Re: [PATCH] arm: Fix an incorrect check in ____longjmp_chk [BZ #27709]

[Andreas Schwab <schwab@linux-m68k.org>]

On Apr 08 2021, Szabolcs Nagy via Libc-alpha wrote:

> An incorrect check in __longjmp_chk could fail on valid code causing
>
> FAIL: debug/tst-longjmp_chk2
>
> The original check was
>
>   altstack_sp + altstack_size - setjmp_sp > altstack_size
>
> i.e. sp at setjmp was outside of the altstack range. Here we know that
> longjmp is called from a signal handler on the altstack (SS_ONSTACK),
> and that it jumps in the wrong direction (sp decreases), so the check
> wants to ensure the jump goes to another stack.
>
> The check is wrong when altstack_sp == setjmp_sp which can happen
> when the altstack is a local buffer in the function that calls setjmp,
> so the patch allows == too. This fixes bug 27709.
>
> Note that the generic __longjmp_chk check seems to be different.
> (it checks if longjmp was on the altstack but does not check setjmp,
> so it would not catch incorrect longjmp use within the signal handler).

Ok.

Andreas.

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510  2552 DF73 E780 A9DA AEC1
"And now for something completely different."