* [PATCH 01/17 v6] Configury support for --enable-stack-protector.
2016-03-13 15:17 --enable-stack-protector for glibc, v6 Nix
@ 2016-03-13 15:17 ` Nix
2016-04-10 3:58 ` Mike Frysinger
2016-03-13 15:17 ` [PATCH 17/17 v5] Enable -fstack-protector=* when requested by configure Nix
` (16 subsequent siblings)
17 siblings, 1 reply; 46+ messages in thread
From: Nix @ 2016-03-13 15:17 UTC (permalink / raw)
To: libc-alpha
From: Nick Alcock <nick.alcock@oracle.com>
This adds =all and =strong, with obvious semantics, and with a rather
arbitrarily-chosen default off, which we might well want to change to
something stronger once this patch has been tested by people other than
me.
We don't validate the value of the option yet: that's in a later patch.
Nor do we use it for anything at this stage.
We differentiate between 'the compiler understands -fstack-protector'
and 'the user wanted -fstack-protector' so that we can pass
-fno-stack-protector in appropriate places even if the user didn't want
to turn on -fstack-protector for other parts. (This helps us overcome
another existing limitation, that glibc doesn't work with GCCs hacked
to pass in -fstack-protector by default.)
We might want to add another configuration option to turn on
-fstack-protector for nscd and other network-facing operations by
default, but for now I've stuck with one option to control everything.
v2: documentation in install.texi; better description of the option.
INSTALL regenerated.
v3: Substitute in no_stack_protector.
v6: Small quoting/spacing revisions following Mike Frysinger's review.
Add STACK_PROTECTOR_LEVEL.
[BZ #7065]
* configure.ac (libc_cv_ssp): Move up.
(libc_cv_ssp_strong): Likewise.
(libc_cv_ssp_all): New.
(stack_protector): Augment, adding -fstack-protector-all.
(no_stack_protector): New.
(STACK_PROTECTOR_LEVEL): New.
(AC_ARG_ENABLE(stack-protector)): New configure flag.
* manual/install.texi (--enable-stack-protector): Document it.
* config.h.in (STACK_PROTECTOR_LEVEL): New macro.
* INSTALL: Regenerate.
---
INSTALL | 39 ++++++++++++++++++-----------
config.h.in | 3 +++
configure.ac | 70 ++++++++++++++++++++++++++++++++++++++---------------
manual/install.texi | 12 +++++++++
4 files changed, 90 insertions(+), 34 deletions(-)
diff --git a/INSTALL b/INSTALL
index a0d0c05..3d55585 100644
--- a/INSTALL
+++ b/INSTALL
@@ -141,20 +141,31 @@ will be used, and CFLAGS sets optimization options for the compiler.
'--enable-lock-elision=yes'
Enable lock elision for pthread mutexes by default.
-'--enable-pt_chown'
- The file 'pt_chown' is a helper binary for 'grantpt' (*note
- Pseudo-Terminals: Allocation.) that is installed setuid root to fix
- up pseudo-terminal ownership. It is not built by default because
- systems using the Linux kernel are commonly built with the 'devpts'
- filesystem enabled and mounted at '/dev/pts', which manages
- pseudo-terminal ownership automatically. By using
- '--enable-pt_chown', you may build 'pt_chown' and install it setuid
- and owned by 'root'. The use of 'pt_chown' introduces additional
- security risks to the system and you should enable it only if you
- understand and accept those risks.
-
-'--disable-werror'
- By default, the GNU C Library is built with '-Werror'. If you wish
+`--enable-stack-protector'
+`--enable-stack-protector=strong'
+`--enable-stack-protector=all'
+ Compile the C library and all other parts of the glibc package
+ (including the threading and math libraries, NSS modules, and
+ transliteration modules) using the GCC `-fstack-protector',
+ `-fstack-protector-strong' or `-fstack-protector-all' options to
+ detect stack overruns. Only the dynamic linker and a small number
+ of routines called directly from assembler are excluded from this
+ protection.
+
+`--enable-pt_chown'
+ The file `pt_chown' is a helper binary for `grantpt' (*note
+ Pseudo-Terminals: Allocation.) that is installed setuid root to
+ fix up pseudo-terminal ownership. It is not built by default
+ because systems using the Linux kernel are commonly built with the
+ `devpts' filesystem enabled and mounted at `/dev/pts', which
+ manages pseudo-terminal ownership automatically. By using
+ `--enable-pt_chown', you may build `pt_chown' and install it
+ setuid and owned by `root'. The use of `pt_chown' introduces
+ additional security risks to the system and you should enable it
+ only if you understand and accept those risks.
+
+`--disable-werror'
+ By default, the GNU C Library is built with `-Werror'. If you wish
to build without this option (for example, if building with a newer
version of GCC than this version of the GNU C Library was tested
with, so new warnings cause the build with '-Werror' to fail), you
diff --git a/config.h.in b/config.h.in
index ec9c8bc..990d5e1 100644
--- a/config.h.in
+++ b/config.h.in
@@ -43,6 +43,9 @@
/* Define if compiler accepts -ftree-loop-distribute-patterns. */
#undef HAVE_CC_INHIBIT_LOOP_TO_LIBCALL
+/* The level of stack protection in use for glibc as a whole. */
+#undef STACK_PROTECTOR_LEVEL
+
/* Define if the regparm attribute shall be used for local functions
(gcc on ix86 only). */
#undef USE_REGPARMS
diff --git a/configure.ac b/configure.ac
index 3c766b7..f690abf 100644
--- a/configure.ac
+++ b/configure.ac
@@ -232,6 +232,18 @@ AC_ARG_ENABLE([bind-now],
[bindnow=no])
AC_SUBST(bindnow)
+dnl Build glibc with -fstack-protector, -fstack-protector-all, or
+dnl -fstack-protector-strong.
+AC_ARG_ENABLE([stack-protector],
+ AC_HELP_STRING([--enable-stack-protector=@<:@yes|no|all|strong@:>@],
+ [Use -fstack-protector[-all|-strong] to detect glibc buffer overflows]),
+ [enable_stack_protector=$enableval],
+ [enable_stack_protector=no])
+case "$enable_stack_protector" in
+all|yes|no|strong) ;;
+*) AC_MSG_ERROR([Not a valid argument for --enable-stack-protector]);;
+esac
+
dnl On some platforms we cannot use dynamic loading. We must provide
dnl static NSS modules.
AC_ARG_ENABLE([static-nss],
@@ -602,6 +614,44 @@ fi
test -n "$base_machine" || base_machine=$machine
AC_SUBST(base_machine)
+AC_CACHE_CHECK(for -fstack-protector, libc_cv_ssp, [dnl
+LIBC_TRY_CC_OPTION([$CFLAGS $CPPFLAGS -Werror -fstack-protector],
+ [libc_cv_ssp=yes],
+ [libc_cv_ssp=no])
+])
+
+AC_CACHE_CHECK(for -fstack-protector-strong, libc_cv_ssp_strong, [dnl
+LIBC_TRY_CC_OPTION([$CFLAGS $CPPFLAGS -Werror -fstack-protector-strong],
+ [libc_cv_ssp_strong=yes],
+ [libc_cv_ssp_strong=no])
+])
+
+AC_CACHE_CHECK(for -fstack-protector-all, libc_cv_ssp_all, [dnl
+LIBC_TRY_CC_OPTION([$CFLAGS $CPPFLAGS -Werror -fstack-protector-all],
+ [libc_cv_ssp_all=yes],
+ [libc_cv_ssp_all=no])
+])
+
+stack_protector=
+no_stack_protector=
+if test "$libc_cv_ssp" = yes; then
+ no_stack_protector=-fno-stack-protector
+fi
+
+if test "$enable_stack_protector" = yes && test "$libc_cv_ssp" = yes; then
+ stack_protector="-fstack-protector"
+ AC_DEFINE(STACK_PROTECTOR_LEVEL, 1)
+elif test "$enable_stack_protector" = all && test "$libc_cv_ssp_all" = yes; then
+ stack_protector="-fstack-protector-all"
+ AC_DEFINE(STACK_PROTECTOR_LEVEL, 2)
+elif test "$enable_stack_protector" = strong && test "$libc_cv_ssp_strong" = yes; then
+ stack_protector="-fstack-protector-strong"
+ AC_DEFINE(STACK_PROTECTOR_LEVEL, 3)
+fi
+AC_SUBST(libc_cv_ssp)
+AC_SUBST(stack_protector)
+AC_SUBST(no_stack_protector)
+
# For the multi-arch option we need support in the assembler & linker.
AC_CACHE_CHECK([for assembler and linker STT_GNU_IFUNC support],
libc_cv_ld_gnu_indirect_function, [dnl
@@ -1389,26 +1439,6 @@ else
fi
AC_SUBST(fno_unit_at_a_time)
-AC_CACHE_CHECK(for -fstack-protector, libc_cv_ssp, [dnl
-LIBC_TRY_CC_OPTION([$CFLAGS $CPPFLAGS -Werror -fstack-protector],
- [libc_cv_ssp=yes],
- [libc_cv_ssp=no])
-])
-
-AC_CACHE_CHECK(for -fstack-protector-strong, libc_cv_ssp_strong, [dnl
-LIBC_TRY_CC_OPTION([$CFLAGS $CPPFLAGS -Werror -fstack-protector-strong],
- [libc_cv_ssp_strong=yes],
- [libc_cv_ssp_strong=no])
-])
-
-stack_protector=
-if test "$libc_cv_ssp_strong" = "yes"; then
- stack_protector="-fstack-protector-strong"
-elif test "$libc_cv_ssp" = "yes"; then
- stack_protector="-fstack-protector"
-fi
-AC_SUBST(stack_protector)
-
AC_CACHE_CHECK(whether cc puts quotes around section names,
libc_cv_have_section_quotes,
[cat > conftest.c <<EOF
diff --git a/manual/install.texi b/manual/install.texi
index b329950..e05424a 100644
--- a/manual/install.texi
+++ b/manual/install.texi
@@ -170,6 +170,18 @@ time. Consult the @file{timezone} subdirectory for more details.
@item --enable-lock-elision=yes
Enable lock elision for pthread mutexes by default.
+@item --enable-stack-protector
+@itemx --enable-stack-protector=strong
+@itemx --enable-stack-protector=all
+Compile the C library and all other parts of the glibc package
+(including the threading and math libraries, NSS modules, and
+transliteration modules) using the GCC @option{-fstack-protector},
+@option{-fstack-protector-strong} or @option{-fstack-protector-all}
+options to detect stack overruns. Only the dynamic linker and a small
+number of routines called directly from assembler are excluded from this
+protection.
+
+
@pindex pt_chown
@findex grantpt
@item --enable-pt_chown
--
2.7.0.198.g6dd47b6
^ permalink raw reply [flat|nested] 46+ messages in thread* [PATCH 17/17 v5] Enable -fstack-protector=* when requested by configure.
2016-03-13 15:17 --enable-stack-protector for glibc, v6 Nix
2016-03-13 15:17 ` [PATCH 01/17 v6] Configury support for --enable-stack-protector Nix
@ 2016-03-13 15:17 ` Nix
2016-03-13 15:17 ` [PATCH 02/17 v6] Initialize the stack guard earlier when linking statically Nix
` (15 subsequent siblings)
17 siblings, 0 replies; 46+ messages in thread
From: Nix @ 2016-03-13 15:17 UTC (permalink / raw)
To: libc-alpha
From: Nick Alcock <nick.alcock@oracle.com>
This finally turns on all the machinery added in previous commits.
v3: Wrap long lines.
v5: Shuffle to the end.
* Makeconfig (+stack-protector): New variable.
(+cflags): Use it.
---
Makeconfig | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/Makeconfig b/Makeconfig
index 87a22e8..efcfdad 100644
--- a/Makeconfig
+++ b/Makeconfig
@@ -762,6 +762,11 @@ endif
# disable any optimization that assume default rounding mode.
+math-flags = -frounding-math
+# We might want to compile with some stack-protection flag.
+ifneq ($(stack-protector),)
++stack-protector=$(stack-protector)
+endif
+
# This is the program that generates makefile dependencies from C source files.
# The -MP flag tells GCC >= 3.2 (which we now require) to produce dummy
# targets for headers so that removed headers don't break the build.
@@ -821,7 +826,8 @@ ifeq "$(strip $(+cflags))" ""
+cflags := $(default_cflags)
endif # $(+cflags) == ""
-+cflags += $(cflags-cpu) $(+gccwarn) $(+merge-constants) $(+math-flags)
++cflags += $(cflags-cpu) $(+gccwarn) $(+merge-constants) $(+math-flags) \
+ $(+stack-protector)
+gcc-nowarn := -w
# Don't duplicate options if we inherited variables from the parent.
--
2.7.0.198.g6dd47b6
^ permalink raw reply [flat|nested] 46+ messages in thread* [PATCH 02/17 v6] Initialize the stack guard earlier when linking statically.
2016-03-13 15:17 --enable-stack-protector for glibc, v6 Nix
2016-03-13 15:17 ` [PATCH 01/17 v6] Configury support for --enable-stack-protector Nix
2016-03-13 15:17 ` [PATCH 17/17 v5] Enable -fstack-protector=* when requested by configure Nix
@ 2016-03-13 15:17 ` Nix
2016-03-13 15:17 ` [PATCH 11/17 v6] De-PLTize __stack_chk_fail internal calls within libc.so Nix
` (14 subsequent siblings)
17 siblings, 0 replies; 46+ messages in thread
From: Nix @ 2016-03-13 15:17 UTC (permalink / raw)
To: libc-alpha
From: Nick Alcock <nick.alcock@oracle.com>
The address of the stack canary is stored in a per-thread variable,
which means that we must ensure that the TLS area is intialized before
calling any -fstack-protector'ed functions. For dynamically linked
applications, we ensure this (in a later patch) by disabling
-fstack-protector for the whole dynamic linker, but for static
applications the AT_ENTRY address is called directly by the kernel, so
we must deal with the problem differently.
So split out the part of pthread initialization that sets up the TCB
(and, more generally, the TLS area) into a separate function (twice --
there is one implementation in libpthread.a, and another outside it for
programs that do not link with libpthread), then call it at
initialization time. Call that, and move the stack guard initialization
above the DL_SYSDEP_OSCHECK hook, which if set will probably call
functions which are stack-protected (it does on Linux and NaCL too).
We also move apply_irel() up, so that we can still safely call functions
that require ifuncs while in __pthread_initialize_tcb_internal()
(though if stack-protection is enabled we still have to avoid calling
functions that are not stack-protected at this stage).
v2: describe why we don't move apply_irel() up, and the consequences.
v6: We can safely move apply_irel() up now.
* nptl/nptl-init.c (__pthread_initialize_tcb_internal): New
function, split out from...
(__pthread_initialize_minimal_internal): ... here.
* csu/libc-start.c (LIBC_START_MAIN): Call it. Move stack canary
and apply_irel() initialization up.
---
csu/libc-start.c | 26 +++++++++++++++-----------
csu/libc-tls.c | 8 ++++++++
nptl/nptl-init.c | 11 +++++++----
3 files changed, 30 insertions(+), 15 deletions(-)
diff --git a/csu/libc-start.c b/csu/libc-start.c
index f4aa01a..c0a8b7a 100644
--- a/csu/libc-start.c
+++ b/csu/libc-start.c
@@ -33,6 +33,7 @@ extern int __libc_multiple_libcs;
#ifndef SHARED
# include <dl-osinfo.h>
extern void __pthread_initialize_minimal (void);
+extern void __pthread_initialize_tcb_internal (void);
# ifndef THREAD_SET_STACK_GUARD
/* Only exported for architectures that don't store the stack guard canary
in thread local area. */
@@ -178,6 +179,20 @@ LIBC_START_MAIN (int (*main) (int, char **, char ** MAIN_AUXVEC_DECL),
}
}
+ /* Perform IREL{,A} relocations. */
+ apply_irel ();
+
+ /* The stack guard goes into the TCB. */
+ __pthread_initialize_tcb_internal ();
+
+ /* Set up the stack checker's canary. */
+ uintptr_t stack_chk_guard = _dl_setup_stack_chk_guard (_dl_random);
+# ifdef THREAD_SET_STACK_GUARD
+ THREAD_SET_STACK_GUARD (stack_chk_guard);
+# else
+ __stack_chk_guard = stack_chk_guard;
+# endif
+
# ifdef DL_SYSDEP_OSCHECK
if (!__libc_multiple_libcs)
{
@@ -187,22 +202,11 @@ LIBC_START_MAIN (int (*main) (int, char **, char ** MAIN_AUXVEC_DECL),
}
# endif
- /* Perform IREL{,A} relocations. */
- apply_irel ();
-
/* Initialize the thread library at least a bit since the libgcc
functions are using thread functions if these are available and
we need to setup errno. */
__pthread_initialize_minimal ();
- /* Set up the stack checker's canary. */
- uintptr_t stack_chk_guard = _dl_setup_stack_chk_guard (_dl_random);
-# ifdef THREAD_SET_STACK_GUARD
- THREAD_SET_STACK_GUARD (stack_chk_guard);
-# else
- __stack_chk_guard = stack_chk_guard;
-# endif
-
/* Set up the pointer guard value. */
uintptr_t pointer_chk_guard = _dl_setup_pointer_guard (_dl_random,
stack_chk_guard);
diff --git a/csu/libc-tls.c b/csu/libc-tls.c
index d6425e0..3d67a64 100644
--- a/csu/libc-tls.c
+++ b/csu/libc-tls.c
@@ -241,5 +241,13 @@ void
__attribute__ ((weak))
__pthread_initialize_minimal (void)
{
+}
+
+/* This is the minimal initialization function used when libpthread is
+ not used. */
+void
+__attribute__ ((weak))
+__pthread_initialize_tcb_internal (void)
+{
__libc_setup_tls (TLS_INIT_TCB_SIZE, TLS_INIT_TCB_ALIGN);
}
diff --git a/nptl/nptl-init.c b/nptl/nptl-init.c
index bdbdfed..a4626be 100644
--- a/nptl/nptl-init.c
+++ b/nptl/nptl-init.c
@@ -296,21 +296,24 @@ extern void **__libc_dl_error_tsd (void) __attribute__ ((const));
/* This can be set by the debugger before initialization is complete. */
static bool __nptl_initial_report_events __attribute_used__;
+#ifndef SHARED
void
-__pthread_initialize_minimal_internal (void)
+__pthread_initialize_tcb_internal (void)
{
-#ifndef SHARED
/* Unlike in the dynamically linked case the dynamic linker has not
taken care of initializing the TLS data structures. */
__libc_setup_tls (TLS_TCB_SIZE, TLS_TCB_ALIGN);
- /* We must prevent gcc from being clever and move any of the
+ /* We must prevent gcc from being clever after inlining and moving any of the
following code ahead of the __libc_setup_tls call. This function
will initialize the thread register which is subsequently
used. */
__asm __volatile ("");
+}
#endif
-
+void
+__pthread_initialize_minimal_internal (void)
+{
/* Minimal initialization of the thread descriptor. */
struct pthread *pd = THREAD_SELF;
__pthread_initialize_pids (pd);
--
2.7.0.198.g6dd47b6
^ permalink raw reply [flat|nested] 46+ messages in thread* [PATCH 11/17 v6] De-PLTize __stack_chk_fail internal calls within libc.so.
2016-03-13 15:17 --enable-stack-protector for glibc, v6 Nix
` (2 preceding siblings ...)
2016-03-13 15:17 ` [PATCH 02/17 v6] Initialize the stack guard earlier when linking statically Nix
@ 2016-03-13 15:17 ` Nix
2016-03-13 15:17 ` [PATCH 03/17 v6] Do not stack-protect ifunc resolvers Nix
` (13 subsequent siblings)
17 siblings, 0 replies; 46+ messages in thread
From: Nix @ 2016-03-13 15:17 UTC (permalink / raw)
To: libc-alpha
From: Adhemerval Zanella <adhemerval.zanella@linaro.org>
We use the same assembler-macro trick we use to de-PLTize
compiler-generated libcalls to memcpy and memset to redirect
__stack_chk_fail to __stack_chk_fail_local.
v5: New.
v6: Only do it within the shared library: with __stack_chk_fail_local
in libc_pic.a now we don't need to worry about calls from inside
other routines in libc_nonshared.a any more.
* sysdeps/generic/symbol-hacks.h (__stack_chk_fail): Add internal
alias.
---
sysdeps/generic/symbol-hacks.h | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/sysdeps/generic/symbol-hacks.h b/sysdeps/generic/symbol-hacks.h
index ce576c9..fd3d2de 100644
--- a/sysdeps/generic/symbol-hacks.h
+++ b/sysdeps/generic/symbol-hacks.h
@@ -5,3 +5,9 @@ asm ("memmove = __GI_memmove");
asm ("memset = __GI_memset");
asm ("memcpy = __GI_memcpy");
#endif
+
+/* -fstack-protector generates calls to __stack_chk_fail, which need
+ similar adjustments to avoid going through the PLT. */
+#if !defined __ASSEMBLER__ && IS_IN (libc) && defined SHARED
+asm ("__stack_chk_fail = __stack_chk_fail_local");
+#endif
--
2.7.0.198.g6dd47b6
^ permalink raw reply [flat|nested] 46+ messages in thread* [PATCH 03/17 v6] Do not stack-protect ifunc resolvers.
2016-03-13 15:17 --enable-stack-protector for glibc, v6 Nix
` (3 preceding siblings ...)
2016-03-13 15:17 ` [PATCH 11/17 v6] De-PLTize __stack_chk_fail internal calls within libc.so Nix
@ 2016-03-13 15:17 ` Nix
2016-04-10 3:59 ` Mike Frysinger
2016-03-13 15:18 ` [PATCH 14/17 v5] Avoid stack-protecting signal-handling functions sibcalled from assembly Nix
` (12 subsequent siblings)
17 siblings, 1 reply; 46+ messages in thread
From: Nix @ 2016-03-13 15:17 UTC (permalink / raw)
To: libc-alpha
From: Nick Alcock <nick.alcock@oracle.com>
When dynamically linking, ifunc resolvers are called before TLS is
initialized, so they cannot be safely stack-protected.
We avoid disabling stack-protection on large numbers of files by
using __attribute__ ((__optimize__ ("-fno-stack-protector")))
to turn it off just for the resolvers themselves. (We provide
the attribute even when statically linking, because we will later
use it elsewhere too.)
v4: New.
v5: Comment fix.
v6: Don't check for __attribute__((__optimize__)).
* config.h.in (HAVE_CC_NO_STACK_PROTECTOR): New macro.
* include/libc-symbols.h (inhibit_stack_protector): New macro.
(libc_ifunc): Use it.
(libm_ifunc): Likewise.
* elf/ifuncdep2.c (foo1_ifunc): Add inhibit_stack_protector.
(foo2_ifunc): Likewise.
(foo3_ifunc): Likewise.
* elf/ifuncmain6pie.c (foo_ifunc): Likewise.
* elf/ifuncmain7.c (foo_ifunc): Likewise.
* elf/ifuncmod1.c (foo_ifunc): Likewise.
(foo_hidden_ifunc): Likewise.
(foo_protected_ifunc): Likewise.
* elf/ifuncmod5.c (foo_ifunc): Likewise.
(foo_hidden_ifunc): Likewise.
(foo_protected_ifunc): Likewise.
* sysdeps/x86_64/ifuncmod8.c (foo_ifunc): Likewise.
* nptl/pt-fork.c (fork_resolve): Likewise.
* nptl/pt-longjmp.c (longjmp_resolve): Likewise.
* nptl/pt-system.c (system_resolve): Likewise.
* nptl/pt-vfork.c (vfork_resolve): Likewise.
* rt/clock-compat.c [HAVE_IFUNC] (COMPAT_REDIRECT): Likewise.
* sysdeps/generic/ifunc-sel.h (ifunc_sel): Likewise.
(ifunc_one): Likewise.
* sysdeps/nacl/nacl_interface_query.c [SHARED]
(nacl_interface_query_ifunc): Likewise.
* sysdeps/powerpc/ifunc-sel.h (ifunc_sel): Likewise.
(ifunc_one): Likewise.
* sysdeps/unix/make-syscalls.sh: Likewise.
* sysdeps/unix/sysv/linux/powerpc/gettimeofday.c
(gettimeofday_ifunc): Likewise.
* sysdeps/unix/sysv/linux/powerpc/time.c (time_ifunc): Likewise.
* sysdeps/unix/sysv/linux/x86/gettimeofday.c (gettimeofday_ifunc):
Likewise.
* sysdeps/unix/sysv/linux/x86/time.c (time_ifunc): Likewise.
* sysdeps/unix/sysv/linux/x86_64/x32/getcpu.c (getcpu_ifunc):
Likewise.
---
config.h.in | 4 ++++
configure.ac | 1 +
elf/ifuncdep2.c | 3 +++
elf/ifuncmain6pie.c | 1 +
elf/ifuncmain7.c | 1 +
elf/ifuncmod1.c | 3 +++
elf/ifuncmod5.c | 3 +++
include/libc-symbols.h | 18 ++++++++++++++++--
nptl/pt-fork.c | 1 +
nptl/pt-longjmp.c | 1 +
nptl/pt-system.c | 1 +
nptl/pt-vfork.c | 1 +
rt/clock-compat.c | 4 +++-
sysdeps/generic/ifunc-sel.h | 2 ++
sysdeps/nacl/nacl_interface_query.c | 1 +
sysdeps/powerpc/ifunc-sel.h | 2 ++
sysdeps/unix/make-syscalls.sh | 1 +
sysdeps/unix/sysv/linux/powerpc/gettimeofday.c | 1 +
sysdeps/unix/sysv/linux/powerpc/time.c | 1 +
sysdeps/unix/sysv/linux/x86/gettimeofday.c | 1 +
sysdeps/unix/sysv/linux/x86/time.c | 1 +
sysdeps/unix/sysv/linux/x86_64/x32/getcpu.c | 1 +
sysdeps/x86_64/ifuncmod8.c | 1 +
23 files changed, 51 insertions(+), 3 deletions(-)
diff --git a/config.h.in b/config.h.in
index 990d5e1..612e18e 100644
--- a/config.h.in
+++ b/config.h.in
@@ -43,6 +43,10 @@
/* Define if compiler accepts -ftree-loop-distribute-patterns. */
#undef HAVE_CC_INHIBIT_LOOP_TO_LIBCALL
+/* Define if compiler accepts -fno-stack-protector in an
+ __attribute__((__optimize__)). */
+#undef HAVE_CC_NO_STACK_PROTECTOR
+
/* The level of stack protection in use for glibc as a whole. */
#undef STACK_PROTECTOR_LEVEL
diff --git a/configure.ac b/configure.ac
index f690abf..6ad87f5 100644
--- a/configure.ac
+++ b/configure.ac
@@ -636,6 +636,7 @@ stack_protector=
no_stack_protector=
if test "$libc_cv_ssp" = yes; then
no_stack_protector=-fno-stack-protector
+ AC_DEFINE(HAVE_CC_NO_STACK_PROTECTOR)
fi
if test "$enable_stack_protector" = yes && test "$libc_cv_ssp" = yes; then
diff --git a/elf/ifuncdep2.c b/elf/ifuncdep2.c
index 6e66d31..d87d61d 100644
--- a/elf/ifuncdep2.c
+++ b/elf/ifuncdep2.c
@@ -32,6 +32,7 @@ void * foo1_ifunc (void) __asm__ ("foo1");
__asm__(".type foo1, %gnu_indirect_function");
void *
+inhibit_stack_protector
foo1_ifunc (void)
{
return ifunc_sel (one, minus_one, zero);
@@ -41,6 +42,7 @@ void * foo2_ifunc (void) __asm__ ("foo2");
__asm__(".type foo2, %gnu_indirect_function");
void *
+inhibit_stack_protector
foo2_ifunc (void)
{
return ifunc_sel (minus_one, one, zero);
@@ -50,6 +52,7 @@ void * foo3_ifunc (void) __asm__ ("foo3");
__asm__(".type foo3, %gnu_indirect_function");
void *
+inhibit_stack_protector
foo3_ifunc (void)
{
return ifunc_sel (one, zero, minus_one);
diff --git a/elf/ifuncmain6pie.c b/elf/ifuncmain6pie.c
index 8478d4c..04faeb8 100644
--- a/elf/ifuncmain6pie.c
+++ b/elf/ifuncmain6pie.c
@@ -21,6 +21,7 @@ void * foo_ifunc (void) __asm__ ("foo");
__asm__(".type foo, %gnu_indirect_function");
void *
+inhibit_stack_protector
foo_ifunc (void)
{
return ifunc_one (one);
diff --git a/elf/ifuncmain7.c b/elf/ifuncmain7.c
index 617a596..1e8f7ea 100644
--- a/elf/ifuncmain7.c
+++ b/elf/ifuncmain7.c
@@ -20,6 +20,7 @@ __asm__(".type foo, %gnu_indirect_function");
static void *
__attribute__ ((used))
+inhibit_stack_protector
foo_ifunc (void)
{
return ifunc_one (one);
diff --git a/elf/ifuncmod1.c b/elf/ifuncmod1.c
index 0b61380..f0bf5fb 100644
--- a/elf/ifuncmod1.c
+++ b/elf/ifuncmod1.c
@@ -36,6 +36,7 @@ void * foo_ifunc (void) __asm__ ("foo");
__asm__(".type foo, %gnu_indirect_function");
void *
+inhibit_stack_protector
foo_ifunc (void)
{
return ifunc_sel (one, minus_one, zero);
@@ -45,6 +46,7 @@ void * foo_hidden_ifunc (void) __asm__ ("foo_hidden");
__asm__(".type foo_hidden, %gnu_indirect_function");
void *
+inhibit_stack_protector
foo_hidden_ifunc (void)
{
return ifunc_sel (minus_one, one, zero);
@@ -54,6 +56,7 @@ void * foo_protected_ifunc (void) __asm__ ("foo_protected");
__asm__(".type foo_protected, %gnu_indirect_function");
void *
+inhibit_stack_protector
foo_protected_ifunc (void)
{
return ifunc_sel (one, zero, minus_one);
diff --git a/elf/ifuncmod5.c b/elf/ifuncmod5.c
index 0e65a63..5a95780 100644
--- a/elf/ifuncmod5.c
+++ b/elf/ifuncmod5.c
@@ -31,6 +31,7 @@ void * foo_ifunc (void) __asm__ ("foo");
__asm__(".type foo, %gnu_indirect_function");
void *
+inhibit_stack_protector
foo_ifunc (void)
{
return ifunc_sel (one, minus_one, zero);
@@ -40,6 +41,7 @@ void * foo_hidden_ifunc (void) __asm__ ("foo_hidden");
__asm__(".type foo_hidden, %gnu_indirect_function");
void *
+inhibit_stack_protector
foo_hidden_ifunc (void)
{
return ifunc_sel (minus_one, one, zero);
@@ -49,6 +51,7 @@ void * foo_protected_ifunc (void) __asm__ ("foo_protected");
__asm__(".type foo_protected, %gnu_indirect_function");
void *
+inhibit_stack_protector
foo_protected_ifunc (void)
{
return ifunc_sel (one, zero, minus_one);
diff --git a/include/libc-symbols.h b/include/libc-symbols.h
index 4548e09..531092c 100644
--- a/include/libc-symbols.h
+++ b/include/libc-symbols.h
@@ -314,6 +314,16 @@ for linking")
#define attribute_relro __attribute__ ((section (".data.rel.ro")))
+
+/* Used to disable stack protection in sensitive places, like ifunc
+ resolvers and early static TLS init. */
+#ifdef HAVE_CC_NO_STACK_PROTECTOR
+# define inhibit_stack_protector \
+ __attribute__ ((__optimize__ ("-fno-stack-protector")))
+#else
+# define inhibit_stack_protector
+#endif
+
/* The following macros are used for PLT bypassing within libc.so
(and if needed other libraries similarly).
