's certainly the only currently-supported one).

	▲	musicale 3 days ago \| parent \| next [-]
		Both this and parent comment about PA-RISC are very interesting. As noted, stack growing up doesn't prevent all stack overflows, but it makes it less trivially easy to overwrite a return address. Bounded strings also made it less trivially easy to create string buffer overflows.
	▲	ch_123 3 days ago \| parent \| prev [-]
		Yeah, my assumption is that all the PA-RISC operating systems did, but I only know about HP-UX for certain.