On Mon, Nov 13, 2017 at 8:44 AM, H.J. Lu <hjl.tools@gmail.com> wrote:
> On Mon, Nov 13, 2017 at 8:34 AM, Florian Weimer <fweimer@redhat.com> wrote:
>> On 11/13/2017 03:05 PM, H.J. Lu wrote:
>>>
>>> On Mon, Nov 13, 2017 at 5:09 AM, Florian Weimer <fweimer@redhat.com>
>>> wrote:
>>>>
>>>> On 11/08/2017 07:27 PM, H.J. Lu wrote:
>>>>>
>>>>>
>>>>> +/* The biggest signal number + 1 */
>>>>> +#define _JUMP_BUF_SIGSET_NSIG 257
>>>>> +/* Number of longs to hold all signals. */
>>>>> +#define _JUMP_BUF_SIGSET_NWORDS \
>>>>> + ((_JUMP_BUF_SIGSET_NSIG - 1 + 7) / (8 * sizeof (unsigned long int)))
>>>>
>>>>
>>>>
>>>> Where does 257 come from? 65 or 129 I would understand considering the
>>>> kernel sources, but 257 is odd.
>>
>>
>> Oh. I'm not sure if we should put this into installed header.
>>
>> Maybe we can use a different approach? Something similar to the pthread
>> types? Or just not change the external type at all and just ad some
>> internal space reuse mechanism?
>
> I will see what I can do.
>
>> We had problems with people poking at supposedly invisible jmpbuf contents
>> in the past, and I'm worried that adding even __ members will encourage
>> that.
>>
>>>> I think it would be clearer to hard-code the array sizes and explain why
>>>> the
>>>> values where chosen in that way.
>>>>
>>>> We also need a test that setprocmask does not read from the previously
>>>
>>>
>>> Did you mean "sigprocmask"?
>>
>>
>> Right.
>>
>>>> unused part. I can move the existing next_to_fault bits to support/ if
>>>> that
>>>> would help.
>>>
>>>
>>> Yes, please.
>>
>>
>> Okay, I'll move it to support/ soon.
>>
>
Here is the updated patch to add <setjmpP.h>. I added a test:
struct support_next_to_fault jmpbuf
= support_next_to_fault_allocate (SAVED_MASK_OFFSET + (_NSIG / 8));
struct __jmp_buf_tag *sj = (struct __jmp_buf_tag *) jmpbuf.buffer;
errno = 0;
if (sigsetjmp (sj, 1) == 0)
{
siglongjmp (sj, 1);
return EXIT_FAILURE;
}
if (errno != 0)
{
printf ("sigsetjmp: %s\n", strerror (errno));
return EXIT_FAILURE;
}
to verify that __sigprocmask won't read beyond _NSIG / 8.
Does it look OK?
Thanks.
From fe74415d7c260b11af530d71f6e1c730374978a6 Mon Sep 17 00:00:00 2001
From: "H.J. Lu" <hjl.tools@gmail.com>
Date: Sat, 10 Jun 2017 17:23:06 -0700
Subject: [PATCH] jmpbuf: Add paddings for architecture specific usage
To support Shadow Stack (SHSTK) in Intel Control-flow Enforcement
Technology (CET) in setjmp/longjmp, we need to save shadow stack
pointer in jmp_buf. The __saved_mask field in jmp_buf has type
of __sigset_t. On Linux, __sigset_t is defined as
#define _SIGSET_NWORDS (1024 / (8 * sizeof (unsigned long int)))
typedef struct
{
unsigned long int __val[_SIGSET_NWORDS];
} __sigset_t;
which is much bigger than expected by the __sigprocmask system call,
which has
typedef struct {
unsigned long sig[_NSIG_WORDS];
} sigset_t;
We can shrink __sigset_t used by __saved_mask in jmp_buf to add paddings
for architecture specific usage. As long as the new __sigset_t is not
smaller than sigset_t expected by the __sigprocmask system call, it should
work correctly. This patch adds an internal header file, <setjmpP.h>,
to define __jmp_buf_sigset_t for __saved_mask in jmp_buf on Linux and
verifies __jmp_buf_sigset_t has the suitable size for the __sigprocmask
system call.
Tested with build-many-glibcs.py.
* debug/longjmp_chk.c: Include <setjmpP.h> instead of
<setjmp.h>.
