Re: [x86.git#mm] stack protector fixes, vmsplice exploit

[Ingo Molnar <mingo@elte.hu>]

* pageexec@freemail.hu <pageexec@freemail.hu> wrote:

> On 14 Feb 2008 at 17:35, Jakub Jelinek wrote:
> 
> > Where do you see a mispredicted branch?
> 
> try it with -Os (gentoo gcc 4.2.2):
> 
> 0000000000000000 <foo>:
>    0:   48 83 ec 58             sub    $0x58,%rsp
>    4:   65 48 8b 04 25 28 00 00 00      mov    %gs:0x28,%rax
>    d:   48 89 44 24 48          mov    %rax,0x48(%rsp)
>   12:   31 c0                   xor    %eax,%eax
>   14:   48 89 e7                mov    %rsp,%rdi
>   17:   e8 00 00 00 00          callq  1c <foo+0x1c>    18: R_X86_64_PC32       
> bar+0xfffffffffffffffc
>   1c:   48 8b 54 24 48          mov    0x48(%rsp),%rdx
>   21:   65 48 33 14 25 28 00 00 00      xor    %gs:0x28,%rdx
>   2a:   b8 06 00 00 00          mov    $0x6,%eax
>   2f:   74 05                   je     36 <foo+0x36>
>   31:   e8 00 00 00 00          callq  36 <foo+0x36>    32: R_X86_64_PC32       
> __stack_chk_fail+0xfffffffffffffffc
>   36:   48 83 c4 58             add    $0x58,%rsp
>   3a:   c3                      retq

ah, that's what my kernel uses too - and CONFIG_CC_OPTIMIZE_FOR_SIZE=y 
is the default for Fedora too.

hm, especially those big addressing mode mov's and xor's look rather 
nasty.

	Ingo