From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by sourceware.org (Postfix) with ESMTPS id B4B9E387703A for ; Fri, 20 Mar 2020 21:03:55 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org B4B9E387703A Received: from pps.filterd (m0098410.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 02KL3iRl136665; Fri, 20 Mar 2020 17:03:54 -0400 Received: from ppma04wdc.us.ibm.com (1a.90.2fa9.ip4.static.sl-reverse.com [169.47.144.26]) by mx0a-001b2d01.pphosted.com with ESMTP id 2yu8buge5n-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 20 Mar 2020 17:03:54 -0400 Received: from pps.filterd (ppma04wdc.us.ibm.com [127.0.0.1]) by ppma04wdc.us.ibm.com (8.16.0.27/8.16.0.27) with SMTP id 02KL0Vft027182; Fri, 20 Mar 2020 21:03:53 GMT Received: from b01cxnp22035.gho.pok.ibm.com (b01cxnp22035.gho.pok.ibm.com [9.57.198.25]) by ppma04wdc.us.ibm.com with ESMTP id 2yrpw7b6fp-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 20 Mar 2020 21:03:53 +0000 Received: from b01ledav004.gho.pok.ibm.com (b01ledav004.gho.pok.ibm.com [9.57.199.109]) by b01cxnp22035.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 02KL3rwJ45416834 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 20 Mar 2020 21:03:53 GMT Received: from b01ledav004.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 110FF112064; Fri, 20 Mar 2020 21:03:53 +0000 (GMT) Received: from b01ledav004.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 85D77112067; Fri, 20 Mar 2020 21:03:52 +0000 (GMT) Received: from linux.ibm.com (unknown [9.85.181.175]) by b01ledav004.gho.pok.ibm.com (Postfix) with ESMTP; Fri, 20 Mar 2020 21:03:52 +0000 (GMT) From: Tulio Magno Quites Machado Filho To: libc-stable@sourceware.org Cc: Andreas Schwab Subject: [2.28 COMMITTED] Fix array overflow in backtrace on PowerPC (bug 25423) Date: Fri, 20 Mar 2020 18:03:32 -0300 Message-Id: <20200320210333.202385-1-tuliom@linux.ibm.com> X-Mailer: git-send-email 2.24.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-TM-AS-GCONF: 00 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138, 18.0.645 definitions=2020-03-20_07:2020-03-20, 2020-03-20 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1011 mlxscore=0 lowpriorityscore=0 adultscore=0 priorityscore=1501 bulkscore=0 suspectscore=1 malwarescore=0 mlxlogscore=999 spamscore=0 phishscore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2003020000 definitions=main-2003200081 X-Spam-Status: No, score=-27.6 required=5.0 tests=BAYES_00, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, KAM_DMARC_STATUS, RCVD_IN_DNSWL_LOW, SPF_HELO_NONE, SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: libc-stable@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-stable mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Mar 2020 21:03:57 -0000 From: Andreas Schwab When unwinding through a signal frame the backtrace function on PowerPC didn't check array bounds when storing the frame address. Fixes commit d400dcac5e ("PowerPC: fix backtrace to handle signal trampolines"). (cherry picked from commit d93769405996dfc11d216ddbe415946617b5a494) --- NEWS | 1 + debug/tst-backtrace5.c | 12 ++++++++++++ sysdeps/powerpc/powerpc32/backtrace.c | 2 ++ sysdeps/powerpc/powerpc64/backtrace.c | 2 ++ 4 files changed, 17 insertions(+) diff --git a/NEWS b/NEWS index ace1b86fdb..038541c83b 100644 --- a/NEWS +++ b/NEWS @@ -73,6 +73,7 @@ The following bugs are resolved with this release: [25204] Ignore LD_PREFER_MAP_32BIT_EXEC for SUID programs [25225] ld.so fails to link on x86 if GCC defaults to -fcf-protection [25232] No const correctness for strchr et al. for Clang++ + [25423] Array overflow in backtrace on powerpc Security related changes: diff --git a/debug/tst-backtrace5.c b/debug/tst-backtrace5.c index 0e6fb1a024..a117f1544f 100644 --- a/debug/tst-backtrace5.c +++ b/debug/tst-backtrace5.c @@ -88,6 +88,18 @@ handle_signal (int signum) } /* Symbol names are not available for static functions, so we do not check do_test. */ + + /* Check that backtrace does not return more than what fits in the array + (bug 25423). */ + for (int j = 0; j < NUM_FUNCTIONS; j++) + { + n = backtrace (addresses, j); + if (n > j) + { + FAIL (); + return; + } + } } NO_INLINE int diff --git a/sysdeps/powerpc/powerpc32/backtrace.c b/sysdeps/powerpc/powerpc32/backtrace.c index 5422fdd50d..c7b64f9e9b 100644 --- a/sysdeps/powerpc/powerpc32/backtrace.c +++ b/sysdeps/powerpc/powerpc32/backtrace.c @@ -114,6 +114,8 @@ __backtrace (void **array, int size) } if (gregset) { + if (count + 1 == size) + break; array[++count] = (void*)((*gregset)[PT_NIP]); current = (void*)((*gregset)[PT_R1]); } diff --git a/sysdeps/powerpc/powerpc64/backtrace.c b/sysdeps/powerpc/powerpc64/backtrace.c index c0c4b48262..0acf17b37e 100644 --- a/sysdeps/powerpc/powerpc64/backtrace.c +++ b/sysdeps/powerpc/powerpc64/backtrace.c @@ -87,6 +87,8 @@ __backtrace (void **array, int size) if (is_sigtramp_address (current->return_address)) { struct signal_frame_64 *sigframe = (struct signal_frame_64*) current; + if (count + 1 == size) + break; array[++count] = (void*) sigframe->uc.uc_mcontext.gp_regs[PT_NIP]; current = (void*) sigframe->uc.uc_mcontext.gp_regs[PT_R1]; } -- 2.24.1