* include/setjmpP.h: New file.
* setjmp/setjmpP.h: Likewise.
* sysdeps/generic/__jmpbuf_arch_t.h: Likewise.
* sysdeps/generic/__saved_mask.h: Likewise.
* sysdeps/unix/sysv/linux/__jmpbuf_arch_t.h: Likewise.
* sysdeps/unix/sysv/linux/__saved_mask.h: Likewise.
* setjmp/tst-sigsetjmp2.c: Likewise.
* include/setjmp.h: [!_ISOMAC]: Include <signal.h>.
[_NSIG] (_SIGPROCMASK_NSIG_WORDS): New.
[_NSIG] (__sigprocmask_sigset_t): Likewise.
[_NSIG] (do_test): Add _Static_assert for size of __saved_mask
in jmp_buf >= sizeof __sigprocmask_sigset_t.
* setjmp/Makefile (tests): Add tst-sigsetjmp2.
* setjmp/longjmp.c: Include <setjmpP.h> instead of <setjmp.h>.
(__libc_siglongjmp): Cast &env[0].__saved_mask to "sigset_t *".
* setjmp/sigjmp.c: Include <setjmpP.h> instead of <setjmp.h>.
(__sigjmp_save): Cast &env[0].__saved_mask to "sigset_t *".
* sysdeps/powerpc/longjmp.c: Include <setjmpP.h> instead of
<setjmp.h>.
(__vmx__libc_siglongjmp): Cast &env[0].__saved_mask to
"sigset_t *".
* sysdeps/powerpc/sigjmp.c: Include <setjmpP.h> instead of
<setjmp.h>.
(__vmx__sigjmp_save): Cast &env[0].__saved_mask to "sigset_t *".
* sysdeps/unix/sysv/linux/ia64/unwind_longjmp.c: Include
<setjmpP.h> instead of <setjmp.h>.
(__libc_unwind_longjmp): Cast &env[0].__saved_mask to "sigset_t *".
---
debug/longjmp_chk.c | 2 +-
include/setjmp.h | 15 ++++++++
include/setjmpP.h | 1 +
setjmp/Makefile | 2 +-
setjmp/longjmp.c | 5 +--
setjmp/setjmpP.h | 32 +++++++++++++++++
setjmp/sigjmp.c | 4 +--
setjmp/tst-sigsetjmp2.c | 50 +++++++++++++++++++++++++++
sysdeps/generic/__jmpbuf_arch_t.h | 24 +++++++++++++
sysdeps/generic/__saved_mask.h | 20 +++++++++++
sysdeps/powerpc/longjmp.c | 5 +--
sysdeps/powerpc/sigjmp.c | 4 +--
sysdeps/unix/sysv/linux/__jmpbuf_arch_t.h | 43 +++++++++++++++++++++++
sysdeps/unix/sysv/linux/__saved_mask.h | 20 +++++++++++
sysdeps/unix/sysv/linux/ia64/unwind_longjmp.c | 5 +--
15 files changed, 220 insertions(+), 12 deletions(-)
create mode 100644 include/setjmpP.h
create mode 100644 setjmp/setjmpP.h
create mode 100644 setjmp/tst-sigsetjmp2.c
create mode 100644 sysdeps/generic/__jmpbuf_arch_t.h
create mode 100644 sysdeps/generic/__saved_mask.h
create mode 100644 sysdeps/unix/sysv/linux/__jmpbuf_arch_t.h
create mode 100644 sysdeps/unix/sysv/linux/__saved_mask.h
@@ -15,7 +15,7 @@
License along with the GNU C Library; if not, see
<http://www.gnu.org/licenses/>. */
-#include <setjmp.h>
+#include <setjmpP.h>
#define __longjmp ____longjmp_chk
#define __libc_siglongjmp __longjmp_chk
@@ -33,6 +33,7 @@ extern __typeof (__sigsetjmp) __sigsetjmp attribute_hidden;
# endif
/* Check jmp_buf sizes, alignments and offsets. */
+# include <signal.h>
# include <stddef.h>
# include <jmp_buf-macros.h>
@@ -65,6 +66,20 @@ TEST_OFFSET (struct __jmp_buf_tag, __mask_was_saved,
MASK_WAS_SAVED_OFFSET);
TEST_OFFSET (struct __jmp_buf_tag, __saved_mask,
SAVED_MASK_OFFSET);
+
+# ifdef _NSIG
+# define _SIGPROCMASK_NSIG_WORDS (_NSIG / (8 * sizeof (unsigned long int)))
+
+typedef struct
+ {
