From 02f6f0e83bfa018eee86909e3a2961e7a2648884 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alex=20R=C3=B8nne=20Petersen?= Date: Wed, 13 Nov 2024 09:18:37 +0100 Subject: [PATCH] musl: Add unwinding protection in clone() implementations. Whatever was in the frame pointer register prior to clone() will no longer be valid in the child process, so zero it to protect FP-based unwinders. This is just an extension of what was already done for i386 and x86_64. Only applied to architectures where the _start() code also zeroes the frame pointer. --- lib/libc/musl/src/thread/aarch64/clone.s | 3 ++- lib/libc/musl/src/thread/arm/clone.s | 3 ++- lib/libc/musl/src/thread/loongarch64/clone.s | 1 + lib/libc/musl/src/thread/m68k/clone.s | 3 ++- lib/libc/musl/src/thread/microblaze/clone.s | 3 ++- lib/libc/musl/src/thread/mips/clone.s | 3 ++- lib/libc/musl/src/thread/mips64/clone.s | 3 ++- lib/libc/musl/src/thread/mipsn32/clone.s | 3 ++- lib/libc/musl/src/thread/or1k/clone.s | 3 ++- 9 files changed, 17 insertions(+), 8 deletions(-) diff --git a/lib/libc/musl/src/thread/aarch64/clone.s b/lib/libc/musl/src/thread/aarch64/clone.s index e3c83395cad2..9ac272bde3e6 100644 --- a/lib/libc/musl/src/thread/aarch64/clone.s +++ b/lib/libc/musl/src/thread/aarch64/clone.s @@ -24,7 +24,8 @@ __clone: // parent ret // child -1: ldp x1,x0,[sp],#16 +1: mov fp, 0 + ldp x1,x0,[sp],#16 blr x1 mov x8,#93 // SYS_exit svc #0 diff --git a/lib/libc/musl/src/thread/arm/clone.s b/lib/libc/musl/src/thread/arm/clone.s index bb0965dafe82..4ff0c0e88b1d 100644 --- a/lib/libc/musl/src/thread/arm/clone.s +++ b/lib/libc/musl/src/thread/arm/clone.s @@ -19,7 +19,8 @@ __clone: ldmfd sp!,{r4,r5,r6,r7} bx lr -1: mov r0,r6 +1: mov fp,#0 + mov r0,r6 bl 3f 2: mov r7,#1 svc 0 diff --git a/lib/libc/musl/src/thread/loongarch64/clone.s b/lib/libc/musl/src/thread/loongarch64/clone.s index a165b365a38e..cb4aacfc6d89 100644 --- a/lib/libc/musl/src/thread/loongarch64/clone.s +++ b/lib/libc/musl/src/thread/loongarch64/clone.s @@ -22,6 +22,7 @@ __clone: beqz $a0, 1f # whether child process jirl $zero, $ra, 0 # parent process return 1: + move $fp, $zero ld.d $t8, $sp, 0 # function pointer ld.d $a0, $sp, 8 # argument pointer jirl $ra, $t8, 0 # call the user's function diff --git a/lib/libc/musl/src/thread/m68k/clone.s b/lib/libc/musl/src/thread/m68k/clone.s index f6dfa06f49da..42ec19f7242a 100644 --- a/lib/libc/musl/src/thread/m68k/clone.s +++ b/lib/libc/musl/src/thread/m68k/clone.s @@ -18,7 +18,8 @@ __clone: beq 1f movem.l (%sp)+,%d2-%d5 rts -1: move.l %a1,-(%sp) +1: suba.l %%fp,%%fp + move.l %a1,-(%sp) jsr (%a0) move.l #1,%d0 trap #0 diff --git a/lib/libc/musl/src/thread/microblaze/clone.s b/lib/libc/musl/src/thread/microblaze/clone.s index b68cc5fc2213..64e3f0743f6c 100644 --- a/lib/libc/musl/src/thread/microblaze/clone.s +++ b/lib/libc/musl/src/thread/microblaze/clone.s @@ -22,7 +22,8 @@ __clone: rtsd r15, 8 nop -1: lwi r3, r1, 0 +1: add r19, r0, r0 + lwi r3, r1, 0 lwi r5, r1, 4 brald r15, r3 nop diff --git a/lib/libc/musl/src/thread/mips/clone.s b/lib/libc/musl/src/thread/mips/clone.s index 0446338568f0..229b987e9691 100644 --- a/lib/libc/musl/src/thread/mips/clone.s +++ b/lib/libc/musl/src/thread/mips/clone.s @@ -27,7 +27,8 @@ __clone: addu $sp, $sp, 16 jr $ra nop -1: lw $25, 0($sp) +1: move $fp, $0 + lw $25, 0($sp) lw $4, 4($sp) jalr $25 nop diff --git a/lib/libc/musl/src/thread/mips64/clone.s b/lib/libc/musl/src/thread/mips64/clone.s index 2d86899a1daa..8de3db6c4e36 100644 --- a/lib/libc/musl/src/thread/mips64/clone.s +++ b/lib/libc/musl/src/thread/mips64/clone.s @@ -25,7 +25,8 @@ __clone: nop jr $ra nop -1: ld $25, 0($sp) # function pointer +1: move $fp, $0 + ld $25, 0($sp) # function pointer ld $4, 8($sp) # argument pointer jalr $25 # call the user's function nop diff --git a/lib/libc/musl/src/thread/mipsn32/clone.s b/lib/libc/musl/src/thread/mipsn32/clone.s index 4d3c8c7a2502..9571231a62cf 100644 --- a/lib/libc/musl/src/thread/mipsn32/clone.s +++ b/lib/libc/musl/src/thread/mipsn32/clone.s @@ -25,7 +25,8 @@ __clone: nop jr $ra nop -1: lw $25, 0($sp) # function pointer +1: move $fp, $0 + lw $25, 0($sp) # function pointer lw $4, 4($sp) # argument pointer jalr $25 # call the user's function nop diff --git a/lib/libc/musl/src/thread/or1k/clone.s b/lib/libc/musl/src/thread/or1k/clone.s index 2473ac204036..05c55c6982dc 100644 --- a/lib/libc/musl/src/thread/or1k/clone.s +++ b/lib/libc/musl/src/thread/or1k/clone.s @@ -23,7 +23,8 @@ __clone: l.jr r9 l.nop -1: l.lwz r11, 0(r1) +1: l.ori r2, r0, 0 + l.lwz r11, 0(r1) l.jalr r11 l.lwz r3, 4(r1)