diff options
| -rw-r--r-- | ChangeLog | 6 | ||||
| -rw-r--r-- | NEWS | 6 | ||||
| -rw-r--r-- | ports/sysdeps/unix/sysv/linux/arm/setcontext.S | 7 |
3 files changed, 19 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog index 3d2063bb1c..30da116ced 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2016-08-15 Andreas Schwab <schwab@suse.de> + + [BZ #20435] + * ports/sysdeps/unix/sysv/linux/arm/setcontext.S (__startcontext): + Mark as .cantunwind. + 2015-02-24 Eric Rannaud <e@nanocritical.com> [BZ #17523] diff --git a/NEWS b/NEWS index 473e35adf9..a1bb8341ea 100644 --- a/NEWS +++ b/NEWS @@ -96,6 +96,12 @@ Version 2.19.1 * The Sun RPC UDP client could exhaust all available stack space when flooded with crafted ICMP and UDP messages. Reported by Aldy Hernandez' alloca plugin for GCC. (CVE-2016-4429) + +* On ARM EABI (32-bit), generating a backtrace for execution contexts which + have been created with makecontext could fail to terminate due to a + missing .cantunwind annotation. This has been observed to lead to a hang + (denial of service) in some Go applications compiled with gccgo. Reported + by Andreas Schwab. (CVE-2016-6323) Version 2.19 diff --git a/ports/sysdeps/unix/sysv/linux/arm/setcontext.S b/ports/sysdeps/unix/sysv/linux/arm/setcontext.S index 7b9b511b80..7da16a95c2 100644 --- a/ports/sysdeps/unix/sysv/linux/arm/setcontext.S +++ b/ports/sysdeps/unix/sysv/linux/arm/setcontext.S @@ -86,12 +86,19 @@ weak_alias(__setcontext, setcontext) /* Called when a makecontext() context returns. Start the context in R4 or fall through to exit(). */ + /* Unwind descriptors are looked up based on PC - 2, so we have to + make sure to mark the instruction preceding the __startcontext + label as .cantunwind. */ + .fnstart + .cantunwind + nop ENTRY(__startcontext) movs r0, r4 bne PLTJMP(__setcontext) @ New context was 0 - exit b PLTJMP(HIDDEN_JUMPTARGET(_exit)) + .fnend END(__startcontext) #ifdef PIC |