This is the mail archive of the
gcc-patches@gcc.gnu.org
mailing list for the GCC project.
Re: i386/prologues: ROP mitigation for normal function epilogues
- From: Bernd Schmidt <bschmidt at redhat dot com>
- To: Jakub Jelinek <jakub at redhat dot com>
- Cc: GCC Patches <gcc-patches at gcc dot gnu dot org>, Uros Bizjak <ubizjak at gmail dot com>
- Date: Fri, 17 Jun 2016 13:22:02 +0200
- Subject: Re: i386/prologues: ROP mitigation for normal function epilogues
- Authentication-results: sourceware.org; auth=none
- References: <5ff22dae-cdfe-6c94-2428-7c8726b7d294 at redhat dot com> <20160617103737 dot GY7387 at tucnak dot redhat dot com>
On 06/17/2016 12:37 PM, Jakub Jelinek wrote:
Do you really need to require frame pointer for this?
I mean, couldn't you instead use what you do if a function needs frame
pointer and otherwise just replace the original ret with
pushq %rbp
movq %rsp, %rbp
jmp __rop_ret
? Or would that defeat the purpose of the mitigation?
Yes, kind of, because then you can jump into code before this little
sequence and the whole pushq/movq/jmp/leave/ret would just behave like a
normal ret. This is admittedly a concern for smaller functions that look
a lot like this; maybe we need to pad function entry points as well.
As for __rop_ret, if you are non-PLT jmp to it, I bet it must be in the same
executable or shared library as the code branching to it, so should be
.hidden. Is libgcc.a really the best place for it though?
I declare myself agnostic.
Looking at nop; nop; 1: jmp 1b; leave; ret
if you branch into the middle of the jmp insn (0x3 below), there is:
0: 90 nop
1: 90 nop
2: eb fe jmp 0x2
4: c9 leaveq
5: c3 retq
and thus:
3: fe c9 dec %cl
5: c3 retq
and thus if you don't mind decreasing %cl, you still have retq without leave
before it. But I very likely just don't understand the ROP threat stuff
enough.
You'd also have to find useful code before this sequence, and in any
case it's just a single ret where we used to have many. But maybe
there's a one-byte trap that could be used instead.
Bernd