linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: "Bae, Chang Seok" <chang.seok.bae@intel.com>
To: Borislav Petkov <bp@suse.de>
Cc: Thomas Gleixner <tglx@linutronix.de>,
	"mingo@kernel.org" <mingo@kernel.org>,
	"luto@kernel.org" <luto@kernel.org>,
	"x86@kernel.org" <x86@kernel.org>,
	"Brown, Len" <len.brown@intel.com>,
	"Hansen, Dave" <dave.hansen@intel.com>,
	"hjl.tools@gmail.com" <hjl.tools@gmail.com>,
	"Dave.Martin@arm.com" <Dave.Martin@arm.com>,
	"jannh@google.com" <jannh@google.com>,
	"mpe@ellerman.id.au" <mpe@ellerman.id.au>,
	"carlos@redhat.com" <carlos@redhat.com>,
	"Luck, Tony" <tony.luck@intel.com>,
	"Shankar, Ravi V" <ravi.v.shankar@intel.com>,
	"libc-alpha@sourceware.org" <libc-alpha@sourceware.org>,
	"linux-arch@vger.kernel.org" <linux-arch@vger.kernel.org>,
	"linux-api@vger.kernel.org" <linux-api@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"Yu, Fenghua" <fenghua.yu@intel.com>,
	"linux-doc@vger.kernel.org" <linux-doc@vger.kernel.org>
Subject: Re: [PATCH v6 3/6] x86/elf: Support a new ELF aux vector AT_MINSIGSTKSZ
Date: Wed, 10 Mar 2021 16:34:40 +0000	[thread overview]
Message-ID: <F637CCE0-1744-478C-B2ED-65EA14B07938@intel.com> (raw)
In-Reply-To: <20210305104325.GA2896@zn.tnic>

On Mar 5, 2021, at 02:43, Borislav Petkov <bp@suse.de> wrote:
> On Sat, Feb 27, 2021 at 08:59:08AM -0800, Chang S. Bae wrote:
>> Historically, signal.h defines MINSIGSTKSZ (2KB) and SIGSTKSZ (8KB), for
>> use by all architectures with sigaltstack(2). Over time, the hardware state
>> size grew, but these constants did not evolve. Today, literal use of these
>> constants on several architectures may result in signal stack overflow, and
>> thus user data corruption.
>> 
>> A few years ago, the ARM team addressed this issue by establishing
>> getauxval(AT_MINSIGSTKSZ). This enables the kernel to supply at runtime
>> value that is an appropriate replacement on the current and future
>> hardware.
>> 
>> Add getauxval(AT_MINSIGSTKSZ) support to x86, analogous to the support
>> added for ARM in commit 94b07c1f8c39 ("arm64: signal: Report signal frame
>> size to userspace via auxv").
>> 
>> Also, include a documentation to describe x86-specific auxiliary vectors.
>> 
>> Reported-by: Florian Weimer <fweimer@redhat.com>
>> Fixes: c2bc11f10a39 ("x86, AVX-512: Enable AVX-512 States Context Switch")
> 
> Right, so this has a Fixes: tag and points to bugzilla entry which talks
> about signal stack corruption with AVX-512F.
> 
> But if this is going to be backported to stable, then the patch(es)
> should be minimal and not contain documentation. And if so, one will
> need all three to be backported, which means, a cc:stable should contain
> a comment explaining that.
> 
> Or am I misreading and they should not need to be backported to stable
> because some <non-obvious reason>?
> 
> Also, I'm not sure backporting a patch to stable which changes ABI is
> ok. It probably is but I don't know.
> 
> So what's the deal here?

Yeah, right. While this attempts to fix the issue, it involves the ABI change.
Len and I think PATCH5 [1] is rather a backport candidate as it gives a more
reasonable behavior.

At least, I can make a new patch for this documentation if you think it is the
right way.

> You also need:
> 
> diff --git a/Documentation/x86/index.rst b/Documentation/x86/index.rst
> index 4693e192b447..d58614d5cde6 100644
> --- a/Documentation/x86/index.rst
> +++ b/Documentation/x86/index.rst
> @@ -35,3 +35,4 @@ x86-specific Documentation
>    sva
>    sgx
>    features
> +   elf_auxvec
> 
> to add this to the TOC.

Ah, will do that.

>> +   #include <sys/auxv.h>
>> +   #include <elf.h>
>> +
>> +   #ifndef AT_MINSIGSTKSZ
>> +   #define AT_MINSIGSTKSZ	51
>> +   #endif
>> +
>> +   stack_t ss;
>> +   int err;
>> +
>> +   ss.ss_size = getauxval(AT_MINSIGSTKSZ) + SIGSTKSZ;
>> +   ss.ss_sp = malloc(ss.ss_size);
>> +   ...
>> +
>> +   err = sigaltstack(&ss, NULL);
>> +   ...
> 
> That source code needs some special markup to look like source code -
> currently, the result looks bad.

