Emulation of the legacy vsyscall page is required by some programs
built before 2013. Newer programs after 2013 don't use it.
Disable vsyscall emulation when Control-flow Enforcement (CET) is
enabled to enhance security.
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@xxxxxxxxx>
---
v12:
- Disable vsyscall emulation only when it is attempted (vs. at compile time).
arch/x86/entry/vsyscall/vsyscall_64.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
index 44c33103a955..3196e963e365 100644
--- a/arch/x86/entry/vsyscall/vsyscall_64.c
+++ b/arch/x86/entry/vsyscall/vsyscall_64.c
@@ -150,6 +150,15 @@ bool emulate_vsyscall(unsigned long error_code,
WARN_ON_ONCE(address != regs->ip);
+#ifdef CONFIG_X86_INTEL_CET
+ if (current->thread.cet.shstk_size ||
+ current->thread.cet.ibt_enabled) {
+ warn_bad_vsyscall(KERN_INFO, regs,
+ "vsyscall attempted with cet enabled");
+ return false;
+ }
+#endif
+
if (vsyscall_mode == NONE) {
warn_bad_vsyscall(KERN_INFO, regs,
"vsyscall attempted with vsyscall=none");
--
2.21.0
