Bug 252549

Summary:	statically linked threaded binaries have executable thread stacks
Product:	Base System	Reporter:	Ed Maste <emaste>
Component:	threads	Assignee:	freebsd-threads (Nobody) <threads>
Status:	Closed FIXED
Severity:	Affects Only Me	CC:	kib
Priority:	---
Version:	CURRENT
Hardware:	Any
OS:	Any

Description Ed Maste freebsd_committer

2021-01-10 02:49:24 UTC

The stack created by pthread_create in a statically linked binary has RWX protection, regardless of the binary's desired stack (via PT_GNU_STACK). Initial stack has expected protection.

See https://reviews.freebsd.org/D28050 for the discovery of this issue.

lib/libc/gen/dlfcn.c provides a weak _rtld_get_stack_prot for statically linked binaries:

#pragma weak _rtld_get_stack_prot
int
_rtld_get_stack_prot(void)
{

        return (PROT_EXEC | PROT_READ | PROT_WRITE);
}

Comment 1 Konstantin Belousov freebsd_committer

2021-01-10 03:13:04 UTC

https://reviews.freebsd.org/D28075

Comment 2 commit-hook freebsd_committer

2021-01-10 06:27:19 UTC

A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=81b3a0a34145ee6c855f50c8035728f76d63c3f0

commit 81b3a0a34145ee6c855f50c8035728f76d63c3f0
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2021-01-10 03:05:42 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2021-01-10 06:25:43 +0000

    libc: implement rtld_get_stack_prot() for real

    which makes stack prot correct for non-main threads created by binaries
    with statically linked libthr.

    Cache result, but do not engage into the full double-checked locking,
    since calculation of the return value is idempotent.

    PR:     252549
    Reported and reviewed by:       emaste
    MFC after:      1 week
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D28075

 lib/libc/gen/dlfcn.c | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

Comment 3 Ed Maste freebsd_committer

2021-02-08 01:16:19 UTC

MFC'd to stable/12 in b63c36db2065770a0b17925cb3b51cde6af95add