Message ID | 20201119190237.626-4-chang.seok.bae@intel.com |
---|---|
State | Not applicable |
Headers |
Return-Path: <libc-alpha-bounces@sourceware.org> X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 3703139ACC47; Thu, 19 Nov 2020 19:07:09 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 3703139ACC47 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1605812829; bh=l9fMe2WYwxUuEMNrOBUHF9ClED7zmzSq383rPc8L1dg=; h=To:Subject:Date:In-Reply-To:References:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=Z/ZAoiqw0pGFWWVuwxfXzqhTR0YWKGBSHlJnt0mAshZLEez9WwpSkUJdaK7435Nsj 2CoDMVDJDqSwH5h46pRsGEZNuN5uoRjnCZyzKJMeMzOVEb1bbbhD1habJAlDpYFJMC jTl4ouHpi87qBJKpXZV9gjR7Qk7n9BdwbcMDGnXA= X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by sourceware.org (Postfix) with ESMTPS id BD2713857804 for <libc-alpha@sourceware.org>; Thu, 19 Nov 2020 19:07:05 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org BD2713857804 IronPort-SDR: FhBPTSolg6OB8Jp8Xf7lPNfNq+q6y0kCZ90B8stRCD6m4R4uMQLT3deWfCoGd8HniS5/HcBQsu IFw42TZJsO2A== X-IronPort-AV: E=McAfee;i="6000,8403,9810"; a="170563949" X-IronPort-AV: E=Sophos;i="5.78,354,1599548400"; d="scan'208";a="170563949" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 19 Nov 2020 11:06:40 -0800 IronPort-SDR: QvspKCblnMCzsL5wITYJlqCsyv5vaoj+VeSN8G8G3ANsVrt2oRyOfr/jIoEfE+Rm7qkyy7yfoR iAXOglYNV5mA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.78,354,1599548400"; d="scan'208";a="431333996" Received: from chang-linux-3.sc.intel.com ([172.25.66.175]) by fmsmga001.fm.intel.com with ESMTP; 19 Nov 2020 11:06:40 -0800 To: tglx@linutronix.de, mingo@kernel.org, bp@suse.de, luto@kernel.org, x86@kernel.org Subject: [PATCH v2 3/4] x86/signal: Prevent an alternate stack overflow before a signal delivery Date: Thu, 19 Nov 2020 11:02:36 -0800 Message-Id: <20201119190237.626-4-chang.seok.bae@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20201119190237.626-1-chang.seok.bae@intel.com> References: <20201119190237.626-1-chang.seok.bae@intel.com> X-Spam-Status: No, score=-10.6 required=5.0 tests=BAYES_00, GIT_PATCH_0, KAM_DMARC_STATUS, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list <libc-alpha.sourceware.org> List-Unsubscribe: <https://sourceware.org/mailman/options/libc-alpha>, <mailto:libc-alpha-request@sourceware.org?subject=unsubscribe> List-Archive: <https://sourceware.org/pipermail/libc-alpha/> List-Post: <mailto:libc-alpha@sourceware.org> List-Help: <mailto:libc-alpha-request@sourceware.org?subject=help> List-Subscribe: <https://sourceware.org/mailman/listinfo/libc-alpha>, <mailto:libc-alpha-request@sourceware.org?subject=subscribe> From: "Chang S. Bae via Libc-alpha" <libc-alpha@sourceware.org> Reply-To: "Chang S. Bae" <chang.seok.bae@intel.com> Cc: linux-arch@vger.kernel.org, len.brown@intel.com, tony.luck@intel.com, libc-alpha@sourceware.org, ravi.v.shankar@intel.com, chang.seok.bae@intel.com, linux-kernel@vger.kernel.org, dave.hansen@intel.com, linux-api@vger.kernel.org, Dave.Martin@arm.com Errors-To: libc-alpha-bounces@sourceware.org Sender: "Libc-alpha" <libc-alpha-bounces@sourceware.org> |
Series |
x86: Improve Minimum Alternate Stack Size
|
|
Commit Message
Chang S. Bae
Nov. 19, 2020, 7:02 p.m. UTC
