From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 1039) id 1CE523858432; Sat, 23 Dec 2023 17:00:45 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 1CE523858432 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1703350845; bh=Fa1/7a8/4C/Im8cDf+UV48Hyxq7ykZ3+0papifyjK/o=; h=From:To:Subject:Date:From; b=myM8VT+xYkf+EoApixGJ6ElzRXpj3yWjOLmghasmw82jqtUg0Er7xUlwjIfdynbXH LsPdvbUjtWRRJpFHCEgc7eGnFHxzgrsgxUmfw2UJ9X0NvYhUgyP8HHbVBypNn8W8OY DqPBKN/wIfi0NBuCxQSh9aSRUISf8r7FVrjZxB34= Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: H.J. Lu To: glibc-cvs@sourceware.org Subject: [glibc/release/2.37/master] x86-64: Fix the tcb field load for x32 [BZ #31185] X-Act-Checkin: glibc X-Git-Author: H.J. Lu X-Git-Refname: refs/heads/release/2.37/master X-Git-Oldrev: 8bd00f5b6d42ee89f61b5f15624788ad1aed917e X-Git-Newrev: d052665f359be24623c0ca0aea8abd372cbefe90 Message-Id: <20231223170045.1CE523858432@sourceware.org> Date: Sat, 23 Dec 2023 17:00:45 +0000 (GMT) List-Id: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d052665f359be24623c0ca0aea8abd372cbefe90 commit d052665f359be24623c0ca0aea8abd372cbefe90 Author: H.J. Lu Date: Wed Dec 20 19:42:12 2023 -0800 x86-64: Fix the tcb field load for x32 [BZ #31185] _dl_tlsdesc_undefweak and _dl_tlsdesc_dynamic access the thread pointer via the tcb field in TCB: _dl_tlsdesc_undefweak: _CET_ENDBR movq 8(%rax), %rax subq %fs:0, %rax ret _dl_tlsdesc_dynamic: ... subq %fs:0, %rax movq -8(%rsp), %rdi ret Since the tcb field in TCB is a pointer, %fs:0 is a 32-bit location, not 64-bit. It should use "sub %fs:0, %RAX_LP" instead. Since _dl_tlsdesc_undefweak returns ptrdiff_t and _dl_make_tlsdesc_dynamic returns void *, RAX_LP is appropriate here for x32 and x86-64. This fixes BZ #31185. (cherry picked from commit 81be2a61dafc168327c1639e97b6dae128c7ccf3) Diff: --- NEWS | 1 + sysdeps/x86_64/dl-tlsdesc.S | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/NEWS b/NEWS index 3634e0c8b5..81d986567e 100644 --- a/NEWS +++ b/NEWS @@ -53,6 +53,7 @@ The following bugs are resolved with this release: [30515] _dl_find_object incorrectly returns 1 during early startup [30842] Stack read overflow in getaddrinfo in no-aaaa mode (CVE-2023-4527) [31184] FAIL: elf/tst-tlsgap + [31185] Incorrect thread point access in _dl_tlsdesc_undefweak and _dl_tlsdesc_dynamic Version 2.37 diff --git a/sysdeps/x86_64/dl-tlsdesc.S b/sysdeps/x86_64/dl-tlsdesc.S index c4823547d7..4579424bf7 100644 --- a/sysdeps/x86_64/dl-tlsdesc.S +++ b/sysdeps/x86_64/dl-tlsdesc.S @@ -61,7 +61,7 @@ _dl_tlsdesc_return: _dl_tlsdesc_undefweak: _CET_ENDBR movq 8(%rax), %rax - subq %fs:0, %rax + sub %fs:0, %RAX_LP ret cfi_endproc .size _dl_tlsdesc_undefweak, .-_dl_tlsdesc_undefweak @@ -116,7 +116,7 @@ _dl_tlsdesc_dynamic: addq TLSDESC_MODOFF(%rdi), %rax .Lret: movq -16(%rsp), %rsi - subq %fs:0, %rax + sub %fs:0, %RAX_LP movq -8(%rsp), %rdi ret .Lslow: