authorgravatar for alex@alexrp.comAlex Rønne Petersen <alex@alexrp.com> 2024-11-13 09:18:37+01:00
committergravatar for alex@alexrp.comAlex Rønne Petersen <alex@alexrp.com> 2024-12-11 00:10:17+01:00
logc666ebb1f8aac440a4d0d554e9f8aa836bf58060
treeddbed1598f7fa9f0737c4a33a72c560b585577b7
parentda018f972619377e8c044c5c27ebf231be262bb3
signaturebadge-check Signed by SSH key SHA256:7B/LJ7bpR1eX8aCXSr4mtd5M45VMPKcx9zY8e95b5QM

musl: Add unwinding protection in clone() implementations.

Whatever was in the frame pointer register prior to clone() will no longer be valid in the child process, so zero it to protect FP-based unwinders. This is just an extension of what was already done for i386 and x86_64. Only applied to architectures where the _start() code also zeroes the frame pointer.

13 files changed, 40 insertions(+), 35 deletions(-)

lib/libc/musl/src/thread/aarch64/clone.s+2-1
...@@ -24,7 +24,8 @@ __clone:...@@ -24,7 +24,8 @@ __clone:
24 // parent24 // parent
25 ret25 ret
26 // child26 // child
271: ldp x1,x0,[sp],#16271: mov fp, 0
28 ldp x1,x0,[sp],#16
28 blr x129 blr x1
29 mov x8,#93 // SYS_exit30 mov x8,#93 // SYS_exit
30 svc #031 svc #0
lib/libc/musl/src/thread/arm/clone.s+2-1
...@@ -19,7 +19,8 @@ __clone:...@@ -19,7 +19,8 @@ __clone:
19 ldmfd sp!,{r4,r5,r6,r7}19 ldmfd sp!,{r4,r5,r6,r7}
20 bx lr20 bx lr
2121
221: mov r0,r6221: mov fp,#0
23 mov r0,r6
23 bl 3f24 bl 3f
242: mov r7,#1252: mov r7,#1
25 svc 026 svc 0
lib/libc/musl/src/thread/i386/clone.s+8-9
...@@ -30,9 +30,15 @@ __clone:...@@ -30,9 +30,15 @@ __clone:
30 mov 8(%ebp),%ebp30 mov 8(%ebp),%ebp
31 int $12831 int $128
32 test %eax,%eax32 test %eax,%eax
33 jnz 1f33 jz 1f
34 add $16,%esp
35 pop %edi
36 pop %esi
37 pop %ebx
38 pop %ebp
39 ret
3440
35 mov %ebp,%eax411: mov %ebp,%eax
36 xor %ebp,%ebp42 xor %ebp,%ebp
37 call *%eax43 call *%eax
38 mov %eax,%ebx44 mov %eax,%ebx
...@@ -40,10 +46,3 @@ __clone:...@@ -40,10 +46,3 @@ __clone:
40 inc %eax46 inc %eax
41 int $12847 int $128
42 hlt48 hlt
43
441: add $16,%esp
45 pop %edi
46 pop %esi
47 pop %ebx
48 pop %ebp
49 ret
lib/libc/musl/src/thread/loongarch64/clone.s+1
...@@ -22,6 +22,7 @@ __clone:...@@ -22,6 +22,7 @@ __clone:
22 beqz $a0, 1f # whether child process22 beqz $a0, 1f # whether child process
23 jirl $zero, $ra, 0 # parent process return23 jirl $zero, $ra, 0 # parent process return
241:241:
25 move $fp, $zero
25 ld.d $t8, $sp, 0 # function pointer26 ld.d $t8, $sp, 0 # function pointer
26 ld.d $a0, $sp, 8 # argument pointer27 ld.d $a0, $sp, 8 # argument pointer
27 jirl $ra, $t8, 0 # call the user's function28 jirl $ra, $t8, 0 # call the user's function
lib/libc/musl/src/thread/m68k/clone.s+2-1
...@@ -18,7 +18,8 @@ __clone:...@@ -18,7 +18,8 @@ __clone:
18 beq 1f18 beq 1f
19 movem.l (%sp)+,%d2-%d519 movem.l (%sp)+,%d2-%d5
20 rts20 rts
211: move.l %a1,-(%sp)211: suba.l %%fp,%%fp
22 move.l %a1,-(%sp)
22 jsr (%a0)23 jsr (%a0)
23 move.l #1,%d024 move.l #1,%d0
24 trap #025 trap #0
lib/libc/musl/src/thread/microblaze/clone.s+2-1
...@@ -22,7 +22,8 @@ __clone:...@@ -22,7 +22,8 @@ __clone:
22 rtsd r15, 822 rtsd r15, 8
23 nop23 nop
2424
251: lwi r3, r1, 0251: add r19, r0, r0
26 lwi r3, r1, 0
26 lwi r5, r1, 427 lwi r5, r1, 4