+ unsigned long int __val[_SIGPROCMASK_NSIG_WORDS];
+ } __sigprocmask_sigset_t;
+
+extern jmp_buf ___buf;
+extern __typeof (___buf[0].__saved_mask) ___saved_mask;
+_Static_assert (sizeof (___saved_mask) >= sizeof (__sigprocmask_sigset_t),
+ "size of ___saved_mask < size of __sigprocmask_sigset_t");
+# endif
#endif
#endif
new file mode 100644
@@ -0,0 +1 @@
+#include <setjmp/setjmpP.h>
@@ -28,7 +28,7 @@ routines := setjmp sigjmp bsd-setjmp bsd-_setjmp \
longjmp __longjmp jmp-unwind
tests := tst-setjmp jmpbug bug269-setjmp tst-setjmp-fp \
- tst-sigsetjmp tst-setjmp-static
+ tst-sigsetjmp tst-setjmp-static tst-sigsetjmp2
tests-static := tst-setjmp-static
@@ -16,7 +16,7 @@
<http://www.gnu.org/licenses/>. */
#include <stddef.h>
-#include <setjmp.h>
+#include <setjmpP.h>
#include <signal.h>
@@ -31,7 +31,8 @@ __libc_siglongjmp (sigjmp_buf env, int val)
if (env[0].__mask_was_saved)
/* Restore the saved signal mask. */
- (void) __sigprocmask (SIG_SETMASK, &env[0].__saved_mask,
+ (void) __sigprocmask (SIG_SETMASK,
+ (sigset_t *) &env[0].__saved_mask,
(sigset_t *) NULL);
/* Call the machine-dependent function to restore machine state. */
new file mode 100644
@@ -0,0 +1,32 @@
+/* Internal __sigset_t type used in struct __jmp_buf_tag.
+ Copyright (C) 2017 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <http://www.gnu.org/licenses/>. */
+
+/*
+ * ISO C99 Standard: 7.13 Nonlocal jumps <setjmp.h>
+ */
+
+#ifndef _SETJMPP_H
+#define _SETJMPP_H 1
+
+#include <__jmpbuf_arch_t.h>
+#undef __sigset_t
+#define __sigset_t __jmpbuf_arch_t
+#include <setjmp.h>
+#include <__saved_mask.h>
+
+#endif /* setjmpP.h */
@@ -16,7 +16,7 @@
<http://www.gnu.org/licenses/>. */
#include <stddef.h>
-#include <setjmp.h>
+#include <setjmpP.h>
#include <signal.h>
/* This function is called by the `sigsetjmp' macro
@@ -28,7 +28,7 @@ __sigjmp_save (sigjmp_buf env, int savemask)
{
env[0].__mask_was_saved = (savemask &&
__sigprocmask (SIG_BLOCK, (sigset_t *) NULL,
- &env[0].__saved_mask) == 0);
+ (sigset_t *) &env[0].__saved_mask) == 0);
return 0;
}
new file mode 100644
@@ -0,0 +1,50 @@
+/* Test that sigprocmask does not read from the unused part of jmpbuf.
+ Copyright (C) 2017 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <http://www.gnu.org/licenses/>. */
+
+#include <stdlib.h>
+#include <signal.h>
+#include <setjmp.h>
+#include <stdio.h>
+#include <string.h>
+#include <errno.h>
+#include <jmp_buf-macros.h>
+#include <support/next_to_fault.h>
+
+static int
+do_test (void)
+{
+ struct support_next_to_fault jmpbuf
+ = support_next_to_fault_allocate (SAVED_MASK_OFFSET + (_NSIG / 8));
+ struct __jmp_buf_tag *sj = (struct __jmp_buf_tag *) jmpbuf.buffer;
+
+ errno = 0;
+ if (sigsetjmp (sj, 1) == 0)
+ {
+ siglongjmp (sj, 1);
+ return EXIT_FAILURE;
+ }
+ if (errno != 0)
+ {
+ printf ("sigsetjmp: %s\n", strerror (errno));
+ return EXIT_FAILURE;
+ }
+ return EXIT_SUCCESS;
+}
+
+#define TEST_FUNCTION do_test ()
+#include "../test-skeleton.c"
new file mode 100644
@@ -0,0 +1,24 @@
+/* Generic __jmpbuf_arch_t defition.
