This is the mail archive of the
mailing list for the GCC project.
Re: RELEASE BLOCKER: Linux doesn't follow x86/x86-64 ABI wrt direction flag
- From: Paolo Bonzini <bonzini at gnu dot org>
- To: Olivier Galibert <galibert at pobox dot com>, Joe Buck <Joe dot Buck at synopsys dot COM>, Paolo Bonzini <bonzini at gnu dot org>, "H. Peter Anvin" <hpa at zytor dot com>, Chris Lattner <clattner at apple dot com>, Michael Matz <matz at suse dot de>, Richard Guenther <richard dot guenther at gmail dot com>, Jan Hubicka <hubicka at ucw dot cz>, Aurelien Jarno <aurelien at aurel32 dot net>, linux-kernel at vger dot kernel dot org, gcc at gcc dot gnu dot org
- Date: Thu, 06 Mar 2008 19:13:20 +0100
- Subject: Re: RELEASE BLOCKER: Linux doesn't follow x86/x86-64 ABI wrt direction flag
- References: <738B72DB-A1D6-43F8-813A-E49688D05771@apple.com> <Pine.LNX.firstname.lastname@example.org> <2F47E21A-9055-4EC3-99CF-B666BBC045C3@apple.com> <47CF3F09.email@example.com> <578FCA7D-D7A6-44F6-9310-4A97C13CDCBE@apple.com> <47CF44E7.firstname.lastname@example.org> <20080306135139.GA5236@dspnet.fr.eu.org> <47CFF9A3.email@example.com> <20080306141221.GC5236@dspnet.fr.eu.org> <20080306175841.GI17267@synopsys.com> <20080306181029.GA42904@dspnet.fr.eu.org>
Olivier Galibert wrote:
On Thu, Mar 06, 2008 at 09:58:41AM -0800, Joe Buck wrote:
If the kernel allows state to leak from one process to another,
for example from a process running as root to a process running as an
ordinary user, it's a bug, with possible security implications.
I don't think that it is relevant in your case. If you have the
signal handler in something that does not share the VM with the
interrupted thread, you will have a context switch which is supposed
to store the direction flag and restore the one from the handling
thread. If you share the VM there is no context switch but you have
access to the exact same memory with the exact same rights, making the
A process can send a signal via kill. IOW, a malicious process can
*control when the process would be interrupted* in order to get it into
the signal handler with DF=1.