How about this code:

#include <sys/auxv.h>
#include <elf.h>
#include <signal.h>
#include <stdlib.h>
#include <assert.h>
#include <err.h>

#ifndef AT_MINSIGSTKSZ
#define AT_MINSIGSTKSZ	51
#endif

stack_t ss;

ss.ss_sp = malloc(ss.ss_size);
assert(ss.ss_sp);

ss.ss_size = getauxval(AT_MINSIGSTKSZ) + SIGSTKSZ;
ss.ss_flags = 0;

if (sigaltstack(&ss, NULL))
	err(1, "sigaltstack");


>> +2. The exposed auxiliary vectors
>> +---------------------------------
>> +
>> +AT_SYSINFO
>> +    The entry point to the system call function the virtual Dynamic Shared
>> +    Object (vDSO), not exported on 64-bit.
> 
> I can't parse that sentence.
> 
>> +
>> +AT_SYSINFO_EHDR
>> +    The start address of the page containing vDSO.
> 						^
> 						the
>> +
>> +AT_MINSIGSTKSZ
>> +    The minimum stack size required to deliver a signal. It is a calculated
>> +    sigframe size based on the largest possible user context. When programs
>> +    use sigaltstack() to provide alternate signal stack, that stack must be
>> +    at least the size to function properly on this hardware. Note that this
>> +    is a minimum of the kernel to correctly get to the signal handler.
> 
> I get what this is trying to say but it reads weird. Simplify pls.
> 
>> +    Additional space must be added to handle objects pushed onto the stack
>> +    by the signal handlers, as well as for nested signal delivery.
>> +
>> +    The purpose of this parameter is to accommodate the different stack
>> +    sizes required by different hardware configuration. E.g., the x86
>> +    system supporting the Advanced Vector Extension needs at least 8KB more
>> +    than the one without it.
> 
> That could be simplified too.

Rewrote like this:

AT_SYSINFO is used for locating the vsyscall entry point.  It is not exported
on 64-bit mode.

AT_SYSINFO_EHDR is the start address of the page containing the vDSO.

AT_MINSIGSTKSZ denotes the minimum stack size required by the kernel to
deliver a signal to user-space.  AT_MINSIGSTKSZ comprehends the space consumed
by the kernel to accommodate the user context for the current hardware
configuration.  It does not comprehend subsequent user-space stack
consumption, which must be added by the user.  (e.g. Above, user-space adds
SIGSTKSZ to AT_MINSIGSTKSZ.)

>> diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
>> index 66bdfe838d61..cd10795c178e 100644
>> --- a/arch/x86/include/asm/elf.h
>> +++ b/arch/x86/include/asm/elf.h
>> @@ -312,6 +312,7 @@ do {									\
>> 		NEW_AUX_ENT(AT_SYSINFO,	VDSO_ENTRY);			\
>> 		NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_CURRENT_BASE);	\
>> 	}								\
>> +	NEW_AUX_ENT(AT_MINSIGSTKSZ, get_sigframe_size());			\
> 
> Check vertical alignment of the '\'

Sorry, I will make sure this next time.

Thanks,
Chang

[1] https://lore.kernel.org/lkml/20210227165911.32757-6-chang.seok.bae@intel.com/



  reply	other threads:[~2021-03-10 16:36 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-02-27 16:59 [PATCH v6 0/6] x86: Improve Minimum Alternate Stack Size Chang S. Bae
2021-02-27 16:59 ` [PATCH v6 1/6] uapi: Define the aux vector AT_MINSIGSTKSZ Chang S. Bae
2021-03-01 19:09   ` Borislav Petkov
2021-03-10 16:31     ` Bae, Chang Seok
2021-02-27 16:59 ` [PATCH v6 2/6] x86/signal: Introduce helpers to get the maximum signal frame size Chang S. Bae
2021-02-27 16:59 ` [PATCH v6 3/6] x86/elf: Support a new ELF aux vector AT_MINSIGSTKSZ Chang S. Bae
2021-03-05 10:43   ` Borislav Petkov
2021-03-10 16:34     ` Bae, Chang Seok [this message]
2021-03-10 17:43       ` Borislav Petkov
2021-03-10 18:01         ` Bae, Chang Seok
2021-02-27 16:59 ` [PATCH v6 4/6] selftest/sigaltstack: Use the AT_MINSIGSTKSZ aux vector if available Chang S. Bae
2021-02-27 16:59 ` [PATCH v6 5/6] x86/signal: Detect and prevent an alternate signal stack overflow Chang S. Bae
2021-02-27 16:59 ` [PATCH v6 6/6] selftest/x86/signal: Include test cases for validating sigaltstack Chang S. Bae

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=F637CCE0-1744-478C-B2ED-65EA14B07938@intel.com \
    --to=chang.seok.bae@intel.com \
    --cc=Dave.Martin@arm.com \
    --cc=bp@suse.de \
    --cc=carlos@redhat.com \
    --cc=dave.hansen@intel.com \
    --cc=fenghua.yu@intel.com \
    --cc=hjl.tools@gmail.com \
    --cc=jannh@google.com \
    --cc=len.brown@intel.com \
    --cc=libc-alpha@sourceware.org \
    --cc=linux-api@vger.kernel.org \
    --cc=linux-arch@vger.kernel.org \
    --cc=linux-doc@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@kernel.org \
    --cc=mingo@kernel.org \
    --cc=mpe@ellerman.id.au \
    --cc=ravi.v.shankar@intel.com \
    --cc=tglx@linutronix.de \
    --cc=tony.luck@intel.com \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).