From patchwork Tue Sep 12 15:25:10 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Richard Sandiford X-Patchwork-Id: 1833094 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=gcc.gnu.org header.i=@gcc.gnu.org header.a=rsa-sha256 header.s=default header.b=FCWrJcPG; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=gcc.gnu.org (client-ip=2620:52:3:1:0:246e:9693:128c; helo=server2.sourceware.org; envelope-from=gcc-patches-bounces+incoming=patchwork.ozlabs.org@gcc.gnu.org; receiver=patchwork.ozlabs.org) Received: from server2.sourceware.org (server2.sourceware.org [IPv6:2620:52:3:1:0:246e:9693:128c]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4RlS8r5FG1z1yhZ for ; Wed, 13 Sep 2023 01:26:04 +1000 (AEST) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id AE0243860778 for ; Tue, 12 Sep 2023 15:26:02 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org AE0243860778 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1694532362; bh=+72xj2BDWng1l6UX3SPRFlSiLrM1IlC85Zp05I6E1W4=; h=To:Cc:Subject:Date:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:From:Reply-To:From; b=FCWrJcPGfO+vY94siJiQwh8jHGhCBvfD3BqZy0+4ofc6S4a3f9RL3C/cqFU9Cq3l+ k20v5trGYvN+pRjky7bbebI3qvKQ72J5uk6kAJBapsrbe2IKIBPcouq8dPAmXjk+yx SU9yrYLr0kJvGzrTrUPbPidiOEc9iGcXWGzivMnQ= X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by sourceware.org (Postfix) with ESMTP id CFD2E3853D03 for ; Tue, 12 Sep 2023 15:25:38 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org CFD2E3853D03 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id A8B60C15; Tue, 12 Sep 2023 08:26:15 -0700 (PDT) Received: from e121540-lin.manchester.arm.com (e121540-lin.manchester.arm.com [10.32.110.72]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 0A1B33F738; Tue, 12 Sep 2023 08:25:37 -0700 (PDT) To: gcc-patches@gcc.gnu.org Cc: Richard Sandiford Subject: [PATCH 00/19] aarch64: Fix -fstack-protector issue Date: Tue, 12 Sep 2023 16:25:10 +0100 Message-Id: <20230912152529.3322336-1-richard.sandiford@arm.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-Spam-Status: No, score=-19.3 required=5.0 tests=BAYES_00, KAM_DMARC_NONE, KAM_DMARC_STATUS, KAM_LAZY_DOMAIN_SECURITY, KAM_SHORT, SPF_HELO_NONE, SPF_NONE, TXREP autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Richard Sandiford via Gcc-patches From: Richard Sandiford Reply-To: Richard Sandiford Errors-To: gcc-patches-bounces+incoming=patchwork.ozlabs.org@gcc.gnu.org Sender: "Gcc-patches" This series of patches fixes deficiencies in GCC's -fstack-protector implementation for AArch64 when using dynamically allocated stack space. This is CVE-2023-4039. See: https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64 https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf for more details. The fix is to put the saved registers above the locals area when -fstack-protector is used. The series also fixes a stack-clash problem that I found while working on the CVE. In unpatched sources, the stack-clash problem would only trigger for unrealistic numbers of arguments (8K 64-bit arguments, or an equivalent). But it would be a more significant issue with the new -fstack-protector frame layout. It's therefore important that both problems are fixed together. Some reorganisation of the code seemed necessary to fix the problems in a cleanish way. The series is therefore quite long, but only a handful of patches should have any effect on code generation. See the individual patches for a detailed description. Tested on aarch64-linux-gnu. Pushed to trunk and to all active branches. I've also pushed backports to GCC 7+ to vendors/ARM/heads/CVE-2023-4039. Richard Sandiford (19): aarch64: Use local frame vars in shrink-wrapping code aarch64: Avoid a use of callee_offset aarch64: Explicitly handle frames with no saved registers aarch64: Add bytes_below_saved_regs to frame info aarch64: Add bytes_below_hard_fp to frame info aarch64: Tweak aarch64_save/restore_callee_saves aarch64: Only calculate chain_offset if there is a chain aarch64: Rename locals_offset to bytes_above_locals aarch64: Rename hard_fp_offset to bytes_above_hard_fp aarch64: Tweak frame_size comment aarch64: Measure reg_offset from the bottom of the frame aarch64: Simplify top of frame allocation aarch64: Minor initial adjustment tweak aarch64: Tweak stack clash boundary condition aarch64: Put LR save probe in first 16 bytes aarch64: Simplify probe of final frame allocation aarch64: Explicitly record probe registers in frame info aarch64: Remove below_hard_fp_saved_regs_size aarch64: Make stack smash canary protect saved registers gcc/config/aarch64/aarch64.cc | 518 ++++++++++-------- gcc/config/aarch64/aarch64.h | 44 +- .../aarch64/stack-check-prologue-17.c | 55 ++ .../aarch64/stack-check-prologue-18.c | 100 ++++ .../aarch64/stack-check-prologue-19.c | 100 ++++ .../aarch64/stack-check-prologue-20.c | 3 + .../gcc.target/aarch64/stack-protector-8.c | 95 ++++ .../gcc.target/aarch64/stack-protector-9.c | 33 ++ .../aarch64/sve/pcs/stack_clash_3.c | 6 +- 9 files changed, 699 insertions(+), 255 deletions(-) create mode 100644 gcc/testsuite/gcc.target/aarch64/stack-check-prologue-17.c create mode 100644 gcc/testsuite/gcc.target/aarch64/stack-check-prologue-18.c create mode 100644 gcc/testsuite/gcc.target/aarch64/stack-check-prologue-19.c create mode 100644 gcc/testsuite/gcc.target/aarch64/stack-check-prologue-20.c create mode 100644 gcc/testsuite/gcc.target/aarch64/stack-protector-8.c create mode 100644 gcc/testsuite/gcc.target/aarch64/stack-protector-9.c