Avoid executable stack by marking that it's not required. (#4418)

jkroonza · web-flow · commit 272a41dc80a8 · 2025-08-01T14:30:39.000+08:00
Also refer to: fluent/fluent-bit#10513 Signed-off-by: Jaco Kroon <jaco@uls.co.za>
diff --git a/core/iwasm/common/arch/fneh.txt b/core/iwasm/common/arch/fneh.txt
@@ -0,0 +1,3 @@
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/core/iwasm/common/arch/invokeNative_aarch64.s b/core/iwasm/common/arch/invokeNative_aarch64.s
@@ -79,3 +79,6 @@ return:
         add     sp, sp, #0x30          /* restore sp */
         ret
 
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/core/iwasm/common/arch/invokeNative_aarch64_simd.s b/core/iwasm/common/arch/invokeNative_aarch64_simd.s
@@ -77,3 +77,6 @@ return:
         add     sp, sp, #0x30          /* restore sp */
         ret
 
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/core/iwasm/common/arch/invokeNative_arc.s b/core/iwasm/common/arch/invokeNative_arc.s
@@ -67,3 +67,6 @@ call_func:
     j_s     [blink]             /* ret */
     nop_s
 
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/core/iwasm/common/arch/invokeNative_arm.s b/core/iwasm/common/arch/invokeNative_arm.s
@@ -73,3 +73,6 @@ return:
         add     sp, sp, #4
         ldmfd   sp!, {r4, r5, r6, r7, lr}
         bx      lr
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/core/iwasm/common/arch/invokeNative_arm_vfp.s b/core/iwasm/common/arch/invokeNative_arm_vfp.s
@@ -84,3 +84,6 @@ return:
         ldmfd   sp!, {r4, r5, r6, r7, lr}
         bx      lr
 
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/core/iwasm/common/arch/invokeNative_em64.s b/core/iwasm/common/arch/invokeNative_em64.s
@@ -62,3 +62,6 @@ push_args_end:
     leave
     ret
 
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/core/iwasm/common/arch/invokeNative_em64_simd.s b/core/iwasm/common/arch/invokeNative_em64_simd.s
@@ -62,3 +62,6 @@ push_args_end:
     leave
     ret
 
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/core/iwasm/common/arch/invokeNative_ia32.s b/core/iwasm/common/arch/invokeNative_ia32.s
@@ -35,3 +35,6 @@ skip_push_args:
     leave
     ret
 
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/core/iwasm/common/arch/invokeNative_mips.s b/core/iwasm/common/arch/invokeNative_mips.s
@@ -72,3 +72,6 @@ done:
 
     j $31
     .end invokeNative
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/core/iwasm/common/arch/invokeNative_osx_universal.s b/core/iwasm/common/arch/invokeNative_osx_universal.s
@@ -15,4 +15,4 @@
 #else
 #include "invokeNative_em64_simd.s"
 #endif
-#endif
+#endif
diff --git a/core/iwasm/common/arch/invokeNative_thumb.s b/core/iwasm/common/arch/invokeNative_thumb.s
@@ -89,3 +89,6 @@ return:
         pop     {r4, r5, r6, r7}
         mov     lr, r3
         bx      lr
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/core/iwasm/common/arch/invokeNative_thumb_vfp.s b/core/iwasm/common/arch/invokeNative_thumb_vfp.s
@@ -98,3 +98,6 @@ return:
         mov     lr, r3
         bx      lr
 
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/core/iwasm/common/arch/invokeNative_xtensa.s b/core/iwasm/common/arch/invokeNative_xtensa.s
@@ -72,3 +72,6 @@ call_func:
 
 return:
         retw.n
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+#if defined(__linux__) && defined(__ELF__)`
	`2`	`+.section .note.GNU-stack,"",%progbits`
	`3`	`+#endif`