From: Rich Felker <dalias@libc.org>
To: musl@lists.openwall.com
Subject: Re: [musl] Revisiting sigaltstack and implementation-internal signals
Date: Mon, 10 Aug 2020 14:32:00 -0400 [thread overview]
Message-ID: <20200810183159.GL3265@brightrain.aerifal.cx> (raw)
In-Reply-To: <3F1D0BA8-6B88-4B3C-A6F0-DF02DAA90212@oflebbe.de>
On Mon, Aug 10, 2020 at 07:04:36PM +0200, Olaf Flebbe wrote:
> Hi Rick,
>
> Thanks for explanation, indeed: This might be a problem, if the
> business logic of the handler is under application control.
> But I was assuming that the handler context of __synccall is under
> musl control .
The handler in question is the one that's under application control
because the application installed it with intent for it to run on the
alternate stack. __synccall is the asynchronous clobbering of its
stack.
> > Am 10.08.2020 um 19:00 schrieb Rich Felker <dalias@libc.org>:
> >
> > On Mon, Aug 10, 2020 at 06:57:21PM +0200, Olaf Flebbe wrote:
> >> Hi Rick ,
> >>
> >> While the alternate stack is in use on cannot change the alternate stack.
> >>
> >> See https://pubs.opengroup.org/onlinepubs/9699919799/
> >> EPERM Error.
> >
> > No change of the alternate stack is described here. The minimal
> > example of the scenario only has one call to sigaltstack in the whole
> > program.
> >
> >
> >>> Am 10.08.2020 um 18:36 schrieb Rich Felker <dalias@libc.org>:
> >>>
> >>> On Mon, Aug 10, 2020 at 10:15:13AM +0200, Olaf Flebbe wrote:
> >>>> Hi,
> >>>>
> >>>> I have some problems to follow the discussion here.
> >>>>
> >>>> It is not about musl to create an alternate stack, it is to *honor* the alternate stack, if the application installed one, for a reason.
> >>>>
> >>>> I am proposing smthg like
> >>>>
> >>>> --- /oss/musl-1.2.1/src/thread/synccall.c
> >>>> +++ /work/musl/src/thread/synccall.c
> >>>> @@ -45,7 +45,7 @@
> >>>> {
> >>>> sigset_t oldmask;
> >>>> int cs, i, r;
> >>>> - struct sigaction sa = { .sa_flags = SA_RESTART, .sa_handler = handler };
> >>>> + struct sigaction sa = { .sa_flags = SA_RESTART|SA_ONSTACK, ....sa_handler = handler };
> >>>> pthread_t self = __pthread_self(), td;
> >>>> int count = 0;
> >>>>
> >>>> This will fix the problem with dynamic stacks, like go implements it.
> >>>> If the application does not install one, kernel will ignore
> >>>> SA_ONSTACK. (This is even specified by POSIX, since there is no
> >>>> error condition mentioned in man page specifically for this).
> >>>
> >>> It's fundamental, since presence and identity of an alternate stack
> >>> are thread-local properties and SA_ONSTACK is global to the signal
> >>> disposition.
> >>>
> >>> The behavior we're concerned about this alterring is not the case
> >>> where an application does not install an alternate stack; of course
> >>> that's unaffected. The interesting case is where an application does
> >>> install one, but expects (albeit IMO wrongly; that's what we're trying
> >>> to establish) that the stack memory is not touched/clobbered unless
> >>> there's actually an SA_ONSTACK signal handler present to run on it and
> >>> such a signal arrives. With the proposed change, the memory for the
> >>> alternate stack can be clobbered asynchronously with no such signal
> >>> handler existing. (In case it's not clear, the above code is *not a
> >>> signal handler* from the perspective that's relevant; it's an
> >>> implementation detail internal to the implementation.)
> >>>
> >>> One way such clobbering could manifest is when a signal handler
> >>> running on the alternate stack temporarily moves the stack pointer to
> >>> somewhere else (not on the alternate stack), via swapcontext or some
> >>> other method. In this case, if a signal for cancellation or synccall
> >>> arrives, the kernel will consider the alt stack not in use, and will
> >>> start using it again from the beginning, clobbering the still-running
> >>> frames.
> >>>
> >>> Rich
> >>
next prev parent reply other threads:[~2020-08-10 18:32 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-09 0:39 Rich Felker
2020-08-09 7:54 ` Markus Wichmann
2020-08-10 0:06 ` Rich Felker
2020-08-10 16:34 ` Markus Wichmann
2020-08-10 0:10 ` Ariadne Conill
2020-08-10 0:26 ` Rich Felker
2020-08-10 0:28 ` Ariadne Conill
2020-08-10 8:15 ` Olaf Flebbe
2020-08-10 15:41 ` Szabolcs Nagy
2020-08-10 15:45 ` Olaf Flebbe
2020-08-10 16:24 ` Szabolcs Nagy
2020-08-10 16:27 ` Rich Felker
2020-08-10 16:36 ` Rich Felker
2020-08-10 16:57 ` Olaf Flebbe
2020-08-10 17:00 ` Rich Felker
2020-08-10 17:04 ` Olaf Flebbe
2020-08-10 18:32 ` Rich Felker [this message]
2020-08-10 19:29 ` Olaf Flebbe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200810183159.GL3265@brightrain.aerifal.cx \
--to=dalias@libc.org \
--cc=musl@lists.openwall.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).