[openssl.org #3074] On PA-RISC, OPENSSL_cleanse() causes crash when called from outside libcrypto, patch included
Mitch Blank via RT <rt <at> openssl.org>
2013-06-16 09:33:25 GMT
I got a strange bug report claiming that "openssl md5" was dumping core on
old parisc hardware. Sure enough, it was generating the correct result
but then crashing:
$ openssl md5 /dev/null
MD5(/dev/null)= d41d8cd98f00b204e9800998ecf8427e
Segmentation fault (core dumped)
The debugger wasn't much help, but through trial and error I narrowed it
down to the single call to OPENSSL_cleanse() in apps/dgst.c. I then spent
a few frustrating hours learning the minutia of how parisc assembly works.
It turns out the problem is rather subtle. The implementation of
crypto/pariscid.pl returns to its caller with this instruction:
bv ($rp)
That would work if it were a function statically linked into bin/openssl.
However, when returning to a function in a different segment you must use
the "bve" instruction ("Branch Vectored _External_") or it will crash as
as the branch completes. By the way, "bve($rp)" is known simply as "ret"
when disassembling.
Just changing that one instruction was enough to make "openssl md5" run,
but "make test" still failed since rc4test.c was calling other assembly
functions (OPENSSL_cpuid_setup, RC4). I ended up changing all of the "bv"
instructions to "bve" and then "make test" passes. Some of them probably
*are* functions that are only called from inside of libcrypto and "bv"
would be OK for them.
Not sure if this fix is appropriate for 32-bit parisc. I don't have an
environment for testing that at the moment. Maybe we should only be using
bve for shared libraries on 64-bit? Hopefully whoever contributed the
parisc assembly functions in openssl 1.x knows.
*** CUT HERE ***
--- openssl-1.0.1e/crypto/modes/asm/ghash-parisc.pl.ORIG 2013-06-15
19:37:45.492322377 -0700
+++ openssl-1.0.1e/crypto/modes/asm/ghash-parisc.pl 2013-06-15
19:37:51.572318630 -0700
<at> <at> -332,7 +332,7 <at> <at>
$POP `-$FRAME+8*$SIZE_T`(%sp),%r11
___
$code.=<<___;
- bv (%r2)
+ bve (%r2)
.EXIT
$POPMB -$FRAME(%sp),%r3
.PROCEND
<at> <at> -606,7 +606,7 <at> <at>
$POP `-$FRAME+8*$SIZE_T`(%sp),%r11
___
$code.=<<___;
- bv (%r2)
+ bve (%r2)
.EXIT
$POPMB -$FRAME(%sp),%r3
.PROCEND
bash: exit 1
--- openssl-1.0.1e/crypto/bn/asm/parisc-mont.pl.ORIG 2013-06-15
19:37:52.551358611 -0700
+++ openssl-1.0.1e/crypto/bn/asm/parisc-mont.pl 2013-06-15
19:37:58.228321842 -0700
<at> <at> -881,7 +881,7 <at> <at>
$POP `-$FRAME+6*$SIZE_T`(%sp),%r9
$POP `-$FRAME+7*$SIZE_T`(%sp),%r10
L\$abort
- bv (%r2)
+ bve (%r2)
.EXIT
$POPMB -$FRAME(%sp),%r3
.PROCEND
bash: exit 1
--- openssl-1.0.1e/crypto/aes/asm/aes-parisc.pl.ORIG 2013-06-15
19:37:59.991639886 -0700
+++ openssl-1.0.1e/crypto/aes/asm/aes-parisc.pl 2013-06-15
19:38:07.753328148 -0700
<at> <at> -175,7 +175,7 <at> <at>
$POP `-$FRAME+13*$SIZE_T`(%sp),%r16
$POP `-$FRAME+14*$SIZE_T`(%sp),%r17
$POP `-$FRAME+15*$SIZE_T`(%sp),%r18
- bv (%r2)
+ bve (%r2)
.EXIT
$POPMB -$FRAME(%sp),%r3
.PROCEND
<at> <at> -430,7 +430,7 <at> <at>
dep $acc14,23,8,$acc15
xor $acc11,$s2,$s2
- bv (%r31)
+ bve (%r31)
.EXIT
xor $acc15,$s3,$s3
.PROCEND
<at> <at> -644,7 +644,7 <at> <at>
$POP `-$FRAME+13*$SIZE_T`(%sp),%r16
$POP `-$FRAME+14*$SIZE_T`(%sp),%r17
$POP `-$FRAME+15*$SIZE_T`(%sp),%r18
- bv (%r2)
+ bve (%r2)
.EXIT
$POPMB -$FRAME(%sp),%r3
.PROCEND
