linux-kernel - Re: [PATCH v1 0/1] Fix a stack misalign bug on

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZOoindMFj1UKqo+s@biznet-home.integral.gnuweeb.org>
Date:   Sat, 26 Aug 2023 23:04:45 +0700
From:   Ammar Faizi <ammarfaizi2@...weeb.org>
To:     Zhangjin Wu <falcon@...ylab.org>
Cc:     Willy Tarreau <w@....eu>,
        Thomas Weißschuh <linux@...ssschuh.net>,
        Nicholas Rosenberg <inori@...x.org>,
        GNU/Weeb Mailing List <gwml@...r.gnuweeb.org>,
        Michael William Jonathan <moe@...weeb.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v1 0/1] Fix a stack misalign bug on _start

On Sat, Aug 26, 2023 at 11:20:24PM +0800, Zhangjin Wu wrote:
> >   $eax   : 0x56559000  →  0x00003f90
> >   $ebx   : 0x56559000  →  0x00003f90
> >   $ecx   : 0x1
> >   $edx   : 0xf7fcaaa0  →   endbr32 
> >   $esp   : 0xffffcdbc  →  0x00000001
> >   $ebp   : 0x0
> >   $esi   : 0xffffce7c  →  0xffffd096
> >   $edi   : 0x56556060  →  <_start+0> xor %ebp, %ebp
> >   $eip   : 0x56556489  →  <sse_pq_add+25> movaps %xmm0, 0x30(%esp)
> > 
> >     <sse_pq_add+11>  pop    %eax
> >     <sse_pq_add+12>  add    $0x2b85, %eax
> >     <sse_pq_add+18>  movups -0x1fd0(%eax), %xmm0
> >   → <sse_pq_add+25>  movaps %xmm0, 0x30(%esp)     <== trapping instruction
> >     <sse_pq_add+30>  movups -0x1fe0(%eax), %xmm1
> >     <sse_pq_add+37>  movaps %xmm1, 0x20(%esp)
> >     <sse_pq_add+42>  movups -0x1ff0(%eax), %xmm2
> >     <sse_pq_add+49>  movaps %xmm2, 0x10(%esp)
> >     <sse_pq_add+54>  movups -0x2000(%eax), %xmm3
> > 
> >   [#0] Id 1, Name: "test", stopped 0x56556489 in sse_pq_add (), reason: SIGSEGV
> > 
> >   (gdb)  bt
> >   #0  0x56556489 in sse_pq_add ()
> >   #1  0x5655608e in main ()
> >
> 
> Since we have a new 'startup' test group, do you have a short function
> to trigger this error?

Here is a simple program to test the stack alignment.

#include "tools/include/nolibc/nolibc.h"

__asm__ (
"main:\n"
    /*
     * When the call main is executed, the
     * %esp is 16 bytes aligned.
     *
     * Then, on function entry (%esp mod 16) == 12
     * because the call instruction pushes 4 bytes
     * onto the stack.
     *
     * subl $12, %esp will make (%esp mod 16) == 0
     * again.
     */
    "subl  $12, %esp\n"

    /*
     * These move instructions will crash if %esp is
     * not a multiple of 16.
     */
    "movdqa (%esp), %xmm0\n"
    "movdqa %xmm0, (%esp)\n"
    "movaps (%esp), %xmm0\n"
    "movaps %xmm0, (%esp)\n"

    "addl   $12, %esp\n"
    "xorl   %eax, %eax\n"
    "ret\n"
);

> Perhaps it is time for us to add a new 'stack alignment' test case for
> all of the architectures.

I don't know the alignment rules for other architectures (I only work on
x86 and x86-64). While waiting for the maintainers' comment, I'll leave
the test case decision to you. Feel free to take the above code.

Extra:
It's also fine if you take my patch with the 'sub $(16 - 4), %esp'
change and batch it together in your next series.

-- 
Ammar Faizi