From: Ingo Molnar <mingo@kernel.org>
To: Andy Lutomirski <luto@amacapital.net>
Cc: Stas Sergeev <stsp@list.ru>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>,
X86 ML <x86@kernel.org>, Borislav Petkov <bp@suse.de>,
Brian Gerst <brgerst@gmail.com>, Oleg Nesterov <oleg@redhat.com>,
Richard Weinberger <richard@nod.at>,
Stas Sergeev <stsp@users.sourceforge.net>
Subject: Re: [PATCH] [Cleanup] x86: signal: unify the sigaltstack check with other arches
Date: Thu, 10 Mar 2016 11:26:18 +0100 [thread overview]
Message-ID: <20160310102618.GB21593@gmail.com> (raw)
In-Reply-To: <CALCETrWSr86vBo=Va-t687A1zEszZJZjG350+-2GCOhM-kLuSA@mail.gmail.com>
* Andy Lutomirski <luto@amacapital.net> wrote:
> On Tue, Mar 8, 2016 at 8:20 AM, Ingo Molnar <mingo@kernel.org> wrote:
> >
> > * Stas Sergeev <stsp@list.ru> wrote:
> >
> >> 25.02.2016 11:25, Ingo Molnar пишет:
> >> >
> >> > * Stas Sergeev <stsp@list.ru> wrote:
> >> >
> >> >> Currently x86's get_sigframe() checks for "current->sas_ss_size"
> >> >> to determine whether there is a need to switch to sigaltstack.
> >> >> The common practice used by all other arches is to check for
> >> >> sas_ss_flags(sp) == 0
> >> >>
> >> >> This patch makes the code consistent with other arches.
> >> >> The slight complexity of the patch is added by the optimization on
> >> >> !sigstack check that was requested by Andy Lutomirski: sas_ss_flags(sp)==0
> >> >> already implies that we are not on a sigstack, so the code is shuffled
> >> >> to avoid the duplicate checking.
> >> >
> >> > So this changelog is missing an analysis about what effect this change will have
> >> > on applications. Can any type of user-space code see a change in behavior? If yes,
> >> > what will happen and is that effect desirable?
> >> This is a clean-up, and as such, there is no visible effect.
> >> If there is - it is a bug.
> >> The purpose of this patch is only to unify the x86 code with
> >> what all the other arches do. It was initially the part of the
> >> rejected series, but now it is just a clean-up.
> >
> > Ok, so AFAICS the relevant change is:
> >
> > - if (current->sas_ss_size)
> > - sp = current->sas_ss_sp + current->sas_ss_size;
> > + if (sas_ss_flags(sp) == 0)
> > + sp = current->sas_ss_sp + current->sas_ss_size;
> >
> > and since sas_ss_flags() is defined as:
> >
> > static inline int sas_ss_flags(unsigned long sp)
> > {
> > if (!current->sas_ss_size)
> > return SS_DISABLE;
> >
> > return on_sig_stack(sp) ? SS_ONSTACK : 0;
> > }
> >
> > sas_ss_flags() returns 0 iff current->sas_ss_size && !on_sig_stack().
> >
> > But we already have on_sig_stack(sp) calculated. Why not write that as:
> >
> > + if (current->sas_ss_size && !onsigstack)
> > + sp = current->sas_ss_sp + current->sas_ss_size;
> >
> > and since we check '!onsigstack' in both branches, we might as well factor it out
> > into a single condition ... and arrive to the exact code that we began with.
>
> ISTM it's silly for us to be unconditionally computing onsigstack.
> We're doing it because we need it later for this:
>
> /*
> * If we are on the alternate signal stack and would overflow it, don't.
> * Return an always-bogus address instead so we will die with SIGSEGV.
> */
> if (onsigstack && !likely(on_sig_stack(sp)))
> return (void __user *)-1L;
>
> This seems basically useless to me. Sure, it's nice to send SIGSEGV
> if we overflow due to signal delivery. But we're almost as likely to
> overflow in the signal handler as we are to overflow during delivery,
> and we don't even try to catch that.
Ok, I was just put off by the code size difference - but no strong opinion from
me, I'd certainly be fine with (as a first step) harmonizing the implementation
with other architectures. I withdraw my objection.
> Anyway, I think we should make two changes to the sig_on_stack thing:
>
> 1. If SS_AUTODISARM, then we're not on the stack, regardless of what sp says.
>
> 2. If !user_64bit_mode(regs) && (regs->ss & 0x4), then we're not on
> the signal stack. This will happen if we're running on an LDT stack
> and we coincidentally have the ESP part of SS:ESP matching the signal
> stack.
>
> In general, the existing design is crap and it should always have
> worked the way that Stas is proposing with SS_AUTODISARM.
Ok, no objections here either.
Thanks,
Ingo
next prev parent reply other threads:[~2016-03-10 10:26 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-21 23:01 [PATCH] [Cleanup] x86: signal: unify the sigaltstack check with other arches Stas Sergeev
2016-02-25 8:25 ` Ingo Molnar
2016-02-25 12:14 ` Stas Sergeev
2016-03-08 16:20 ` Ingo Molnar
2016-03-08 16:55 ` Stas Sergeev
2016-03-10 0:02 ` Andy Lutomirski
2016-03-10 10:26 ` Ingo Molnar [this message]
2016-03-10 12:08 ` Stas Sergeev
2016-04-13 22:11 ` Stas Sergeev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160310102618.GB21593@gmail.com \
--to=mingo@kernel.org \
--cc=bp@suse.de \
--cc=brgerst@gmail.com \
--cc=hpa@zytor.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=mingo@redhat.com \
--cc=oleg@redhat.com \
--cc=richard@nod.at \
--cc=stsp@list.ru \
--cc=stsp@users.sourceforge.net \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).