<at> <at> -899,7 +899,7 <at> <at>
dep $acc14,23,8,$acc15
xor $acc11,$s2,$s2
- bv (%r31)
+ bve (%r31)
.EXIT
xor $acc15,$s3,$s3
.PROCEND
bash: exit 1
--- openssl-1.0.1e/crypto/sha/asm/sha512-parisc.pl.ORIG 2013-06-15
19:38:09.574428604 -0700
+++ openssl-1.0.1e/crypto/sha/asm/sha512-parisc.pl 2013-06-15
19:38:13.730374882 -0700
<at> <at> -678,7 +678,7 <at> <at>
$POP `-$FRAME+13*$SIZE_T`(%sp),%r16
$POP `-$FRAME+14*$SIZE_T`(%sp),%r17
$POP `-$FRAME+15*$SIZE_T`(%sp),%r18
- bv (%r2)
+ bve (%r2)
.EXIT
$POPMB -$FRAME(%sp),%r3
.PROCEND
bash: exit 1
--- openssl-1.0.1e/crypto/sha/asm/sha1-parisc.pl.ORIG 2013-06-15
19:38:15.030284745 -0700
+++ openssl-1.0.1e/crypto/sha/asm/sha1-parisc.pl 2013-06-15
19:38:18.599390306 -0700
<at> <at> -246,7 +246,7 <at> <at>
$POP `-$FRAME+11*$SIZE_T`(%sp),%r14
$POP `-$FRAME+12*$SIZE_T`(%sp),%r15
$POP `-$FRAME+13*$SIZE_T`(%sp),%r16
- bv (%r2)
+ bve (%r2)
.EXIT
$POPMB -$FRAME(%sp),%r3
.PROCEND
bash: exit 1
--- openssl-1.0.1e/crypto/rc4/asm/rc4-parisc.pl.ORIG 2013-06-15
19:38:20.646301859 -0700
+++ openssl-1.0.1e/crypto/rc4/asm/rc4-parisc.pl 2013-06-15
19:38:26.388314623 -0700
<at> <at> -235,7 +235,7 <at> <at>
$POP `-$FRAME+2*$SIZE_T`(%sp),%r5
$POP `-$FRAME+3*$SIZE_T`(%sp),%r6
L\$abort
- bv (%r2)
+ bve (%r2)
.EXIT
$POPMB -$FRAME(%sp),%r3
.PROCEND
<at> <at> -282,7 +282,7 <at> <at>
bb,>= <at> XX[0],`31-8`,L\$2nd ; <at> XX[0]<256
$ST <at> TX[1],0($TY)
- bv,n (%r2)
+ bve,n (%r2)
.EXIT
nop
.PROCEND
<at> <at> -297,7 +297,7 <at> <at>
ldi 3,%r1
L\$pic
andcm %r28,%r1,%r28
- bv (%r2)
+ bve (%r2)
.EXIT
ldo L\$opts-L\$pic(%r28),%r28
.PROCEND
bash: exit 1
--- openssl-1.0.1e/crypto/pariscid.pl.ORIG 2013-06-15 19:38:29.189331581
-0700
+++ openssl-1.0.1e/crypto/pariscid.pl 2013-06-15 19:38:36.817265345 -0700
<at> <at> -29,7 +29,7 <at> <at>
.PROC
.CALLINFO NO_CALLS
.ENTRY
- bv ($rp)
+ bve ($rp)
.EXIT
nop
.PROCEND
<at> <at> -41,7 +41,7 <at> <at>
.CALLINFO NO_CALLS
.ENTRY
mfctl %cr16,$rv
- bv ($rp)
+ bve ($rp)
.EXIT
nop
.PROCEND
<at> <at> -81,7 +81,7 <at> <at>
fcpy,dbl %fr0,%fr29
fcpy,dbl %fr0,%fr30
fcpy,dbl %fr0,%fr31
- bv ($rp)
+ bve ($rp)
.EXIT
ldo 0($sp),$rv
.PROCEND
<at> <at> -124,7 +124,7 <at> <at>
addib,*<> -1,$len,Little
ldo 1($inp),$inp
Ldone
- bv ($rp)
+ bve ($rp)
.EXIT
nop
.PROCEND
<at> <at> -164,7 +164,7 <at> <at>
addib,<> -1,$cnt,Loop
addi 4,$out,$out
- bv ($rp)
+ bve ($rp)
.EXIT
sub $rv,$cnt,$rv
.PROCEND
<at> <at> -211,7 +211,7 <at> <at>
addb,<> $tick,$cnt,Loop2
shladd,l $tick,2,$out,$out
Ldone2
- bv ($rp)
+ bve ($rp)
.EXIT
add $rv,$cnt,$rv
.PROCEND
*** CUT HERE ***
"make report" output:
OpenSSL version: 1.0.1e
Last change: Make the decoding of SSLv3, TLS and DTLS CBC records
co...
Options: {PATHS ELIDED FOR PRIVACY} --libdir=lib enable-shared
enable-zlib enable-threads no-ec_nistp_64_gcc_128 no-gmp no-idea no-jpake
no-krb5 no-md2 no-mdc2 no-rc5 no-rfc3779 no-sctp no-store no-zlib-dynamic
no-static-engine
OS (uname): HP-UX hp B.11.11 U 9000/785 3763961412 unlimited-user
license
OS (config): 9000/785-hp-hpux1x
Target (default): hpux-parisc2-cc
Target: hpux64-parisc2-cc
Compiler: cc: informational note 404: NLSPATH is
/opt/ansic/lib/nls/msg/%L/%N.cat:/opt/ansic/lib/nls/msg/C/%N.cat:
cc: informational note 404: INCLUDIR is INCLUDIR=/usr/include
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List openssl-dev <at> openssl.org
Automated List Manager majordomo <at> openssl.org
RSS Feed