From patchwork Sat Nov 25 16:34:45 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "H.J. Lu" X-Patchwork-Id: 24527 Received: (qmail 124712 invoked by alias); 25 Nov 2017 16:34:52 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 124670 invoked by uid 89); 25 Nov 2017 16:34:51 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-25.2 required=5.0 tests=AWL, BAYES_00, FREEMAIL_FROM, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, KAM_SHORT, KB_WAM_FROM_NAME_SINGLEWORD, RCVD_IN_DNSWL_NONE, SPF_PASS autolearn=ham version=3.3.2 spammy= X-HELO: mail-oi0-f66.google.com X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Nmnhph4PDWQWP0bE/IdPjw8Zdhkm4am8LcQVoDIX5YU=; b=cF6SEBJmeiNq5GTPVY4mwNqVC75VLmibNsYyYx5lfJb4QJIZTWrK+OVteHqxbmrvSa VJ1hU6kEU1JGpK9H1aTq4yNcZ/pii+1y1bR/ppCreaLzDFKIbFZI67n5+AxP1a3QUei1 pjq/s16XKhKDiTKtxw1mJXaSK9vZtTc9sUHAuxbdVV4bx5c8byqS5IaLgfoykxJHK7TZ kSUxe9MbYQVPS7c57WyOYsT5caHxwfPEVw6SU1T2o/RfxeMeCzVOsIM7hh3Rgn6tBrLP g0BUSt7mdI87NzQT4BQjB9/4OGLjQUNwfL1yrRmono3IVrZMFDia94vHwD7gv7eLs6A6 tLeA== X-Gm-Message-State: AJaThX7slD5B4zqTFHyNayNsMQO7+1tlDoTr9iRhr//l4gmaJ0eV/6Z3 z5hurLNpNtl8Oc03LAkMHdMNfBrK8fhmUxdvowo= X-Google-Smtp-Source: AGs4zMY1n+PbBnHCmk9C6PKe6MpYUqtmYsabvlwTdRpo+YpUrctu9p8gsS6tm2lGKR89v5wPgNK/pw+PEIH/lOnHkaw= X-Received: by 10.202.253.73 with SMTP id b70mr12307270oii.279.1511627686179; Sat, 25 Nov 2017 08:34:46 -0800 (PST) MIME-Version: 1.0 In-Reply-To: References: <20171107223908.GB46190@intel.com> <33f4a80e-b377-a9c8-1fba-c136211154be@redhat.com> <7874b7d1-bf58-4fb2-b3e3-aba07db76bfa@redhat.com> <3a270ef7-eae6-e8cb-f7bb-7de8b9a926dc@redhat.com> <08d27473-93ca-a0fe-83ac-78db1732befc@redhat.com> <5e692320-fe48-88c4-9440-0276f2b8795b@redhat.com> From: "H.J. Lu" Date: Sat, 25 Nov 2017 08:34:45 -0800 Message-ID: Subject: Re: [PATCH 2/2] jmpbuf: Add paddings for target specific usage To: Florian Weimer Cc: GNU C Library On Tue, Nov 21, 2017 at 2:22 PM, H.J. Lu wrote: > On Wed, Nov 15, 2017 at 5:20 AM, H.J. Lu wrote: >> On Wed, Nov 15, 2017 at 3:10 AM, Florian Weimer wrote: >>> On 11/14/2017 02:10 PM, H.J. Lu wrote: >>>> >>>> +static int >>>> +do_test (void) >>>> +{ >>>> + sigjmp_buf sj; >>>> + struct support_next_to_fault sigset_t_buf >>>> + = support_next_to_fault_allocate (SIZEOF_SIGSET_T); >>>> + sigset_t *m_p = (sigset_t *) sigset_t_buf.buffer; >>>> + sigset_t m; >>>> + >>>> + sigemptyset (&m); >>>> + memcpy (m_p, &m, SIZEOF_SIGSET_T); >>>> + sigprocmask (SIG_SETMASK, m_p, NULL); >>>> + memcpy (&m, m_p, SIZEOF_SIGSET_T); >>>> + if (sigsetjmp (sj, 0) == 0) >>>> + { >>>> + sigaddset (&m, SIGUSR1); >>>> + memcpy (m_p, &m, SIZEOF_SIGSET_T); >>>> + sigprocmask (SIG_SETMASK, m_p, NULL); >>>> + memcpy (&m, m_p, SIZEOF_SIGSET_T); >>>> + siglongjmp (sj, 1); >>>> + return EXIT_FAILURE; >>>> + } >>>> + sigprocmask (SIG_SETMASK, NULL, m_p); >>>> + memcpy (&m, m_p, SIZEOF_SIGSET_T); >>>> + return