The kernel pushes data on the userspace stack when entering a signal. If using a sigaltstack(), the kernel precisely knows the user stack size. When the kernel knows that the user stack is too small, avoid the overflow and do an immediate SIGSEGV instead. This overflow is known to occur on systems with large XSAVE state. The effort to increase the size typically used for altstacks reduces the frequency of these overflows, but this approach is still useful for legacy binaries. Here the kernel expects a bit conservative stack size (for 64-bit apps). Legacy binaries used a too-small sigaltstack would be already overflowed before this change, if they run on modern hardware. Signed-off-by: Chang S. Bae <chang.seok.bae@intel.com> Reviewed-by: Len Brown <len.brown@intel.com> Cc: x86@kernel.org Cc: linux-kernel@vger.kernel.org --- arch/x86/ia32/ia32_signal.c | 11 ++++++++--- arch/x86/include/asm/sigframe.h | 2 ++ arch/x86/kernel/signal.c | 16 +++++++++++++++- 3 files changed, 25 insertions(+), 4 deletions(-)
Comments
On Thu, Nov 19, 2020 at 8:40 PM Chang S. Bae <chang.seok.bae@intel.com> wrote: > The kernel pushes data on the userspace stack when entering a signal. If > using a sigaltstack(), the kernel precisely knows the user stack size. > > When the kernel knows that the user stack is too small, avoid the overflow > and do an immediate SIGSEGV instead. > > This overflow is known to occur on systems with large XSAVE state. The > effort to increase the size typically used for altstacks reduces the > frequency of these overflows, but this approach is still useful for legacy > binaries. > > Here the kernel expects a bit conservative stack size (for 64-bit apps). > Legacy binaries used a too-small sigaltstack would be already overflowed > before this change, if they run on modern hardware. [...] > diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c > index ee6f1ceaa7a2..cee41d684dc2 100644 > --- a/arch/x86/kernel/signal.c > +++ b/arch/x86/kernel/signal.c > @@ -251,8 +251,13 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, > > /* This is the X/Open sanctioned signal stack switching. */ > if (ka->sa.sa_flags & SA_ONSTACK) { > - if (sas_ss_flags(sp) == 0) > + if (sas_ss_flags(sp) == 0) { > + /* If the altstack might overflow, die with SIGSEGV: */ > + if (!altstack_size_ok(current)) > + return (void __user *)-1L; > + > sp = current->sas_ss_sp + current->sas_ss_size; > + } A couple lines further down, we have this (since commit 14fc9fbc700d): /* * If we are on the alternate signal stack and would overflow it, don't. * Return an always-bogus address instead so we will die with SIGSEGV. */ if (onsigstack && !likely(on_sig_stack(sp))) return (void __user *)-1L; Is that not working? (It won't handle the case where the kernel fills up almost all of the alternate stack, and the userspace signal handler then overflows out of the alternate signal stack. But there isn't much the kernel can do about that...)
> On Nov 20, 2020, at 15:04, Jann Horn <jannh@google.com> wrote: > > On Thu, Nov 19, 2020 at 8:40 PM Chang S. Bae <chang.seok.bae@intel.com> wrote: >> >> diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c >> index ee6f1ceaa7a2..cee41d684dc2 100644 >> --- a/arch/x86/kernel/signal.c >> +++ b/arch/x86/kernel/signal.c >> @@ -251,8 +251,13 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, >> >> /* This is the X/Open sanctioned signal stack switching. */ >> if (ka->sa.sa_flags & SA_ONSTACK) { >> - if (sas_ss_flags(sp) == 0) >> + if (sas_ss_flags(sp) == 0) { >> + /* If the altstack might overflow, die with SIGSEGV: */ >> + if (!altstack_size_ok(current)) >> + return (void __user *)-1L; >> + >> sp = current->sas_ss_sp + current->sas_ss_size; >> + } > > A couple lines further down, we have this (since commit 14fc9fbc700d): > > /* > * If we are on the alternate signal stack and would overflow it, don't. > * Return an always-bogus address instead so we will die with SIGSEGV. > */ > if (onsigstack && !likely(on_sig_stack(sp))) > return (void __user *)-1L; > > Is that not working? onsigstack is set at the beginning here. If a signal hits under normal stack, this flag is not set. Then it will miss the overflow. The added check allows to detect the sigaltstack overflow (always). Thanks, Chang
