From a85abfa92220239cad0a8a6b0f2a223f5e6472a9 Mon Sep 17 00:00:00 2001 From: Andreas Schwab <schwab@suse.de> Date: Thu, 18 Aug 2016 11:38:28 +0200 Subject: [PATCH] arm: mark __startcontext as .cantunwind (bug 20435) __startcontext marks the bottom of the call stack of the contexts created by makecontext. (cherry picked from commit 9e2ff6c9cc54c0b4402b8d49e4abe7000fde7617) Also includes the NEWS update, cherry-picked from commits 056dd72af83f5459ce6d545a49dea6dba7d635dc and 4d047efdbc55b0d68947cde682e5363d16a66294. --- ChangeLog | 6 ++++++ NEWS | 6 ++++++ sysdeps/unix/sysv/linux/arm/setcontext.S | 7 +++++++ 3 files changed, 19 insertions(+) #diff --git a/ChangeLog b/ChangeLog #index 618515e..c2a91e1 100644 #--- a/ChangeLog #+++ b/ChangeLog #@@ -1,3 +1,9 @@ #+2016-08-15 Andreas Schwab <schwab@suse.de> #+ #+ [BZ #20435] #+ * sysdeps/unix/sysv/linux/arm/setcontext.S (__startcontext): Mark #+ as .cantunwind. #+ # 2016-06-21 Florian Weimer <fweimer@redhat.com> # # [BZ #20284] #diff --git a/NEWS b/NEWS #index 923468d..a19f656 100644 #--- a/NEWS #+++ b/NEWS #@@ -7,6 +7,12 @@ using `glibc' in the "product" field. # # Version 2.22.1 # #+* On ARM EABI (32-bit), generating a backtrace for execution contexts which #+ have been created with makecontext could fail to terminate due to a #+ missing .cantunwind annotation. This has been observed to lead to a hang #+ (denial of service) in some Go applications compiled with gccgo. Reported #+ by Andreas Schwab. (CVE-2016-6323) #+ # * A stack-based buffer overflow was found in libresolv when invoked from # libnss_dns, allowing specially crafted DNS responses to seize control # of execution flow in the DNS client. The buffer overflow occurs in diff --git a/sysdeps/unix/sysv/linux/arm/setcontext.S b/sysdeps/unix/sysv/linux/arm/setcontext.S index 24c7294..926b65a 100644 --- a/sysdeps/unix/sysv/linux/arm/setcontext.S +++ b/sysdeps/unix/sysv/linux/arm/setcontext.S @@ -86,12 +86,19 @@ weak_alias(__setcontext, setcontext) /* Called when a makecontext() context returns. Start the context in R4 or fall through to exit(). */ + /* Unwind descriptors are looked up based on PC - 2, so we have to + make sure to mark the instruction preceding the __startcontext + label as .cantunwind. */ + .fnstart + .cantunwind + nop ENTRY(__startcontext) movs r0, r4 bne PLTJMP(__setcontext) @ New context was 0 - exit b PLTJMP(HIDDEN_JUMPTARGET(exit)) + .fnend END(__startcontext) #ifdef PIC -- 2.10.2