sigismember (&m, SIGUSR1) ? EXIT_SUCCESS : EXIT_FAILURE; >>>> +} >>> >>> >>> Sorry, I don't understand anymore what this test is supposed to test and >>> how. >> >> This tests the reduced __jmp_buf_sigset_t used by __saved_mask is >> bigger than sigset expected by kernel. >> >>> To be honest, I don't like how you inject the internal definition of >>> jmp_buf. Is this the way we do it for the nptl types? >> >> I only need to make some room in >> >> /* Calling environment, plus possibly a saved signal mask. */ >> struct __jmp_buf_tag >> { >> /* NOTE: The machine-dependent definitions of `__sigsetjmp' >> assume that a `jmp_buf' begins with a `__jmp_buf' and that >> `__mask_was_saved' follows it. Do not move these members >> or add others before it. */ >> __jmp_buf __jmpbuf; /* Calling environment. */ >> int __mask_was_saved; /* Saved the signal mask? */ >> __sigset_t __saved_mask; /* Saved signal mask. */ >> }; >> >> for target specific purpose. I changed it to >> >> struct __jmp_buf_tag >> { >> /* NOTE: The machine-dependent definitions of `__sigsetjmp' >> assume that a `jmp_buf' begins with a `__jmp_buf' and that >> `__mask_was_saved' follows it. Do not move these members >> or add others before it. */ >> __jmp_buf __jmpbuf; /* Calling environment. */ >> int __mask_was_saved; /* Saved the signal mask? */ >> union >> { >> __sigset_t __saved_mask_compat; >> struct >> { >> __jmp_buf_sigset_t __saved_mask; >> /* Paddings for architecture specific usage. */ >> unsigned long int __padding[12]; >> } __saved; >> } __saved_mask; >> }; >> >> #define __saved_mask __saved_mask.__saved.__saved_mask >> >> I did only to __sigset_t in __jmp_buf_tag and this test verifies that the size >> of __jmp_buf_sigset_t works with sigprocmask. >> >> Are you suggesting we make some room in __sigset_t directly? This will >> require very extensive changes. If not, what do you exactly suggest? >> >>> I think you should check _JUMP_BUF_SIGSET_NSIG against a kernel constant >>> (_NSIGS?) somewhere. >> >> There is a _Static_assert in include/setjmp.h. But it isn't triggered. This >> updated patch moves it to sysdeps/unix/sysv/linux/__saved_mask.h. Now >> I got >> >> ../sysdeps/unix/sysv/linux/__saved_mask.h:32:1: error: static >> assertion failed: "size of ___saved_mask < size of >> __sigprocmask_sigset_t" >> _Static_assert (sizeof (___saved_mask) >= sizeof (__sigprocmask_sigset_t), >> >> if __jmp_buf_sigset_t is too small. >> >> -- >> H.J. > > Any comments, suggestions or objections? The patch is at > > https://sourceware.org/ml/libc-alpha/2017-11/msg00510.html > This is the updated patch. It limited the changes to Linux/x86. Any comments? From 71ac6d741e74e8be54fdc74132bce3def8d90bea Mon Sep 17 00:00:00 2001 From: "H.J. Lu" Date: Sat, 10 Jun 2017 17:23:06 -0700 Subject: [PATCH] x86: Add paddings in jmpbuf for shadow stack pointer