[uml-devel] problems compiling 2.6.17 against glibc 2.4

[uml-devel] problems compiling 2.6.17 against glibc 2.4

[Nix]

The problem is that arch/um/os-Linux/sys-i386/registers.c
messes around inside a jmp_buf, and in glibc 2.4 the glibc
maintainers have helpfully removed the definitions that
let you poke around in there (they were only there for the
sake of one macro, _JMPBUF_UNWINDS, which is no longer
user-visible.)

This vile patch lets me compile but is almost certainly not good enough:
however, I don't know what *is* good enough: now that glibc is blocking
us from the layout of the jmp_buf, what's to stop them from changing it?
(Well, other than that it would break the ABI ;) )

A temporary hack to make it compile is

--- linux-orig/arch/um/os-Linux/sys-i386/registers.c	2006-06-20 08:17:47.000000000 +0100
+++ linux/arch/um/os-Linux/sys-i386/registers.c	2006-06-21 07:54:52.000000000 +0100
@@ -130,6 +130,14 @@
 		       HOST_FP_SIZE * sizeof(unsigned long));
 }
 
+# define JB_BX  0
+# define JB_SI  1
+# define JB_DI  2
+# define JB_BP  3
+# define JB_SP  4
+# define JB_PC  5
+# define JB_SIZE 24
+
 void get_thread_regs(union uml_pt_regs *uml_regs, void *buffer)
 {
 	struct __jmp_buf_tag *jmpbuf = buffer;

but that's hardly acceptable in the long run.

-- 
`NB: Anyone suggesting that we should say "Tibibytes" instead of
 Terabytes there will be hunted down and brutally slain.
 That is all.' --- Matthew Wilcox

All the advantages of Linux Managed Hosting--Without the Cost and Risk!
Fully trained technicians. The highest number of Red Hat certifications in
the hosting industry. Fanatical Support. Click to learn more
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=107521&bid=248729&dat=121642
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

Re: [uml-devel] problems compiling 2.6.17 against glibc 2.4

[Blaisorblade]

On Wednesday 21 June 2006 21:38, Nix wrote:
> The problem is that arch/um/os-Linux/sys-i386/registers.c
> messes around inside a jmp_buf, and in glibc 2.4 the glibc
> maintainers have helpfully removed the definitions that
> let you poke around in there (they were only there for the
> sake of one macro, _JMPBUF_UNWINDS, which is no longer
> user-visible.)
>
> This vile patch lets me compile but is almost certainly not good enough:
> however, I don't know what *is* good enough: now that glibc is blocking
> us from the layout of the jmp_buf, what's to stop them from changing it?
> (Well, other than that it would break the ABI ;) )
I made the same thought, but no, they have *already* changed it.
Search for the message from Ulrich Drepper (and if you understand 
the "security reasons" I'd be curious to hear them); also the below patch is 
available in Jeff's tree from some time.

I asked Jeff to #ifdef that code out for 2.6.17 release (since the below patch 
was refused)... anyway Jeff found that we can take setjmp() implementation 
from klibc and include it in UML.

> A temporary hack to make it compile is
>
> --- linux-orig/arch/um/os-Linux/sys-i386/registers.c	2006-06-20
> 08:17:47.000000000 +0100 +++
> linux/arch/um/os-Linux/sys-i386/registers.c	2006-06-21 07:54:52.000000000
> +0100 @@ -130,6 +130,14 @@
>  		       HOST_FP_SIZE * sizeof(unsigned long));
>  }
>
> +# define JB_BX  0
> +# define JB_SI  1
> +# define JB_DI  2
> +# define JB_BP  3
> +# define JB_SP  4
> +# define JB_PC  5
> +# define JB_SIZE 24
> +
>  void get_thread_regs(union uml_pt_regs *uml_regs, void *buffer)
>  {
>  	struct __jmp_buf_tag *jmpbuf = buffer;
>
> but that's hardly acceptable in the long run.

-- 
Inform me of my mistakes, so I can keep imitating Homer Simpson's "Doh!".
Paolo Giarrusso, aka Blaisorblade (Skype ID "PaoloGiarrusso", ICQ 215621894)
http://www.user-mode-linux.org/~blaisorblade
Chiacchiera con i tuoi amici in tempo reale! 
 http://it.yahoo.com/mail_it/foot/*http://it.messenger.yahoo.com 


Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

Re: [uml-devel] problems compiling 2.6.17 against glibc 2.4

[Nix]

On Sun, 25 Jun 2006, blaisorblade@yahoo.it announced authoritatively:
> On Wednesday 21 June 2006 21:38, Nix wrote:
[jmp_buf goes hidden]
>> This vile patch lets me compile but is almost certainly not good enough:
>> however, I don't know what *is* good enough: now that glibc is blocking
>> us from the layout of the jmp_buf, what's to stop them from changing it?
>> (Well, other than that it would break the ABI ;) )
> I made the same thought, but no, they have *already* changed it.
> Search for the message from Ulrich Drepper

It's not easy to find it given that little info :(

>                                            (and if you understand 
> the "security reasons" I'd be curious to hear them);

Well, there are obvious security problems with having pointers in
jmp_buf exposed: attackers who can exploit a buffer overflow and know
the location of a jmp_buf and its layout can force someone to longjmp()
to any location they like, regardless of -fstack-protector tricks. Even
FORTIFY_SOURCE won't protect against it if the buffer overrun didn't use
strcpy() or a similarly fortified call.

>                                                      also the below patch is 
> available in Jeff's tree from some time.