First of all, you need to have the function prototyped somewhere,
@@ -716,7 +726,9 @@ for linking")
/* Marker used for indirection function symbols. */
#define libc_ifunc(name, expr) \
extern void *name##_ifunc (void) __asm__ (#name); \
- void *name##_ifunc (void) \
+ void * \
+ inhibit_stack_protector \
+ name##_ifunc (void) \
{ \
INIT_ARCH (); \
__typeof (name) *res = expr; \
@@ -728,7 +740,9 @@ for linking")
which will, if necessary, initialize the data first. */
#define libm_ifunc(name, expr) \
extern void *name##_ifunc (void) __asm__ (#name); \
- void *name##_ifunc (void) \
+ void * \
+ inhibit_stack_protector \
+ name##_ifunc (void) \
{ \
__typeof (name) *res = expr; \
return res; \
diff --git a/nptl/pt-fork.c b/nptl/pt-fork.c
index b65d6b4..4178af8 100644
--- a/nptl/pt-fork.c
+++ b/nptl/pt-fork.c
@@ -34,6 +34,7 @@
static __typeof (fork) *
__attribute__ ((used))
+inhibit_stack_protector
fork_resolve (void)
{
return &__libc_fork;
diff --git a/nptl/pt-longjmp.c b/nptl/pt-longjmp.c
index a1cc286..8a33cb4 100644
--- a/nptl/pt-longjmp.c
+++ b/nptl/pt-longjmp.c
@@ -34,6 +34,7 @@
static __typeof (longjmp) *
__attribute__ ((used))
+inhibit_stack_protector
longjmp_resolve (void)
{
return &__libc_longjmp;
diff --git a/nptl/pt-system.c b/nptl/pt-system.c
index 56f2a89..a481ab3 100644
--- a/nptl/pt-system.c
+++ b/nptl/pt-system.c
@@ -34,6 +34,7 @@
static __typeof (system) *
__attribute__ ((used))
+inhibit_stack_protector
system_resolve (void)
{
return &__libc_system;
diff --git a/nptl/pt-vfork.c b/nptl/pt-vfork.c
index 8f4be0c..8f3c2c0 100644
--- a/nptl/pt-vfork.c
+++ b/nptl/pt-vfork.c
@@ -48,6 +48,7 @@ extern __typeof (vfork) __libc_vfork; /* Defined in libc. */
static __typeof (vfork) *
__attribute__ ((used))
+inhibit_stack_protector
vfork_resolve (void)
{
return &__libc_vfork;
diff --git a/rt/clock-compat.c b/rt/clock-compat.c
index dc69e4a..b0fdd8b 100644
--- a/rt/clock-compat.c
+++ b/rt/clock-compat.c
@@ -30,7 +30,9 @@
#if HAVE_IFUNC
# define COMPAT_REDIRECT(name, proto, arglist) \
__typeof (name) *name##_ifunc (void) asm (#name); \
- __typeof (name) *name##_ifunc (void) \
+ __typeof (name) * \
+ inhibit_stack_protector \
+ name##_ifunc (void) \
{ \
return &__##name; \
} \
diff --git a/sysdeps/generic/ifunc-sel.h b/sysdeps/generic/ifunc-sel.h
index 6a27b69..1fff405 100644
--- a/sysdeps/generic/ifunc-sel.h
+++ b/sysdeps/generic/ifunc-sel.h
@@ -5,6 +5,7 @@
extern int global;
static inline void *
+inhibit_stack_protector
ifunc_sel (int (*f1) (void), int (*f2) (void), int (*f3) (void))
{
switch (global)
@@ -19,6 +20,7 @@ ifunc_sel (int (*f1) (void), int (*f2) (void), int (*f3) (void))
}
static inline void *
+inhibit_stack_protector
ifunc_one (int (*f1) (void))
{
return f1;
diff --git a/sysdeps/nacl/nacl_interface_query.c b/sysdeps/nacl/nacl_interface_query.c
index adf1dd4..dbaa88b 100644
--- a/sysdeps/nacl/nacl_interface_query.c
+++ b/sysdeps/nacl/nacl_interface_query.c
@@ -29,6 +29,7 @@ extern TYPE_nacl_irt_query nacl_interface_query_ifunc (void)
asm ("nacl_interface_query");
TYPE_nacl_irt_query
+inhibit_stack_protector
nacl_interface_query_ifunc (void)
{
return &__nacl_irt_query;
diff --git a/sysdeps/powerpc/ifunc-sel.h b/sysdeps/powerpc/ifunc-sel.h
index 526d8ed..598b125 100644
--- a/sysdeps/powerpc/ifunc-sel.h
+++ b/sysdeps/powerpc/ifunc-sel.h
@@ -5,6 +5,7 @@
extern int global;
static inline void *
+inhibit_stack_protector
ifunc_sel (int (*f1) (void), int (*f2) (void), int (*f3) (void))
{
register void *ret __asm__ ("r3");
@@ -30,6 +31,7 @@ ifunc_sel (int (*f1) (void), int (*f2) (void), int (*f3) (void))
}
static inline void *
+inhibit_stack_protector
ifunc_one (int (*f1) (void))
{
register void *ret __asm__ ("r3");
diff --git a/sysdeps/unix/make-syscalls.sh b/sysdeps/unix/make-syscalls.sh
index 58d165e..123553c 100644
--- a/sysdeps/unix/make-syscalls.sh
+++ b/sysdeps/unix/make-syscalls.sh
@@ -287,6 +287,7 @@ while read file srcfile caller syscall args strong weak; do
(echo '#include <dl-vdso.h>'; \\
echo 'extern void *${strong}_ifunc (void) __asm ("${strong}");'; \\
echo 'void *'; \\
+ echo 'inhibit_stack_protector'; \\
echo '${strong}_ifunc (void)'; \\
echo '{'; \\
echo ' PREPARE_VERSION_KNOWN (symver, ${vdso_symver});'; \\
diff --git a/sysdeps/unix/sysv/linux/powerpc/gettimeofday.c b/sysdeps/unix/sysv/linux/powerpc/gettimeofday.c
index 25a4e7c..a8b6cfa 100644
--- a/sysdeps/unix/sysv/linux/powerpc/gettimeofday.c
+++ b/sysdeps/unix/sysv/linux/powerpc/gettimeofday.c
@@ -33,6 +33,7 @@ __gettimeofday_syscall (struct timeval *tv, struct timezone *tz)
}
void *
+inhibit_stack_protector
gettimeofday_ifunc (void)
{
PREPARE_VERSION (linux2615, "LINUX_2.6.15", 123718565);
diff --git a/sysdeps/unix/sysv/linux/powerpc/time.c b/sysdeps/unix/sysv/linux/powerpc/time.c
index 7973419..4b89b38 100644
--- a/sysdeps/unix/sysv/linux/powerpc/time.c
+++ b/sysdeps/unix/sysv/linux/powerpc/time.c
@@ -43,6 +43,7 @@ time_syscall (time_t *t)
}
void *
+inhibit_stack_protector
time_ifunc (void)
{
PREPARE_VERSION (linux2615, "LINUX_2.6.15", 123718565);
diff --git a/sysdeps/unix/sysv/linux/x86/gettimeofday.c b/sysdeps/unix/sysv/linux/x86/gettimeofday.c
index 36f7c26..e05ad53 100644
--- a/sysdeps/unix/sysv/linux/x86/gettimeofday.c
+++ b/sysdeps/unix/sysv/linux/x86/gettimeofday.c
@@ -32,6 +32,7 @@ __gettimeofday_syscall (struct timeval *tv, struct timezone *tz)
void *gettimeofday_ifunc (void) __asm__ ("__gettimeofday");
void *
+inhibit_stack_protector
gettimeofday_ifunc (void)
{
PREPARE_VERSION_KNOWN (linux26, LINUX_2_6);
diff --git a/sysdeps/unix/sysv/linux/x86/time.c b/sysdeps/unix/sysv/linux/x86/time.c
index f5f7f91..c5bd8dc 100644
--- a/sysdeps/unix/sysv/linux/x86/time.c
+++ b/sysdeps/unix/sysv/linux/x86/time.c
@@ -33,6 +33,7 @@ __time_syscall (time_t *t)
void *time_ifunc (void) __asm__ ("time");
void *
+inhibit_stack_protector
time_ifunc (void)
{
PREPARE_VERSION_KNOWN (linux26, LINUX_2_6);
diff --git a/sysdeps/unix/sysv/linux/x86_64/x32/getcpu.c b/sysdeps/unix/sysv/linux/x86_64/x32/getcpu.c
index cbac4b3..8436f9d 100644
--- a/sysdeps/unix/sysv/linux/x86_64/x32/getcpu.c
+++ b/sysdeps/unix/sysv/linux/x86_64/x32/getcpu.c
@@ -21,6 +21,7 @@
void *getcpu_ifunc (void) __asm__ ("__getcpu");
void *
+inhibit_stack_protector
getcpu_ifunc (void)
{
PREPARE_VERSION (linux26, "LINUX_2.6", 61765110);
diff --git a/sysdeps/x86_64/ifuncmod8.c b/sysdeps/x86_64/ifuncmod8.c
index c004367..7c06562 100644
--- a/sysdeps/x86_64/ifuncmod8.c
+++ b/sysdeps/x86_64/ifuncmod8.c
@@ -28,6 +28,7 @@ foo_impl (float x)
}
void *
+inhibit_stack_protector
foo_ifunc (void)
{
__m128i xmm = _mm_set1_epi32 (-1);
--
2.7.0.198.g6dd47b6
^ permalink raw reply [flat|nested] 46+ messages in thread* [PATCH 14/17 v5] Avoid stack-protecting signal-handling functions sibcalled from assembly.
2016-03-13 15:17 --enable-stack-protector for glibc, v6 Nix
` (4 preceding siblings ...)
2016-03-13 15:17 ` [PATCH 03/17 v6] Do not stack-protect ifunc resolvers Nix
@ 2016-03-13 15:18 ` Nix
2016-05-13 9:54 ` Florian Weimer
2016-03-13 15:18 ` [PATCH 07/17 v3] Compile the entire dynamic linker with -fno-stack-protector Nix
` (11 subsequent siblings)
17 siblings, 1 reply; 46+ messages in thread
From: Nix @ 2016-03-13 15:18 UTC (permalink / raw)
To: libc-alpha
From: Nick Alcock <nick.alcock@oracle.com>
Certain signal-handling functions are sibcalled from assembly on
x86, both on Linux and the Hurd. As such, they depend on having
the same-shaped stack frame, an assumption it seems likely that
-fstack-protector violates. More worryingly, setjmp/sigjmp.c lands
in the dynamic linker but is overlooked by the machinery that
rebuilds almost everything else, and is never rebuilt: so we
should compile it witout stack-protection for the sake of ld.so.
v2: de-stack-protect setjmp/sigjmp.c.
v3: Use $(no-stack-protector).
v4: Use inhibit_stack_protector.
v5: Remove inhibition of nptl/pthread_mutex_(un)lock.c now that is
diagnosed and fixed elsewhere, properly; inhibit _hurd_self_sigstate
instead.
* hurd/hurd/signal.h (_hurd_self_sigstate): Add
inhibit_stack_protector.
* setjmp/Makefile (CFLAGS-sigjmp.c): Add $(no-stack-protector).
---
hurd/hurd/signal.h | 2 +-
setjmp/Makefile | 4 ++++
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/hurd/hurd/signal.h b/hurd/hurd/signal.h
index 85e5152..78a25ae 100644
--- a/hurd/hurd/signal.h
+++ b/hurd/hurd/signal.h
@@ -129,7 +129,7 @@ extern struct hurd_sigstate *_hurd_self_sigstate (void)
#define _HURD_SIGNAL_H_EXTERN_INLINE __extern_inline
#endif
-_HURD_SIGNAL_H_EXTERN_INLINE struct hurd_sigstate *
+_HURD_SIGNAL_H_EXTERN_INLINE inhibit_stack_protector struct hurd_sigstate *
_hurd_self_sigstate (void)
{
struct hurd_sigstate **location = (struct hurd_sigstate **)
diff --git a/setjmp/Makefile b/setjmp/Makefile
index 5b677cc..b617a84 100644
--- a/setjmp/Makefile
+++ b/setjmp/Makefile
@@ -35,3 +35,7 @@ tests-static := tst-setjmp-static
include ../Rules
$(objpfx)tst-setjmp-fp: $(libm)
+
+# This is sibcalled directly from arch-specific assembly, included in rtld,
+# but never rebuilt, so it must never be built with stack protection.
