linux-kernel - Re: [PATCH v1 0/1] Fix a stack misalign bug on

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 26 Aug 2023 23:20:24 +0800
From:   Zhangjin Wu <falcon@...ylab.org>
To:     ammarfaizi2@...weeb.org
Cc:     falcon@...ylab.org, gwml@...r.gnuweeb.org, inori@...x.org,
        linux-kernel@...r.kernel.org, linux@...ssschuh.net,
        moe@...weeb.org, w@....eu
Subject: Re: [PATCH v1 0/1] Fix a stack misalign bug on _start

Hi, Ammar

> Hi Willy,
> 
> Just a single quick fix.
> 
> The ABI mandates that the %esp register must be a multiple of 16 when
> executing a call instruction.
>
> Commit 2ab446336b17 simplified the _start function, but it didn't take
> care of the %esp alignment, causing SIGSEGV on SSE and AVX programs that
> use aligned move instruction (e.g., movdqa, movaps, and vmovdqa).
>

Yeah, I have learned carefully about the old 'sub $4, %esp' instruction
for the old 3 'push' instructions, but at last forgot to add a new
instruction for the new single 'push' instruction to reserve the
16-byte alignment, very sorry for this bad regression. 

>   $eax   : 0x56559000  →  0x00003f90
>   $ebx   : 0x56559000  →  0x00003f90
>   $ecx   : 0x1
>   $edx   : 0xf7fcaaa0  →   endbr32 
>   $esp   : 0xffffcdbc  →  0x00000001
>   $ebp   : 0x0
>   $esi   : 0xffffce7c  →  0xffffd096
>   $edi   : 0x56556060  →  <_start+0> xor %ebp, %ebp
>   $eip   : 0x56556489  →  <sse_pq_add+25> movaps %xmm0, 0x30(%esp)
> 
>     <sse_pq_add+11>  pop    %eax
>     <sse_pq_add+12>  add    $0x2b85, %eax
>     <sse_pq_add+18>  movups -0x1fd0(%eax), %xmm0
>   → <sse_pq_add+25>  movaps %xmm0, 0x30(%esp)     <== trapping instruction
>     <sse_pq_add+30>  movups -0x1fe0(%eax), %xmm1
>     <sse_pq_add+37>  movaps %xmm1, 0x20(%esp)
>     <sse_pq_add+42>  movups -0x1ff0(%eax), %xmm2
>     <sse_pq_add+49>  movaps %xmm2, 0x10(%esp)
>     <sse_pq_add+54>  movups -0x2000(%eax), %xmm3
> 
>   [#0] Id 1, Name: "test", stopped 0x56556489 in sse_pq_add (), reason: SIGSEGV
> 
>   (gdb)  bt
>   #0  0x56556489 in sse_pq_add ()
>   #1  0x5655608e in main ()
>

Since we have a new 'startup' test group, do you have a short function
to trigger this error?

Perhaps it is time for us to add a new 'stack alignment' test case for
all of the architectures.

Thanks,
Zhangjin

> Ensure the %esp is a multiple of 16 when executing the call instruction.
> 
> Signed-off-by: Ammar Faizi <ammarfaizi2@...weeb.org>
> ---
> Ammar Faizi (1):
>   tools/nolibc: i386: Fix a stack misalign bug on _start
> 
>  tools/include/nolibc/arch-i386.h | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> 
> base-commit: 6269320850097903b30be8f07a5c61d9f7592393
> -- 
> Ammar Faizi