[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20180917152415.GA29861@voyager>
Date: Mon, 17 Sep 2018 17:24:15 +0200
From: Markus Wichmann <nullplan@....net>
To: musl@...ts.openwall.com
Subject: Re: Replacing a_crash() ?
On Sun, Sep 16, 2018 at 11:23:17PM -0400, Rich Felker wrote:
> Now that we have an abort() that reliably terminates with uncatchable
> SIGABRT, I've been thinking about replacing the a_crash() calls in
> musl (which are usually an instruction generating SIGILL or SIGSEGV)
> with calls to the uncatchable tail of abort(), which I would factor
> off as a __forced_abort() function.
>
> In case it's not clear, the reason for not just calling abort() is
> that too many programs catch it, and catching it is even encouraged.
> Catchability is a problem with the current approach too, since
> a_crash() is used in places where process state is known to be
> dangerously corrupt and likely under attacker control; eliminating it
> is one of the potential goals of switching to __forced_abort().
>
> Are there any objections to making such a change? So far I've gotten
> mostly positive feedback -- SIGABRT is more telling of what's happened
> than SIGSEGV/SIGILL. It would also get rid of the ugly misplacement of
> a_crash() (no longer needed) in "atomic.h" and the inclusion of
> "atomic.h" in some files where it makes no sense without knowing it's
> where a_crash() is defined.
>
> For i386, some nontrivial work would be needed to make abort's tail
> perform syscalls with int $128 rather than the vdso, which is unsafe
> since the pointer to it may have been subverted. On other archs,
> inline syscalls are fully inline. I'd probably add a
> NEED_FAILSAFE_SYSCALL macro to define before including "syscall.h" and
> have arch/i386/syscall_arch.h adjust the asm string based on it; this
> is more maintainable than writing an asm version of the function.
>
> Rich
Simple checklist for whether to perform a change or not:
1. Does the change fix problems? Check (namely, maintainability,
legibility, understandability of problems).
2. Does the change introduce problems? Unlikely. Someone might subvert
__forced_abort(), but then, someone might catch SIGILL, so we haven't
gone anywhere.
3. Is the change compatible with old programs? No, but a_crash() was
never a defined interface, so any program catching it was walking on
thin ice, anyway.
So that's two green lights and a don't care, so please go ahead.
Ciao,
Markus
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