+CFLAGS-sigjmp.c += $(no-stack-protector)
--
2.7.0.198.g6dd47b6
^ permalink raw reply [flat|nested] 46+ messages in thread* Re: [PATCH 14/17 v5] Avoid stack-protecting signal-handling functions sibcalled from assembly.
2016-03-13 15:18 ` [PATCH 14/17 v5] Avoid stack-protecting signal-handling functions sibcalled from assembly Nix
@ 2016-05-13 9:54 ` Florian Weimer
2016-05-13 14:38 ` Nix
2016-05-15 9:50 ` Nix
0 siblings, 2 replies; 46+ messages in thread
From: Florian Weimer @ 2016-05-13 9:54 UTC (permalink / raw)
To: Nix; +Cc: libc-alpha
On 03/13/2016 04:16 PM, Nix wrote:
> Certain signal-handling functions are sibcalled from assembly on
> x86, both on Linux and the Hurd. As such, they depend on having
> the same-shaped stack frame, an assumption it seems likely that
> -fstack-protector violates.
I think that's not actually true for tail calls to
stack-protector-enabled functions from those who are not so enabled.
The lack of rebuild is more problematic. Does it really make a
difference, considering that the affected function is not active while
we initialize the stack guard value?
Thanks,
Florian
^ permalink raw reply [flat|nested] 46+ messages in thread
* Re: [PATCH 14/17 v5] Avoid stack-protecting signal-handling functions sibcalled from assembly.
2016-05-13 9:54 ` Florian Weimer
@ 2016-05-13 14:38 ` Nix
2016-05-15 9:50 ` Nix
1 sibling, 0 replies; 46+ messages in thread
From: Nix @ 2016-05-13 14:38 UTC (permalink / raw)
To: Florian Weimer; +Cc: libc-alpha
On 13 May 2016, Florian Weimer told this:
> On 03/13/2016 04:16 PM, Nix wrote:
>> Certain signal-handling functions are sibcalled from assembly on
>> x86, both on Linux and the Hurd. As such, they depend on having
>> the same-shaped stack frame, an assumption it seems likely that
>> -fstack-protector violates.
>
> I think that's not actually true for tail calls to stack-protector-enabled functions from those who are not so enabled.
>
> The lack of rebuild is more problematic. Does it really make a difference, considering that the affected function is not active
> while we initialize the stack guard value?
I was being paranoid and aiming for stability given that at the time I
didn't know what caused the locking-related crashes on x86-32 when
stack-protection was enabled, and thought this was a plausible victim as
well.
In hindsight, given that we now know it was a missing reload of a
call-clobbered register in that specific case and not something to do
with some sort of stack-frame incompatibility between stack-protected
and non-stack-protected code, it seems likely that we can drop this (and
the corresponding sparc changes).
I'll roll a new patch series with that done and with the changes
requested a few weeks ago by Mike, and sans the stuff that's already
been pulled in, this weekend, and see if they pass their checks. (The
posting of the patches might not follow until early next week, because
all those make checks take a long time, particularly on my little ARM
home cinema box. :) )
--
NULL && (void)
^ permalink raw reply [flat|nested] 46+ messages in thread
* Re: [PATCH 14/17 v5] Avoid stack-protecting signal-handling functions sibcalled from assembly.
2016-05-13 9:54 ` Florian Weimer
2016-05-13 14:38 ` Nix
@ 2016-05-15 9:50 ` Nix
2016-05-15 10:35 ` Andreas Schwab
2016-05-15 10:39 ` Nix
1 sibling, 2 replies; 46+ messages in thread
From: Nix @ 2016-05-15 9:50 UTC (permalink / raw)
To: Florian Weimer; +Cc: libc-alpha
On 13 May 2016, Florian Weimer told this:
> On 03/13/2016 04:16 PM, Nix wrote:
>> Certain signal-handling functions are sibcalled from assembly on
>> x86, both on Linux and the Hurd. As such, they depend on having
>> the same-shaped stack frame, an assumption it seems likely that
>> -fstack-protector violates.
[...]
> The lack of rebuild is more problematic. Does it really make a
> difference, considering that the affected function is not active while
> we initialize the stack guard value?
Oh yes it really does. We're not just keeping stack-protection out of
ld.so because that's where the canary is initialized, but also because
ld.so doesn't have __libc_message() et al. If a single reference is
missed we end up dragging all of the __libc_message() machinery, libio,
etc, into ld.so. We could fix this by providing a small stub for
__libc_message() or __fortify_fail() in ld.so, but given that this
behaviour also prevents any references from creeping in to ld.so's more
delicate machinery, this seems like a better first step. We can try to
stack-protect ld.so later :)
To be specific, because of this rebuild error, sigjmp.c stays
stack-protected, so we see this:
make[3]: Leaving directory '/home/oranix/oracle/src/glibc/elf'
gcc -nostdlib -nostartfiles -r -o /usr/local/tmp/test/1/elf/librtld.os '-Wl,-(' /usr/local/tmp/test/1/elf/dl-allobjs.os /usr/local/tmp/test/1/elf/rtld-libc.a -lgcc '-Wl,-)' \
-Wl,-Map,/usr/local/tmp/test/1/elf/librtld.os.map
gcc -nostdlib -nostartfiles -shared -o /usr/local/tmp/test/1/elf/ld.so.new \
-Wl,-z,combreloc -Wl,-z,relro -Wl,--hash-style=both -Wl,-z,defs -Wl,-z,now \
/usr/local/tmp/test/1/elf/librtld.os -Wl,--version-script=/usr/local/tmp/test/1/ld.map \
-Wl,-soname=ld-linux-x86-64.so.2 \
-Wl,-defsym=_begin=0
/usr/local/tmp/test/1/elf/librtld.os: In function `check_one_fd':
/home/oranix/oracle/src/glibc/csu/check_fds.c:84: undefined reference to `__stack_chk_fail'
/usr/local/tmp/test/1/elf/librtld.os: In function `__libc_check_standard_fds':
/home/oranix/oracle/src/glibc/csu/check_fds.c:100: undefined reference to `__stack_chk_fail'
/usr/local/tmp/test/1/elf/librtld.os: In function `__closedir':
/home/oranix/oracle/src/glibc/dirent/../sysdeps/posix/closedir.c:53: undefined reference to `__stack_chk_fail'
/usr/local/tmp/test/1/elf/librtld.os: In function `__readdir':
/home/oranix/oracle/src/glibc/dirent/../sysdeps/posix/readdir.c:118: undefined reference to `__stack_chk_fail'
/usr/local/tmp/test/1/elf/librtld.os: In function `__rewinddir':
/home/oranix/oracle/src/glibc/dirent/../sysdeps/posix/rewinddir.c:39: undefined reference to `__stack_chk_fail'
/usr/local/tmp/test/1/elf/librtld.os:/home/oranix/oracle/src/glibc/dirent/../sysdeps/unix/sysv/linux/getdents.c:301: more undefined references to `__stack_chk_fail' follow
collect2: error: ld returned 1 exit status
This is obviously a bad thing.
I'll have a hunt for whatever it is that's causing sigjmp.c to not be
rebuilt after this test cycle, because that's the underlying bug here,
really.
--
NULL && (void)
^ permalink raw reply [flat|nested] 46+ messages in thread* Re: [PATCH 14/17 v5] Avoid stack-protecting signal-handling functions sibcalled from assembly.
2016-05-15 9:50 ` Nix
@ 2016-05-15 10:35 ` Andreas Schwab
2016-05-15 15:18 ` Nix
2016-05-15 10:39 ` Nix
1 sibling, 1 reply; 46+ messages in thread
From: Andreas Schwab @ 2016-05-15 10:35 UTC (permalink / raw)
To: Nix; +Cc: Florian Weimer, libc-alpha
Nix <nix@esperi.org.uk> writes:
> I'll have a hunt for whatever it is that's causing sigjmp.c to not be
> rebuilt after this test cycle, because that's the underlying bug here,
> really.
Just changing CFLAGS-foo doesn't trigger a rebuild of dependent objects.
Andreas.
--
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756 01D3 44D5 214B 8276 4ED5
"And now for something completely different."
^ permalink raw reply [flat|nested] 46+ messages in thread
* Re: [PATCH 14/17 v5] Avoid stack-protecting signal-handling functions sibcalled from assembly.
2016-05-15 10:35 ` Andreas Schwab
@ 2016-05-15 15:18 ` Nix
2016-05-15 15:49 ` Andreas Schwab
0 siblings, 1 reply; 46+ messages in thread
From: Nix @ 2016-05-15 15:18 UTC (permalink / raw)
To: Andreas Schwab; +Cc: Florian Weimer, libc-alpha
On 15 May 2016, Andreas Schwab verbalised:
> Nix <nix@esperi.org.uk> writes:
>
>> I'll have a hunt for whatever it is that's causing sigjmp.c to not be
>> rebuilt after this test cycle, because that's the underlying bug here,
>> really.
>
> Just changing CFLAGS-foo doesn't trigger a rebuild of dependent objects.
Well, no, but sigjmp.c should be rebuilt if it's incorporated in ld.so
anyway: we should be getting an rtld-sigjmp.o, and we're not.
(However, I suspect that this is because it's *not* incorporated into
ld.so, and I was misreading the code! So this is all rather moot.
Everything seems to be going fine so far on the testing front with the
CFLAGS-set for sigjmp.c removed...)
--
NULL && (void)
^ permalink raw reply [flat|nested] 46+ messages in thread
* Re: [PATCH 14/17 v5] Avoid stack-protecting signal-handling functions sibcalled from assembly.
2016-05-15 15:18 ` Nix
@ 2016-05-15 15:49 ` Andreas Schwab
2016-05-16 9:00 ` Florian Weimer
0 siblings, 1 reply; 46+ messages in thread
From: Andreas Schwab @ 2016-05-15 15:49 UTC (permalink / raw)
To: Nix; +Cc: Florian Weimer, libc-alpha
Nix <nix@esperi.org.uk> writes:
> On 15 May 2016, Andreas Schwab verbalised:
>
>> Nix <nix@esperi.org.uk> writes:
>>
>>> I'll have a hunt for whatever it is that's causing sigjmp.c to not be
>>> rebuilt after this test cycle, because that's the underlying bug here,
>>> really.
>>
>> Just changing CFLAGS-foo doesn't trigger a rebuild of dependent objects.
>
> Well, no, but sigjmp.c should be rebuilt if it's incorporated in ld.so
> anyway: we should be getting an rtld-sigjmp.o, and we're not.
Most architectures implement setjmp in assembler anyway.
Andreas.
--
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756 01D3 44D5 214B 8276 4ED5
"And now for something completely different."
^ permalink raw reply [flat|nested] 46+ messages in thread
* Re: [PATCH 14/17 v5] Avoid stack-protecting signal-handling functions sibcalled from assembly.
2016-05-15 15:49 ` Andreas Schwab
@ 2016-05-16 9:00 ` Florian Weimer
2016-05-16 9:16 ` Andreas Schwab
0 siblings, 1 reply; 46+ messages in thread
From: Florian Weimer @ 2016-05-16 9:00 UTC (permalink / raw)
To: Andreas Schwab, Nix; +Cc: libc-alpha
On 05/15/2016 05:49 PM, Andreas Schwab wrote:
> Nix <nix@esperi.org.uk> writes:
>
>> On 15 May 2016, Andreas Schwab verbalised:
>>
>>> Nix <nix@esperi.org.uk> writes:
>>>
>>>> I'll have a hunt for whatever it is that's causing sigjmp.c to not be
>>>> rebuilt after this test cycle, because that's the underlying bug here,
>>>> really.
>>>
>>> Just changing CFLAGS-foo doesn't trigger a rebuild of dependent objects.
>>
>> Well, no, but sigjmp.c should be rebuilt if it's incorporated in ld.so
>> anyway: we should be getting an rtld-sigjmp.o, and we're not.
>
> Most architectures implement setjmp in assembler anyway.
But a lot (all?) of them use a C tail for some of the work, and the
patch is about how that is compiled.
Florian
^ permalink raw reply [flat|nested] 46+ messages in thread
* Re: [PATCH 14/17 v5] Avoid stack-protecting signal-handling functions sibcalled from assembly.
2016-05-16 9:00 ` Florian Weimer
@ 2016-05-16 9:16 ` Andreas Schwab
0 siblings, 0 replies; 46+ messages in thread
From: Andreas Schwab @ 2016-05-16 9:16 UTC (permalink / raw)
To: Florian Weimer; +Cc: Nix, libc-alpha
Florian Weimer <fweimer@redhat.com> writes:
> On 05/15/2016 05:49 PM, Andreas Schwab wrote:
>> Nix <nix@esperi.org.uk> writes:
>>
>>> On 15 May 2016, Andreas Schwab verbalised:
>>>
>>>> Nix <nix@esperi.org.uk> writes:
>>>>
>>>>> I'll have a hunt for whatever it is that's causing sigjmp.c to not be
>>>>> rebuilt after this test cycle, because that's the underlying bug here,
>>>>> really.
>>>>
>>>> Just changing CFLAGS-foo doesn't trigger a rebuild of dependent objects.
>>>
>>> Well, no, but sigjmp.c should be rebuilt if it's incorporated in ld.so
>>> anyway: we should be getting an rtld-sigjmp.o, and we're not.
>>
>> Most architectures implement setjmp in assembler anyway.
>
> But a lot (all?) of them use a C tail for some of the work, and the patch
> is about how that is compiled.
Ahh, yes, sigjmp, not setjmp. :-)
Andreas.
--
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756 01D3 44D5 214B 8276 4ED5
"And now for something completely different."
^ permalink raw reply [flat|nested] 46+ messages in thread
* Re: [PATCH 14/17 v5] Avoid stack-protecting signal-handling functions sibcalled from assembly.
2016-05-15 9:50 ` Nix
2016-05-15 10:35 ` Andreas Schwab
@ 2016-05-15 10:39 ` Nix
1 sibling, 0 replies; 46+ messages in thread
From: Nix @ 2016-05-15 10:39 UTC (permalink / raw)
To: Florian Weimer; +Cc: libc-alpha
On 15 May 2016, nix@esperi.org.uk told this:
> To be specific, because of this rebuild error, sigjmp.c stays
> stack-protected, so we see this:
As anyone with working eyes should have seen (but I didn't), this was a
*different* problem. (I shouldn't drop the already-merged stuff from my
patch tree and then try building against a tree that doesn't have them
merged in anywhere!)
We do indeed appear to get no problems if dropping the sigjmp stuff,
though I have no idea why not. Clearly the code inspection that led me
to believe I needed to do this was erronous, at least on x86*. Running
tests on other arches now.
--
NULL && (void)
^ permalink raw reply [flat|nested] 46+ messages in thread
* [PATCH 07/17 v3] Compile the entire dynamic linker with -fno-stack-protector.