Aha, great minds kludge alike ;)

> I asked Jeff to #ifdef that code out for 2.6.17 release (since the below patch 
> was refused)... anyway Jeff found that we can take setjmp() implementation 
> from klibc and include it in UML.

Well, it wasn't ifdeffed out ;)

Using the uml setjmp() implementation seems like a good idea (or the uClibc one).

-- 
`NB: Anyone suggesting that we should say "Tibibytes" instead of
 Terabytes there will be hunted down and brutally slain.
 That is all.' --- Matthew Wilcox

Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

Re: [uml-devel] problems compiling 2.6.17 against glibc 2.4

[Blaisorblade]

On Sunday 25 June 2006 21:19, Nix wrote:
> On Sun, 25 Jun 2006, blaisorblade@yahoo.it announced authoritatively:
> > On Wednesday 21 June 2006 21:38, Nix wrote:
>
> [jmp_buf goes hidden]

> > I made the same thought, but no, they have *already* changed it.
> > Search for the message from Ulrich Drepper
>
> It's not easy to find it given that little info :(
No working author search?
-- 
Inform me of my mistakes, so I can keep imitating Homer Simpson's "Doh!".
Paolo Giarrusso, aka Blaisorblade (Skype ID "PaoloGiarrusso", ICQ 215621894)
http://www.user-mode-linux.org/~blaisorblade
Chiacchiera con i tuoi amici in tempo reale! 
 http://it.yahoo.com/mail_it/foot/*http://it.messenger.yahoo.com 


Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

Re: [uml-devel] problems compiling 2.6.17 against glibc 2.4

[Nix]

On Sun, 25 Jun 2006, blaisorblade@yahoo.it spake:
> On Sunday 25 June 2006 21:19, Nix wrote:
>> On Sun, 25 Jun 2006, blaisorblade@yahoo.it announced authoritatively:
>> > On Wednesday 21 June 2006 21:38, Nix wrote:
>>
>> [jmp_buf goes hidden]
> 
>> > I made the same thought, but no, they have *already* changed it.
>> > Search for the message from Ulrich Drepper
>>
>> It's not easy to find it given that little info :(
> No working author search?

sourceware.org/gcc.gnu.org ran out of space to support its mailing list
archive search in mid-2005. I don't think this was ever fixed. AIUI you
can only get search results from after that by using Google.

(And it never supported author search anyway.)

-- 
`NB: Anyone suggesting that we should say "Tibibytes" instead of
 Terabytes there will be hunted down and brutally slain.
 That is all.' --- Matthew Wilcox

Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

Re: [uml-devel] problems compiling 2.6.17 against glibc 2.4

[Blaisorblade]

On Monday 26 June 2006 18:26, Nix wrote:
> On Sun, 25 Jun 2006, blaisorblade@yahoo.it spake:
> > On Sunday 25 June 2006 21:19, Nix wrote:
> >> On Sun, 25 Jun 2006, blaisorblade@yahoo.it announced authoritatively:
> >> > On Wednesday 21 June 2006 21:38, Nix wrote:
> >>
> >> [jmp_buf goes hidden]
> >>
> >> > I made the same thought, but no, they have *already* changed it.
> >> > Search for the message from Ulrich Drepper
> >>
> >> It's not easy to find it given that little info :(
> >
> > No working author search?
>
> sourceware.org/gcc.gnu.org ran out of space to support its mailing list
> archive search in mid-2005. I don't think this was ever fixed. AIUI you
> can only get search results from after that by using Google.
>
> (And it never supported author search anyway.)
Ok, I missed one important bit of info. Plus, MARC archives when searching for 
author don't support restricting to one ML. So, here's the link to the 
discussion within UML-devel. Which is just a pointer to the issue (he surely 
doesn't explain here the security issues).

http://marc.theaimsgroup.com/?t=113927900500002&r=1&w=2
-- 
Inform me of my mistakes, so I can keep imitating Homer Simpson's "Doh!".
Paolo Giarrusso, aka Blaisorblade (Skype ID "PaoloGiarrusso", ICQ 215621894)
http://www.user-mode-linux.org/~blaisorblade
Chiacchiera con i tuoi amici in tempo reale! 
 http://it.yahoo.com/mail_it/foot/*http://it.messenger.yahoo.com 


Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

Re: [uml-devel] problems compiling 2.6.17 against glibc 2.4

[Nix]

On Mon, 26 Jun 2006, blaisorblade@yahoo.it wrote:
> Ok, I missed one important bit of info. Plus, MARC archives when searching for 
> author don't support restricting to one ML. So, here's the link to the 
> discussion within UML-devel. Which is just a pointer to the issue (he surely 
> doesn't explain here the security issues).

Oh, it was on *l-k*. Right.

The security issue is (probably) that attackers can stick stuff into a
jmp_buf if they can successfully execute arbitrary code in some (buggy)
function, and thus can trigger a later longjmp() by the application
which would go somewhere unexpected. glibc fixes this by xoring the
pointers in the jmp_buf with (IIRC) a TLS-stored random cookie (much as
-fstack-protector sticks a TLS-stored random cookie on the stack;
obviously it can't actually modify the on-stack return address, so that
is the next best thing).

A shame Roland wasn't listening in: he made the original changes and
he's a lot more, well, *helpful* than Ulrich... he'll say what
the problem is where Ulrich will just growl at you.

-- 
`NB: Anyone suggesting that we should say "Tibibytes" instead of
 Terabytes there will be hunted down and brutally slain.
 That is all.' --- Matthew Wilcox

Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel