diff options
| author |   Sergei Trofimovich <slyfox@gentoo.org> | 2017-12-18 17:23:02 +0000 |
|---|---|---|
| committer | Sergei Trofimovich <slyfox@gentoo.org> | 2017-12-18 19:31:34 +0000 |
| commit | 976565c6698a62b7275a21792c2500bb360c23bf (patch) | |
| tree | 71ade21692794081f7099bcdc994034a6a920f0f | |
| parent | ia64: Add ipc_priv.h header to set __IPC_64 to zero (diff) | |
| download | glibc-976565c6698a62b7275a21792c2500bb360c23bf.tar.gz glibc-976565c6698a62b7275a21792c2500bb360c23bf.tar.bz2 glibc-976565c6698a62b7275a21792c2500bb360c23bf.zip | |
mips64: fix clobbering s0 in setjmp() [BZ #22624]
When configured as --enable-stack-protector=all glibc
inserts stack checking canary into every function
including __sigsetjmp_aux(). Stack checking code
ends up using s0 register to temporary hold address
of global canary value.
Unfortunately __sigsetjmp_aux assumes no caller' caller-save
registers should be clobbered as it stores them as-is.
The fix is to disable stack protection of __sigsetjmp_aux.
Tested on the following test:
#include <setjmp.h>
#include <stdio.h>
int main() {
jmp_buf jb;
volatile register long s0 asm ("$s0");
s0 = 1234;
if (setjmp(jb) == 0)
longjmp(jb, 1);
printf ("$s0 = %lu\n", s0);
}
Without the fix:
$ qemu-mipsn32 -L . ./mips-longjmp-bug
$s0 = 1082346228
With the fix:
$ qemu-mipsn32 -L . ./mips-longjmp-bug
$s0 = 1234
[BZ #22624]
* sysdeps/mips/mips64/setjmp_aux.c (__sigsetjmp_aux): Use
inhibit_stack_protector.
| -rw-r--r-- | sysdeps/mips/mips64/setjmp_aux.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/sysdeps/mips/mips64/setjmp_aux.c b/sysdeps/mips/mips64/setjmp_aux.c index b43c36a7d5..43fffc74bf 100644 --- a/sysdeps/mips/mips64/setjmp_aux.c +++ b/sysdeps/mips/mips64/setjmp_aux.c @@ -24,7 +24,12 @@ pointer. We do things this way because it's difficult to reliably access them in C. */ +/* Stack protection is disabled to avoid changing s0 (or any other + caller-save register) before storing it to environment. + See BZ #22624. */ + int +inhibit_stack_protector __sigsetjmp_aux (jmp_buf env, int savemask, long long sp, long long fp, long long gp) { |