To support Shadow Stack (SHSTK) in Intel Control-flow Enforcement Technology (CET) in setjmp/longjmp, we need to save shadow stack pointer in jmp_buf. The __saved_mask field in jmp_buf has type of __sigset_t. On Linux, __sigset_t is defined as #define _SIGSET_NWORDS (1024 / (8 * sizeof (unsigned long int))) typedef struct { unsigned long int __val[_SIGSET_NWORDS]; } __sigset_t; which is much bigger than expected by the __sigprocmask system call, which has typedef struct { unsigned long sig[_NSIG_WORDS]; } sigset_t; For Linux/x86, we can shrink __sigset_t used by __saved_mask in jmp_buf to add paddings for shadow stack pointer. As long as the new __sigset_t is not smaller than sigset_t expected by the __sigprocmask system call, it should work correctly. This patch adds an internal header file, , to define __jmp_buf_sigset_t for __saved_mask in jmp_buf for Linux/x86 and verifies __jmp_buf_sigset_t has the suitable size for the __sigprocmask system call. A run-time test, tst-saved_mask-1.c, is added to verify that size of __jmp_buf_sigset_t is sufficient. If size is too small, the test fails with rt_sigprocmask(SIG_SETMASK, strace: umoven: short read (4 < 8) @0x7fa8aa28effc 0x7fa8aa28effc, NULL, 8) = -1 EFAULT (Bad address) rt_sigprocmask(SIG_SETMASK, strace: umoven: short read (4 < 8) @0x7fa8aa28effc 0x7fa8aa28effc, NULL, 8) = -1 EFAULT (Bad address) rt_sigprocmask(SIG_SETMASK, NULL, 0x7fa8aa28effc, 8) = -1 EFAULT (Bad address) exit_group(1) = ? Tested with build-many-glibcs.py. * debug/longjmp_chk.c: Include instead of . * setjmp/longjmp.c: Include instead of . (__libc_siglongjmp): Cast &env[0].__saved_mask to "sigset_t *". * setjmp/sigjmp.c: Include instead of . (__sigjmp_save): Cast &env[0].__saved_mask to "sigset_t *". * sysdeps/generic/setjmpP.h: New file. * sysdeps/unix/sysv/linux/x86/__jmpbuf_arch_t.h: Likewise. * sysdeps/unix/sysv/linux/x86/__saved_mask.h: Likewise. * sysdeps/unix/sysv/linux/x86/setjmpP.h: Likewise. * sysdeps/unix/sysv/linux/x86/tst-saved_mask-1.c: Likewise. * sysdeps/unix/sysv/linux/x86/Makefile (tests): Add tst-saved_mask-1. --- debug/longjmp_chk.c | 2 +- setjmp/longjmp.c | 5 ++- setjmp/sigjmp.c | 4 +- sysdeps/generic/setjmpP.h | 24 +++++++++++ sysdeps/unix/sysv/linux/x86/Makefile | 4 ++ sysdeps/unix/sysv/linux/x86/__jmpbuf_arch_t.h | 43 ++++++++++++++++++++ sysdeps/unix/sysv/linux/x86/__saved_mask.h | 34 ++++++++++++++++ sysdeps/unix/sysv/linux/x86/setjmpP.h | 28 +++++++++++++ sysdeps/unix/sysv/linux/x86/tst-saved_mask-1.c | 56 ++++++++++++++++++++++++++ 9 files changed, 195 insertions(+), 5 deletions(-) create mode 100644 sysdeps/generic/setjmpP.h create mode 100644 sysdeps/unix/sysv/linux/x86/__jmpbuf_arch_t.h create mode 100644 sysdeps/unix/sysv/linux/x86/__saved_mask.h create mode 100644 sysdeps/unix/sysv/linux/x86/setjmpP.h create mode 100644 sysdeps/unix/sysv/linux/x86/tst-saved_mask-1.c