From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/13281 Path: news.gmane.org!.POSTED!not-for-mail From: Markus Wichmann Newsgroups: gmane.linux.lib.musl.general Subject: Re: Replacing a_crash() ? Date: Mon, 17 Sep 2018 17:24:15 +0200 Message-ID: <20180917152415.GA29861@voyager> References: <20180917032317.GF17995@brightrain.aerifal.cx> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: blaine.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: blaine.gmane.org 1537197749 2337 195.159.176.226 (17 Sep 2018 15:22:29 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Mon, 17 Sep 2018 15:22:29 +0000 (UTC) User-Agent: Mutt/1.10.1 (2018-07-13) To: musl@lists.openwall.com Original-X-From: musl-return-13297-gllmg-musl=m.gmane.org@lists.openwall.com Mon Sep 17 17:22:25 2018 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by blaine.gmane.org with smtp (Exim 4.84_2) (envelope-from ) id 1g1vLw-0000PV-7y for gllmg-musl@m.gmane.org; Mon, 17 Sep 2018 17:22:20 +0200 Original-Received: (qmail 18358 invoked by uid 550); 17 Sep 2018 15:24:29 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Original-Received: (qmail 18310 invoked from network); 17 Sep 2018 15:24:28 -0000 Content-Disposition: inline In-Reply-To: <20180917032317.GF17995@brightrain.aerifal.cx> X-Provags-ID: V03:K1:dtxDSP7tNGVVGKpaLXdgjZlYULH9HDT+juLrxwIlFc4Tu34Drem 5xrDUC2Xy2PZ5mVtQlB7hGLkaOcqvWJ9I5+2dTPlJIeRr+oXUXmCY5+gtLUhqjQgwe5cg+R 8iwZdi3xjfN2mA0E0mmd5g/51MuBKGl1GFFCFkE9CjwKA5qvGtAtSDGa7/wkvXOh6zMOKvb y+7rq6mCiABVotMU4b9Bw== X-UI-Out-Filterresults: notjunk:1;V01:K0:SThI+cjZl9k=:snaNn4msHHRYGgI0HOBPpM xjbOHBxEv+VHL+ddvbREFQgOxO8GvaOmnIDrRoZSvXbd6Lf0OgZrDAY6u4H1pkPPDssiHEzI7 stIBybbm73ZI1qGmCfiZVibMGa3R/kNNW6wrPME+LIroqwvBPkF/Jh+oM1SxMLgCli50Vc5sb PRvslV+lEN7kCVPi+U5gW6+wNPStMX7z9gdw6wV2WKCttbqs3TTie+s1RKp3hdcX99t3tHEwB 4IWst2jl+5RGG4aBRqB0oC9hXyhH/HEO33CRstXOnJeoQlvGZlSOoDgaM/eyJfCpcrDoJvv96 0Z9YCa578iZ8pqWUtCWafLKvin7H5SmfzJw/a/fPRt21G2nFeh496NVaamqyelWCMaHakbWdL KaAJFGRpy6JcO7r/ph6ZFjxUKrVjFEa/ZavdGrcYga540s4bSrjQPTQt9ruIb2DpM+BVO+1YJ ArTpId8O1b0xEhSztUuErcQ5Z2agBHtMt1nu8YfHdMNltd8Ko9bl8121qtNSerKlP6fYxB/cw iHBtgLTRWfJcG14CBDl8T7wlYoocBFM+4wkkp40leE2e4W0tpdzmexSZgIgodKxg2vRag266Q FLDyNrWwJpDpdNghMZKb6D45XsFZuyDn1IVUGX0UVuI6W7CocpdOoSTenA8XIBRbxbiOOzAxe 2Z2TONfHx2ojpMhuQ9tkG3aFckd97pIDa8bHNap3KrB4yCge+tfVVhbgGEVP/dwPooPlfrbUl 0711jsdpZaqC10jDVoJrL/l57SDpDoh/CRQuKnx0IxiE2G8w/8l5O3AnXP6GvZcAHeYrc43h Xref: news.gmane.org gmane.linux.lib.musl.general:13281 Archived-At: On Sun, Sep 16, 2018 at 11:23:17PM -0400, Rich Felker wrote: > Now that we have an abort() that reliably terminates with uncatchable > SIGABRT, I've been thinking about replacing the a_crash() calls in > musl (which are usually an instruction generating SIGILL or SIGSEGV) > with calls to the uncatchable tail of abort(), which I would factor > off as a __forced_abort() function. > > In case it's not clear, the reason for not just calling abort() is > that too many programs catch it, and catching it is even encouraged. > Catchability is a problem with the current approach too, since > a_crash() is used in places where process state is known to be > dangerously corrupt and likely under attacker control; eliminating it > is one of the potential goals of switching to __forced_abort(). > > Are there any objections to making such a change? So far I've gotten > mostly positive feedback -- SIGABRT is more telling of what's happened > than SIGSEGV/SIGILL. It would also get rid of the ugly misplacement of > a_crash() (no longer needed) in "atomic.h" and the inclusion of > "atomic.h" in some files where it makes no sense without knowing it's > where a_crash() is defined. > > For i386, some nontrivial work would be needed to make abort's tail > perform syscalls with int $128 rather than the vdso, which is unsafe > since the pointer to it may have been subverted. On other archs, > inline syscalls are fully inline. I'd probably add a > NEED_FAILSAFE_SYSCALL macro to define before including "syscall.h" and > have arch/i386/syscall_arch.h adjust the asm string based on it; this > is more maintainable than writing an asm version of the function. > > Rich Simple checklist for whether to perform a change or not: 1. Does the change fix problems? Check (namely, maintainability, legibility, understandability of problems). 2. Does the change introduce problems? Unlikely. Someone might subvert __forced_abort(), but then, someone might catch SIGILL, so we haven't gone anywhere. 3. Is the change compatible with old programs? No, but a_crash() was never a defined interface, so any program catching it was walking on thin ice, anyway. So that's two green lights and a don't care, so please go ahead. Ciao, Markus