+ Copyright (C) 2017 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <http://www.gnu.org/licenses/>. */
+
+#include <bits/types/__sigset_t.h>
+
+typedef struct
+ {
+ __sigset_t __saved_mask;
+ } __jmpbuf_arch_t;
new file mode 100644
@@ -0,0 +1,20 @@
+/* Generic __saved_mask defition.
+ Copyright (C) 2017 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <http://www.gnu.org/licenses/>. */
+
+/* Saved signal mask. */
+#define __saved_mask __saved_mask.__saved_mask
@@ -19,7 +19,7 @@
#include <shlib-compat.h>
#include <stddef.h>
-#include <setjmp.h>
+#include <setjmpP.h>
#include <signal.h>
extern void __vmx__longjmp (__jmp_buf __env, int __val)
@@ -39,7 +39,8 @@ __vmx__libc_siglongjmp (sigjmp_buf env, int val)
if (env[0].__mask_was_saved)
/* Restore the saved signal mask. */
- (void) __sigprocmask (SIG_SETMASK, &env[0].__saved_mask,
+ (void) __sigprocmask (SIG_SETMASK,
+ (sigset_t *) &env[0].__saved_mask,
(sigset_t *) NULL);
/* Call the machine-dependent function to restore machine state. */
@@ -19,7 +19,7 @@
#include <shlib-compat.h>
#include <stddef.h>
-#include <setjmp.h>
+#include <setjmpP.h>
#include <signal.h>
/* This function is called by the `sigsetjmp' macro
@@ -31,7 +31,7 @@ __vmx__sigjmp_save (sigjmp_buf env, int savemask)
{
env[0].__mask_was_saved = (savemask &&
__sigprocmask (SIG_BLOCK, (sigset_t *) NULL,
- &env[0].__saved_mask) == 0);
+ (sigset_t *) &env[0].__saved_mask) == 0);
return 0;
}
new file mode 100644
@@ -0,0 +1,43 @@
+/* __jmpbuf_arch_t defition for Linux.
+ Copyright (C) 2017 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <http://www.gnu.org/licenses/>. */
+
+#include <bits/types/__sigset_t.h>
+
+/* The biggest signal number + 1. As of kernel 4.13, the maximum number
+ of signals is 128 on MIPS. Define it to 257 to leave some rooms for
+ the future. */
+#define _JUMP_BUF_SIGSET_NSIG 257
+/* Number of longs to hold all signals. */
+#define _JUMP_BUF_SIGSET_NWORDS \
+ ((_JUMP_BUF_SIGSET_NSIG - 1 + 7) / (8 * sizeof (unsigned long int)))
+
+typedef struct
+ {
+ unsigned long int __val[_JUMP_BUF_SIGSET_NWORDS];
+ } __jmp_buf_sigset_t;
+
+typedef union
+ {
+ __sigset_t __saved_mask_compat;
+ struct
+ {
+ __jmp_buf_sigset_t __saved_mask;
+ /* Paddings for architecture specific usage. */
+ unsigned long int __padding[12];
+ } __saved;
+ } __jmpbuf_arch_t;
new file mode 100644
@@ -0,0 +1,20 @@
+/* __saved_mask defition for Linux.
+ Copyright (C) 2017 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <http://www.gnu.org/licenses/>. */
+
+/* Saved signal mask. */
+#define __saved_mask __saved_mask.__saved.__saved_mask
@@ -16,7 +16,7 @@
<http://www.gnu.org/licenses/>. */
#include <stddef.h>
-#include <setjmp.h>
+#include <setjmpP.h>
#include <signal.h>
#include <pthreadP.h>
#include <jmpbuf-unwind.h>
@@ -34,7 +34,8 @@ __libc_unwind_longjmp (sigjmp_buf env, int val)
if (env[0].__mask_was_saved)
/* Restore the saved signal mask. */
- (void) __sigprocmask (SIG_SETMASK, &env[0].__saved_mask,
+ (void) __sigprocmask (SIG_SETMASK,
+ (sigset_t *) &env[0].__saved_mask,
(sigset_t *) NULL);
/* Call the machine-dependent function to restore machine state. */
--
2.13.6