Re: [PATCH v4 0/6] Micro-optimize vclock_gettime

[Ingo Molnar <mingo@elte.hu>]

* Andrew Lutomirski <luto@mit.edu> wrote:

> > Well, how does that differ from having the real syscall instruction there? 
> > How are we going to filter real (old-)glibc calls from exploits?
> 
> Because there are only four vsyscalls: vgettimeofday, vtime, vgetcpu, and 
> venosys.  None of them have side-effects, so they only allow an attacker to 
> write something to user memory somewhere.  The implementation of 
> vgettimeofday needs a syscall instruction internally for its fallback, which 
> means that an attack could jump there instead of to the start of the vsyscall 
> implementation.

So for this to work securely the emulation code would also have to filter the 
syscall numbers, to make sure that only these benign syscalls are used.

It should perhaps also warn if it notices something weird going on.

> > If it can be filtered in a meaningful way then we should just do that and 
> > perhaps offer a (default enabled) .config COMPAT_VDSO_EMU=y switch to turn 
> > the emulation off.
> >
> > That way we keep the ABI and also have a way out for users who *really* 
> > need this to work in a performant way.
> 
> Yeah, that probably makes more sense.  It'll make for an uglier diffstat, 
> though -- there's a lot of ugly duplicate code around to make vgettimeofday 
> and vgetcpu work.

Lets try the pure emulation thing first, ok? Complications is not really what 
we need in this area ...

Thanks,

	Ingo