320497 - libfreebl3.so wrongly requires executable stack

Status: RESOLVED FIXED

(NSS :: Build, defect, P1)

Description

[Wolfgang Rosenauer [:wolfiR]]

I get this output from our build system which checks for executable stack issues:

The following ELF objects are marked with executable stack requirements:
usr/lib64/libfreebl3.so

Most likely this requirement comes from the source files for the
following object files:
nss-3.11/mozilla/security/nss/lib/freebl/Linux2.6_x86_64_glibc_PTH_64_OPT.OBJ/Linux_SINGLE_SHLIB/mpi_amd64_gas.o
nss-3.11/mozilla/security/nss/lib/freebl/Linux2.6_x86_64_glibc_PTH_64_OPT.OBJ/Linux_SINGLE_SHLIB/arcfour-amd64-gas.o

You have SEVERAL possibilities to fix this warning, choose ONE: 
- if the source file is a plain C file, look for trampoline code 
  and convert the code to not require it 
  (for example by moving nested functions to toplevel) 
- if the source file is a NASM/GAS file, add a nonexec stack 
  declaration IF YOU'RE SURE IT DOESN'T REQUIRE executable stack (99% of all cases)

  for GAS: 
    .section .note.GNU-stack,"",@progbits
    .previous
  for NASM: 
    %ifidn __OUTPUT_FORMAT__,elf
    SECTION .note.GNU-stack noalloc progbits noexec nowrite
    %endif
- make sure that (G)AS invocations contain --noexecstack as commandline option
- make sure that gcc flags contain -Wa,--noexecstack during compilation
- make sure that gcc flags contain -Wl,--noexecstack during linking

Comment 1

[Wan-Teh Chang]

Attachment: Proposed patch

Wolfgang, thanks for the bug report.

Please try this patch.  I don't have an AMD64 machine to
test it.

Julien, could you test this patch on Solaris x64 with GCC?

Comment 2

[Wolfgang Rosenauer [:wolfiR]]

Our buildsystem doesn't complain any longer about the executable stack and the build still works fine. I couldn't test the resulting library easily.

Comment 3

[Julien Pierre]

Comment on attachment 206111 [details] [diff] [review]
Proposed patch

This patch works fine. I can confirm that there is no code requiring any exectable stack in these assembly files.

Comment 4

[Wan-Teh Chang]

I checked in the patch on the NSS trunk (NSS 3.12) and
the NSS_3_11_BRANCH (NSS 3.11.1).

Checking in arcfour-amd64-gas.s;
/cvsroot/mozilla/security/nss/lib/freebl/arcfour-amd64-gas.s,v  <--  arcfour-amd
64-gas.s
new revision: 1.2; previous revision: 1.1
done
Checking in mpi/mpi_amd64_gas.s;
/cvsroot/mozilla/security/nss/lib/freebl/mpi/mpi_amd64_gas.s,v  <--  mpi_amd64_g
as.s
new revision: 1.2; previous revision: 1.1
done

Checking in arcfour-amd64-gas.s;
/cvsroot/mozilla/security/nss/lib/freebl/arcfour-amd64-gas.s,v  <--  arcfour-amd
64-gas.s
new revision: 1.1.28.1; previous revision: 1.1
done
Checking in mpi/mpi_amd64_gas.s;
/cvsroot/mozilla/security/nss/lib/freebl/mpi/mpi_amd64_gas.s,v  <--  mpi_amd64_g
as.s
new revision: 1.1.30.1; previous revision: 1.1
done

Comment 5

[Wan-Teh Chang]

*** Bug 327254 has been marked as a duplicate of this bug. ***

Comment 6

[Christopher Aillon (sabbatical, not receiving bugmail)]

*** Bug 308289 has been marked as a duplicate of this bug. ***

Comment 7

[Wan-Teh Chang]

*** Bug 327595 has been marked as a duplicate of this bug. ***