Re: GCC 8.1 Release Candidate available from gcc.gnu.org

2018-04-27 Thread Chung-Ju Wu
Jakub Jelinek on 2018/4/25 18:04 wrote: https://gcc.gnu.org/pub/gcc/snapshots/8.0.1-RC-20180425/ The first release candidate for GCC 8.1 is available from ftp://gcc.gnu.org/pub/gcc/snapshots/8.0.1-RC-20180425 and shortly its mirrors. It has been generated from SVN revision 259636. I have so

Re: Stack protector: leak of guard's address on stack

2018-04-27 Thread Thomas Preudhomme
Hi there, Any objection to filing a CVE for that? Best regards, Thomas On 19 April 2018 at 18:17, Thomas Preudhomme wrote: > Hi, > > For stack protector to be robust, at no point in time the guard against > which the canari is compared must be spilled to the stack. This is achieved > by havin

Re: Stack protector: leak of guard's address on stack

2018-04-27 Thread Jakub Jelinek
On Thu, Apr 19, 2018 at 06:17:26PM +0100, Thomas Preudhomme wrote: > For stack protector to be robust, at no point in time the guard against > which the canari is compared must be spilled to the stack. This is achieved > by having dedicated insn pattern for setting the canari and comparing it > aga

RE: MIPS maintainership

2018-04-27 Thread Matthew Fortune
Hi Catherine, Thank-you for all the advice and guidance while we have been co-maintaining the MIPS backend; it's been a pleasure. Thanks, Matthew From: Moore, Catherine [mailto:catherine_mo...@mentor.com] Sent: 25 April 2018 22:52 To: gcc@gcc.gnu.org Cc: Matthew Fortune Subject: MIPS maintaine

Re: Stack protector: leak of guard's address on stack

2018-04-27 Thread Thomas Preudhomme
It's not the canari which is spilled in this case, but the address to the canari. Which means an attacker could make it point to something else than the real canari. On 27 April 2018 at 13:16, Jakub Jelinek wrote: > On Thu, Apr 19, 2018 at 06:17:26PM +0100, Thomas Preudhomme wrote: > > For stack

Re: Stack protector: leak of guard's address on stack

2018-04-27 Thread Jakub Jelinek
On Fri, Apr 27, 2018 at 01:17:50PM +0100, Thomas Preudhomme wrote: > It's not the canari which is spilled in this case, but the address to the > canari. Which means an attacker could make it point to something else than > the real canari. When the canary is in TLS area, it is usually small constan

Re: Stack protector: leak of guard's address on stack

2018-04-27 Thread Thomas Preudhomme
On x86 yes, it's actually done in the same instruction that's doing the comparison if I'm not mistaken. That is not the case for arm and aarch64 though where loading the canari is done separately from the comparison and does not involve an offset. Computing the address from which to do the load is

Re: Stack protector: leak of guard's address on stack

2018-04-27 Thread Jakub Jelinek
On Fri, Apr 27, 2018 at 02:31:25PM +0100, Thomas Preudhomme wrote: > On x86 yes, it's actually done in the same instruction that's doing the > comparison if I'm not mistaken. That is not the case for arm and aarch64 > though where loading the canari is done separately from the comparison and > does

Re: Stack protector: leak of guard's address on stack

2018-04-27 Thread Thomas Preudhomme
Yes absolutely, CSE needs to be avoided. I made memory access volatile because the change was easier to do. Also on Arm Thumb-1 computing the guard's address itself takes several loads so had to modify some more patterns. Anyway, regardless of the proper fix, do you have any objection to raising a

Second GCC 8.1 Release Candidate available from gcc.gnu.org

2018-04-27 Thread Jakub Jelinek
The second release candidate for GCC 8.1 is available from ftp://gcc.gnu.org/pub/gcc/snapshots/8.0.1-RC-20180427 and shortly its mirrors. It has been generated from SVN revision 259731. I have so far bootstrapped and tested the release candidate on x86_64-linux and i686-linux. Please test it

gcc-8-20180427 is now available

2018-04-27 Thread gccadmin
Snapshot gcc-8-20180427 is now available on ftp://gcc.gnu.org/pub/gcc/snapshots/8-20180427/ and on various mirrors, see http://gcc.gnu.org/mirrors.html for details. This snapshot has been generated from the GCC 8 SVN branch with the following options: svn://gcc.gnu.org/svn/gcc/branches/gcc-8