On Tue, Nov 24, 2020 at 7:22 PM Bae, Chang Seok <chang.seok.bae@intel.com> wrote: > > On Nov 20, 2020, at 15:04, Jann Horn <jannh@google.com> wrote: > > On Thu, Nov 19, 2020 at 8:40 PM Chang S. Bae <chang.seok.bae@intel.com> wrote: > >> > >> diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c > >> index ee6f1ceaa7a2..cee41d684dc2 100644 > >> --- a/arch/x86/kernel/signal.c > >> +++ b/arch/x86/kernel/signal.c > >> @@ -251,8 +251,13 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, > >> > >> /* This is the X/Open sanctioned signal stack switching. */ > >> if (ka->sa.sa_flags & SA_ONSTACK) { > >> - if (sas_ss_flags(sp) == 0) > >> + if (sas_ss_flags(sp) == 0) { > >> + /* If the altstack might overflow, die with SIGSEGV: */ > >> + if (!altstack_size_ok(current)) > >> + return (void __user *)-1L; > >> + > >> sp = current->sas_ss_sp + current->sas_ss_size; > >> + } > > > > A couple lines further down, we have this (since commit 14fc9fbc700d): > > > > /* > > * If we are on the alternate signal stack and would overflow it, don't. > > * Return an always-bogus address instead so we will die with SIGSEGV. > > */ > > if (onsigstack && !likely(on_sig_stack(sp))) > > return (void __user *)-1L; > > > > Is that not working? > > onsigstack is set at the beginning here. If a signal hits under normal stack, > this flag is not set. Then it will miss the overflow. > > The added check allows to detect the sigaltstack overflow (always). Ah, I think I understand what you're trying to do. But wouldn't the better approach be to ensure that the existing on_sig_stack() check is also used if we just switched to the signal stack? Something like: diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c index be0d7d4152ec..2f57842fb4d6 100644 --- a/arch/x86/kernel/signal.c +++ b/arch/x86/kernel/signal.c @@ -237,7 +237,7 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, unsigned long math_size = 0; unsigned long sp = regs->sp; unsigned long buf_fx = 0; - int onsigstack = on_sig_stack(sp); + bool onsigstack = on_sig_stack(sp); int ret; /* redzone */ @@ -246,8 +246,10 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, /* This is the X/Open sanctioned signal stack switching. */ if (ka->sa.sa_flags & SA_ONSTACK) { - if (sas_ss_flags(sp) == 0) + if (sas_ss_flags(sp) == 0) { sp = current->sas_ss_sp + current->sas_ss_size; + onsigstack = true; + } } else if (IS_ENABLED(CONFIG_X86_32) && !onsigstack && regs->ss != __USER_DS &&
> On Nov 24, 2020, at 10:41, Jann Horn <jannh@google.com> wrote: > > On Tue, Nov 24, 2020 at 7:22 PM Bae, Chang Seok > <chang.seok.bae@intel.com> wrote: >>> On Nov 20, 2020, at 15:04, Jann Horn <jannh@google.com> wrote: >>> On Thu, Nov 19, 2020 at 8:40 PM Chang S. Bae <chang.seok.bae@intel.com> wrote: >>>> >>>> diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c >>>> index ee6f1ceaa7a2..cee41d684dc2 100644 >>>> --- a/arch/x86/kernel/signal.c >>>> +++ b/arch/x86/kernel/signal.c >>>> @@ -251,8 +251,13 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, >>>> >>>> /* This is the X/Open sanctioned signal stack switching. */ >>>> if (ka->sa.sa_flags & SA_ONSTACK) { >>>> - if (sas_ss_flags(sp) == 0) >>>> + if (sas_ss_flags(sp) == 