mailing list of musl libc
 help / color / mirror / code / Atom feed
From: Segher Boessenkool <segher@kernel.crashing.org>
To: Rich Felker <dalias@libc.org>
Cc: Sergei Trofimovich <slyfox@gentoo.org>,
	musl@lists.openwall.com, libc-alpha@sourceware.org,
	gcc@gcc.gnu.org, toolchain@gentoo.org
Subject: Re: [musl] musl, glibc and ideal place for __stack_chk_fail_local
Date: Thu, 30 Jan 2020 08:56:03 -0600	[thread overview]
Message-ID: <20200130145603.GW22482@gate.crashing.org> (raw)
In-Reply-To: <20200130133740.GB1775@brightrain.aerifal.cx>

On Thu, Jan 30, 2020 at 08:37:40AM -0500, Rich Felker wrote:
> On Thu, Jan 30, 2020 at 06:33:51AM -0600, Segher Boessenkool wrote:
> > On Sat, Jan 25, 2020 at 10:54:24AM -0500, Rich Felker wrote:
> > > > To support smash stack protection gcc emits __stack_chk_fail
> > > > calls on all targets. On top of that gcc emits __stack_chk_fail_local
> > > > calls at least on i386 and powerpc:
> > 
> > (Only on 32-bit -fPIC -msecure-plt, for Power).
> 
> Right, but musl only supports the secure-plt ABI.

Sure, it is the modern one.  Still only for 32-bit -fPIC for musl, too.

> > > There is a half-serious proposal to put it in crti.o which is always
> > > linked too, but that seems like an ugly hack to me...
> > 
> > Not *very* ugly, but it would be very effective, and no real downsides
> > to it (or do you see something?)
> 
> Well either the thunk has to be written in asm per-arch, or some ld -r
> magic (which is fragile and something I don't want musl to depend on
> since I know users will someday hit breakage and rightfully blame us
> for using ld -r) to merge an asm source and C source. Or perhaps the
> existing crti.s content could be moved to file-scope __asm__ included
> in the C source file...that might be ok?

At least for powerpc, the existing crti.s gets stuff inserted after (in
both functions), and then closed off by crtn.s -- not something you want
to do in C :-)

GCC can just say to also use extra crti files -- see STARTFILE_SPEC.
Many platforms do that already.

> > On Power it is just the setting up itself that is costly (in the config
> > where we have this _local thing).
> 
> I think it'd be the same.

We don't have a shortage of usable registers, that's what I was getting at.
All the other arguments are similar, sure.

> > > Absolutely not. libssp is unsafe and creates new vulns/attack surface
> > > by doing introspective stuff after the process is already *known to
> > > be* in a compromised state. It should never be used. musl's
> > > __stack_chk_fail is safe and terminates immediately.
> > 
> > Some implementations even print strings from the stack, it can be worse ;-)
> 
> :-)

It wasn't a joke, unfortunately.

> > > Ideally, though, GCC would just emit the termination inline (or at
> > > least have an option to do so) rather than calling __stack_chk_fail or
> > > the local version. This would additionally harden against the case
> > > where the GOT is compromised.
> > 
> > Yeah, but how to terminate is system-specific, it's much easier to punt
> > this job to the libc to do ;-)
> 
> My ideas was __builtin_trap, although a slightly more hardened version
> (that might make users unhappy? :) is inlining a syscall to
> sigprocmask to mask SIGILL/SIGSEGV before the trapping instruction so
> that termination occurs regardless of whether there's a signal handler
> installed.

I think we should make this a separate RTL pattern?  Or a (noreturn)
libgcc function?  Anyway, let's talk in the PR :-)

> > Open a GCC PR for this please?
> 
> Filed as https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93509

Thanks!


Segher

      reply	other threads:[~2020-01-30 16:36 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-01-25 10:53 Sergei Trofimovich
2020-01-25 15:54 ` Rich Felker
2020-01-30 12:33   ` Segher Boessenkool
2020-01-30 13:37     ` Rich Felker
2020-01-30 14:56       ` Segher Boessenkool [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200130145603.GW22482@gate.crashing.org \
    --to=segher@kernel.crashing.org \
    --cc=dalias@libc.org \
    --cc=gcc@gcc.gnu.org \
    --cc=libc-alpha@sourceware.org \
    --cc=musl@lists.openwall.com \
    --cc=slyfox@gentoo.org \
    --cc=toolchain@gentoo.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://git.vuxu.org/mirror/musl/

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).