HEADSUP: toolchain modifications required for built-in SSP

[Yaakov Selkowitz]

On 2017-11-30 02:07, Sebastian Huber wrote:
> On 30/11/17 02:43, Yaakov Selkowitz wrote:
>> Newlib/RTEMS users,
>>
>> Please be aware that, as of today's git master, and the next (2.6.0?)
>> tarball release, Newlib includes its own implementation of Stack
>> Smashing Protection (-fstack-protector*) and Object Size Checking
>> (-D_FORTIFY_SOURCE=*) features.  This implementation replaces and
>> conflicts with GCC's libssp, which is practically broken and
>> unmaintained.
>>
>> In order to avoid the conflict with GCC's libssp, Newlib/RTEMS
>> toolchains using git master or the next release MUST be rebuilt,
>> configuring with the --disable-libssp flag,
> 
> Since libssp was apparently broken, the --disable-libssp does no harm if
> used with older Newlib versions?

libssp's -fstack-protector* works fine (as long as you link with that
flag too), but -D_FORTIFY_SOURCE=* is completely broken.  Disabling it
now would prevent both.

>> and exporting
>> gcc_cv_libc_provides_ssp=yes in the environment during 'make'.
> 
> I think this should be fixed for Newlib in general in the GCC
> gcc/configure.ac:

I have attached patches for 5/6/7 and 8 (trunk) which I could propose,
but I don't know if it will get into stable versions in time, and in
trunk, it appears --disable-libssp will be enough by itself.  In the
meantime, export gcc_cv_libc_provides_ssp=yes is a workaround.

-- 
Yaakov
-------------- next part --------------
--- gcc-7.2.0/gcc/configure.ac	2017-11-19 20:46:36.357074000 -0600
+++ gcc-7.2.0/gcc/configure.ac	2017-11-29 16:42:15.831711200 -0600
@@ -5752,6 +5752,12 @@ AC_CACHE_CHECK(__stack_chk_fail in targe
 	 AC_CHECK_FUNC(__stack_chk_fail,[gcc_cv_libc_provides_ssp=yes],
            [echo "no __stack_chk_fail on this target"])
         ;;
+       *-*-cygwin* | *-*-rtems* | *-*-eabi* | *-*-elf* | mmix-knuth-mmixware)
+         # This is a recent addition to Newlib/Cygwin/RTEMS
+         if test -f $target_header_dir/ssp/ssp.h; then
+           gcc_cv_libc_provides_ssp=yes
+         fi
+        ;;
   *) gcc_cv_libc_provides_ssp=no ;;
     esac])
 
--- gcc-7.2.0/gcc/configure	2017-11-19 20:46:36.357074000 -0600
+++ gcc-7.2.0/gcc/configure	2017-11-29 16:42:37.399600900 -0600
@@ -28991,6 +28991,12 @@ else
 fi
 
         ;;
+       *-*-cygwin* | *-*-rtems* | *-*-eabi* | *-*-elf* | mmix-knuth-mmixware)
+         # This is a recent addition to Newlib/Cygwin/RTEMS
+         if test -f $target_header_dir/ssp/ssp.h; then
+           gcc_cv_libc_provides_ssp=yes
+         fi
+        ;;
   *) gcc_cv_libc_provides_ssp=no ;;
     esac
 fi
-------------- next part --------------
2017-11-29  Yaakov Selkowitz  <yselkowi@redhat.com>

	gcc/
	* configure.ac (gcc_cv_libc_provides_ssp): Define as yes
	on Newlib-based targets if new builtin SSP support is present.
	* configure: Regenerate.

Index: gcc/configure
===================================================================
--- gcc/configure	(revision 255250)
+++ gcc/configure	(working copy)
@@ -29100,6 +29100,12 @@
 fi
 
         ;;
+       *-*-cygwin* | *-*-rtems* | *-*-eabi* | *-*-elf* | mmix-knuth-mmixware)
+         # This is a recent addition to Newlib/Cygwin/RTEMS
+         if test -f $target_header_dir/ssp/ssp.h; then
+           gcc_cv_libc_provides_ssp=yes
+         fi
+        ;;
        *) gcc_cv_libc_provides_ssp=no ;;
     esac
   fi
Index: gcc/configure.ac
===================================================================
--- gcc/configure.ac	(revision 255250)
+++ gcc/configure.ac	(working copy)
@@ -5821,6 +5821,12 @@
 	 AC_CHECK_FUNC(__stack_chk_fail,[gcc_cv_libc_provides_ssp=yes],
            [echo "no __stack_chk_fail on this target"])
         ;;
+       *-*-cygwin* | *-*-rtems* | *-*-eabi* | *-*-elf* | mmix-knuth-mmixware)
+         # This is a recent addition to Newlib/Cygwin/RTEMS
+         if test -f $target_header_dir/ssp/ssp.h; then
+           gcc_cv_libc_provides_ssp=yes
+         fi
+        ;;
        *) gcc_cv_libc_provides_ssp=no ;;
     esac
   fi])
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: OpenPGP digital signature
URL: <http://sourceware.org/pipermail/newlib/attachments/20171130/d842e127/attachment.sig>