0) { >>>> + /* If the altstack might overflow, die with SIGSEGV: */ >>>> + if (!altstack_size_ok(current)) >>>> + return (void __user *)-1L; >>>> + >>>> sp = current->sas_ss_sp + current->sas_ss_size; >>>> + } >>> >>> A couple lines further down, we have this (since commit 14fc9fbc700d): >>> >>> /* >>> * If we are on the alternate signal stack and would overflow it, don't. >>> * Return an always-bogus address instead so we will die with SIGSEGV. >>> */ >>> if (onsigstack && !likely(on_sig_stack(sp))) >>> return (void __user *)-1L; >>> >>> Is that not working? >> >> onsigstack is set at the beginning here. If a signal hits under normal stack, >> this flag is not set. Then it will miss the overflow. >> >> The added check allows to detect the sigaltstack overflow (always). > > Ah, I think I understand what you're trying to do. But wouldn't the > better approach be to ensure that the existing on_sig_stack() check is > also used if we just switched to the signal stack? Something like: > > diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c > index be0d7d4152ec..2f57842fb4d6 100644 > --- a/arch/x86/kernel/signal.c > +++ b/arch/x86/kernel/signal.c > @@ -237,7 +237,7 @@ get_sigframe(struct k_sigaction *ka, struct > pt_regs *regs, size_t frame_size, > unsigned long math_size = 0; > unsigned long sp = regs->sp; > unsigned long buf_fx = 0; > - int onsigstack = on_sig_stack(sp); > + bool onsigstack = on_sig_stack(sp); > int ret; > > /* redzone */ > @@ -246,8 +246,10 @@ get_sigframe(struct k_sigaction *ka, struct > pt_regs *regs, size_t frame_size, > > /* This is the X/Open sanctioned signal stack switching. */ > if (ka->sa.sa_flags & SA_ONSTACK) { > - if (sas_ss_flags(sp) == 0) > + if (sas_ss_flags(sp) == 0) { > sp = current->sas_ss_sp + current->sas_ss_size; > + onsigstack = true; > + } > } else if (IS_ENABLED(CONFIG_X86_32) && > !onsigstack && > regs->ss != __USER_DS && Yeah, but wouldn't it better to avoid overwriting user data if we can? The old check raises segfault *after* overwritten. The old check is still helpful to detect an overflow from the nested signal(s) under sigaltstack. Thanks, Chang
On Tue, Nov 24, 2020 at 9:43 PM Bae, Chang Seok <chang.seok.bae@intel.com> wrote: > > On Nov 24, 2020, at 10:41, Jann Horn <jannh@google.com> wrote: > > On Tue, Nov 24, 2020 at 7:22 PM Bae, Chang Seok > > <chang.seok.bae@intel.com> wrote: > >>> On Nov 20, 2020, at 15:04, Jann Horn <jannh@google.com> wrote: > >>> On Thu, Nov 19, 2020 at 8:40 PM Chang S. Bae <chang.seok.bae@intel.com> wrote: > >>>> > >>>> diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c > >>>> index ee6f1ceaa7a2..cee41d684dc2 100644 > >>>> --- a/arch/x86/kernel/signal.c > >>>> +++ b/arch/x86/kernel/signal.c > >>>> @@ -251,8 +251,13 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, > >>>> > >>>> /* This is the X/Open sanctioned signal stack switching. */ > >>>> if (ka->sa.sa_flags & SA_ONSTACK) { > >>>> - if (sas_ss_flags(sp) == 0) > >>>> + if (sas_ss_flags(sp) == 0) { > >>>> + /* If the altstack might overflow, die with SIGSEGV: */ > >>>> + if (!altstack_size_ok(current)) > >>>> + return (void __user *)-1L; > >>>> + > >>>> sp = current->sas_ss_sp + current->sas_ss_size; > >>>> + } > >>> > >>> A couple lines further down, we have this (since commit 14fc9fbc700d): > >>> > >>> /* > >>> * If we are on the alternate signal stack and would overflow it, don't. > >>> * Return an always-bogus address instead so we will die with SIGSEGV. > >>> */ > >>> if (onsigstack && !likely(on_sig_stack(sp))) > >>> return (void __user *)-1L; > >>> > >>> Is that not working? > >> > >> onsigstack is set at the beginning here. If a signal hits under normal stack, > >> this flag is not set. Then it will miss the overflow. > >> > >> The added check allows to detect the sigaltstack overflow (always). > > > > Ah, I think I understand what you're trying to do. But wouldn't the > > better approach be to ensure that the existing on_sig_stack() check is > > also used if we just switched to the signal stack? Something like: > > > > diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c > > index be0d7d4152ec..2f57842fb4d6 100644 > > --- a/arch/x86/kernel/signal.c > > +++ b/arch/x86/kernel/signal.c > > @@ -237,7 +237,7 @@ get_sigframe(struct k_sigaction *ka, struct > > pt_regs *regs, size_t frame_size, > > unsigned long math_size = 0; > > unsigned long sp = regs->sp; > > unsigned long buf_fx = 0; > > - int onsigstack = on_sig_stack(sp); > > + bool onsigstack = on_sig_stack(sp); > > int ret; > > > > /* redzone */ > > @@ -246,8 +246,10 @@ get_sigframe(struct k_sigaction *ka, struct > > pt_regs *regs, size_t frame_size, > > > > /* This is the X/Open sanctioned signal stack switching. */ > > if (ka->sa.sa_flags & SA_ONSTACK) { > > - if (sas_ss_flags(sp) == 0) > > + if (sas_ss_flags(sp) == 0) { > > sp = current->sas_ss_sp + current->sas_ss_size; > > + onsigstack = true; > > + } > > } else if (IS_ENABLED(CONFIG_X86_32) && > > !onsigstack && > > regs->ss != __USER_DS && > > Yeah, but wouldn't it better to avoid overwriting user data if we can? The old > check raises segfault *after* overwritten. Where is that overwrite happening? Between the point where your check happens, and the point where the old check is, the only calls are to fpu__alloc_mathframe() and align_sigframe(), right? fpu__alloc_mathframe() just does some size calculations and doesn't write anything. align_sigframe() also just does size calculations. Am I missing something?
> On Nov 24, 2020, at 12:47, Jann Horn <jannh@google.com> wrote: > > On Tue, Nov 24, 2020 at 9:43 PM Bae, Chang Seok > <chang.seok.bae@intel.com> wrote: >>> On Nov 24, 2020, at 10:41, Jann Horn <jannh@google.com> wrote: >>> On Tue, Nov 24, 2020 at 7:22 PM Bae, Chang Seok >>> <chang.seok.bae@intel.com> wrote: >>>>> On Nov 20, 2020, at 15:04, Jann Horn <jannh@google.com> wrote: >>>>> On Thu, Nov 19, 2020 at 8:40 PM Chang S. Bae <chang.seok.bae@intel.com> wrote: >>>>>> >>>>>> diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c >>>>>> index ee6f1ceaa7a2..cee41d684dc2 100644 >>>>>> --- a/arch/x86/kernel/signal.c >>>>>> +++ b/arch/x86/kernel/signal.c >>>>>> @@ -251,8 +251,13 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, >>>>>> >>>>>> /* This is the X/Open sanctioned signal stack switching. */ >>>>>> if (ka->sa.sa_flags & SA_ONSTACK) { >>>>>> - if (sas_ss_flags(sp) == 0) >>>>>> + if (sas_ss_flags(sp) == 0) { >>>>>> + /* If the altstack might overflow, die with SIGSEGV: */ >>>>>> + if (!altstack_size_ok(current)) >>>>>> + return (void __user *)-1L; >>>>>> + >>>>>> sp = current->sas_ss_sp + current->sas_ss_size; >>>>>> + } >>>>> >>>>> A couple lines further down, we have this (since commit 14fc9fbc700d): >>>>> >>>>> /* >>>>> * If we are on the alternate signal stack and would overflow it, don't. >>>>> * Return an always-bogus address instead so we will die with SIGSEGV. >>>>> */ >>>>> if (onsigstack && !likely(on_sig_stack(sp))) >>>>> return (void __user *)-1L; >>>>> >>>>> Is that not working? >>>> >>>> onsigstack is set at the beginning here. If a signal hits under normal stack, >>>> this