2016-03-13 15:17 --enable-stack-protector for glibc, v6 Nix
` (5 preceding siblings ...)
2016-03-13 15:18 ` [PATCH 14/17 v5] Avoid stack-protecting signal-handling functions sibcalled from assembly Nix
@ 2016-03-13 15:18 ` Nix
2016-03-13 15:18 ` [PATCH 13/17] Drop explicit stack-protection of pieces of the system Nix
` (10 subsequent siblings)
17 siblings, 0 replies; 46+ messages in thread
From: Nix @ 2016-03-13 15:18 UTC (permalink / raw)
To: libc-alpha
From: Nick Alcock <nick.alcock@oracle.com>
Also compile corresponding routines in the static libc.a with the same
flag.
v3: Use $(no-stack-protector).
Introduce $(elide-stack-protector) and use it to reduce redundancy.
Bring all the elisions together textually.
* elf/Makefile (elide-stack-protector): New.
(CFLAGS-.os): Use it, eliding $(all-rtld-routines).
(CFLAGS-.oX): Likewise, eliding $(elide-routines.os).
(rtld-CFLAGS): Likewise.
---
elf/Makefile | 13 +++++++++++++
elf/rtld-Rules | 2 ++
2 files changed, 15 insertions(+)
diff --git a/elf/Makefile b/elf/Makefile
index 63a5355..0037cca 100644
--- a/elf/Makefile
+++ b/elf/Makefile
@@ -50,6 +50,19 @@ CFLAGS-dl-runtime.c = -fexceptions -fasynchronous-unwind-tables
CFLAGS-dl-lookup.c = -fexceptions -fasynchronous-unwind-tables
CFLAGS-dl-iterate-phdr.c = $(uses-callbacks)
+# Compile rtld itself without stack protection.
+# Also compile all routines in the static library that are elided from
+# the shared libc because they are in ld.so the same way.
+
+define elide-stack-protector
+$(if $(filter $(@F),$(patsubst %,%$(1),$(2))), $(no-stack-protector))
+endef
+
+CFLAGS-.o += $(call elide-stack-protector,.o,$(elide-routines.os))
+CFLAGS-.op += $(call elide-stack-protector,.op,$(elide-routines.os))
+CFLAGS-.og += $(call elide-stack-protector,.og,$(elide-routines.os))
+CFLAGS-.os += $(call elide-stack-protector,.os,$(all-rtld-routines))
+
ifeq ($(unwind-find-fde),yes)
routines += unwind-dw2-fde-glibc
shared-only-routines += unwind-dw2-fde-glibc
diff --git a/elf/rtld-Rules b/elf/rtld-Rules
index c1bb506..aff4e3e 100644
--- a/elf/rtld-Rules
+++ b/elf/rtld-Rules
@@ -144,4 +144,6 @@ cpp-srcs-left := $(rtld-modules:%.os=%)
lib := rtld
include $(patsubst %,$(..)cppflags-iterator.mk,$(cpp-srcs-left))
+rtld-CFLAGS := $(no-stack-protector)
+
endif
--
2.7.0.198.g6dd47b6
^ permalink raw reply [flat|nested] 46+ messages in thread* [PATCH 13/17] Drop explicit stack-protection of pieces of the system.
2016-03-13 15:17 --enable-stack-protector for glibc, v6 Nix
` (6 preceding siblings ...)
2016-03-13 15:18 ` [PATCH 07/17 v3] Compile the entire dynamic linker with -fno-stack-protector Nix
@ 2016-03-13 15:18 ` Nix
2016-04-04 22:47 ` Roland McGrath
2016-03-13 15:18 ` [PATCH 15/17 v4] sparc: do not stack-protect the sigreturn handler Nix
` (9 subsequent siblings)
17 siblings, 1 reply; 46+ messages in thread
From: Nix @ 2016-03-13 15:18 UTC (permalink / raw)
To: libc-alpha
From: Nick Alcock <nick.alcock@oracle.com>
This is probably a bad idea: maybe we want to stack-protect some parts
of the system even when ! --enable-stack-protector. I can easily adjust
the patch to do that (though it'll mean introducing a new variable
analogous to $(stack-protector) but not controlled by the configure
flag.)
But if we wanted to value consistency over security, and use the same
stack-protection configure flag to control everything, this is how we'd
do it!
("Always include at least one patch with something obviously wrong with
it.")
* login/Makefile (pt_chown-cflags): Remove.
* nscd/Makefile (CFLAGS-nscd): Likewise.
* resolv/Makefile (CFLAGS-libresolv): Likewise.
---
login/Makefile | 1 -
nscd/Makefile | 1 -
resolv/Makefile | 1 -
3 files changed, 3 deletions(-)
diff --git a/login/Makefile b/login/Makefile
index 9ff36d6..1a6161c 100644
--- a/login/Makefile
+++ b/login/Makefile
@@ -58,7 +58,6 @@ CFLAGS-getpt.c = -fexceptions
ifeq (yesyes,$(have-fpie)$(build-shared))
pt_chown-cflags += $(pie-ccflag)
endif
-pt_chown-cflags += $(stack-protector)
ifeq (yes,$(have-libcap))
libcap = -lcap
endif
diff --git a/nscd/Makefile b/nscd/Makefile
index 50bad32..bfd72d5 100644
--- a/nscd/Makefile
+++ b/nscd/Makefile
@@ -84,7 +84,6 @@ CPPFLAGS-nscd += -D_FORTIFY_SOURCE=2
ifeq (yesyes,$(have-fpie)$(build-shared))
CFLAGS-nscd += $(pie-ccflag)
endif
-CFLAGS-nscd += $(stack-protector)
ifeq (yesyes,$(have-fpie)$(build-shared))
LDFLAGS-nscd = -Wl,-z,now
diff --git a/resolv/Makefile b/resolv/Makefile
index 8be41d3..0395b1a 100644
--- a/resolv/Makefile
+++ b/resolv/Makefile
@@ -90,7 +90,6 @@ CPPFLAGS += -Dgethostbyname=res_gethostbyname \
-Dgetnetbyname=res_getnetbyname \
-Dgetnetbyaddr=res_getnetbyaddr
-CFLAGS-libresolv += $(stack-protector)
CFLAGS-res_hconf.c = -fexceptions
# The BIND code elicits some harmless warnings.
--
2.7.0.198.g6dd47b6
^ permalink raw reply [flat|nested] 46+ messages in thread* [PATCH 15/17 v4] sparc: do not stack-protect the sigreturn handler.
2016-03-13 15:17 --enable-stack-protector for glibc, v6 Nix
` (7 preceding siblings ...)
2016-03-13 15:18 ` [PATCH 13/17] Drop explicit stack-protection of pieces of the system Nix
@ 2016-03-13 15:18 ` Nix
2016-05-13 9:55 ` Florian Weimer
2016-03-13 15:18 ` [PATCH 06/17] Allow overriding of CFLAGS as well as CPPFLAGS for rtld Nix
` (8 subsequent siblings)
17 siblings, 1 reply; 46+ messages in thread
From: Nix @ 2016-03-13 15:18 UTC (permalink / raw)
To: libc-alpha
From: Nick Alcock <nick.alcock@oracle.com>
This is called from the kernel and must not have a canary.
v2: New.
v3: Use $(no-stack-protector).
v4: Use inhibit_stack_protector.
* sysdeps/unix/sysv/linux/sparc/sparc64/sigaction.c:
(__rt_sigreturn_stub): Use inhibit_stack_protector.
* sysdeps/unix/sysv/linux/sparc/sparc32/sigaction.c
(__rt_sigreturn_stub): Likewise.
(__sigreturn_stub): Likewise.
---
sysdeps/unix/sysv/linux/sparc/sparc32/sigaction.c | 8 ++++++--
sysdeps/unix/sysv/linux/sparc/sparc64/sigaction.c | 4 +++-
2 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/sysdeps/unix/sysv/linux/sparc/sparc32/sigaction.c b/sysdeps/unix/sysv/linux/sparc/sparc32/sigaction.c
index 5aa3c35..b75142f 100644
--- a/sysdeps/unix/sysv/linux/sparc/sparc32/sigaction.c
+++ b/sysdeps/unix/sysv/linux/sparc/sparc32/sigaction.c
@@ -65,7 +65,9 @@ libc_hidden_def (__libc_sigaction)
#include <nptl/sigaction.c>
-static void
+static
+inhibit_stack_protector
+void
__rt_sigreturn_stub (void)
{
__asm__ ("mov %0, %%g1\n\t"
@@ -74,7 +76,9 @@ __rt_sigreturn_stub (void)
: "i" (__NR_rt_sigreturn));
}
-static void
+static
+inhibit_stack_protector
+void
__sigreturn_stub (void)
{
__asm__ ("mov %0, %%g1\n\t"
diff --git a/sysdeps/unix/sysv/linux/sparc/sparc64/sigaction.c b/sysdeps/unix/sysv/linux/sparc/sparc64/sigaction.c
index 50c444c..058c011 100644
--- a/sysdeps/unix/sysv/linux/sparc/sparc64/sigaction.c
+++ b/sysdeps/unix/sysv/linux/sparc/sparc64/sigaction.c
@@ -66,7 +66,9 @@ libc_hidden_def (__libc_sigaction)
#include <nptl/sigaction.c>
-static void
+static
+inhibit_stack_protector
+void
__rt_sigreturn_stub (void)
{
__asm__ ("mov %0, %%g1\n\t"
--
2.7.0.198.g6dd47b6
^ permalink raw reply [flat|nested] 46+ messages in thread* [PATCH 06/17] Allow overriding of CFLAGS as well as CPPFLAGS for rtld.
2016-03-13 15:17 --enable-stack-protector for glibc, v6 Nix
` (8 preceding siblings ...)
2016-03-13 15:18 ` [PATCH 15/17 v4] sparc: do not stack-protect the sigreturn handler Nix
@ 2016-03-13 15:18 ` Nix
2016-04-04 22:44 ` Roland McGrath
2016-04-10 3:53 ` Mike Frysinger
2016-03-13 15:19 ` [PATCH 05/17 v6] Open-code the memcpy() at static TLS initialization time Nix
` (7 subsequent siblings)
17 siblings, 2 replies; 46+ messages in thread
From: Nix @ 2016-03-13 15:18 UTC (permalink / raw)
To: libc-alpha
From: Nick Alcock <nick.alcock@oracle.com>
We need this to pass -fno-stack-protector to all the pieces of rtld in
non-elf/ directories.
* elf/rtld-Rules (rtld-compile-command.c): Add $(rtld-CFLAGS).
* scripts/sysd-rules.awk: Substitute in $(CFLAGS) as well as
$(CPPFLAGS).
---
elf/rtld-Rules | 2 +-
scripts/sysd-rules.awk | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/elf/rtld-Rules b/elf/rtld-Rules
index 94ca39b..c1bb506 100644
--- a/elf/rtld-Rules
+++ b/elf/rtld-Rules
@@ -90,7 +90,7 @@ else
rtld-compile-command.S = $(compile-command.S) $(rtld-CPPFLAGS)
rtld-compile-command.s = $(compile-command.s) $(rtld-CPPFLAGS)
-rtld-compile-command.c = $(compile-command.c) $(rtld-CPPFLAGS)
+rtld-compile-command.c = $(compile-command.c) $(rtld-CPPFLAGS) $(rtld-CFLAGS)
# These are the basic compilation rules corresponding to the Makerules ones.
# The sysd-rules generated makefile already defines pattern rules for rtld-%
diff --git a/scripts/sysd-rules.awk b/scripts/sysd-rules.awk
index cebc9d3..69af400 100644
--- a/scripts/sysd-rules.awk
+++ b/scripts/sysd-rules.awk
@@ -54,7 +54,7 @@ BEGIN {
command_suffix = "";
} else {
prefix = gensub(/%/, "", 1, target_pattern);
- command_suffix = " $(" prefix "CPPFLAGS)";
+ command_suffix = " $(" prefix "CPPFLAGS)" " $(" prefix "CFLAGS)";
}
target = "$(objpfx)" target_pattern o ":";
if (asm_rules) {
--
2.7.0.198.g6dd47b6
^ permalink raw reply [flat|nested] 46+ messages in thread* [PATCH 05/17 v6] Open-code the memcpy() at static TLS initialization time.
2016-03-13 15:17 --enable-stack-protector for glibc, v6 Nix
` (9 preceding siblings ...)
2016-03-13 15:18 ` [PATCH 06/17] Allow overriding of CFLAGS as well as CPPFLAGS for rtld Nix
@ 2016-03-13 15:19 ` Nix
2016-03-13 15:19 ` [PATCH 10/17 v6] Add stack_chk_fail_local to libc.so Nix
` (6 subsequent siblings)
17 siblings, 0 replies; 46+ messages in thread
From: Nix @ 2016-03-13 15:19 UTC (permalink / raw)
To: libc-alpha
From: Nick Alcock <nick.alcock@oracle.com>
This one is a bit nasty. Now that we are initializing TLS earlier for
the stack canary's sake, existing memcpy() implementations become
problematic. We can use the multiarch implementations, but they might
not always be present, and even if they are present they might not always
be in assembler, so might be compiled with stack-protection. We cannot
use posix/memcpy.c without marking both it and */wordcopy.c as non-stack-
protected, which for memcpy() of all things seems like a seriously bad
idea: if any function in glibc should be stack-protected, it's memcpy()
(though stack-protecting the many optimized assembly versions is not done
in this patch series).
So we have two real options: hack up the guts of posix/memcpy.c and
*/wordcopy.c so that they can be #included (renamed and declared static)
inside libc-tls.c, or simply open-code the memcpy(). For simplicity's
sake, this patch open-codes it, on the grounds that static binaries are
relatively rare and quasi-deprecated anyway, and static binaries with
large TLS sections are yet rarer, and not worth the complexity of hacking
up all the arch-dependent wordcopy files. If the arch provides an inline
assembler memcpy() implementation, we can use that in preference, for
speed; also, of course, if stack protection is not enabled at all, we
can still use a normal memcpy() as before.
(This was not revealed when testing on x86 because on that platform
GCC was open-coding the memcpy() for us.)
v2: New, lets us remove the memcpy() -fno-stack-protection, which wasn't
enough in any case.
v4: Add an inhibit_loop_to_libcall to prevent GCC from turning the loop
back into a memcpy() again. Wrap long lines.
v6: Only do this if stack-protected. Use the inline assembler
ARCH_memcpy if available.
* csu/libc-tls.c (__libc_setup_tls): Add inhibit_loop_to_libcall
to avoid calls to potentially ifunced or stack-protected memcpy.
Optionally open-code the TLS-initialization memcpy.
