[Bug libc/22624] New: MIPS setjmp() saves incorrect 'o0' register in --enable-stack-protector=all

[slyfox at inbox dot ru]

https://sourceware.org/bugzilla/show_bug.cgi?id=22624

            Bug ID: 22624
           Summary: MIPS setjmp() saves incorrect 'o0' register in
                    --enable-stack-protector=all
           Product: glibc
           Version: 2.27
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: slyfox at inbox dot ru
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

Initially noticed as a SIGSEGV in dlopen() when error is encountered:
    https://bugs.gentoo.org/640130

Minimal reproducer:


    #include <setjmp.h>
    #include <stdio.h>

    int main() {
        jmp_buf jb;
        volatile register long s0 asm ("$s0");
        s0 = 1234;
        if (setjmp(jb) == 0)
            longjmp(jb, 1);
        printf ("$s0 = %lu\n", s0);
    }


Without the fix:

$ qemu-mipsn32 -L . ./mips-longjmp-bug
$s0 = 1082346228

With the fix:

$ qemu-mipsn32 -L . ./mips-longjmp-bug
$s0 = 1234

The problem happens in function __sigsetjmp_aux() when
--enable-stack-protector=all is enabled. Implementation of __sigsetjmp_aux()
assumes it clobber no registers as it's called right from assembly __sigsetjmp.

Unfortunately -fstack-protector-all clobbers s0 right at the beginning of the
function:

    Dump of assembler code for function __sigsetjmp_aux:
    addiu   sp,sp,-48
    sd      gp,32(sp)
    lui     gp,0x18
    addu    gp,gp,t9
    addiu   gp,gp,-23968
    sd      s0,24(sp)     ; here we backup s0
    lw      s0,-27824(gp) ; and load into s0 stack canary address
    ...
    sd      s0,16(a0)
    ...

The workaround to disable stack protection fixes the failure:

--- a/sysdeps/mips/mips64/setjmp_aux.c
+++ b/sysdeps/mips/mips64/setjmp_aux.c
@@ -25,6 +25,7 @@
    access them in C.  */

 int
+inhibit_stack_protector
 __sigsetjmp_aux (jmp_buf env, int savemask, long long sp, long long fp,
                 long long gp)
 {

-- 
You are receiving this mail because:
You are on the CC list for the bug.