flag is not set. Then it will miss the overflow. >>>> >>>> The added check allows to detect the sigaltstack overflow (always). >>> >>> Ah, I think I understand what you're trying to do. But wouldn't the >>> better approach be to ensure that the existing on_sig_stack() check is >>> also used if we just switched to the signal stack? Something like: >>> >>> diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c >>> index be0d7d4152ec..2f57842fb4d6 100644 >>> --- a/arch/x86/kernel/signal.c >>> +++ b/arch/x86/kernel/signal.c >>> @@ -237,7 +237,7 @@ get_sigframe(struct k_sigaction *ka, struct >>> pt_regs *regs, size_t frame_size, >>> unsigned long math_size = 0; >>> unsigned long sp = regs->sp; >>> unsigned long buf_fx = 0; >>> - int onsigstack = on_sig_stack(sp); >>> + bool onsigstack = on_sig_stack(sp); >>> int ret; >>> >>> /* redzone */ >>> @@ -246,8 +246,10 @@ get_sigframe(struct k_sigaction *ka, struct >>> pt_regs *regs, size_t frame_size, >>> >>> /* This is the X/Open sanctioned signal stack switching. */ >>> if (ka->sa.sa_flags & SA_ONSTACK) { >>> - if (sas_ss_flags(sp) == 0) >>> + if (sas_ss_flags(sp) == 0) { >>> sp = current->sas_ss_sp + current->sas_ss_size; >>> + onsigstack = true; >>> + } >>> } else if (IS_ENABLED(CONFIG_X86_32) && >>> !onsigstack && >>> regs->ss != __USER_DS && >> >> Yeah, but wouldn't it better to avoid overwriting user data if we can? The old >> check raises segfault *after* overwritten. > > Where is that overwrite happening? Between the point where your check > happens, and the point where the old check is, the only calls are to > fpu__alloc_mathframe() and align_sigframe(), right? > fpu__alloc_mathframe() just does some size calculations and doesn't > write anything. align_sigframe() also just does size calculations. Am > I missing something? Yeah, you’re right. Right now, I’m thinking your approach is simpler and providing almost the same function (unless I’m missing here). Thanks, Chang
On Nov 24, 2020, at 10:41, Jann Horn <jannh@google.com> wrote: > On Tue, Nov 24, 2020 at 7:22 PM Bae, Chang Seok > <chang.seok.bae@intel.com> wrote: >>> On Nov 20, 2020, at 15:04, Jann Horn <jannh@google.com> wrote: >>> On Thu, Nov 19, 2020 at 8:40 PM Chang S. Bae <chang.seok.bae@intel.com> wrote: >>>> >>>> diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c >>>> index ee6f1ceaa7a2..cee41d684dc2 100644 >>>> --- a/arch/x86/kernel/signal.c >>>> +++ b/arch/x86/kernel/signal.c >>>> @@ -251,8 +251,13 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, >>>> >>>> /* This is the X/Open sanctioned signal stack switching. */ >>>> if (ka->sa.sa_flags & SA_ONSTACK) { >>>> - if (sas_ss_flags(sp) == 0) >>>> + if (sas_ss_flags(sp) == 0) { >>>> + /* If the altstack might overflow, die with SIGSEGV: */ >>>> + if (!altstack_size_ok(current)) >>>> + return (void __user *)-1L; >>>> + >>>> sp = current->sas_ss_sp + current->sas_ss_size; >>>> + } >>> >>> A couple lines further down, we have this (since commit 14fc9fbc700d): >>> >>> /* >>> * If we are on the alternate signal stack and would overflow it, don't. >>> * Return an always-bogus address instead so we will die with SIGSEGV. >>> */ >>> if (onsigstack && !likely(on_sig_stack(sp))) >>> return (void __user *)-1L; >>> >>> Is that not working? >> >> onsigstack is set at the beginning here. If a signal hits under normal stack, >> this flag is not set. Then it will miss the overflow. >> >> The added check allows to detect the sigaltstack overflow (always). > > Ah, I think I understand what you're trying to do. But wouldn't the > better