intel / intel/confidential-computing.sgx.sdk

Invalid CFI data in enclave_entry causes bogus stack traces

Open
#119 3 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
C++
Stars
2
Forks
3
PR merge metrics
No merged PRs in 30d

Description

Tested on current master (commit ced74d68f60a10577ea2d27e8fa1e9529fc67da0), default build without debug info.
Repro: in simulation mode set a breakpoint in `enclave_entry` start (or any offset before it switches the stack and the subsequent `.cfi` directives).

```
(gdb) break enclave_entry
Breakpoint 4 at 0x7ffff674b177
(gdb) c
Continuing.

Breakpoint 4, 0x00007ffff674b177 in enclave_entry ()
(gdb) bt
#0 0x00007ffff674b177 in enclave_entry ()
intel/confidential-computing.sgx#1 0x00007fffffffdac0 in ?? ()
intel/confidential-computing.sgx#2 0x0000000000000000 in ?? ()
```

Here's how the relevant CFI data looks:
```
00000e28 0000000000000018 00000e2c FDE cie=00000000 pc=000000000001517b..00000000000152ab
LOC CFA rbp ra
000000000001517b rsp+8 u c-8 # enclave_entry start, invalid CFI data: RA isn't correct here and leads to garbage pointers
00000000000151cd rsp+16 c-16 c-8 # after stack switch
00000000000151d0 rbp+16 c-16 c-8
```

```
Dump of assembler code for function enclave_entry:
0x00007ffff674b177 <+0>: endbr64
0x00007ffff674b17b <+4>: xor %rdx,%rdx # enclave_entry start
0x00007ffff674b17e <+7>: add %rdx,%rdx
0x00007ffff674b181 <+10>: cld
0x00007ffff674b182 <+11>: xor %r8,%r8
0x00007ffff674b185 <+14>: xor %r9,%r9
0x00007ffff674b188 <+17>: xor %r10,%r10
0x00007ffff674b18b <+20>: xor %r11,%r11
0x00007ffff674b18e <+23>: xor %r12,%r12
0x00007ffff674b191 <+26>: xor %r13,%r13
0x00007ffff674b194 <+29>: xor %r14,%r14
0x00007ffff674b197 <+32>: xor %r15,%r15
0x00007ffff674b19a <+35>: cmp $0x0,%rax
0x00007ffff674b19e <+39>: jne 0x7ffff674b298
0x00007ffff674b1a4 <+45>: mov %fs:0x8,%rax
0x00007ffff674b1ad <+54>: mov (%rax),%rax
0x00007ffff674b1b0 <+57>: mov 0x8(%rax),%rax
0x00007ffff674b1b4 <+61>: cmp $0x0,%rax
0x00007ffff674b1b8 <+65>: jne 0x7ffff674b1c9
0x00007ffff674b1ba <+67>: mov %rbx,%rax
0x00007ffff674b1bd <+70>: sub $0x10000,%rax
0x00007ffff674b1c3 <+76>: sub $0x2b0,%rax
0x00007ffff674b1c9 <+82>: xchg %rax,%rsp
0x00007ffff674b1cb <+84>: push %rcx
0x00007ffff674b1cc <+85>: push %rbp
0x00007ffff674b1cd <+86>: mov %rsp,%rbp # after stack switch
0x00007ffff674b1d0 <+89>: pushf
```

Contributor guide

Open the contributing guide

Research direction

Locate enclave_entry and the CFI directives that describe its entry and post-stack-switch states. Reproduce the issue in simulation mode with GDB stopped at enclave_entry, then inspect the unwind information and backtrace. Done means the entry-point CFI no longer produces bogus stack frames while preserving correct unwinding after the stack switch.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.