lkml.org 
[lkml]   [2020]   [Sep]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH v12 8/8] x86: Disallow vsyscall emulation when CET is enabled
Date
Emulation of the legacy vsyscall page is required by some programs
built before 2013. Newer programs after 2013 don't use it.
Disable vsyscall emulation when Control-flow Enforcement (CET) is
enabled to enhance security.

Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
---
v12:
- Disable vsyscall emulation only when it is attempted (vs. at compile time).

arch/x86/entry/vsyscall/vsyscall_64.c | 9 +++++++++
1 file changed, 9 insertions(+)

diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
index 44c33103a955..3196e963e365 100644
--- a/arch/x86/entry/vsyscall/vsyscall_64.c
+++ b/arch/x86/entry/vsyscall/vsyscall_64.c
@@ -150,6 +150,15 @@ bool emulate_vsyscall(unsigned long error_code,

WARN_ON_ONCE(address != regs->ip);

+#ifdef CONFIG_X86_INTEL_CET
+ if (current->thread.cet.shstk_size ||
+ current->thread.cet.ibt_enabled) {
+ warn_bad_vsyscall(KERN_INFO, regs,
+ "vsyscall attempted with cet enabled");
+ return false;
+ }
+#endif
+
if (vsyscall_mode == NONE) {
warn_bad_vsyscall(KERN_INFO, regs,
"vsyscall attempted with vsyscall=none");
--
2.21.0
\
 
 \ /
  Last update: 2020-09-18 21:25    [W:0.195 / U:1.396 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site