commit 68448be208ee06e76665918b37b0a57e3e00c8b4
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date: Fri Nov 17 16:04:29 2017 -0200
i386: Fix i386 sigaction sa_restorer initialization (BZ#21269)
This patch fixes the i386 sa_restorer field initialization for sigaction
syscall for kernel with vDSO. As described in bug report, i386 Linux
(and compat on x86_64) interprets SA_RESTORER clear with nonzero
sa_restorer as a request for stack switching if the SS segment is 'funny'.
This means that anything that tries to mix glibc's signal handling with
segmentation (for instance through modify_ldt syscall) is randomly broken
depending on what values lands in sa_restorer.
The testcase added is based on Linux test tools/testing/selftests/x86/ldt_gdt.c,
more specifically in do_multicpu_tests function. The main changes are:
- C11 atomics instead of plain access.
- Remove x86_64 support which simplifies the syscall handling and fallbacks.
- Replicate only the test required to trigger the issue.
Checked on i686-linux-gnu.
[BZ #21269]
* sysdeps/unix/sysv/linux/i386/Makefile (tests): Add tst-bz21269.
* sysdeps/unix/sysv/linux/i386/sigaction.c (SET_SA_RESTORER): Clear
sa_restorer for vDSO case.
* sysdeps/unix/sysv/linux/i386/tst-bz21269.c: New file.
(Adjusted for conflicted in sysdeps/unix/sysv/linux/i386/Makefile due
different context around the addition of the new test.)
diff --git a/sysdeps/unix/sysv/linux/i386/Makefile b/sysdeps/unix/sysv/linux/i386/Makefile
index acc30219e8dc965f..78e2101682d8d996 100644
--- a/sysdeps/unix/sysv/linux/i386/Makefile
+++ b/sysdeps/unix/sysv/linux/i386/Makefile
@@ -3,6 +3,9 @@ default-abi := 32
ifeq ($(subdir),misc)
sysdep_routines += ioperm iopl vm86 call_pselect6 call_fallocate
+
+tests += tst-bz21269
+$(objpfx)tst-bz21269: $(shared-thread-library)
endif
ifeq ($(subdir),elf)
diff --git a/sysdeps/unix/sysv/linux/i386/sigaction.c b/sysdeps/unix/sysv/linux/i386/sigaction.c
index 414ef759a97363c4..f10e1363865c3d18 100644
--- a/sysdeps/unix/sysv/linux/i386/sigaction.c
+++ b/sysdeps/unix/sysv/linux/i386/sigaction.c
@@ -44,7 +44,6 @@ extern void restore_rt (void) asm ("__restore_rt") attribute_hidden;
#endif
extern void restore (void) asm ("__restore") attribute_hidden;
-
/* If ACT is not NULL, change the action for SIG to *ACT.
If OACT is not NULL, put the old action for SIG in *OACT. */
int
@@ -67,6 +66,8 @@ __libc_sigaction (int sig, const struct sigaction *act, struct sigaction *oact)
kact.sa_restorer = ((act->sa_flags & SA_SIGINFO)
? &restore_rt : &restore);
}
+ else
+ kact.sa_restorer = NULL;
}
/* XXX The size argument hopefully will have to be changed to the
diff --git a/sysdeps/unix/sysv/linux/i386/tst-bz21269.c b/sysdeps/unix/sysv/linux/i386/tst-bz21269.c
new file mode 100644
index 0000000000000000..353e36507dce92ea
--- /dev/null
+++ b/sysdeps/unix/sysv/linux/i386/tst-bz21269.c
@@ -0,0 +1,233 @@
+/* Test for i386 sigaction sa_restorer handling (BZ#21269)
+ Copyright (C) 2017 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <http://www.gnu.org/licenses/>. */
+
+/* This is based on Linux test tools/testing/selftests/x86/ldt_gdt.c,
+ more specifically in do_multicpu_tests function. The main changes
+ are:
+
+ - C11 atomics instead of plain access.
+ - Remove x86_64 support which simplifies the syscall handling
+ and fallbacks.
