From 08b12344149080c5f71deae8d8f63662d1a7be2d Mon Sep 17 00:00:00 2001 From: Alexander Potapenko Date: Wed, 10 Sep 2025 15:36:25 +0200 Subject: executor: introduce __no_stack_protector and use it for guest code When compiling the executor in syz-env-old, -fstack-protector may kick in and introduce global accesses that tools/check-syzos.sh reports. To prevent this, introduce the __no_stack_protector macro attribute that disable stack protection for the function in question, and use it for guest code. While at it, factor out some common definitions into common_kvm_syzos.h --- executor/common_kvm_amd64_syzos.h | 12 +----------- executor/common_kvm_arm64_syzos.h | 15 +++------------ executor/common_kvm_syzos.h | 33 +++++++++++++++++++++++++++++++++ 3 files changed, 37 insertions(+), 23 deletions(-) create mode 100644 executor/common_kvm_syzos.h (limited to 'executor') diff --git a/executor/common_kvm_amd64_syzos.h b/executor/common_kvm_amd64_syzos.h index 32e09e0ba..655e83ce3 100644 --- a/executor/common_kvm_amd64_syzos.h +++ b/executor/common_kvm_amd64_syzos.h @@ -3,21 +3,11 @@ // This file provides guest code running inside the AMD64 KVM. +#include "common_kvm_syzos.h" #include "kvm.h" #include #include -// Host will map the code in this section into the guest address space. -#define GUEST_CODE __attribute__((section("guest"))) - -// Prevent function inlining. This attribute is applied to every guest_handle_* function, -// making sure they remain small so that the compiler does not attempt to be too clever -// (e.g. generate switch tables). -#define noinline __attribute__((noinline)) - -// Start/end of the guest section. -extern char *__start_guest, *__stop_guest; - // Compilers will eagerly try to transform the switch statement in guest_main() // into a jump table, unless the cases are sparse enough. // We use prime numbers multiplied by 10 to prevent this behavior. diff --git a/executor/common_kvm_arm64_syzos.h b/executor/common_kvm_arm64_syzos.h index 41a7f184b..2dd00a146 100644 --- a/executor/common_kvm_arm64_syzos.h +++ b/executor/common_kvm_arm64_syzos.h @@ -3,21 +3,11 @@ // This file provides guest code running inside the ARM64 KVM. +#include "common_kvm_syzos.h" #include "kvm.h" #include #include -// Host will map the code in this section into the guest address space. -#define GUEST_CODE __attribute__((section("guest"))) - -// Prevent function inlining. This attribute is applied to every guest_handle_* function, -// making sure they remain small so that the compiler does not attempt to be too clever -// (e.g. generate switch tables). -#define noinline __attribute__((noinline)) - -// Start/end of the guest section. -extern char *__start_guest, *__stop_guest; - // Compilers will eagerly try to transform the switch statement in guest_main() // into a jump table, unless the cases are sparse enough. // We use prime numbers multiplied by 10 to prevent this behavior. @@ -1201,7 +1191,8 @@ GUEST_CODE static void its_send_movall_cmd(uint64 cmdq_base, uint32 vcpu_id, uin its_send_cmd(cmdq_base, &cmd); } -GUEST_CODE static void its_send_invall_cmd(uint64 cmdq_base, uint32 collection_id) +GUEST_CODE static void +its_send_invall_cmd(uint64 cmdq_base, uint32 collection_id) { struct its_cmd_block cmd; guest_memzero(&cmd, sizeof(cmd)); diff --git a/executor/common_kvm_syzos.h b/executor/common_kvm_syzos.h new file mode 100644 index 000000000..a635d517b --- /dev/null +++ b/executor/common_kvm_syzos.h @@ -0,0 +1,33 @@ +// Copyright 2025 syzkaller project authors. All rights reserved. +// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file. + +// Common SYZOS definitions. + +// Prevent function inlining. This attribute is applied to every guest_handle_* function, +// making sure they remain small so that the compiler does not attempt to be too clever +// (e.g. generate switch tables). +#define noinline __attribute__((noinline)) + +// __no_stack_protector disables -fstack-protector which may introduce unwanted global accesses. +// TODO(glider): once syz-env-old migrates to GCC>11 we can just use +// __attribute__((no_stack_protector)). +#if defined(__clang__) +// Clang supports the no_stack_protector attribute. +#define __no_stack_protector __attribute__((no_stack_protector)) +#elif defined(__GNUC__) +// The no_stack_protector attribute was introduced in GCC 11.1. +#if __GNUC__ > 11 +#define __no_stack_protector __attribute__((no_stack_protector)) +#else +// Fallback to the optimize attribute for older GCC versions. +#define __no_stack_protector __attribute__((__optimize__("-fno-stack-protector"))) +#endif +#else +#define __no_stack_protector +#endif + +// Host will map the code in this section into the guest address space. +#define GUEST_CODE __attribute__((section("guest"))) __no_stack_protector + +// Start/end of the guest section. +extern char *__start_guest, *__stop_guest; -- cgit mrf-deployment