• Ingo Molnar's avatar
    x86: fix stackprotector canary updates during context switches · e0032087
    Ingo Molnar authored
    fix a bug noticed and fixed by pageexec@freemail.hu.
    
    if built with -fstack-protector-all then we'll have canary checks built
    into the __switch_to() function. That does not work well with the
    canary-switching code there: while we already use the %rsp of the
    new task, we still call __switch_to() whith the previous task's canary
    value in the PDA, hence the __switch_to() ssp prologue instructions
    will store the previous canary. Then we update the PDA and upon return
    from __switch_to() the canary check triggers and we panic.
    
    so update the canary after we have called __switch_to(), where we are
    at the same stackframe level as the last stackframe of the next
    (and now freshly current) task.
    
    Note: this means that we call __switch_to() [and its sub-functions]
    still with the old canary, but that is not a problem, both the previous
    and the next task has a high-quality canary. The only (mostly academic)
    disadvantage is that the canary of one task may leak onto the stack of
    another task, increasing the risk of information leaks, were an attacker
    able to read the stack of specific tasks (but not that of others).
    
    To solve this we'll have to reorganize the way we switch tasks, and move
    the PDA setting into the switch_to() assembly code. That will happen in
    another patch.
    Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
    Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
    e0032087
system.h 12.2 KB