Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20241010210512.GO10433@brightrain.aerifal.cx>
Date: Thu, 10 Oct 2024 17:05:12 -0400
From: Rich Felker <dalias@...c.org>
To: Stefan Liebler <stli@...ux.ibm.com>
Cc: musl@...ts.openwall.com
Subject: Re: [PATCH] s390x: Don't allow br r0 in CRTJMP

On Thu, Oct 10, 2024 at 03:02:44PM +0200, Stefan Liebler wrote:
> When building musl with gcc 14, I've recognized that gcc has chosen
> r0 for the branch-instruction. Therefore we don't jump, but keep
> looping in ldso/dynlink.c:__dls3():
> CRTJMP((void *)aux[AT_ENTRY], argv-1);
> for(;;);
> 
> This patch adjusts the inline assembly constraints and marks "pc" as
> address, which disallows usage of r0.
> ---
>  arch/s390x/reloc.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/s390x/reloc.h b/arch/s390x/reloc.h
> index 6e5c1fb8..38de9d9b 100644
> --- a/arch/s390x/reloc.h
> +++ b/arch/s390x/reloc.h
> @@ -10,4 +10,4 @@
>  #define REL_TPOFF       R_390_TLS_TPOFF
>  
>  #define CRTJMP(pc,sp) __asm__ __volatile__( \
> -	"lgr %%r15,%1; br %0" : : "r"(pc), "r"(sp) : "memory" )
> +	"lgr %%r15,%1; br %0" : : "a"(pc), "r"(sp) : "memory" )
> -- 
> 2.46.0

What is especially problematic about r0 here? Does the encoding for br
just use the bits that would be for r0 to encode some other jump form?
Or is r0 cursed in some other way?

(Patch is probably fine, but I would like to better understand the
motivation.)

Rich

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.