Re: [x86.git#mm] stack protector fixes, vmsplice exploit

[Ingo Molnar]

* pageexec@xxxxxxxxxxx <pageexec@xxxxxxxxxxx> wrote:

> On 14 Feb 2008 at 17:35, Jakub Jelinek wrote:
> 
> > Where do you see a mispredicted branch?
> 
> try it with -Os (gentoo gcc 4.2.2):
> 
> 0000000000000000 <foo>:
>    0:   48 83 ec 58             sub    $0x58,%rsp
>    4:   65 48 8b 04 25 28 00 00 00      mov    %gs:0x28,%rax
>    d:   48 89 44 24 48          mov    %rax,0x48(%rsp)
>   12:   31 c0                   xor    %eax,%eax
>   14:   48 89 e7                mov    %rsp,%rdi
>   17:   e8 00 00 00 00          callq  1c <foo+0x1c>    18: R_X86_64_PC32       
> bar+0xfffffffffffffffc
>   1c:   48 8b 54 24 48          mov    0x48(%rsp),%rdx
>   21:   65 48 33 14 25 28 00 00 00      xor    %gs:0x28,%rdx
>   2a:   b8 06 00 00 00          mov    $0x6,%eax
>   2f:   74 05                   je     36 <foo+0x36>
>   31:   e8 00 00 00 00          callq  36 <foo+0x36>    32: R_X86_64_PC32       
> __stack_chk_fail+0xfffffffffffffffc
>   36:   48 83 c4 58             add    $0x58,%rsp
>   3a:   c3                      retq

ah, that's what my kernel uses too - and CONFIG_CC_OPTIMIZE_FOR_SIZE=y 
is the default for Fedora too.

hm, especially those big addressing mode mov's and xor's look rather 
nasty.

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/