intel / intel/confidential-computing.sgx.sdk
Invalid CFI data in enclave_entry causes bogus stack traces
- Dominant language
- C++
- Stars
- 2
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
Tested on current master (commit ced74d68f60a10577ea2d27e8fa1e9529fc67da0), default build without debug info.
Repro: in simulation mode set a breakpoint in `enclave_entry` start (or any offset before it switches the stack and the subsequent `.cfi` directives).
```
(gdb) break enclave_entry
Breakpoint 4 at 0x7ffff674b177
(gdb) c
Continuing.
Breakpoint 4, 0x00007ffff674b177 in enclave_entry ()
(gdb) bt
#0 0x00007ffff674b177 in enclave_entry ()
intel/confidential-computing.sgx#1 0x00007fffffffdac0 in ?? ()
intel/confidential-computing.sgx#2 0x0000000000000000 in ?? ()
```
Here's how the relevant CFI data looks:
```
00000e28 0000000000000018 00000e2c FDE cie=00000000 pc=000000000001517b..00000000000152ab
LOC CFA rbp ra
000000000001517b rsp+8 u c-8 # enclave_entry start, invalid CFI data: RA isn't correct here and leads to garbage pointers
00000000000151cd rsp+16 c-16 c-8 # after stack switch
00000000000151d0 rbp+16 c-16 c-8
```
```
Dump of assembler code for function enclave_entry:
0x00007ffff674b177 <+0>: endbr64
0x00007ffff674b17b <+4>: xor %rdx,%rdx # enclave_entry start
0x00007ffff674b17e <+7>: add %rdx,%rdx
0x00007ffff674b181 <+10>: cld
0x00007ffff674b182 <+11>: xor %r8,%r8
0x00007ffff674b185 <+14>: xor %r9,%r9
0x00007ffff674b188 <+17>: xor %r10,%r10
0x00007ffff674b18b <+20>: xor %r11,%r11
0x00007ffff674b18e <+23>: xor %r12,%r12
0x00007ffff674b191 <+26>: xor %r13,%r13
0x00007ffff674b194 <+29>: xor %r14,%r14
0x00007ffff674b197 <+32>: xor %r15,%r15
0x00007ffff674b19a <+35>: cmp $0x0,%rax
0x00007ffff674b19e <+39>: jne 0x7ffff674b298
0x00007ffff674b1a4 <+45>: mov %fs:0x8,%rax
0x00007ffff674b1ad <+54>: mov (%rax),%rax
0x00007ffff674b1b0 <+57>: mov 0x8(%rax),%rax
0x00007ffff674b1b4 <+61>: cmp $0x0,%rax
0x00007ffff674b1b8 <+65>: jne 0x7ffff674b1c9
0x00007ffff674b1ba <+67>: mov %rbx,%rax
0x00007ffff674b1bd <+70>: sub $0x10000,%rax
0x00007ffff674b1c3 <+76>: sub $0x2b0,%rax
0x00007ffff674b1c9 <+82>: xchg %rax,%rsp
0x00007ffff674b1cb <+84>: push %rcx
0x00007ffff674b1cc <+85>: push %rbp
0x00007ffff674b1cd <+86>: mov %rsp,%rbp # after stack switch
0x00007ffff674b1d0 <+89>: pushf
```
Contributor guide
Research direction
Locate enclave_entry and the CFI directives that describe its entry and post-stack-switch states. Reproduce the issue in simulation mode with GDB stopped at enclave_entry, then inspect the unwind information and backtrace. Done means the entry-point CFI no longer produces bogus stack frames while preserving correct unwinding after the stack switch.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100