authorgravatar for alex@alexrp.comAlex Rønne Petersen <alex@alexrp.com> 2024-11-13 09:18:37+01:00
committergravatar for alex@alexrp.comAlex Rønne Petersen <alex@alexrp.com> 2024-12-11 00:10:17+01:00
logc666ebb1f8aac440a4d0d554e9f8aa836bf58060
treeddbed1598f7fa9f0737c4a33a72c560b585577b7
parentda018f972619377e8c044c5c27ebf231be262bb3
signaturebadge-check Signed by SSH key SHA256:7B/LJ7bpR1eX8aCXSr4mtd5M45VMPKcx9zY8e95b5QM

musl: Add unwinding protection in clone() implementations.

Whatever was in the frame pointer register prior to clone() will no longer be valid in the child process, so zero it to protect FP-based unwinders. This is just an extension of what was already done for i386 and x86_64. Only applied to architectures where the _start() code also zeroes the frame pointer.

13 files changed, 40 insertions(+), 35 deletions(-)

lib/libc/musl/src/thread/aarch64/clone.s+2-1
......@@ -24,7 +24,8 @@ __clone:
2424 // parent
2525 ret
2626 // child
271: ldp x1,x0,[sp],#16
271: mov fp, 0
28 ldp x1,x0,[sp],#16
2829 blr x1
2930 mov x8,#93 // SYS_exit
3031 svc #0
lib/libc/musl/src/thread/arm/clone.s+2-1
......@@ -19,7 +19,8 @@ __clone:
1919 ldmfd sp!,{r4,r5,r6,r7}
2020 bx lr
2121
221: mov r0,r6
221: mov fp,#0
23 mov r0,r6
2324 bl 3f
24252: mov r7,#1
2526 svc 0
lib/libc/musl/src/thread/i386/clone.s+8-9
......@@ -30,9 +30,15 @@ __clone:
3030 mov 8(%ebp),%ebp
3131 int $128
3232 test %eax,%eax
33 jnz 1f
33 jz 1f
34 add $16,%esp
35 pop %edi
36 pop %esi
37 pop %ebx
38 pop %ebp
39 ret
3440
35 mov %ebp,%eax
411: mov %ebp,%eax
3642 xor %ebp,%ebp
3743 call *%eax
3844 mov %eax,%ebx
......@@ -40,10 +46,3 @@ __clone:
4046 inc %eax
4147 int $128
4248 hlt
43
441: add $16,%esp
45 pop %edi
46 pop %esi
47 pop %ebx
48 pop %ebp
49 ret
lib/libc/musl/src/thread/loongarch64/clone.s+1
......@@ -22,6 +22,7 @@ __clone:
2222 beqz $a0, 1f # whether child process
2323 jirl $zero, $ra, 0 # parent process return
24241:
25 move $fp, $zero
2526 ld.d $t8, $sp, 0 # function pointer
2627 ld.d $a0, $sp, 8 # argument pointer
2728 jirl $ra, $t8, 0 # call the user's function
lib/libc/musl/src/thread/m68k/clone.s+2-1
......@@ -18,7 +18,8 @@ __clone:
1818 beq 1f
1919 movem.l (%sp)+,%d2-%d5
2020 rts
211: move.l %a1,-(%sp)
211: suba.l %%fp,%%fp
22 move.l %a1,-(%sp)
2223 jsr (%a0)
2324 move.l #1,%d0
2425 trap #0
lib/libc/musl/src/thread/microblaze/clone.s+2-1
......@@ -22,7 +22,8 @@ __clone:
2222 rtsd r15, 8
2323 nop
2424
251: lwi r3, r1, 0
251: add r19, r0, r0
26 lwi r3, r1, 0
2627 lwi r5, r1, 4
2728 brald r15, r3
2829 nop
lib/libc/musl/src/thread/mips/clone.s+2-1
......@@ -27,7 +27,8 @@ __clone:
2727 addu $sp, $sp, 16
2828 jr $ra
2929 nop
301: lw $25, 0($sp)
301: move $fp, $0
31 lw $25, 0($sp)
3132 lw $4, 4($sp)
3233 jalr $25
3334 nop
lib/libc/musl/src/thread/mips64/clone.s+2-1
......@@ -25,7 +25,8 @@ __clone:
2525 nop
2626 jr $ra
2727 nop
281: ld $25, 0($sp) # function pointer
281: move $fp, $0
29 ld $25, 0($sp) # function pointer
2930 ld $4, 8($sp) # argument pointer
3031 jalr $25 # call the user's function
3132 nop
lib/libc/musl/src/thread/mipsn32/clone.s+2-1
......@@ -25,7 +25,8 @@ __clone:
2525 nop
2626 jr $ra
2727 nop
281: lw $25, 0($sp) # function pointer
281: move $fp, $0
29 lw $25, 0($sp) # function pointer
2930 lw $4, 4($sp) # argument pointer
3031 jalr $25 # call the user's function
3132 nop
lib/libc/musl/src/thread/or1k/clone.s+2-1
......@@ -23,7 +23,8 @@ __clone:
2323 l.jr r9
2424 l.nop
2525
261: l.lwz r11, 0(r1)
261: l.ori r2, r0, 0
27 l.lwz r11, 0(r1)
2728 l.jalr r11
2829 l.lwz r3, 4(r1)
2930
lib/libc/musl/src/thread/powerpc/clone.s+9-12
......@@ -48,9 +48,16 @@ neg 3, 3 #negate the result (errno)
4848# compare sc result with 0
4949cmpwi cr7, 3, 0
5050
51# if not 0, jump to end
52bne cr7, 2f
51# if not 0, restore stack and return
52beq cr7, 2f
5353
54lwz 30, 0(1)
55lwz 31, 4(1)
56addi 1, 1, 16
57
58blr
59
602:
5461#else: we're the child
5562#call funcptr: move arg (d) into r3
5663mr 3, 31
......@@ -61,13 +68,3 @@ bctrl
6168# mov SYS_exit into r0 (the exit param is already in r3)
6269li 0, 1
6370sc
64
652:
66
67# restore stack
68lwz 30, 0(1)
69lwz 31, 4(1)
70addi 1, 1, 16
71
72blr
73
lib/libc/musl/src/thread/x32/clone.s+3-3
......@@ -15,12 +15,12 @@ __clone:
1515 mov %rcx,(%rsi)
1616 syscall
1717 test %eax,%eax
18 jnz 1f
19 xor %ebp,%ebp
18 jz 1f
19 ret
201: xor %ebp,%ebp
2021 pop %rdi
2122 call *%r9
2223 mov %eax,%edi
2324 movl $0x4000003c,%eax /* SYS_exit */
2425 syscall
2526 hlt
261: ret
lib/libc/musl/src/thread/x86_64/clone.s+3-3
......@@ -16,8 +16,9 @@ __clone:
1616 mov %rcx,(%rsi)
1717 syscall
1818 test %eax,%eax
19 jnz 1f
20 xor %ebp,%ebp
19 jz 1f
20 ret
211: xor %ebp,%ebp
2122 pop %rdi
2223 call *%r9
2324 mov %eax,%edi
......@@ -25,4 +26,3 @@ __clone:
2526 mov $60,%al
2627 syscall
2728 hlt
281: ret