Re: aio_cancel segmentation fault for in progress write requests

[Rich Felker <dalias@libc.org>]

On Fri, Dec 07, 2018 at 11:31:01AM -0600, A. Wilcox wrote:
> awilcox on gwyn [pts/7 Fri 7 11:29] ~: ./aioWrite
> zsh: segmentation fault  ./aioWrite
> awilcox on gwyn [pts/7 Fri 7 11:29] ~: ./aioWrite
> zsh: segmentation fault  ./aioWrite
> awilcox on gwyn [pts/7 Fri 7 11:29] ~: ./aioWrite
> zsh: segmentation fault  ./aioWrite
> awilcox on gwyn [pts/7 Fri 7 11:29] ~: ./aioWrite
> zsh: segmentation fault  ./aioWrite
> awilcox on gwyn [pts/7 Fri 7 11:29] ~: ./aioWrite
> zsh: segmentation fault  ./aioWrite
> awilcox on gwyn [pts/7 Fri 7 11:29] ~: gdb aioWrite
> GNU gdb (GDB) 8.2
> Copyright (C) 2018 Free Software Foundation, Inc.
> License GPLv3+: GNU GPL version 3 or later
> <http://gnu.org/licenses/gpl.html>
> This is free software: you are free to change and redistribute it.
> There is NO WARRANTY, to the extent permitted by law.
> Type "show copying" and "show warranty" for details.
> This GDB was configured as "powerpc64-foxkit-linux-musl".
> Type "show configuration" for configuration details.
> For bug reporting instructions, please see:
> <http://www.gnu.org/software/gdb/bugs/>.
> Find the GDB manual and other documentation resources online at:
>     <http://www.gnu.org/software/gdb/documentation/>.
> 
> For help, type "help".
> Type "apropos word" to search for commands related to "word"...
> Reading symbols from aioWrite...done.
> (gdb) run
> Starting program: /home/awilcox/aioWrite
> [New LWP 60165]
> [LWP 60165 exited]
> aio_write/1-1.c cancelationStatus : 2
> Test PASSED
> [Inferior 1 (process 60162) exited normally]
> (gdb) quit
> 
> 
> Well, that's pretty interesting.
> 
> 
> awilcox on gwyn [pts/7 Fri 7 11:29] ~: uname -a
> Linux gwyn 4.14.76-mc11-easy-p8 #1 SMP Sat Nov 17 04:52:54 UTC 2018
> ppc64 GNU/Linux
> awilcox on gwyn [pts/7 Fri 7 11:30] ~: /lib/ld-musl-powerpc64.so.1
> musl libc (powerpc64)
> Version 1.1.20
> Dynamic Program Loader
> Usage: /lib/ld-musl-powerpc64.so.1 [options] [--] pathname [args]
> 
> 
> Maybe this is a bug that has been fixed on master?

I don't think so. I'm concerned that it's a stack overflow, and that
somehow the kernel folks have managed to break the MINSIGSTKSZ ABI.
AIO threads use a PTHREAD_STACK_MIN-sized stack with no guard page
(because they don't run any application code, just a tiny stub
function) but this could overflow in kernelspace (and either crash or
clobber memory depending on memory layout and presence/absence of
ASLR) if the kernel is making a signal frame that's too big. Note that
this would have to be nearly twice MINSIGSTKSZ (on x86 at least) due
to rounding up to whole pages, so if the kernel is misbehaving here
it's *badly* misbehaving...

Rich