From: H.J. Lu Date: Fri, 19 Jan 2018 17:51:58 +0000 (-0800) Subject: x86-64: Properly align La_x86_64_retval to VEC_SIZE [BZ #22715] X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=17d5d67f4f0350bdcfb5bf1a31cef2e14dabf7de;p=thirdparty%2Fglibc.git x86-64: Properly align La_x86_64_retval to VEC_SIZE [BZ #22715] _dl_runtime_profile calls _dl_call_pltexit, passing a pointer to La_x86_64_retval which is allocated on stack. The lrv_vector0 field in La_x86_64_retval must be aligned to size of vector register. When allocating stack space for La_x86_64_retval, we need to make sure that the address of La_x86_64_retval + RV_VECTOR0_OFFSET is aligned to VEC_SIZE. This patch checks the alignment of the lrv_vector0 field and pads the stack space if needed. Tested with x32 and x86-64 on SSE4, AVX and AVX512 machines. It fixed FAIL: elf/tst-audit10 FAIL: elf/tst-audit4 FAIL: elf/tst-audit5 FAIL: elf/tst-audit6 FAIL: elf/tst-audit7 on x32 AVX512 machine. (cherry picked from commit 207a72e2988c6d6343f50fe0128eb4fc4edfdd15) [BZ #22715] * sysdeps/x86_64/dl-trampoline.h (_dl_runtime_profile): Properly align La_x86_64_retval to VEC_SIZE. --- diff --git a/ChangeLog b/ChangeLog index 723b363df89..33f57580734 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2018-01-19 H.J. Lu + + [BZ #22715] + * sysdeps/x86_64/dl-trampoline.h (_dl_runtime_profile): Properly + align La_x86_64_retval to VEC_SIZE. + 2017-12-30 Aurelien Jarno Dmitry V. Levin diff --git a/NEWS b/NEWS index c2de2df4b54..d11dfe14295 100644 --- a/NEWS +++ b/NEWS @@ -60,6 +60,7 @@ The following bugs are resolved with this release: [21609] x86-64: Align the stack in __tls_get_addr [21624] Unsafe alloca allows local attackers to alias stack and heap (CVE-2017-1000366) [21654] nss: Fix invalid cast in group merging + [22715] x86-64: Properly align La_x86_64_retval to VEC_SIZE Version 2.24 diff --git a/sysdeps/x86_64/dl-trampoline.h b/sysdeps/x86_64/dl-trampoline.h index b9c2f1796fc..60c8a595c8c 100644 --- a/sysdeps/x86_64/dl-trampoline.h +++ b/sysdeps/x86_64/dl-trampoline.h @@ -440,8 +440,16 @@ _dl_runtime_profile: # ifdef RESTORE_AVX /* sizeof(La_x86_64_retval). Need extra space for 2 SSE registers to detect if xmm0/xmm1 registers are changed - by audit module. */ - sub $(LRV_SIZE + XMM_SIZE*2), %RSP_LP + by audit module. Since rsp is aligned to VEC_SIZE, we + need to make sure that the address of La_x86_64_retval + + LRV_VECTOR0_OFFSET is aligned to VEC_SIZE. */ +# define LRV_SPACE (LRV_SIZE + XMM_SIZE*2) +# define LRV_MISALIGNED ((LRV_SIZE + LRV_VECTOR0_OFFSET) & (VEC_SIZE - 1)) +# if LRV_MISALIGNED == 0 + sub $LRV_SPACE, %RSP_LP +# else + sub $(LRV_SPACE + VEC_SIZE - LRV_MISALIGNED), %RSP_LP +# endif # else sub $LRV_SIZE, %RSP_LP # sizeof(La_x86_64_retval) # endif