linux-kernel - Re: [PATCH v1 1/1] tools/nolibc: i386: Fix a stack misalign bug on

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f67cedfc-f275-4b26-b27d-c5c506fe0e85@t-8ch.de>
Date:   Sun, 27 Aug 2023 08:53:26 +0200
From:   Thomas Weißschuh <linux@...ssschuh.net>
To:     Ammar Faizi <ammarfaizi2@...weeb.org>
Cc:     Willy Tarreau <w@....eu>, Zhangjin Wu <falcon@...ylab.org>,
        Nicholas Rosenberg <inori@...x.org>,
        GNU/Weeb Mailing List <gwml@...r.gnuweeb.org>,
        Michael William Jonathan <moe@...weeb.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v1 1/1] tools/nolibc: i386: Fix a stack misalign bug on
 _start

Hi Ammar,

On 2023-08-26 21:16:32+0700, Ammar Faizi wrote:
> The ABI mandates that the %esp register must be a multiple of 16 when
> executing a call instruction.
> 
> Commit 2ab446336b17 simplified the _start function, but it didn't take

Afaik references to commits in commit messages are supposed to follow
the same format as in the Fixes: tag.

"Commit 2ab446336b17 ("tools/nolibc: i386: shrink _start with _start_c")
simplified the _start function, [...]"

> care of the %esp alignment, causing SIGSEGV on SSE and AVX programs that
> use aligned move instruction (e.g., movdqa, movaps, and vmovdqa).
> 
> Ensure the %esp is a multiple of 16 when executing the call instruction.
> 
> Cc: Zhangjin Wu <falcon@...ylab.org>
> Fixes: 2ab446336b17aad362c6decee29b4efd83a01979 ("tools/nolibc: i386: shrink _start with _start_c")
> Reported-by: Nicholas Rosenberg <inori@...x.org>
> Signed-off-by: Ammar Faizi <ammarfaizi2@...weeb.org>
> ---
>  tools/include/nolibc/arch-i386.h | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/include/nolibc/arch-i386.h b/tools/include/nolibc/arch-i386.h
> index 64415b9fac77f996..4edf238eeac67aa2 100644
> --- a/tools/include/nolibc/arch-i386.h
> +++ b/tools/include/nolibc/arch-i386.h
> @@ -167,7 +167,8 @@ void __attribute__((weak, noreturn, optimize("Os", "omit-frame-pointer"))) __no_
>  	__asm__ volatile (
>  		"xor  %ebp, %ebp\n"       /* zero the stack frame                                */
>  		"mov  %esp, %eax\n"       /* save stack pointer to %eax, as arg1 of _start_c     */
> -		"and  $-16, %esp\n"       /* last pushed argument must be 16-byte aligned        */
> +		"and  $-16, %esp\n"       /* align stack to 16 bytes                             */
> +		"sub  $12, %esp\n"        /* last pushed argument must be 16-byte aligned        */
>  		"push %eax\n"             /* push arg1 on stack to support plain stack modes too */
>  		"call _start_c\n"         /* transfer to c runtime                               */
>  		"hlt\n"                   /* ensure it does not return                           */

Thanks for the fix!

In general:

Acked-by: Thomas Weißschuh <linux@...ssschuh.net>


Though I'd like to have the following part of your follow-up mail as
part of the commit message [0]:

"""
When the call main is executed, the
%esp is 16 bytes aligned.

Then, on function entry (%esp mod 16) == 12
because the call instruction pushes 4 bytes
onto the stack.

subl $12, %esp will make (%esp mod 16) == 0
again.
"""

It's much clearer to someone not that familiar with ASM and its
intricacies; like me.

Also a Link: tag for the Reported-by: would be nice.

[0] https://lore.kernel.org/lkml/ZOoindMFj1UKqo+s@biznet-home.integral.gnuweeb.org/


Thomas