grsecurity forums

I was recently going through the Kconfig with pax and grsecurity. One question I have is this: Whis is CC_STACKPROTECTOR disabled if UDEREF is enabled? This may be silly, but would be good to know.

ncuk wrote:Whis is CC_STACKPROTECTOR disabled if UDEREF is enabled?

due to a change in UDEREF/i386 the gs register is permanently needed in the kernel (to properly track/enforce the task address limit even across kernel re-entries and to prevent exploitation of bugs like CVE-2010-4258) and that excludes its use for SSP.