[RFC PATCH 2/7] avoid invoking the vDSO when SafeStack is enabled

[RFC PATCH 2/7] avoid invoking the vDSO when SafeStack is enabled

[LeMay, Michael]

The Linux vDSO code may be incompatible with programs that enable
segmentation-hardened SafeStack.  This patch prevents the vDSO from
being invoked when segmentation-hardened SafeStack is enabled.

Signed-off-by: Michael LeMay <michael.lemay@intel.com>
---
  arch/i386/syscall_arch.h | 13 +++++++++++++
  1 file changed, 13 insertions(+)

diff --git a/arch/i386/syscall_arch.h b/arch/i386/syscall_arch.h
index 4c9d874..08e0910 100644
--- a/arch/i386/syscall_arch.h
+++ b/arch/i386/syscall_arch.h
@@ -52,8 +52,21 @@ static inline long __syscall6(long n, long a1, long 
a2, long a3, long a4, long a
      return __ret;
  }

+#if !SAFE_STACK
+/* The vDSO is not compiled with segmentation-hardened SafeStack.  Avoid
+ * invoking the vDSO when hardened SafeStack is enabled, since it may 
try to
+ * access the stack using memory operands with base registers other 
than EBP or
+ * ESP without also using a stack segment override prefix.  A special 
compiler
+ * pass needs to be used to add such prefixes, and it is unlikely that 
a pass
+ * of that sort was applied when the vDSO was compiled.
+ *
+ * A possible alternative to disabling the use of the vDSO may be to 
load the
+ * default flat data segment into DS prior to invoking the vDSO and 
reloading
+ * the restricted data segment into DS after the vDSO routine returns.
+ */
  #define VDSO_USEFUL
  #define VDSO_CGT_SYM "__vdso_clock_gettime"
  #define VDSO_CGT_VER "LINUX_2.6"
+#endif

  #define SYSCALL_USE_SOCKETCALL
-- 
2.7.4

[RFC PATCH 2/7] avoid invoking the vDSO when SafeStack is enabled

[LeMay, Michael]

The Linux vDSO code may be incompatible with programs that enable
segmentation-hardened SafeStack.  This patch prevents the vDSO from
being invoked when segmentation-hardened SafeStack is enabled.

Signed-off-by: Michael LeMay <michael.lemay@intel.com>
---
  arch/i386/syscall_arch.h | 13 +++++++++++++
  1 file changed, 13 insertions(+)

diff --git a/arch/i386/syscall_arch.h b/arch/i386/syscall_arch.h
index 4c9d874..08e0910 100644
--- a/arch/i386/syscall_arch.h
+++ b/arch/i386/syscall_arch.h
@@ -52,8 +52,21 @@ static inline long __syscall6(long n, long a1, long 
a2, long a3, long a4, long a
      return __ret;
  }

+#if !SAFE_STACK
+/* The vDSO is not compiled with segmentation-hardened SafeStack.  Avoid
+ * invoking the vDSO when hardened SafeStack is enabled, since it may 
try to
+ * access the stack using memory operands with base registers other 
than EBP or
+ * ESP without also using a stack segment override prefix.  A special 
compiler
+ * pass needs to be used to add such prefixes, and it is unlikely that 
a pass
+ * of that sort was applied when the vDSO was compiled.
+ *
+ * A possible alternative to disabling the use of the vDSO may be to 
load the
+ * default flat data segment into DS prior to invoking the vDSO and 
reloading
+ * the restricted data segment into DS after the vDSO routine returns.
+ */
  #define VDSO_USEFUL
  #define VDSO_CGT_SYM "__vdso_clock_gettime"
  #define VDSO_CGT_VER "LINUX_2.6"
+#endif

  #define SYSCALL_USE_SOCKETCALL
-- 
2.7.4