From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 58296 invoked by alias); 30 Jan 2020 14:56:09 -0000 Mailing-List: contact gcc-help@gcc.gnu.org; run by ezmlm Precedence: bulk List-Id: List-Archive: List-Post: List-Help: Sender: gcc-owner@gcc.gnu.org Received: (qmail 58195 invoked by uid 89); 30 Jan 2020 14:56:08 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-2.3 required=5.0 tests=AWL,BAYES_00,KAM_SHORT,RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 spammy=joke, filed, shortage, SIGILL X-HELO: gate.crashing.org Received: from gate.crashing.org (HELO gate.crashing.org) (63.228.1.57) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Thu, 30 Jan 2020 14:56:07 +0000 Received: from gate.crashing.org (localhost.localdomain [127.0.0.1]) by gate.crashing.org (8.14.1/8.14.1) with ESMTP id 00UEu43f003041; Thu, 30 Jan 2020 08:56:04 -0600 Received: (from segher@localhost) by gate.crashing.org (8.14.1/8.14.1/Submit) id 00UEu3X0003036; Thu, 30 Jan 2020 08:56:03 -0600 Date: Fri, 31 Jan 2020 04:48:00 -0000 From: Segher Boessenkool To: Rich Felker Cc: Sergei Trofimovich , musl@lists.openwall.com, libc-alpha@sourceware.org, gcc@gcc.gnu.org, toolchain@gentoo.org Subject: Re: [musl] musl, glibc and ideal place for __stack_chk_fail_local Message-ID: <20200130145603.GW22482@gate.crashing.org> References: <20200125105331.7c5d284b@sf> <20200125155424.GZ30412@brightrain.aerifal.cx> <20200130123351.GU22482@gate.crashing.org> <20200130133740.GB1775@brightrain.aerifal.cx> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200130133740.GB1775@brightrain.aerifal.cx> User-Agent: Mutt/1.4.2.3i X-IsSubscribed: yes X-SW-Source: 2020-01/txt/msg00489.txt.bz2 On Thu, Jan 30, 2020 at 08:37:40AM -0500, Rich Felker wrote: > On Thu, Jan 30, 2020 at 06:33:51AM -0600, Segher Boessenkool wrote: > > On Sat, Jan 25, 2020 at 10:54:24AM -0500, Rich Felker wrote: > > > > To support smash stack protection gcc emits __stack_chk_fail > > > > calls on all targets. On top of that gcc emits __stack_chk_fail_local > > > > calls at least on i386 and powerpc: > > > > (Only on 32-bit -fPIC -msecure-plt, for Power). > > Right, but musl only supports the secure-plt ABI. Sure, it is the modern one. Still only for 32-bit -fPIC for musl, too. > > > There is a half-serious proposal to put it in crti.o which is always > > > linked too, but that seems like an ugly hack to me... > > > > Not *very* ugly, but it would be very effective, and no real downsides > > to it (or do you see something?) > > Well either the thunk has to be written in asm per-arch, or some ld -r > magic (which is fragile and something I don't want musl to depend on > since I know users will someday hit breakage and rightfully blame us > for using ld -r) to merge an asm source and C source. Or perhaps the > existing crti.s content could be moved to file-scope __asm__ included > in the C source file...that might be ok? At least for powerpc, the existing crti.s gets stuff inserted after (in both functions), and then closed off by crtn.s -- not something you want to do in C :-) GCC can just say to also use extra crti files -- see STARTFILE_SPEC. Many platforms do that already. > > On Power it is just the setting up itself that is costly (in the config > > where we have this _local thing). > > I think it'd be the same. We don't have a shortage of usable registers, that's what I was getting at. All the other arguments are similar, sure. > > > Absolutely not. libssp is unsafe and creates new vulns/attack surface > > > by doing introspective stuff after the process is already *known to > > > be* in a compromised state. It should never be used. musl's > > > __stack_chk_fail is safe and terminates immediately. > > > > Some implementations even print strings from the stack, it can be worse ;-) > > :-) It wasn't a joke, unfortunately. > > > Ideally, though, GCC would just emit the termination inline (or at > > > least have an option to do so) rather than calling __stack_chk_fail or > > > the local version. This would additionally harden against the case > > > where the GOT is compromised. > > > > Yeah, but how to terminate is system-specific, it's much easier to punt > > this job to the libc to do ;-) > > My ideas was __builtin_trap, although a slightly more hardened version > (that might make users unhappy? :) is inlining a syscall to > sigprocmask to mask SIGILL/SIGSEGV before the trapping instruction so > that termination occurs regardless of whether there's a signal handler > installed. I think we should make this a separate RTL pattern? Or a (noreturn) libgcc function? Anyway, let's talk in the PR :-) > > Open a GCC PR for this please? > > Filed as https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93509 Thanks! Segher