From: Rich Felker <dalias@libc.org>
To: musl@lists.openwall.com
Subject: Re: Replacing a_crash() ?
Date: Mon, 17 Sep 2018 11:36:16 -0400 [thread overview]
Message-ID: <20180917153616.GM17995@brightrain.aerifal.cx> (raw)
In-Reply-To: <20180917152415.GA29861@voyager>
On Mon, Sep 17, 2018 at 05:24:15PM +0200, Markus Wichmann wrote:
> On Sun, Sep 16, 2018 at 11:23:17PM -0400, Rich Felker wrote:
> > Now that we have an abort() that reliably terminates with uncatchable
> > SIGABRT, I've been thinking about replacing the a_crash() calls in
> > musl (which are usually an instruction generating SIGILL or SIGSEGV)
> > with calls to the uncatchable tail of abort(), which I would factor
> > off as a __forced_abort() function.
> >
> > In case it's not clear, the reason for not just calling abort() is
> > that too many programs catch it, and catching it is even encouraged.
> > Catchability is a problem with the current approach too, since
> > a_crash() is used in places where process state is known to be
> > dangerously corrupt and likely under attacker control; eliminating it
> > is one of the potential goals of switching to __forced_abort().
> >
> > Are there any objections to making such a change? So far I've gotten
> > mostly positive feedback -- SIGABRT is more telling of what's happened
> > than SIGSEGV/SIGILL. It would also get rid of the ugly misplacement of
> > a_crash() (no longer needed) in "atomic.h" and the inclusion of
> > "atomic.h" in some files where it makes no sense without knowing it's
> > where a_crash() is defined.
> >
> > For i386, some nontrivial work would be needed to make abort's tail
> > perform syscalls with int $128 rather than the vdso, which is unsafe
> > since the pointer to it may have been subverted. On other archs,
> > inline syscalls are fully inline. I'd probably add a
> > NEED_FAILSAFE_SYSCALL macro to define before including "syscall.h" and
> > have arch/i386/syscall_arch.h adjust the asm string based on it; this
> > is more maintainable than writing an asm version of the function.
>
> Simple checklist for whether to perform a change or not:
>
> 1. Does the change fix problems? Check (namely, maintainability,
> legibility, understandability of problems).
It slightly reduces amount of per-arch asm needed. (Actually not,
because there's a "generic" a_crash() that writes to a volatile null
pointer, but it doesn't work on nommu.) It also gets rid of atomic.h
dependencies.
> 2. Does the change introduce problems? Unlikely. Someone might subvert
> __forced_abort(), but then, someone might catch SIGILL, so we haven't
> gone anywhere.
I was thinking more like friendliness to debugging workflows; that's
the motivation for not using SIGKILL, which always would have been
easy. Subverting __forced_abort() for static linking is of course
easy; for dynamic you'd have to modify the mapped libc.so since it
would be a direct call.
> 3. Is the change compatible with old programs? No, but a_crash() was
> never a defined interface, so any program catching it was walking on
> thin ice, anyway.
>
> So that's two green lights and a don't care, so please go ahead.
Indeed, catching it was never intended to be supported usage.
Rich
prev parent reply other threads:[~2018-09-17 15:36 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-17 3:23 Rich Felker
2018-09-17 3:50 ` A. Wilcox
2018-09-17 9:24 ` u-uy74
2018-09-17 11:13 ` Szabolcs Nagy
2018-09-17 13:24 ` Rich Felker
2018-09-17 15:24 ` Markus Wichmann
2018-09-17 15:36 ` Rich Felker [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180917153616.GM17995@brightrain.aerifal.cx \
--to=dalias@libc.org \
--cc=musl@lists.openwall.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).