From: Alexey Izbyshev <izbyshev@ispras.ru>
To: musl@lists.openwall.com
Subject: Re: [musl] More thoughts on wrapping signal handling
Date: Sat, 31 Oct 2020 20:33:01 +0300 [thread overview]
Message-ID: <7197cef63957a7efa79d219c02ea35f8@ispras.ru> (raw)
In-Reply-To: <20201029133839.GL534@brightrain.aerifal.cx>
On 2020-10-29 16:38, Rich Felker wrote:
> On Thu, Oct 29, 2020 at 02:45:34PM +0300, Alexey Izbyshev wrote:
>> On 2020-10-29 09:34, Rich Felker wrote:
>> >In "Re: [musl] Re: [PATCH] Make abort() AS-safe (Bug 26275)."
>> >(20201010002612.GC17637@brightrain.aerifal.cx,
>> >https://www.openwall.com/lists/musl/2020/10/10/1) I raised the
>> >longstanding thought of having libc wrap signal handling. This is a
>> >little bit of a big hammer for what it was proposed for -- fixing an
>> >extremely-rare race between abort and execve -- but today I had a
>> >thought about another use of it that's really compelling.
>> >
>> >What I noted before was that, by wrapping signal handlers, libc could
>> >implement a sort of "rollback" to restart a critical section that was
>> >interrupted. However this really only has any use when the critical
>> >section has no side effects aside from its final completion, and
>> >except for execve where replacement of the process gives the atomic
>> >cutoff for rollback, it requires __cp_end-like asm label of the end of
>> >the critical section. So it's of limited utility.
>> >
>> >However, what's more interesting than restarting the critical section
>> >when a signal is received is *allowing it to complete* before handling
>> >the signal. This can be implemented by having the wrapper, upon seeing
>> >that it interrupted a critical section, save the siginfo_t in TLS and
>> >immediately return, leaving signals blocked, without executing the
>> >application-installed signal handler. Then, when leaving the critical
>> >section, the unlock function can see the saved siginfo_t and call the
>> >application's signal handler. Effectively, it's as if the signal were
>> >just blocked until the end of the critical section.
>> >
>> As described, that would call the application's signal handler on
>> the wrong stack in case SA_ONSTACK was used.
>>
>> And what happens if the application wants to modify ucontext via the
>> third argument of the signal handler?
>
> Yes, I kinda hand-waved over this with the word "call", which I
> thought about annotating with (*). In the case of SA_ONSTACK you need
> a primitive to "call on new stack", and while the ucontext is mostly
> not meaningful/inspectable to the signal handler (because it's
> interrupting libc code), the saved signal mask is. You can have the
> caller restore it (in place of SYS_[rt_]sigreturn), but the natural
> common solution to all of these needs is having a sort of makecontext.
>
Such "sigcall/sigreturn" shims would have to emulate kernel behavior
precisely. If a new feature is added into the kernel, and the
application detects that it's supported based on what the *kernel* tells
it, subtle breakage might occur due to imprecise emulation (as a random
example, consider SS_AUTODISARM flag of sigaltstack()). So you'd have to
intercept feature tests as well, and it starts to look messy IMO.
Re-raising the signal would avoid most of that emulation, but appears to
be broken at least due to signal ordering issues as mentioned in
https://www.openwall.com/lists/musl/2020/10/29/12.
Alexey
next prev parent reply other threads:[~2020-10-31 17:33 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-29 6:34 Rich Felker
2020-10-29 11:45 ` Alexey Izbyshev
2020-10-29 13:38 ` Rich Felker
2020-10-29 13:51 ` Alexander Monakov
2020-10-29 14:02 ` Alexander Monakov
2020-10-29 14:12 ` Florian Weimer
2020-10-29 14:18 ` Alexander Monakov
2020-10-29 14:28 ` Rich Felker
2020-10-31 17:33 ` Alexey Izbyshev [this message]
2020-10-29 14:21 ` Szabolcs Nagy
2020-10-29 14:43 ` Rich Felker
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7197cef63957a7efa79d219c02ea35f8@ispras.ru \
--to=izbyshev@ispras.ru \
--cc=musl@lists.openwall.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).