27 brald r15, r328 brald r15, r3
28 nop29 nop
lib/libc/musl/src/thread/mips/clone.s+2-1
...@@ -27,7 +27,8 @@ __clone:...@@ -27,7 +27,8 @@ __clone:
27 addu $sp, $sp, 1627 addu $sp, $sp, 16
28 jr $ra28 jr $ra
29 nop29 nop
301: lw $25, 0($sp)301: move $fp, $0
31 lw $25, 0($sp)
31 lw $4, 4($sp)32 lw $4, 4($sp)
32 jalr $2533 jalr $25
33 nop34 nop
lib/libc/musl/src/thread/mips64/clone.s+2-1
...@@ -25,7 +25,8 @@ __clone:...@@ -25,7 +25,8 @@ __clone:
25 nop25 nop
26 jr $ra26 jr $ra
27 nop27 nop
281: ld $25, 0($sp) # function pointer281: move $fp, $0
29 ld $25, 0($sp) # function pointer
29 ld $4, 8($sp) # argument pointer30 ld $4, 8($sp) # argument pointer
30 jalr $25 # call the user's function31 jalr $25 # call the user's function
31 nop32 nop
lib/libc/musl/src/thread/mipsn32/clone.s+2-1
...@@ -25,7 +25,8 @@ __clone:...@@ -25,7 +25,8 @@ __clone:
25 nop25 nop
26 jr $ra26 jr $ra
27 nop27 nop
281: lw $25, 0($sp) # function pointer281: move $fp, $0
29 lw $25, 0($sp) # function pointer
29 lw $4, 4($sp) # argument pointer30 lw $4, 4($sp) # argument pointer
30 jalr $25 # call the user's function31 jalr $25 # call the user's function
31 nop32 nop
lib/libc/musl/src/thread/or1k/clone.s+2-1
...@@ -23,7 +23,8 @@ __clone:...@@ -23,7 +23,8 @@ __clone:
23 l.jr r923 l.jr r9
24 l.nop24 l.nop
2525
261: l.lwz r11, 0(r1)261: l.ori r2, r0, 0
27 l.lwz r11, 0(r1)
27 l.jalr r1128 l.jalr r11
28 l.lwz r3, 4(r1)29 l.lwz r3, 4(r1)
2930
lib/libc/musl/src/thread/powerpc/clone.s+9-12
...@@ -48,9 +48,16 @@ neg 3, 3 #negate the result (errno)...@@ -48,9 +48,16 @@ neg 3, 3 #negate the result (errno)
48# compare sc result with 048# compare sc result with 0
49cmpwi cr7, 3, 049cmpwi cr7, 3, 0
5050
51# if not 0, jump to end51# if not 0, restore stack and return
52bne cr7, 2f52beq cr7, 2f
5353
54lwz 30, 0(1)
55lwz 31, 4(1)
56addi 1, 1, 16
57
58blr
59
602:
54#else: we're the child61#else: we're the child
55#call funcptr: move arg (d) into r362#call funcptr: move arg (d) into r3
56mr 3, 3163mr 3, 31
...@@ -61,13 +68,3 @@ bctrl...@@ -61,13 +68,3 @@ bctrl
61# mov SYS_exit into r0 (the exit param is already in r3)68# mov SYS_exit into r0 (the exit param is already in r3)
62li 0, 169li 0, 1
63sc70sc
64
652:
66
67# restore stack
68lwz 30, 0(1)
69lwz 31, 4(1)
70addi 1, 1, 16
71
72blr
73
lib/libc/musl/src/thread/x32/clone.s+3-3
...@@ -15,12 +15,12 @@ __clone:...@@ -15,12 +15,12 @@ __clone:
15 mov %rcx,(%rsi)15 mov %rcx,(%rsi)
16 syscall16 syscall
17 test %eax,%eax17 test %eax,%eax
18 jnz 1f18 jz 1f
19 xor %ebp,%ebp19 ret
201: xor %ebp,%ebp
20 pop %rdi21 pop %rdi
21 call *%r922 call *%r9
22 mov %eax,%edi23 mov %eax,%edi
23 movl $0x4000003c,%eax /* SYS_exit */24 movl $0x4000003c,%eax /* SYS_exit */
24 syscall25 syscall
25 hlt26 hlt
261: ret
lib/libc/musl/src/thread/x86_64/clone.s+3-3
...@@ -16,8 +16,9 @@ __clone:...@@ -16,8 +16,9 @@ __clone:
16 mov %rcx,(%rsi)16 mov %rcx,(%rsi)
17 syscall17 syscall
18 test %eax,%eax18 test %eax,%eax
19 jnz 1f19 jz 1f
20 xor %ebp,%ebp20 ret
211: xor %ebp,%ebp
21 pop %rdi22 pop %rdi
22 call *%r923 call *%r9
23 mov %eax,%edi24 mov %eax,%edi
...@@ -25,4 +26,3 @@ __clone:...@@ -25,4 +26,3 @@ __clone:
25 mov $60,%al26 mov $60,%al
26 syscall27 syscall
27 hlt28 hlt
281: ret