---
csu/libc-tls.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/csu/libc-tls.c b/csu/libc-tls.c
index 3d67a64..4d81113 100644
--- a/csu/libc-tls.c
+++ b/csu/libc-tls.c
@@ -102,6 +102,7 @@ init_static_tls (size_t memsz, size_t align)
}
void
+inhibit_loop_to_libcall
__libc_setup_tls (size_t tcbsize, size_t tcbalign)
{
void *tlsblock;
@@ -176,8 +177,23 @@ __libc_setup_tls (size_t tcbsize, size_t tcbalign)
# error "Either TLS_TCB_AT_TP or TLS_DTV_AT_TP must be defined"
#endif
_dl_static_dtv[2].pointer.is_static = true;
- /* sbrk gives us zero'd memory, so we don't need to clear the remainder. */
+
+ /* sbrk gives us zero'd memory, so we don't need to clear the remainder.
+
+ When stack-protecting, use inlined asm implementation if available:
+ otherwise, copy by hand, because memcpy() is stack-protected and is often
+ multiarch too. */
+
+#if defined _HAVE_STRING_ARCH_memcpy || !defined STACK_PROTECTOR_LEVEL
memcpy (_dl_static_dtv[2].pointer.val, initimage, filesz);
+#else
+ char *dst = (char *) _dl_static_dtv[2].pointer.val;
+ char *src = (char *) initimage;
+ size_t i;
+
+ for (i = 0; i < filesz; dst++, src++, i++)
+ *dst = *src;
+#endif
/* Install the pointer to the dtv. */
--
2.7.0.198.g6dd47b6
^ permalink raw reply [flat|nested] 46+ messages in thread* [PATCH 10/17 v6] Add stack_chk_fail_local to libc.so.
2016-03-13 15:17 --enable-stack-protector for glibc, v6 Nix
` (10 preceding siblings ...)
2016-03-13 15:19 ` [PATCH 05/17 v6] Open-code the memcpy() at static TLS initialization time Nix
@ 2016-03-13 15:19 ` Nix
2016-03-13 15:19 ` [PATCH 12/17 v3] Link various tests with -fno-stack-protector Nix
` (5 subsequent siblings)
17 siblings, 0 replies; 46+ messages in thread
From: Nix @ 2016-03-13 15:19 UTC (permalink / raw)
To: libc-alpha
From: Nick Alcock <nick.alcock@oracle.com>
This is required by the next commit, which routes all
__stack_chk_fail() calls in libc.so via this function to avoid
the PLT. It has be duplicated in libc.so and libc_nonshared.a
because its entire reason for existence is to be hidden and avoid
the PLT, so the copy in libc.so is not visible from elsewhere.
Also stop all the variants of __stack_chk_fail from being stack-
protected: this makes no sense and risks recursion.
v5: Better explanation. Add no-stack-protection of
__stack_chk_fail_local etc.
v6: Rework as suggested by Andreas: make a shared-only version of
stack_chk_fail_local.c rather than linking libc_nonshared into
libc.
* debug/libc-stack_chk_fail_local.c: New file.
* debug/Makefile (routines): Add it.
(shared-only-routines): Likewise.
(CFLAGS-stack_chk_fail.c): Use $(no-stack-protector).
(CFLAGS-stack_chk_fail_local.c): Likewise.
(CFLAGS-libc-stack_chk_fail_local.c): Likewise.
---
debug/Makefile | 14 +++++++++++++-
debug/libc-stack_chk_fail_local.c | 3 +++
2 files changed, 16 insertions(+), 1 deletion(-)
create mode 100644 debug/libc-stack_chk_fail_local.c
diff --git a/debug/Makefile b/debug/Makefile
index 6b5f31e..27da081 100644
--- a/debug/Makefile
+++ b/debug/Makefile
@@ -48,9 +48,21 @@ routines = backtrace backtracesyms backtracesymsfd noophooks \
vdprintf_chk obprintf_chk \
longjmp_chk ____longjmp_chk \
fdelt_chk poll_chk ppoll_chk \
- stack_chk_fail fortify_fail \
+ stack_chk_fail fortify_fail libc-stack_chk_fail_local \
$(static-only-routines)
+
+# stack_chk_fail_local must be non-PIC, thus static-only, but we also
+# want an identical thunk hidden in libc.so to avoid going via the PLT.
+
static-only-routines := warning-nop stack_chk_fail_local
+shared-only-routines += libc-stack_chk_fail_local
+
+# Building the stack-protector failure routines with stack protection
+# makes no sense.
+
+CFLAGS-stack_chk_fail.c = $(no-stack-protector)
+CFLAGS-stack_chk_fail_local.c = $(no-stack-protector)
+CFLAGS-libc-stack_chk_fail_local.c = $(no-stack-protector)
CFLAGS-backtrace.c = -fno-omit-frame-pointer
CFLAGS-sprintf_chk.c = $(libio-mtsafe)
diff --git a/debug/libc-stack_chk_fail_local.c b/debug/libc-stack_chk_fail_local.c
new file mode 100644
index 0000000..73da970
--- /dev/null
+++ b/debug/libc-stack_chk_fail_local.c
@@ -0,0 +1,3 @@
+/* This goes into the shared libc. */
+
+#include <stack_chk_fail_local.c>
--
2.7.0.198.g6dd47b6
^ permalink raw reply [flat|nested] 46+ messages in thread* [PATCH 12/17 v3] Link various tests with -fno-stack-protector.
2016-03-13 15:17 --enable-stack-protector for glibc, v6 Nix
` (11 preceding siblings ...)
2016-03-13 15:19 ` [PATCH 10/17 v6] Add stack_chk_fail_local to libc.so Nix
@ 2016-03-13 15:19 ` Nix
2016-03-13 15:19 ` [PATCH 08/17 v6] Prevent the rtld mapfile computation from dragging in __stack_chk_fail* Nix
` (4 subsequent siblings)
17 siblings, 0 replies; 46+ messages in thread
From: Nix @ 2016-03-13 15:19 UTC (permalink / raw)
To: libc-alpha
From: Nick Alcock <nick.alcock@oracle.com>
These tests do not link with libc, so cannot see __stack_chk_fail().
v3: Use $(no-stack-protector).
* elf/Makefile (CFLAGS-filtmod1.c): Use $(no-stack-protector) for
non-libc-linking testcase.
(CFLAGS-filtmod2.c): Likewise.
* stdlib/Makefile (CFLAGS-tst-putenvmod.c): Likewise.
* sysdeps/x86_64/Makefile (CFLAGS-tst-quad1pie.c): Likewise.
(CFLAGS-tst-quad2pie.c): Likewise.
---
elf/Makefile | 4 ++++
stdlib/Makefile | 3 +++
sysdeps/x86_64/Makefile | 3 +++
3 files changed, 10 insertions(+)
diff --git a/elf/Makefile b/elf/Makefile
index d1e29a58..185731e 100644
--- a/elf/Makefile
+++ b/elf/Makefile
@@ -752,6 +752,10 @@ $(objpfx)filtmod1.so: $(objpfx)filtmod1.os $(objpfx)filtmod2.so
$< -Wl,-F,$(objpfx)filtmod2.so
$(objpfx)filter: $(objpfx)filtmod1.so
+# These do not link against libc.
+CFLAGS-filtmod1.c = $(no-stack-protector)
+CFLAGS-filtmod2.c = $(no-stack-protector)
+
$(objpfx)unload: $(libdl)
$(objpfx)unload.out: $(objpfx)unloadmod.so
diff --git a/stdlib/Makefile b/stdlib/Makefile
index 26fe67a..d601b87 100644
--- a/stdlib/Makefile
+++ b/stdlib/Makefile
@@ -164,6 +164,9 @@ LDFLAGS-tst-putenv = $(no-as-needed)
$(objpfx)tst-putenvmod.so: $(objpfx)tst-putenvmod.os $(link-libc-deps)
$(build-module)
+# This is not only not in libc, it's not even linked with it.
+CFLAGS-tst-putenvmod.c += $(no-stack-protector)
+
libof-tst-putenvmod = extramodules
$(objpfx)bug-getcontext: $(libm)
diff --git a/sysdeps/x86_64/Makefile b/sysdeps/x86_64/Makefile
index 67ed5ba..6caa74a 100644
--- a/sysdeps/x86_64/Makefile
+++ b/sysdeps/x86_64/Makefile
@@ -40,6 +40,9 @@ quad-pie-test += tst-quad1pie tst-quad2pie
tests += $(quad-pie-test)
tests-pie += $(quad-pie-test)
+CFLAGS-tst-quad1pie.c = $(no-stack-protector)
+CFLAGS-tst-quad2pie.c = $(no-stack-protector)
+
$(objpfx)tst-quad1pie: $(objpfx)tst-quadmod1pie.o
$(objpfx)tst-quad2pie: $(objpfx)tst-quadmod2pie.o
--
2.7.0.198.g6dd47b6
^ permalink raw reply [flat|nested] 46+ messages in thread* [PATCH 08/17 v6] Prevent the rtld mapfile computation from dragging in __stack_chk_fail*.
2016-03-13 15:17 --enable-stack-protector for glibc, v6 Nix
` (12 preceding siblings ...)
2016-03-13 15:19 ` [PATCH 12/17 v3] Link various tests with -fno-stack-protector Nix
@ 2016-03-13 15:19 ` Nix
2016-03-13 15:19 ` [PATCH 16/17 v5] x86, pthread_cond_*wait: Do not depend on %eax not being clobbered Nix
` (3 subsequent siblings)
17 siblings, 0 replies; 46+ messages in thread
From: Nix @ 2016-03-13 15:19 UTC (permalink / raw)
To: libc-alpha
From: Nick Alcock <nick.alcock@oracle.com>
The previous commit prevented rtld itself from being built with
-fstack-protector, but this is not quite enough. We identify which
objects belong in rtld via a test link and analysis of the resulting
mapfile. That link is necessarily done against objects that are
stack-protected, so drags in __stack_chk_fail_local, __stack_chk_fail,
and all the libc and libio code they use.
To stop this happening, use --defsym in the test librtld.map-production
link to force the linker to predefine these two symbols (to 0, but it
could be to anything). (In a real link, this would of course be
catastrophic, but these object files are never used for anything else.)
v2: New.
v6: Dummy out stack_chk_fail_local too.
* elf/Makefile (dummy-stack-chk-fail): New.
($(objpfx)librtld.map): Use it.
---
elf/Makefile | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/elf/Makefile b/elf/Makefile
index 0037cca..d1e29a58 100644
--- a/elf/Makefile
+++ b/elf/Makefile
@@ -349,9 +349,20 @@ $(objpfx)dl-allobjs.os: $(all-rtld-routines:%=$(objpfx)%.os)
# are compiled with special flags, and puts these modules into rtld-libc.a
# for us. Then we do the real link using rtld-libc.a instead of libc_pic.a.
+# If the compiler can do SSP, build the mapfile with dummy __stack_chk_fail
+# and __stack_chk_fail_local symbols defined, to prevent the real things
+# being dragged into rtld even though rtld is never built with stack-protection.
+
+ifeq ($(have-ssp),yes)
+dummy-stack-chk-fail := -Wl,--defsym='__stack_chk_fail=0' \
+ -Wl,--defsym='__stack_chk_fail_local=0'
+else
+dummy-stack-chk-fail :=
+endif
+
$(objpfx)librtld.map: $(objpfx)dl-allobjs.os $(common-objpfx)libc_pic.a
@-rm -f $@T
- $(reloc-link) -o $@.o '-Wl,-(' $^ -lgcc '-Wl,-)' -Wl,-Map,$@T
+ $(reloc-link) -o $@.o $(dummy-stack-chk-fail) '-Wl,-(' $^ -lgcc '-Wl,-)' -Wl,-Map,$@T
rm -f $@.o
mv -f $@T $@
--
2.7.0.198.g6dd47b6
^ permalink raw reply [flat|nested] 46+ messages in thread* [PATCH 16/17 v5] x86, pthread_cond_*wait: Do not depend on %eax not being clobbered
2016-03-13 15:17 --enable-stack-protector for glibc, v6 Nix
` (13 preceding siblings ...)
2016-03-13 15:19 ` [PATCH 08/17 v6] Prevent the rtld mapfile computation from dragging in __stack_chk_fail* Nix
@ 2016-03-13 15:19 ` Nix
2016-03-14 20:01 ` Florian Weimer
2016-03-13 15:20 ` [PATCH 04/17 v5] Mark all machinery needed in early static-link init as -fno-stack-protector Nix
` (2 subsequent siblings)
17 siblings, 1 reply; 46+ messages in thread
From: Nix @ 2016-03-13 15:19 UTC (permalink / raw)
To: libc-alpha
From: Nick Alcock <nick.alcock@oracle.com>
The x86-specific versions of both pthread_cond_wait and
pthread_cond_timedwait have (in their fall-back-to-futex-wait slow
paths) calls to __pthread_mutex_cond_lock_adjust followed by
__pthread_mutex_unlock_usercnt, which load the parameters before the
first call but then assume that the first parameter, in %eax, will
survive unaffected. This happens to have been true before now, but %eax
is a call-clobbered register, and this assumption is not safe: it could
change at any time, at GCC's whim, and indeed the stack-protector canary
checking code clobbers %eax while checking that the canary is
uncorrupted.
So reload %eax before calling __pthread_mutex_unlock_usercnt. (Do this
unconditionally, even when stack-protection is not in use, because it's
the right thing to do, it's a slow path, and anything else is dicing
with death.)
v5: New.
* sysdeps/unix/sysv/linux/i386/pthread_cond_timedwait.S: Reload
call-clobbered %eax on retry path.
* sysdeps/unix/sysv/linux/i386/pthread_cond_wait.S: Likewise.
---
sysdeps/unix/sysv/linux/i386/pthread_cond_timedwait.S | 1 +
sysdeps/unix/sysv/linux/i386/pthread_cond_wait.S | 1 +
2 files changed, 2 insertions(+)
diff --git a/sysdeps/unix/sysv/linux/i386/pthread_cond_timedwait.S b/sysdeps/unix/sysv/linux/i386/pthread_cond_timedwait.S
index 96f8a8d..6256376 100644
--- a/sysdeps/unix/sysv/linux/i386/pthread_cond_timedwait.S
+++ b/sysdeps/unix/sysv/linux/i386/pthread_cond_timedwait.S
@@ -297,6 +297,7 @@ __pthread_cond_timedwait:
correctly. */
movl dep_mutex(%ebx), %eax
call __pthread_mutex_cond_lock_adjust
+ movl dep_mutex(%ebx), %eax
xorl %edx, %edx
call __pthread_mutex_unlock_usercnt
jmp 8b
diff --git a/sysdeps/unix/sysv/linux/i386/pthread_cond_wait.S b/sysdeps/unix/sysv/linux/i386/pthread_cond_wait.S
index 94302b0..5016718 100644
--- a/sysdeps/unix/sysv/linux/i386/pthread_cond_wait.S
+++ b/sysdeps/unix/sysv/linux/i386/pthread_cond_wait.S
@@ -309,6 +309,7 @@ __pthread_cond_wait:
correctly. */
movl dep_mutex(%ebx), %eax
call __pthread_mutex_cond_lock_adjust
+ movl dep_mutex(%ebx), %eax
xorl %edx, %edx
call __pthread_mutex_unlock_usercnt
jmp 8b
--
2.7.0.198.g6dd47b6
^ permalink raw reply [flat|nested] 46+ messages in thread* Re: [PATCH 16/17 v5] x86, pthread_cond_*wait: Do not depend on %eax not being clobbered
2016-03-13 15:19 ` [PATCH 16/17 v5] x86, pthread_cond_*wait: Do not depend on %eax not being clobbered Nix
@ 2016-03-14 20:01 ` Florian Weimer
2016-03-14 23:36 ` Nix
0 siblings, 1 reply; 46+ messages in thread
From: Florian Weimer @ 2016-03-14 20:01 UTC (permalink / raw)
To: Nix; +Cc: libc-alpha
On 03/13/2016 04:17 PM, Nix wrote:
> From: Nick Alcock <nick.alcock@oracle.com>
> * sysdeps/unix/sysv/linux/i386/pthread_cond_timedwait.S: Reload
> call-clobbered %eax on retry path.