diff --git a/debug/longjmp_chk.c b/debug/longjmp_chk.c index 1cea6c05ef..61be0da0cd 100644 --- a/debug/longjmp_chk.c +++ b/debug/longjmp_chk.c @@ -15,7 +15,7 @@ License along with the GNU C Library; if not, see . */ -#include +#include #define __longjmp ____longjmp_chk #define __libc_siglongjmp __longjmp_chk diff --git a/setjmp/longjmp.c b/setjmp/longjmp.c index 2453c2c124..e144a874d7 100644 --- a/setjmp/longjmp.c +++ b/setjmp/longjmp.c @@ -16,7 +16,7 @@ . */ #include -#include +#include #include @@ -31,7 +31,8 @@ __libc_siglongjmp (sigjmp_buf env, int val) if (env[0].__mask_was_saved) /* Restore the saved signal mask. */ - (void) __sigprocmask (SIG_SETMASK, &env[0].__saved_mask, + (void) __sigprocmask (SIG_SETMASK, + (sigset_t *) &env[0].__saved_mask, (sigset_t *) NULL); /* Call the machine-dependent function to restore machine state. */ diff --git a/setjmp/sigjmp.c b/setjmp/sigjmp.c index 30839ae819..32b727fae8 100644 --- a/setjmp/sigjmp.c +++ b/setjmp/sigjmp.c @@ -16,7 +16,7 @@ . */ #include -#include +#include #include /* This function is called by the `sigsetjmp' macro @@ -28,7 +28,7 @@ __sigjmp_save (sigjmp_buf env, int savemask) { env[0].__mask_was_saved = (savemask && __sigprocmask (SIG_BLOCK, (sigset_t *) NULL, - &env[0].__saved_mask) == 0); + (sigset_t *) &env[0].__saved_mask) == 0); return 0; } diff --git a/sysdeps/generic/setjmpP.h b/sysdeps/generic/setjmpP.h new file mode 100644 index 0000000000..a878ce6b35 --- /dev/null +++ b/sysdeps/generic/setjmpP.h @@ -0,0 +1,24 @@ +/* Internal header file for . Generic version. + Copyright (C) 2017 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#ifndef _SETJMPP_H +#define _SETJMPP_H 1 + +#include + +#endif /* setjmpP.h */ diff --git a/sysdeps/unix/sysv/linux/x86/Makefile b/sysdeps/unix/sysv/linux/x86/Makefile index c069570683..111ff9ff58 100644 --- a/sysdeps/unix/sysv/linux/x86/Makefile +++ b/sysdeps/unix/sysv/linux/x86/Makefile @@ -19,3 +19,7 @@ endif ifeq ($(subdir),elf) sysdep_routines += dl-vdso endif + +ifeq ($(subdir),setjmp) +tests += tst-saved_mask-1 +endif diff --git a/sysdeps/unix/sysv/linux/x86/__jmpbuf_arch_t.h b/sysdeps/unix/sysv/linux/x86/__jmpbuf_arch_t.h new file mode 100644 index 0000000000..a170f3ef9b --- /dev/null +++ b/sysdeps/unix/sysv/linux/x86/__jmpbuf_arch_t.h @@ -0,0 +1,43 @@ +/* __jmpbuf_arch_t defition for Linux/x86. + Copyright (C) 2017 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include + +/* The biggest signal number + 1. As of kernel 4.13, the maximum number + of signals is 128 on MIPS. Define it to 257 to leave some rooms for + the future. */ +#define _JUMP_BUF_SIGSET_NSIG 257 +/* Number of longs to hold all signals. */ +#define _JUMP_BUF_SIGSET_NWORDS \ + ((_JUMP_BUF_SIGSET_NSIG - 1 + 7) / (8 * sizeof (unsigned long int))) + +typedef struct + { + unsigned long int __val[_JUMP_BUF_SIGSET_NWORDS]; + } __jmp_buf_sigset_t; + +typedef