【x86】gcc开启fno-omit-frame-pointer编译选项后编译glibc代码，编出的二进制执行会触发coredump

**一、缺陷信息**
glibc 合入上游社区一个CVE-2023-4911补丁后，开启fno-omit-frame-pointer编译选项后编译出的代码会触发coredump，具体原因是访问了一个无法访问的地址。
glibc版本：glibc-2.34(openEuler-22.03-LTS-SP1)
而使用fomit-frame-pointer编译选项，编译同样的glibc代码，编译出的测试用例二进制不会触发coredump，经过定位发现是gcc的问题导致编译出的汇编代码有问题。
该问题必现
只涉及x86架构
**内核信息：**
kernel-headers-5.10.0-136.12.0.86.oe2203sp1.x86_64
**缺陷归属组件：**
gcc
**缺陷归属的版本：**
gcc-10.3.1-20.h6
**缺陷简述：**
已经定位到gcc 使用-fno-omit-frame-pointer编译编译编译的二进制缺少一行汇编代码，导致coredump

**【问题复现步骤】**

```
git clone https://gitee.com/src-openeuler/glibc.git
git checkout -b openEuler-22.03-LTS-SP1 origin/openEuler-22.03-LTS-SP1
mkdir -p /root/rpmbuild/SOURCES
cp * /root/rpmbuild/SOURCES/
rpmbuild -bp glibc.spec
cd /root/rpmbuild/BUILD/glibc-2.34
mkdir build && cd build
../configure CC=gcc CXX=g++ 'CFLAGS=-O2 -g -DNDEBUG  -fno-omit-frame-pointer  -Wp,-D_GLIBCXX_ASSERTIONS -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection' --prefix=/usr --enable-hardcoded-path-in-tests --enable-hugepage-shared-library --with-headers=/usr/include --enable-kernel=3.2 --with-nonshared-cflags=-Wp,-D_FORTIFY_SOURCE=2 --enable-bind-now  --enable-stack-protector=strong --enable-static-pie --enable-cet --enable-tunables --enable-systemtap --disable-werror --disable-profile --disable-crypt
make -j 64
make test t=elf/tst-env-setuid
```
**【实际结果】**
```
[root@localhost build]# LD_HWCAP_MASK=0x1 /root/rpmbuild/BUILD/glibc-2.34_BackTrace/build/elf/tst-env-setuid
Segmentation fault (core dumped)

```
**【core调用栈】**
```
(gdb) set env MALLOC_CHECK_=2
(gdb) r
Starting program: /usr/bin/env GCONV_PATH=/home/abuild/rpmbuild/BUILD/glibc-2.34/build-x86_64-openEuler-linux/iconvdata LOCPATH=/home/abuild/rpmbuild/BUILD/glibc-2.34/build-x86_64-openEuler-linux/localedata LC_ALL=C MALLOC_CHECK_=2 MALLOC_MMAP_THRESHOLD_=4096 LD_HWCAP_MASK=0x1 /home/abuild/rpmbuild/BUILD/glibc-2.34/build-x86_64-openEuler-linux/elf/tst-env-setuid
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib64/libthread_db.so.1".
process 3086970 is executing new program: /home/abuild/rpmbuild/BUILD/glibc-2.34/build-x86_64-openEuler-linux/elf/tst-env-setuid

Program received signal SIGSEGV, Segmentation fault.
do_tunable_update_val (cur=cur@entry=0xffffefefc740, valp=valp@entry=0x7fffffffcff8, minp=minp@entry=0x0, maxp=maxp@entry=0x0) at dl-tunables.c:101
101       if (cur->type.type_code == TUNABLE_TYPE_STRING)
(gdb) bt
#0  do_tunable_update_val (cur=cur@entry=0xffffefefc740, valp=valp@entry=0x7fffffffcff8, minp=minp@entry=0x0, maxp=maxp@entry=0x0) at dl-tunables.c:101
#1  0x00007ffff7f4c371 in tunable_initialize (strval=0x7fffffffef71 "2", cur=<optimized out>) at dl-tunables.c:150
#2  __tunables_init (envp=0x7fffffffd358) at dl-tunables.c:351
#3  0x00007ffff7f1420f in __libc_start_main_impl (main=0x7ffff7f107b0 <main>, argc=1, argv=0x7fffffffd168, init=<optimized out>, fini=<optimized out>, rtld_fini=0x0, stack_end=0x7fffffffd158) at ../csu/libc-start.c:291
#4  0x00007ffff7f108a5 in _start () at ../sysdeps/x86_64/start.S:116

(gdb) p *cur
Cannot access memory at address 0xffffefefc740
```
目前发现可以通过在elf/dl-tunables.c 中增加一行_dl_printf("")；代码可以让gcc编译出的汇编代码不一样，从而避免coredump，不过fno-omit-frame-pointer编译选项为什么会造成编译的汇编代码不一致还不知道原因。

src-openEuler/gcc
关闭

内容风险标识

评论 (2)

src-openEuler/gcc关闭 .gitee-modal { width: 500px !important; }

内容风险标识