approach be to ensure that the existing on_sig_stack() check is > also used if we just switched to the signal stack? Something like: > > diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c > index be0d7d4152ec..2f57842fb4d6 100644 > --- a/arch/x86/kernel/signal.c > +++ b/arch/x86/kernel/signal.c > @@ -237,7 +237,7 @@ get_sigframe(struct k_sigaction *ka, struct > pt_regs *regs, size_t frame_size, > unsigned long math_size = 0; > unsigned long sp = regs->sp; > unsigned long buf_fx = 0; > - int onsigstack = on_sig_stack(sp); > + bool onsigstack = on_sig_stack(sp); > int ret; > > /* redzone */ > @@ -246,8 +246,10 @@ get_sigframe(struct k_sigaction *ka, struct > pt_regs *regs, size_t frame_size, > > /* This is the X/Open sanctioned signal stack switching. */ > if (ka->sa.sa_flags & SA_ONSTACK) { > - if (sas_ss_flags(sp) == 0) > + if (sas_ss_flags(sp) == 0) { > sp = current->sas_ss_sp + current->sas_ss_size; > + onsigstack = true; FWIW, here. Thanks to the report by Oliver via the kernel test robot, I realized that this needs to be conditional on the SS_AUTODISARM tag like, : onsigstack = !(current->sas_ss_flags & SS_AUTODISARM); Thanks, Chang
diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c index 81cf22398cd1..85abd9eb79d5 100644 --- a/arch/x86/ia32/ia32_signal.c +++ b/arch/x86/ia32/ia32_signal.c @@ -210,13 +210,18 @@ static void __user *get_sigframe(struct ksignal *ksig, struct pt_regs *regs, sp = regs->sp; /* This is the X/Open sanctioned signal stack switching. */ - if (ksig->ka.sa.sa_flags & SA_ONSTACK) + if (ksig->ka.sa.sa_flags & SA_ONSTACK) { + /* If the altstack might overflow, die with SIGSEGV: */ + if (!altstack_size_ok(current)) + return (void __user *)-1L; + sp = sigsp(sp, ksig); /* This is the legacy signal stack switching. */ - else if (regs->ss != __USER32_DS && + } else if (regs->ss != __USER32_DS && !(ksig->ka.sa.sa_flags & SA_RESTORER) && - ksig->ka.sa.sa_restorer) + ksig->ka.sa.sa_restorer) { sp = (unsigned long) ksig->ka.sa.sa_restorer; + } sp = fpu__alloc_mathframe(sp, 1, &fx_aligned, &math_size); *fpstate = (struct _fpstate_32 __user *) sp; diff --git a/arch/x86/include/asm/sigframe.h b/arch/x86/include/asm/sigframe.h index ac77f3f90bc9..c9f2f9ace76f 100644 --- a/arch/x86/include/asm/sigframe.h +++ b/arch/x86/include/asm/sigframe.h @@ -106,6 +106,8 @@ struct rt_sigframe_x32 { #define SIZEOF_rt_sigframe_x32 0 #endif +bool altstack_size_ok(struct task_struct *tsk); + void __init init_sigframe_size(void); #endif /* _ASM_X86_SIGFRAME_H */ diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c index ee6f1ceaa7a2..cee41d684dc2 100644 --- a/arch/x86/kernel/signal.c +++ b/arch/x86/kernel/signal.c @@ -251,8 +251,13 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, /* This is the X/Open sanctioned signal stack switching. */ if (ka->sa.sa_flags & SA_ONSTACK) { - if (sas_ss_flags(sp) == 0) + if (sas_ss_flags(sp) == 0) { + /* If the altstack might overflow, die with SIGSEGV: */ + if (!altstack_size_ok(current)) + return (void __user *)-1L; + sp = current->sas_ss_sp + current->sas_ss_size; + } } else if (IS_ENABLED(CONFIG_X86_32) && !onsigstack && regs->ss != __USER_DS && @@ -725,6 +730,15 @@ unsigned long get_sigframe_size(void) return max_frame_size; } +bool altstack_size_ok(struct task_struct *tsk) +{ + /* + * Can this task's sigaltstack accommodate the largest + * signal frame the kernel might need? + */ + return (tsk->sas_ss_size >= max_frame_size); +} + static inline int is_ia32_compat_frame(struct ksignal *ksig) { return IS_ENABLED(CONFIG_IA32_EMULATION) &&