union + { + __sigset_t __saved_mask_compat; + struct + { + __jmp_buf_sigset_t __saved_mask; + /* Paddings for architecture specific usage. */ + unsigned long int __padding[12]; + } __saved; + } __jmpbuf_arch_t; diff --git a/sysdeps/unix/sysv/linux/x86/__saved_mask.h b/sysdeps/unix/sysv/linux/x86/__saved_mask.h new file mode 100644 index 0000000000..98b3bbc836 --- /dev/null +++ b/sysdeps/unix/sysv/linux/x86/__saved_mask.h @@ -0,0 +1,34 @@ +/* __saved_mask defition for Linux/x86. + Copyright (C) 2017 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +/* Saved signal mask. */ +#define __saved_mask __saved_mask.__saved.__saved_mask + +#include + +#define _SIGPROCMASK_NSIG_WORDS (_NSIG / (8 * sizeof (unsigned long int))) + +typedef struct + { + unsigned long int __val[_SIGPROCMASK_NSIG_WORDS]; + } __sigprocmask_sigset_t; + +extern jmp_buf ___buf; +extern __typeof (___buf[0].__saved_mask) ___saved_mask; +_Static_assert (sizeof (___saved_mask) >= sizeof (__sigprocmask_sigset_t), + "size of ___saved_mask < size of __sigprocmask_sigset_t"); diff --git a/sysdeps/unix/sysv/linux/x86/setjmpP.h b/sysdeps/unix/sysv/linux/x86/setjmpP.h new file mode 100644 index 0000000000..03bc477166 --- /dev/null +++ b/sysdeps/unix/sysv/linux/x86/setjmpP.h @@ -0,0 +1,28 @@ +/* Internal header file for . Linux/x86 version. + Copyright (C) 2017 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#ifndef _SETJMPP_H +#define _SETJMPP_H 1 + +#include <__jmpbuf_arch_t.h> +#undef __sigset_t +#define __sigset_t __jmpbuf_arch_t +#include +#include <__saved_mask.h> + +#endif /* setjmpP.h */ diff --git a/sysdeps/unix/sysv/linux/x86/tst-saved_mask-1.c b/sysdeps/unix/sysv/linux/x86/tst-saved_mask-1.c new file mode 100644 index 0000000000..1c5adebf0b --- /dev/null +++ b/sysdeps/unix/sysv/linux/x86/tst-saved_mask-1.c @@ -0,0 +1,56 @@ +/* Test that sigprocmask does not read from the unused part of jmpbuf. + Copyright (C) 2017 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include +#include +#include +#include <__jmpbuf_arch_t.h> +#include + +#define SIZEOF_SIGSET_T sizeof (__jmp_buf_sigset_t) + +static int +do_test (void) +{ + sigjmp_buf sj; + struct support_next_to_fault sigset_t_buf + = support_next_to_fault_allocate (SIZEOF_SIGSET_T); + sigset_t *m_p = (sigset_t *) sigset_t_buf.buffer; + sigset_t m; + + sigemptyset (&m); + memcpy (m_p, &m, SIZEOF_SIGSET_T); + sigprocmask (SIG_SETMASK, m_p, NULL); + memcpy (&m, m_p, SIZEOF_SIGSET_T); + if (sigsetjmp (sj, 0) == 0) + { + sigaddset (&m, SIGUSR1); + memcpy (m_p, &m, SIZEOF_SIGSET_T); + sigprocmask (SIG_SETMASK, m_p, NULL); + memcpy (&m, m_p, SIZEOF_SIGSET_T); + siglongjmp (sj, 1); + return EXIT_FAILURE; + } + sigprocmask (SIG_SETMASK, NULL, m_p); + memcpy (&m, m_p, SIZEOF_SIGSET_T); + return sigismember (&m, SIGUSR1) ? EXIT_SUCCESS : EXIT_FAILURE; +} + +#include -- 2.14.3