FreeChainXenon/gcc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

arm: Fix canary address calculation for non-PIC

Browse source 
For non-PIC, the stack protector patterns did:

	  rtx mem = XEXP (force_const_mem (SImode, operands[1]), 0);
	  emit_move_insn (operands[2], mem);

Here, operands[1] is the address of the canary (&__stack_chk_guard)
and operands[2] is the register that we want to move that address into.
However, the code above instead sets operands[2] to the address of a
constant pool entry that contains &__stack_chk_guard, rather than to
&__stack_chk_guard itself.  The sequence therefore does one less
pointer indirection than it should.

The net effect was to use &__stack_chk_guard for stack-smash detection,
instead of using __stack_chk_guard itself.

gcc/
	* config/arm/arm.md (*stack_protect_combined_set_insn): For non-PIC,
	load the address of the canary rather than the address of the
	constant pool entry that points to it.
	(*stack_protect_combined_test_insn): Likewise.

gcc/testsuite/
	* gcc.target/arm/stack-protector-3.c: New test.
	* gcc.target/arm/stack-protector-4.c: Likewise.
This commit is contained in:
Richard Sandiford 2020-09-24 10:06:11 +01:00
parent 10843f8303
commit e94797250b
3 changed files with 46 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
gcc/config/arm/arm.md
View file

@ -9212,7 +9212,7 @@
operands[2] = operands[1];
else
{
rtx mem = XEXP (force_const_mem (SImode, operands[1]), 0);
rtx mem = force_const_mem (SImode, operands[1]);
emit_move_insn (operands[2], mem);
}
}
@ -9295,7 +9295,7 @@
operands[3] = operands[1];
else
{
rtx mem = XEXP (force_const_mem (SImode, operands[1]), 0);
rtx mem = force_const_mem (SImode, operands[1]);
emit_move_insn (operands[3], mem);
}
}

38
gcc/testsuite/gcc.target/arm/stack-protector-3.c Normal file
View file

@ -0,0 +1,38 @@
/* { dg-do run } */
/* { dg-require-effective-target fstack_protector } */
/* { dg-options "-fstack-protector-all -O2" } */
extern volatile long *stack_chk_guard_ptr;
void __attribute__ ((noipa))
f (void)
{
volatile int x;
/* Munging the contents of __stack_chk_guard should trigger a
stack-smashing failure for this function. */
*stack_chk_guard_ptr += 1;
}
asm (
" .data\n"
" .align 3\n"
" .globl stack_chk_guard_ptr\n"
"stack_chk_guard_ptr:\n"
" .word __stack_chk_guard\n"
" .weak __stack_chk_guard\n"
"__stack_chk_guard:\n"
" .word 0xdead4321\n"
" .text\n"
" .type __stack_chk_fail, %function\n"
"__stack_chk_fail:\n"
" movs r0, #0\n"
" b exit\n"
" .size __stack_chk_fail, .-__stack_chk_fail"
);
int
main (void)
{
f ();
__builtin_abort ();
}

6
gcc/testsuite/gcc.target/arm/stack-protector-4.c Normal file
View file

@ -0,0 +1,6 @@
/* { dg-do run } */
/* { dg-require-effective-target fstack_protector } */
/* { dg-require-effective-target fpic } */
/* { dg-options "-fstack-protector-all -O2 -fpic" } */
#include "stack-protector-3.c"