> * sysdeps/unix/sysv/linux/i386/pthread_cond_wait.S: Likewise.
Looks good. Can you commit this yourself, or do you need someone to
commit it for you?
Thanks,
Florian
^ permalink raw reply [flat|nested] 46+ messages in thread
* Re: [PATCH 16/17 v5] x86, pthread_cond_*wait: Do not depend on %eax not being clobbered
2016-03-14 20:01 ` Florian Weimer
@ 2016-03-14 23:36 ` Nix
2016-03-23 15:02 ` Florian Weimer
0 siblings, 1 reply; 46+ messages in thread
From: Nix @ 2016-03-14 23:36 UTC (permalink / raw)
To: Florian Weimer; +Cc: libc-alpha
On 14 Mar 2016, Florian Weimer said:
> On 03/13/2016 04:17 PM, Nix wrote:
>> From: Nick Alcock <nick.alcock@oracle.com>
>
>> * sysdeps/unix/sysv/linux/i386/pthread_cond_timedwait.S: Reload
>> call-clobbered %eax on retry path.
>> * sysdeps/unix/sysv/linux/i386/pthread_cond_wait.S: Likewise.
>
> Looks good. Can you commit this yourself, or do you need someone to
> commit it for you?
I don't have commit rights, so if you or someone else wants to commit
it, commit away!
(and if anyone has any more comments on the rest of the patch, do fire
away with slings and arrows etc. I'd hope it's converging on something
acceptable after this many rounds... :) )
--
NULL && (void)
^ permalink raw reply [flat|nested] 46+ messages in thread
* Re: [PATCH 16/17 v5] x86, pthread_cond_*wait: Do not depend on %eax not being clobbered
2016-03-14 23:36 ` Nix
@ 2016-03-23 15:02 ` Florian Weimer
2016-04-04 22:09 ` Nix
0 siblings, 1 reply; 46+ messages in thread
From: Florian Weimer @ 2016-03-23 15:02 UTC (permalink / raw)
To: Nix; +Cc: libc-alpha
On 03/15/2016 12:36 AM, Nix wrote:
> On 14 Mar 2016, Florian Weimer said:
>
>> On 03/13/2016 04:17 PM, Nix wrote:
>>> From: Nick Alcock <nick.alcock@oracle.com>
>>
>>> * sysdeps/unix/sysv/linux/i386/pthread_cond_timedwait.S: Reload
>>> call-clobbered %eax on retry path.
>>> * sysdeps/unix/sysv/linux/i386/pthread_cond_wait.S: Likewise.
>>
>> Looks good. Can you commit this yourself, or do you need someone to
>> commit it for you?
>
> I don't have commit rights, so if you or someone else wants to commit
> it, commit away!
I have pushed this.
Thanks,
Florian
^ permalink raw reply [flat|nested] 46+ messages in thread
* Re: [PATCH 16/17 v5] x86, pthread_cond_*wait: Do not depend on %eax not being clobbered
2016-03-23 15:02 ` Florian Weimer
@ 2016-04-04 22:09 ` Nix
0 siblings, 0 replies; 46+ messages in thread
From: Nix @ 2016-04-04 22:09 UTC (permalink / raw)
To: Florian Weimer; +Cc: libc-alpha
On 23 Mar 2016, Florian Weimer told this:
> On 03/15/2016 12:36 AM, Nix wrote:
>> On 14 Mar 2016, Florian Weimer said:
>>
>>> On 03/13/2016 04:17 PM, Nix wrote:
>>>> From: Nick Alcock <nick.alcock@oracle.com>
>>>
>>>> * sysdeps/unix/sysv/linux/i386/pthread_cond_timedwait.S: Reload
>>>> call-clobbered %eax on retry path.
>>>> * sysdeps/unix/sysv/linux/i386/pthread_cond_wait.S: Likewise.
>>>
>>> Looks good. Can you commit this yourself, or do you need someone to
>>> commit it for you?
>>
>> I don't have commit rights, so if you or someone else wants to commit
>> it, commit away!
>
> I have pushed this.
Thank you!
... now, is there anything I can do to the rest to make people happier?
I think I've addressed all the review comments...
--
NULL && (void)
^ permalink raw reply [flat|nested] 46+ messages in thread
* [PATCH 04/17 v5] Mark all machinery needed in early static-link init as -fno-stack-protector.
2016-03-13 15:17 --enable-stack-protector for glibc, v6 Nix
` (14 preceding siblings ...)
2016-03-13 15:19 ` [PATCH 16/17 v5] x86, pthread_cond_*wait: Do not depend on %eax not being clobbered Nix
@ 2016-03-13 15:20 ` Nix
2016-04-10 4:02 ` Mike Frysinger
2016-03-13 15:20 ` [PATCH 09/17 v6] Work even with compilers hacked to enable -fstack-protector by default Nix
2016-03-18 11:48 ` --enable-stack-protector for glibc, v6 Nix
17 siblings, 1 reply; 46+ messages in thread
From: Nix @ 2016-03-13 15:20 UTC (permalink / raw)
To: libc-alpha
From: Nick Alcock <nick.alcock@oracle.com>
The startup code in csu/, brk() and sbrk(), and the
__pthread_initialize_tcb_internal() function we just introduced are
needed very early in initialization of a statically-linked program,
before the stack guard is initialized. Mark all of these as
-fno-stack-protector.
We also finally introduce @libc_cv_ssp@ and @no-stack-protector@, both
substituted by the configury changes made earlier, to detect the case
when -fno-stack-protector is supported by the compiler, and
unconditionally pass it in when this is the case, whether or not
--enable-stack-protector is passed to configure. (This means that
it'll even work when the compiler's been hacked to pass
-fstack-protector by default, unless the hackage is so broken that
it does so in a way that is impossible to override.)
(At one point we marked __libc_fatal() as non-stack-protected too,
but this was pointless: all it did was call other routines which *are*
stack-protected. The earliest __libc_fatal() call is in the
DL_SYSDEP_OSCHECK hook on some platforms, when statically linking:
this is fine, since it is after TLS and stack-canary initialization.
I have tested invocation of programs statically and dynamically
linked against this glibc on older kernels on x86 and ARM, and they
still "work", i.e. fail with the appropriate message.)
v2: No longer mark memcpy() as -fno-stack-protector.
v3: Use $(no-stack-protector).
v4: Use inhibit_stack_protector rather than de-protecting all of nptl-init.c.
v5: Don't stack-protect brk() and sbrk() in the shared library.
* config.make.in (have-ssp): New.
(no-stack-protector): New.
* csu/Makefile (CFLAGS-.o): Use it.
(CFLAGS-.og): Likewise.
(CFLAGS-.op): Likewise.
(CFLAGS-.os): Likewise.
* misc/Makefile (CFLAGS-sbrk.o): Likewise.
(CFLAGS-sbrk.op): Likewise.
(CFLAGS-sbrk.og): Likewise.
(CFLAGS-brk.o): Likewise.
(CFLAGS-brk.op): Likewise.
(CFLAGS-brk.og): Likewise.
* nptl/nptl-init.c [!SHARED] (__pthread_initialize_tcb_internal):
Likewise.
---
config.make.in | 2 ++
csu/Makefile | 5 +++++
misc/Makefile | 8 ++++++++
nptl/nptl-init.c | 1 +
4 files changed, 16 insertions(+)
diff --git a/config.make.in b/config.make.in
index 05ed6ec..9afd4ff 100644
--- a/config.make.in
+++ b/config.make.in
@@ -55,7 +55,9 @@ with-fp = @with_fp@
enable-timezone-tools = @enable_timezone_tools@
unwind-find-fde = @libc_cv_gcc_unwind_find_fde@
have-fpie = @libc_cv_fpie@
+have-ssp = @libc_cv_ssp@
stack-protector = @stack_protector@
+no-stack-protector = @no_stack_protector@
have-selinux = @have_selinux@
have-libaudit = @have_libaudit@
have-libcap = @have_libcap@
diff --git a/csu/Makefile b/csu/Makefile
index 31e8bb9..22afe67 100644
--- a/csu/Makefile
+++ b/csu/Makefile
@@ -45,6 +45,11 @@ before-compile += $(objpfx)version-info.h
tests := tst-empty tst-atomic tst-atomic-long
tests-static := tst-empty
+CFLAGS-.o += $(no-stack-protector)
+CFLAGS-.og += $(no-stack-protector)
+CFLAGS-.op += $(no-stack-protector)
+CFLAGS-.os += $(no-stack-protector)
+
ifeq (yes,$(build-shared))
extra-objs += S$(start-installed-name) gmon-start.os
ifneq ($(start-installed-name),$(static-start-installed-name))
diff --git a/misc/Makefile b/misc/Makefile
index d7bbc85..e3062f8 100644
--- a/misc/Makefile
+++ b/misc/Makefile
@@ -99,6 +99,14 @@ CFLAGS-getusershell.c = -fexceptions
CFLAGS-err.c = -fexceptions
CFLAGS-tst-tsearch.c = $(stack-align-test-flags)
+# Called during static library initialization.
+CFLAGS-sbrk.o = $(no-stack-protector)
+CFLAGS-sbrk.op = $(no-stack-protector)
+CFLAGS-sbrk.og = $(no-stack-protector)
+CFLAGS-brk.o = $(no-stack-protector)
+CFLAGS-brk.op = $(no-stack-protector)
+CFLAGS-brk.og = $(no-stack-protector)
+
include ../Rules
$(objpfx)libg.a: $(dep-dummy-lib); $(make-dummy-lib)
diff --git a/nptl/nptl-init.c b/nptl/nptl-init.c
index a4626be..2775d14 100644
--- a/nptl/nptl-init.c
+++ b/nptl/nptl-init.c
@@ -298,6 +298,7 @@ static bool __nptl_initial_report_events __attribute_used__;
#ifndef SHARED
void
+inhibit_stack_protector
__pthread_initialize_tcb_internal (void)
{
/* Unlike in the dynamically linked case the dynamic linker has not
--
2.7.0.198.g6dd47b6
^ permalink raw reply [flat|nested] 46+ messages in thread* Re: [PATCH 04/17 v5] Mark all machinery needed in early static-link init as -fno-stack-protector.
2016-03-13 15:20 ` [PATCH 04/17 v5] Mark all machinery needed in early static-link init as -fno-stack-protector Nix
@ 2016-04-10 4:02 ` Mike Frysinger
2016-04-10 11:27 ` Nix
0 siblings, 1 reply; 46+ messages in thread
From: Mike Frysinger @ 2016-04-10 4:02 UTC (permalink / raw)
To: Nix; +Cc: libc-alpha
[-- Attachment #1: Type: text/plain, Size: 793 bytes --]
On 13 Mar 2016 15:16, Nix wrote:
> We also finally introduce @libc_cv_ssp@ and @no-stack-protector@, both
@no_stack_protector@
> --- a/csu/Makefile
> +++ b/csu/Makefile
>
> +CFLAGS-.o += $(no-stack-protector)
> +CFLAGS-.og += $(no-stack-protector)
> +CFLAGS-.op += $(no-stack-protector)
> +CFLAGS-.os += $(no-stack-protector)
is there a format you're trying to avoid ? *.oS ?
could use a comment.
> --- a/misc/Makefile
> +++ b/misc/Makefile
>
> +# Called during static library initialization.
> +CFLAGS-sbrk.o = $(no-stack-protector)
> +CFLAGS-sbrk.op = $(no-stack-protector)
> +CFLAGS-sbrk.og = $(no-stack-protector)
> +CFLAGS-brk.o = $(no-stack-protector)
> +CFLAGS-brk.op = $(no-stack-protector)
> +CFLAGS-brk.og = $(no-stack-protector)
same here
-mike
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]
^ permalink raw reply [flat|nested] 46+ messages in thread
* Re: [PATCH 04/17 v5] Mark all machinery needed in early static-link init as -fno-stack-protector.
2016-04-10 4:02 ` Mike Frysinger
@ 2016-04-10 11:27 ` Nix
2016-05-15 10:01 ` Nix
0 siblings, 1 reply; 46+ messages in thread
From: Nix @ 2016-04-10 11:27 UTC (permalink / raw)
To: libc-alpha
On 10 Apr 2016, Mike Frysinger outgrape:
> On 13 Mar 2016 15:16, Nix wrote:
>> We also finally introduce @libc_cv_ssp@ and @no-stack-protector@, both
>
> @no_stack_protector@
>
>> --- a/csu/Makefile
>> +++ b/csu/Makefile
>>
>> +CFLAGS-.o += $(no-stack-protector)
>> +CFLAGS-.og += $(no-stack-protector)
>> +CFLAGS-.op += $(no-stack-protector)
>> +CFLAGS-.os += $(no-stack-protector)
>
> is there a format you're trying to avoid ? *.oS ?
Not particularly. If CFLAGS on its own works, I could use that.
>> --- a/misc/Makefile
>> +++ b/misc/Makefile
>>
>> +# Called during static library initialization.
>> +CFLAGS-sbrk.o = $(no-stack-protector)
>> +CFLAGS-sbrk.op = $(no-stack-protector)
>> +CFLAGS-sbrk.og = $(no-stack-protector)
>> +CFLAGS-brk.o = $(no-stack-protector)
>> +CFLAGS-brk.op = $(no-stack-protector)
>> +CFLAGS-brk.og = $(no-stack-protector)
>
> same here
Now this is .os-avoidance. I assumed the mention of static library
initialization was sufficient, but I could add ', so turn it off for
non-.os' or something if you like.
--
NULL && (void)
^ permalink raw reply [flat|nested] 46+ messages in thread
* Re: [PATCH 04/17 v5] Mark all machinery needed in early static-link init as -fno-stack-protector.