+ - Replicate only the test required to trigger the issue for the
+ BZ#21269. */
+
+#include <stdatomic.h>
+
+#include <asm/ldt.h>
+#include <linux/futex.h>
+
+#include <setjmp.h>
+#include <signal.h>
+#include <errno.h>
+#include <sys/syscall.h>
+#include <sys/mman.h>
+
+#include <support/xunistd.h>
+#include <support/check.h>
+#include <support/xthread.h>
+
+static int
+xset_thread_area (struct user_desc *u_info)
+{
+ long ret = syscall (SYS_set_thread_area, u_info);
+ TEST_VERIFY_EXIT (ret == 0);
+ return ret;
+}
+
+static void
+xmodify_ldt (int func, const void *ptr, unsigned long bytecount)
+{
+ TEST_VERIFY_EXIT (syscall (SYS_modify_ldt, 1, ptr, bytecount) == 0);
+}
+
+static int
+futex (int *uaddr, int futex_op, int val, void *timeout, int *uaddr2,
+ int val3)
+{
+ return syscall (SYS_futex, uaddr, futex_op, val, timeout, uaddr2, val3);
+}
+
+static void
+xsethandler (int sig, void (*handler)(int, siginfo_t *, void *), int flags)
+{
+ struct sigaction sa = { 0 };
+ sa.sa_sigaction = handler;
+ sa.sa_flags = SA_SIGINFO | flags;
+ TEST_VERIFY_EXIT (sigemptyset (&sa.sa_mask) == 0);
+ TEST_VERIFY_EXIT (sigaction (sig, &sa, 0) == 0);
+}
+
+static jmp_buf jmpbuf;
+
+static void
+sigsegv_handler (int sig, siginfo_t *info, void *ctx_void)
+{
+ siglongjmp (jmpbuf, 1);
+}
+
+/* Points to an array of 1024 ints, each holding its own index. */
+static const unsigned int *counter_page;
+static struct user_desc *low_user_desc;
+static struct user_desc *low_user_desc_clear; /* Used to delete GDT entry. */
+static int gdt_entry_num;
+
+static void
+setup_counter_page (void)
+{
+ long page_size = sysconf (_SC_PAGE_SIZE);
+ TEST_VERIFY_EXIT (page_size > 0);
+ unsigned int *page = xmmap (NULL, page_size, PROT_READ | PROT_WRITE,
+ MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1);
+ for (int i = 0; i < (page_size / sizeof (unsigned int)); i++)
+ page[i] = i;
+ counter_page = page;
+}
+
+static void
+setup_low_user_desc (void)
+{
+ low_user_desc = xmmap (NULL, 2 * sizeof (struct user_desc),
+ PROT_READ | PROT_WRITE,
+ MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1);
+
+ low_user_desc->entry_number = -1;
+ low_user_desc->base_addr = (unsigned long) &counter_page[1];
+ low_user_desc->limit = 0xffff;
+ low_user_desc->seg_32bit = 1;
+ low_user_desc->contents = 0;
+ low_user_desc->read_exec_only = 0;
+ low_user_desc->limit_in_pages = 1;
+ low_user_desc->seg_not_present = 0;
+ low_user_desc->useable = 0;
+
+ xset_thread_area (low_user_desc);
+
+ low_user_desc_clear = low_user_desc + 1;
+ low_user_desc_clear->entry_number = gdt_entry_num;
+ low_user_desc_clear->read_exec_only = 1;
+ low_user_desc_clear->seg_not_present = 1;
+}
+
+/* Possible values of futex:
+ 0: thread is idle.
+ 1: thread armed.
+ 2: thread should clear LDT entry 0.
+ 3: thread should exit. */
+static atomic_uint ftx;
+
+static void *
+threadproc (void *ctx)
+{
+ while (1)
+ {
+ futex ((int *) &ftx, FUTEX_WAIT, 1, NULL, NULL, 0);
+ while (atomic_load (&ftx) != 2)
+ {
+ if (atomic_load (&ftx) >= 3)
+ return NULL;
+ }
+
+ /* clear LDT entry 0. */
+ const struct user_desc desc = { 0 };
+ xmodify_ldt (1, &desc, sizeof (desc));
+
+ /* If ftx == 2, set it to zero, If ftx == 100, quit. */
+ if (atomic_fetch_add (&ftx, -2) != 2)
+ return NULL;
+ }
+}
+
+
+/* As described in testcase, for historical reasons x86_32 Linux (and compat
+ on x86_64) interprets SA_RESTORER clear with nonzero sa_restorer as a
+ request for stack switching if the SS segment is 'funny' (this is default
+ scenario for vDSO system). This means that anything that tries to mix
+ signal handling with segmentation should explicit clear the sa_restorer.
+
+ This testcase check if sigaction in fact does it by changing the local
+ descriptor table (LDT) through the modify_ldt syscall and triggering
+ a synchronous segfault on iret fault by trying to install an invalid
+ segment. With a correct zeroed sa_restorer it should not trigger an
+ 'real' SEGSEGV and allows the siglongjmp in signal handler. */
+
+static int
+do_test (void)
+{
+ setup_counter_page ();
+ setup_low_user_desc ();
+
+ pthread_t thread;
+ unsigned short orig_ss;
+
+ xsethandler (SIGSEGV, sigsegv_handler, 0);
+ /* 32-bit kernels send SIGILL instead of SIGSEGV on IRET faults. */
+ xsethandler (SIGILL, sigsegv_handler, 0);
+
+ thread = xpthread_create (0, threadproc, 0);
+
+ asm volatile ("mov %%ss, %0" : "=rm" (orig_ss));
+
+ for (int i = 0; i < 5; i++)
+ {
+ if (sigsetjmp (jmpbuf, 1) != 0)
+ continue;
+
+ /* Make sure the thread is ready after the last test. */
+ while (atomic_load (&ftx) != 0)
+ ;
+
+ struct user_desc desc = {
+ .entry_number = 0,
+ .base_addr = 0,
+ .limit = 0xffff,
+ .seg_32bit = 1,
+ .contents = 0,
+ .read_exec_only = 0,
+ .limit_in_pages = 1,
+ .seg_not_present = 0,
+ .useable = 0
+ };
+
+ xmodify_ldt (0x11, &desc, sizeof (desc));
+
+ /* Arm the thread. */
+ ftx = 1;
+ futex ((int*) &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
+
+ asm volatile ("mov %0, %%ss" : : "r" (0x7));
+
+ /* Fire up thread modify_ldt call. */
+ atomic_store (&ftx, 2);
+
+ while (atomic_load (&ftx) != 0)
+ ;
+
+ /* On success, modify_ldt will segfault us synchronously and we will
+ escape via siglongjmp. */
+ support_record_failure ();
+ }
+
+ atomic_store (&ftx, 100);
+ futex ((int*) &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
+
+ xpthread_join (thread);
+
+ return 0;
+}
+
+#include <support/test-driver.c>