gcc generates prolog without rsp decrementing, i.e. allocates locals and parameters in free stack without privatising this stack

[Denis]

Hi,

I use gcc:

[dnlarion@msteplxl5 ~]$ gcc -v

Using built-in specs.

Target: x86_64-suse-linux

Configured with: ../configure --enable-threads=posix --prefix=/usr  
--with-local-prefix=/usr/local --infodir=/usr/share/info  
--mandir=/usr/share/man --libdir=/usr/lib64 --libexecdir=/usr/lib64  
--enable-languages=c,c++,objc,fortran,java,ada  
--enable-checking=release  
--with-gxx-include-dir=/usr/include/c++/4.1.0 --enable-ssp  
--disable-libssp --enable-java-awt=gtk --enable-gtk-cairo  
--disable-libjava-multilib --with-slibdir=/lib64 --with-system-zlib  
--enable-shared --enable-__cxa_atexit --enable-libstdcxx-allocator=new  
--without-system-libunwind --with-cpu=generic --host=x86_64-suse-linux

Thread model: posix

gcc version 4.1.0 (SUSE Linux)

and trying to compile program:

################################

void plus (long * a, long * b)
{
     long aa = 10;
     long bb =10;
     *a += *b + aa + bb;
}



int main (){

     long a = 1;

     long b = 2;

     long *aa = &a;

     long *bb = &b;

     plus(aa,bb);

}



######################################



[dnlarion@msteplxl5 gc]$ gcc -S main.c



But code produced for plus function is incorrect:



        .file   "main.c"

         .text

.globl plus

         .type   plus, @function

plus:

.LFB2:

         pushq   %rbp

.LCFI0:

         movq    %rsp, %rbp

.LCFI1:

##################>>>>>>> As you can see here it allocates parameters  
and autos into stack minus shifts, that is free stack space. I.e. it  
didn.t reservation.

         movq    %rdi, -24(%rbp)

         movq    %rsi, -32(%rbp)

         movq    $10, -16(%rbp)

         movq    $10, -8(%rbp)

         movq    -24(%rbp), %rax

         movq    (%rax), %rdx

         movq    -32(%rbp), %rax

         movq    (%rax), %rax

         addq    -16(%rbp), %rax

         addq    -8(%rbp), %rax

         addq    %rax, %rdx

         movq    -24(%rbp), %rax

         movq    %rdx, (%rax)

         leave

         ret

.LFE2:

         .size   plus, .-plus

.globl main

         .type   main, @function

main:

.LFB3:

         pushq   %rbp

.LCFI2:

         movq    %rsp, %rbp

.LCFI3:

#################>>>>>>>>>> Here it does all correct . firstly reserve  
stack frame and then allocates autos and parameters there.

         subq    $32, %rsp

.LCFI4:

         movq    $1, -24(%rbp)

         movq    $2, -32(%rbp)

         leaq    -24(%rbp), %rax

         movq    %rax, -16(%rbp)

         leaq    -32(%rbp), %rax

         movq    %rax, -8(%rbp)

         movq    -8(%rbp), %rsi

         movq    -16(%rbp), %rdi

         call    plus

         leave

         ret:



The difference between functions is that main calls other function and  
.plus. does not.



In my project I have kernel code that has a function w/o calls  
(memcpy) and it is compiled also incorrectly.

And problem is that when *dst = *src executed . pagefault appeared,  
this pagefault works on the same stack and rewrites free space, i.e.  
rewrites locals of memcpy function.

That results to crash on next read from src.



So probably somebody knows how to solve this problem? I.ve explored  
gcc flags and didn.t find anything to solve it.

I.ve also tried another gcc version :



[dnlarion@msteplxl35 gc]$ gcc -v

Reading specs from /usr/lib/gcc/x86_64-redhat-linux/3.4.5/specs

Configured with: ../configure --prefix=/usr --mandir=/usr/share/man  
--infodir=/usr/share/info --enable-shared --enable-threads=posix  
--disable-checking --with-system-zlib --enable-__cxa_atexit  
--disable-libunwind-exceptions --enable-java-awt=gtk  
--host=x86_64-redhat-linux

Thread model: posix

gcc version 3.4.5 20051201 (Red Hat 3.4.5-2)

Result is the same.

Thank you in advance,

Denis.