2016-04-10 11:27 ` Nix
@ 2016-05-15 10:01 ` Nix
0 siblings, 0 replies; 46+ messages in thread
From: Nix @ 2016-05-15 10:01 UTC (permalink / raw)
To: libc-alpha
On 10 Apr 2016, nix@esperi.org.uk said:
> On 10 Apr 2016, Mike Frysinger outgrape:
>
>> On 13 Mar 2016 15:16, Nix wrote:
>>> We also finally introduce @libc_cv_ssp@ and @no-stack-protector@, both
>>
>> @no_stack_protector@
>>
>>> --- a/csu/Makefile
>>> +++ b/csu/Makefile
>>>
>>> +CFLAGS-.o += $(no-stack-protector)
>>> +CFLAGS-.og += $(no-stack-protector)
>>> +CFLAGS-.op += $(no-stack-protector)
>>> +CFLAGS-.os += $(no-stack-protector)
>>
>> is there a format you're trying to avoid ? *.oS ?
>
> Not particularly. If CFLAGS on its own works, I could use that.
It doesn't. We have to explicitly name the lot. (*.oS is not affected by
this, which is the only reason I'm not naming it...)
--
NULL && (void)
^ permalink raw reply [flat|nested] 46+ messages in thread
* [PATCH 09/17 v6] Work even with compilers hacked to enable -fstack-protector by default.
2016-03-13 15:17 --enable-stack-protector for glibc, v6 Nix
` (15 preceding siblings ...)
2016-03-13 15:20 ` [PATCH 04/17 v5] Mark all machinery needed in early static-link init as -fno-stack-protector Nix
@ 2016-03-13 15:20 ` Nix
2016-04-10 4:04 ` Mike Frysinger
2016-03-18 11:48 ` --enable-stack-protector for glibc, v6 Nix
17 siblings, 1 reply; 46+ messages in thread
From: Nix @ 2016-03-13 15:20 UTC (permalink / raw)
To: libc-alpha
From: Nick Alcock <nick.alcock@oracle.com>
With all the machinery we just added, we can easily arrange to work even
when the compiler passes in -fstack-protector automatically: all the
necessary bits of glibc are always compiled with -fno-stack-protector
now.
So tear out the check in configure, and add appropriate calls to
-fno-stack-protector in tests that need them (largely those that use
-nostdlib), since we don't yet have a __stack_chk_fail() that those
tests can rely upon. (GCC often provides one, but we cannot rely on
this, especially not when bootstrapping.)
v2: No longer pass in -lssp to anything.
v5: Remove accidentally duplicated $(no_ssp)s.
v6: Small revisions following Mike Frysinger's review.
* configure.ac: Add check for unsupported stack-protection level.
(libc_cv_predef_stack_protector): Remove.
(no_ssp): New variable.
(libc_cv_ld_gnu_indirect_function): Use it.
(libc_cv_asm_set_directive): Likewise.
(libc_cv_protected_data): Likewise.
(libc_cv_z_combreloc): Likewise.
(libc_cv_hashstyle): Likewise.
(libc_cv_has_glob_dat): Likewise.
(libc_cv_output_format): Likewise.
(libc_cv_ehdr_start): Likewise.
* aclocal.m4 (LIBC_TRY_LINK_STATIC): Likewise.
(LIBC_LINKER_FEATURE): Likewise.
(LIBC_COMPILER_BUILTIN_INLINED): Likewise.
---
aclocal.m4 | 6 +++---
configure.ac | 70 ++++++++++++++++++------------------------------------------
2 files changed, 24 insertions(+), 52 deletions(-)
diff --git a/aclocal.m4 b/aclocal.m4
index 3d64f77..6902155 100644
--- a/aclocal.m4
+++ b/aclocal.m4
@@ -141,7 +141,7 @@ int _start (void) { return 0; }
int __start (void) { return 0; }
$1
EOF
-AS_IF([AC_TRY_COMMAND([${CC-cc} $CFLAGS $CPPFLAGS $LDFLAGS -o conftest
+AS_IF([AC_TRY_COMMAND([${CC-cc} $CFLAGS $CPPFLAGS $LDFLAGS $no_ssp -o conftest
conftest.c -static -nostartfiles -nostdlib
1>&AS_MESSAGE_LOG_FD])],
[$2], [$3])
@@ -226,7 +226,7 @@ if test x"$gnu_ld" = x"yes"; then
cat > conftest.c <<EOF
int _start (void) { return 42; }
EOF
- if AC_TRY_COMMAND([${CC-cc} $CFLAGS $CPPFLAGS $LDFLAGS
+ if AC_TRY_COMMAND([${CC-cc} $CFLAGS $CPPFLAGS $LDFLAGS $no_ssp
$2 -nostdlib -nostartfiles
-fPIC -shared -o conftest.so conftest.c
1>&AS_MESSAGE_LOG_FD])
@@ -268,7 +268,7 @@ libc_compiler_builtin_inlined=no
cat > conftest.c <<EOF
int _start (void) { $2 return 0; }
EOF
-if ! AC_TRY_COMMAND([${CC-cc} $CFLAGS $CPPFLAGS $LDFLAGS
+if ! AC_TRY_COMMAND([${CC-cc} $CFLAGS $CPPFLAGS $LDFLAGS $no_ssp
$3 -nostdlib -nostartfiles
-S conftest.c -o - | fgrep "$1"
1>&AS_MESSAGE_LOG_FD])
diff --git a/configure.ac b/configure.ac
index 6ad87f5..a11dd10 100644
--- a/configure.ac
+++ b/configure.ac
@@ -653,6 +653,18 @@ AC_SUBST(libc_cv_ssp)
AC_SUBST(stack_protector)
AC_SUBST(no_stack_protector)
+if test -n "$stack_protector"; then
+ dnl Don't run configure tests with stack-protection on, to avoid problems with
+ dnl bootstrapping.
+ no_ssp=-fno-stack-protector
+else
+ no_ssp=
+
+ if test "$enable_stack_protector" != no; then
+ AC_MSG_ERROR([--enable-stack-protector=$enable_stack_protector specified, but specified level of stack protection is not supported by the compiler.])
+ fi
+fi
+
# For the multi-arch option we need support in the assembler & linker.
AC_CACHE_CHECK([for assembler and linker STT_GNU_IFUNC support],
libc_cv_ld_gnu_indirect_function, [dnl
@@ -672,7 +684,7 @@ __start:
EOF
libc_cv_ld_gnu_indirect_function=no
if ${CC-cc} $CFLAGS $CPPFLAGS $LDFLAGS \
- -nostartfiles -nostdlib \
+ -nostartfiles -nostdlib $no_ssp \
-o conftest conftest.S 1>&AS_MESSAGE_LOG_FD 2>&AS_MESSAGE_LOG_FD; then
# Do a link to see if the backend supports IFUNC relocs.
$READELF -r conftest 1>&AS_MESSAGE_LOG_FD
@@ -1141,7 +1153,7 @@ extern int glibc_conftest_frobozz;
void _start() { glibc_conftest_frobozz = 1; }
EOF
if ${CC-cc} $CFLAGS $CPPFLAGS $LDFLAGS \
- -nostartfiles -nostdlib \
+ -nostartfiles -nostdlib $no_ssp \
-o conftest conftest.s conftest1.c 1>&AS_MESSAGE_LOG_FD 2>&AS_MESSAGE_LOG_FD; then
libc_cv_asm_set_directive=yes
else
@@ -1158,12 +1170,12 @@ AC_CACHE_CHECK(linker support for protected data symbol,
int bar __attribute__ ((visibility ("protected"))) = 1;
EOF
libc_cv_protected_data=no
- if AC_TRY_COMMAND(${CC-cc} -nostdlib -nostartfiles -fPIC -shared conftest.c -o conftest.so); then
+ if AC_TRY_COMMAND(${CC-cc} -nostdlib -nostartfiles $no_ssp -fPIC -shared conftest.c -o conftest.so); then
cat > conftest.c <<EOF
extern int bar;
int main (void) { return bar; }
EOF
- if AC_TRY_COMMAND(${CC-cc} -nostdlib -nostartfiles conftest.c -o conftest conftest.so); then
+ if AC_TRY_COMMAND(${CC-cc} -nostdlib -nostartfiles $no_ssp conftest.c -o conftest conftest.so); then
libc_cv_protected_data=yes
fi
fi
@@ -1285,7 +1297,7 @@ extern int mumble;
int foo (void) { return bar (mumble); }
EOF
if AC_TRY_COMMAND([${CC-cc} $CFLAGS $CPPFLAGS $LDFLAGS
- -fPIC -shared -o conftest.so conftest.c
+ -fPIC -shared $no_ssp -o conftest.so conftest.c
-nostdlib -nostartfiles
-Wl,-z,combreloc 1>&AS_MESSAGE_LOG_FD])
then
@@ -1323,7 +1335,7 @@ AC_CACHE_CHECK(for --hash-style option,
cat > conftest.c <<EOF
int _start (void) { return 42; }
EOF
-if AC_TRY_COMMAND([${CC-cc} $CFLAGS $CPPFLAGS $LDFLAGS
+if AC_TRY_COMMAND([${CC-cc} $CFLAGS $CPPFLAGS $LDFLAGS $no_ssp
-fPIC -shared -o conftest.so conftest.c
-Wl,--hash-style=both -nostdlib 1>&AS_MESSAGE_LOG_FD])
then
@@ -1395,7 +1407,7 @@ int foo (void) { return mumble; }
EOF
if AC_TRY_COMMAND([${CC-cc} $CFLAGS $CPPFLAGS $LDFLAGS
-fPIC -shared -o conftest.so conftest.c
- -nostdlib -nostartfiles
+ -nostdlib -nostartfiles $no_ssp
1>&AS_MESSAGE_LOG_FD])
then
dnl look for GLOB_DAT relocation.
@@ -1412,7 +1424,7 @@ AC_SUBST(libc_cv_has_glob_dat)
AC_CACHE_CHECK(linker output format, libc_cv_output_format, [dnl
if libc_cv_output_format=`
-${CC-cc} -nostartfiles -nostdlib -Wl,--print-output-format 2>&AS_MESSAGE_LOG_FD`
+${CC-cc} -nostartfiles -nostdlib $no_ssp -Wl,--print-output-format 2>&AS_MESSAGE_LOG_FD`
then
:
else
@@ -1611,46 +1623,6 @@ if test $libc_cv_predef_fortify_source = yes; then
fi
AC_SUBST(CPPUNDEFS)
-dnl Check for silly hacked compilers inserting -fstack-protector.
-dnl This breaks badly for the early startup code we compile, since
-dnl the compiled code can refer to a magic machine-dependent location
-dnl for the canary value before we have sufficient setup for that to
-dnl work. It's also questionable to build all of libc with this flag
-dnl even when you're doing that for most applications you build, since
-dnl libc's code is so heavily-used and performance-sensitive. If we
-dnl ever really want to make that work, it should be enabled explicitly
-dnl in the libc build, not inherited from implicit compiler settings.
-AC_CACHE_CHECK([whether $CC implicitly enables -fstack-protector],
- libc_cv_predef_stack_protector, [
-AC_TRY_COMPILE([extern void foobar (char *);],
- [char large_array[2048]; foobar (large_array);], [
-libc_undefs=`$NM -u conftest.o |
- LC_ALL=C $AWK '$1 == "U" { print $2 | "sort -u"; next } { exit(1) }' \
- 2>&AS_MESSAGE_LOG_FD` || {
- AC_MSG_ERROR([confusing output from $NM -u])
-}
-echo >&AS_MESSAGE_LOG_FD "libc_undefs='$libc_undefs'"
-# On some architectures, there are architecture-specific undefined
-# symbols (resolved by the linker), so filter out unknown symbols.
-# This will fail to produce the correct result if the compiler
-# defaults to -fstack-protector but this produces an undefined symbol
-# other than __stack_chk_fail. However, compilers like that have not
-# been encountered in practice.
-libc_undefs=`echo "$libc_undefs" | egrep '^(foobar|__stack_chk_fail)$'`
-case "$libc_undefs" in
-foobar) libc_cv_predef_stack_protector=no ;;
-'__stack_chk_fail
-foobar') libc_cv_predef_stack_protector=yes ;;
-*) AC_MSG_ERROR([unexpected symbols in test: $libc_undefs]) ;;
-esac],
- [AC_MSG_ERROR([test compilation failed])])
-])
-libc_extra_cflags=
-if test $libc_cv_predef_stack_protector = yes; then
- libc_extra_cflags="$libc_extra_cflags -fno-stack-protector"
-fi
-libc_extra_cppflags=
-
# Some linkers on some architectures support __ehdr_start but with
# bugs. Make sure usage of it does not create relocations in the
# output (as the linker should resolve them all for us).
@@ -1660,7 +1632,7 @@ old_CFLAGS="$CFLAGS"
old_LDFLAGS="$LDFLAGS"
old_LIBS="$LIBS"
CFLAGS="$CFLAGS -fPIC"
-LDFLAGS="$LDFLAGS -nostdlib -nostartfiles -shared"
+LDFLAGS="$LDFLAGS -nostdlib -nostartfiles -shared $no_ssp"
LIBS=
AC_LINK_IFELSE([AC_LANG_SOURCE([
typedef struct {
--
2.7.0.198.g6dd47b6
^ permalink raw reply [flat|nested] 46+ messages in thread* Re: --enable-stack-protector for glibc, v6
2016-03-13 15:17 --enable-stack-protector for glibc, v6 Nix
` (16 preceding siblings ...)
2016-03-13 15:20 ` [PATCH 09/17 v6] Work even with compilers hacked to enable -fstack-protector by default Nix
@ 2016-03-18 11:48 ` Nix
2016-05-13 12:10 ` Florian Weimer
17 siblings, 1 reply; 46+ messages in thread
From: Nix @ 2016-03-18 11:48 UTC (permalink / raw)
To: libc-alpha
On 13 Mar 2016, nix@esperi.org.uk said:
> This is version 6 of the stack-protected glibc patch, incorporating all review
> comments to date (unless I missed some).
Anyone got any more comments on this, or is everyone happy? (Or so
appalled you're not commenting...)
--
NULL && (void)
^ permalink raw reply [flat|nested] 46+ messages in thread* Re: --enable-stack-protector for glibc, v6
2016-03-18 11:48 ` --enable-stack-protector for glibc, v6 Nix
@ 2016-05-13 12:10 ` Florian Weimer
0 siblings, 0 replies; 46+ messages in thread
From: Florian Weimer @ 2016-05-13 12:10 UTC (permalink / raw)
To: Nix, libc-alpha
On 03/18/2016 12:48 PM, Nix wrote:
> On 13 Mar 2016, nix@esperi.org.uk said:
>
>> This is version 6 of the stack-protected glibc patch, incorporating all review
>> comments to date (unless I missed some).
>
> Anyone got any more comments on this, or is everyone happy? (Or so
> appalled you're not commenting...)
I think there are some open comments from Mike.
I'd like to help you to move this forward, if you are interested.
Thanks,
Florian
^ permalink raw reply [flat|nested] 46+ messages in thread