about summary refs log tree commit diff
path: root/sysdeps/mips/mips64
diff options
context:
space:
mode:
authorSergei Trofimovich <slyfox@gentoo.org>2017-12-18 17:23:02 +0000
committerJoseph Myers <joseph@codesourcery.com>2017-12-18 17:23:02 +0000
commit368b6c8da9f8ae453f5d70f8a62dbf3f1b6d5995 (patch)
tree906e5f509e6c322750bbec6942fbfeac6ac09e3d /sysdeps/mips/mips64
parentc8e939f12a4fce3bb09a8c4818629ccf76c8658c (diff)
downloadglibc-368b6c8da9f8ae453f5d70f8a62dbf3f1b6d5995.tar.gz
glibc-368b6c8da9f8ae453f5d70f8a62dbf3f1b6d5995.tar.xz
glibc-368b6c8da9f8ae453f5d70f8a62dbf3f1b6d5995.zip
mips64: fix clobbering s0 in setjmp() [BZ #22624]
When configured as --enable-stack-protector=all glibc
inserts stack checking canary into every function
including __sigsetjmp_aux(). Stack checking code
ends up using s0 register to temporary hold address
of global canary value.

Unfortunately __sigsetjmp_aux assumes no caller' caller-save
registers should be clobbered as it stores them as-is.

The fix is to disable stack protection of __sigsetjmp_aux.

Tested on the following test:

    #include <setjmp.h>
    #include <stdio.h>

    int main() {
        jmp_buf jb;
        volatile register long s0 asm ("$s0");
        s0 = 1234;
        if (setjmp(jb) == 0)
            longjmp(jb, 1);
        printf ("$s0 = %lu\n", s0);
    }

Without the fix:
    $ qemu-mipsn32 -L . ./mips-longjmp-bug
    $s0 = 1082346228

With the fix:
    $ qemu-mipsn32 -L . ./mips-longjmp-bug
    $s0 = 1234

	[BZ #22624]
	* sysdeps/mips/mips64/setjmp_aux.c (__sigsetjmp_aux): Use
	inhibit_stack_protector.
Diffstat (limited to 'sysdeps/mips/mips64')
-rw-r--r--sysdeps/mips/mips64/setjmp_aux.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/sysdeps/mips/mips64/setjmp_aux.c b/sysdeps/mips/mips64/setjmp_aux.c
index b43c36a7d5..43fffc74bf 100644
--- a/sysdeps/mips/mips64/setjmp_aux.c
+++ b/sysdeps/mips/mips64/setjmp_aux.c
@@ -24,7 +24,12 @@
    pointer.  We do things this way because it's difficult to reliably
    access them in C.  */
 
+/* Stack protection is disabled to avoid changing s0 (or any other
+   caller-save register) before storing it to environment.
+   See BZ #22624.  */
+
 int
+inhibit_stack_protector
 __sigsetjmp_aux (jmp_buf env, int savemask, long long sp, long long fp,
 		 long long gp)
 {