From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-3.4 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL autolearn=ham autolearn_force=no version=3.4.4 Received: (qmail 8922 invoked from network); 10 Aug 2020 19:30:09 -0000 Received: from mother.openwall.net (195.42.179.200) by inbox.vuxu.org with ESMTPUTF8; 10 Aug 2020 19:30:09 -0000 Received: (qmail 19740 invoked by uid 550); 10 Aug 2020 19:30:05 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 19713 invoked from network); 10 Aug 2020 19:30:05 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1597087793; s=strato-dkim-0002; d=oflebbe.de; h=Message-Id:In-Reply-To:To:References:Date:Subject:From: X-RZG-CLASS-ID:X-RZG-AUTH:From:Subject:Sender; bh=Grk1Q9V/L0sS8g335tbdiPxFa5fFIIXR08ti0wZqr18=; b=GnIiVQ3WRb2rVZs0h7jMVciUxk6+AwMeYbX8iTWuHx10WEYmmAuX+/JSNcqMg6vbKI OjS/XZg51lSKDXWDxndYTd98qIokyMRwOimG84U+1bfjZxR3db6hlDfoCws2pY4JD8zH vqB8+t527guwHBCTt12H3L2+bLK9DEv9jVTVAqBWxnItxtJhT3D4IpjgHJ+4iQRpvix4 US7lzADRLXRLZDsASppvMjxe1kRF1U07fxHPY0abYih6jtkdLC4TBeqRFDq+dqTLBllz 0oMLZt5JpXKwLp0GwL48W/4sGXslGo62S/pHxSfJRGa+9Cy42LNKYDXJnmm8OaDgXON+ ut4g== X-RZG-AUTH: ":I2okekakfv3mKNs8YSFayssNXg+upDn7jErwclkPntL+Rbxoy1FyfmVPIbDECH82zNYb4zXt9RFJJgQXvGBS959f7VPVP3v3qQ==" X-RZG-CLASS-ID: mo00 From: Olaf Flebbe Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Mon, 10 Aug 2020 21:29:52 +0200 References: <20200809003958.GE3265@brightrain.aerifal.cx> <2142D551-13BE-4033-94F7-80A7B2C01890@oflebbe.de> <20200810163647.GI3265@brightrain.aerifal.cx> <20200810170053.GK3265@brightrain.aerifal.cx> <3F1D0BA8-6B88-4B3C-A6F0-DF02DAA90212@oflebbe.de> <20200810183159.GL3265@brightrain.aerifal.cx> To: musl@lists.openwall.com In-Reply-To: <20200810183159.GL3265@brightrain.aerifal.cx> Message-Id: <0956F547-0134-45E4-8F23-C503E3E6B6DC@oflebbe.de> X-Mailer: Apple Mail (2.3608.120.23.2.1) Subject: Re: [musl] Revisiting sigaltstack and implementation-internal signals Hi Rick, Since the alternate stack is only used for signal handlers, one can = limit to the allowed signal safe functions: There is a list of async-safe-signal functions copied from the OpenGroup = documents. https://man7.org/linux/man-pages/man7/signal-safety.7.html swapcontext is not mentioned here :) Sounds to me moving the stack pointer like you are describing is not = allowed. Installing the same stack both as regular and alternate stack sound to = me like asking for trouble as well. Best Olaf > Am 10.08.2020 um 20:32 schrieb Rich Felker : >=20 > On Mon, Aug 10, 2020 at 07:04:36PM +0200, Olaf Flebbe wrote: >> Hi Rick, >>=20 >> Thanks for explanation, indeed: This might be a problem, if the >> business logic of the handler is under application control. >> But I was assuming that the handler context of __synccall is under >> musl control . >=20 > The handler in question is the one that's under application control > because the application installed it with intent for it to run on the > alternate stack. __synccall is the asynchronous clobbering of its > stack. >=20 >>> Am 10.08.2020 um 19:00 schrieb Rich Felker : >>>=20 >>> On Mon, Aug 10, 2020 at 06:57:21PM +0200, Olaf Flebbe wrote: >>>> Hi Rick , >>>>=20 >>>> While the alternate stack is in use on cannot change the alternate = stack. >>>>=20 >>>> See https://pubs.opengroup.org/onlinepubs/9699919799/=20 >>>> EPERM Error. >>>=20 >>> No change of the alternate stack is described here. The minimal >>> example of the scenario only has one call to sigaltstack in the = whole >>> program. >>>=20 >>>=20 >>>>> Am 10.08.2020 um 18:36 schrieb Rich Felker : >>>>>=20 >>>>> On Mon, Aug 10, 2020 at 10:15:13AM +0200, Olaf Flebbe wrote: >>>>>> Hi,=20 >>>>>>=20 >>>>>> I have some problems to follow the discussion here. >>>>>>=20 >>>>>> It is not about musl to create an alternate stack, it is to = *honor* the alternate stack, if the application installed one, for a = reason. >>>>>>=20 >>>>>> I am proposing smthg like >>>>>>=20 >>>>>> --- /oss/musl-1.2.1/src/thread/synccall.c >>>>>> +++ /work/musl/src/thread/synccall.c >>>>>> @@ -45,7 +45,7 @@ >>>>>> { >>>>>> sigset_t oldmask; >>>>>> int cs, i, r; >>>>>> - struct sigaction sa =3D { .sa_flags =3D SA_RESTART, = .sa_handler =3D handler }; >>>>>> + struct sigaction sa =3D { .sa_flags =3D = SA_RESTART|SA_ONSTACK, ....sa_handler =3D handler }; >>>>>> pthread_t self =3D __pthread_self(), td; >>>>>> int count =3D 0; >>>>>>=20 >>>>>> This will fix the problem with dynamic stacks, like go implements = it.=20 >>>>>> If the application does not install one, kernel will ignore >>>>>> SA_ONSTACK. (This is even specified by POSIX, since there is no >>>>>> error condition mentioned in man page specifically for this). >>>>>=20 >>>>> It's fundamental, since presence and identity of an alternate = stack >>>>> are thread-local properties and SA_ONSTACK is global to the signal >>>>> disposition. >>>>>=20 >>>>> The behavior we're concerned about this alterring is not the case >>>>> where an application does not install an alternate stack; of = course >>>>> that's unaffected. The interesting case is where an application = does >>>>> install one, but expects (albeit IMO wrongly; that's what we're = trying >>>>> to establish) that the stack memory is not touched/clobbered = unless >>>>> there's actually an SA_ONSTACK signal handler present to run on it = and >>>>> such a signal arrives. With the proposed change, the memory for = the >>>>> alternate stack can be clobbered asynchronously with no such = signal >>>>> handler existing. (In case it's not clear, the above code is *not = a >>>>> signal handler* from the perspective that's relevant; it's an >>>>> implementation detail internal to the implementation.) >>>>>=20 >>>>> One way such clobbering could manifest is when a signal handler >>>>> running on the alternate stack temporarily moves the stack pointer = to >>>>> somewhere else (not on the alternate stack), via swapcontext or = some >>>>> other method. In this case, if a signal for cancellation or = synccall >>>>> arrives, the kernel will consider the alt stack not in use, and = will >>>>> start using it again from the beginning, clobbering the = still-running >>>>> frames. >>>>>=20 >>>>> Rich >>>>=20