[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20240831150241.GP10433@brightrain.aerifal.cx>
Date: Sat, 31 Aug 2024 11:02:42 -0400
From: Rich Felker <dalias@...c.org>
To: Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
linux-api@...r.kernel.org, libc-alpha@...rceware.org,
musl@...ts.openwall.com
Subject: Re: AT_MINSIGSTKSZ mismatched interpretation kernel vs libc
On Sat, Aug 31, 2024 at 11:29:02AM +0200, Szabolcs Nagy wrote:
> * Rich Felker <dalias@...c.org> [2024-08-29 16:54:38 -0400]:
> > As I understand it, the AT_MINSIGSTKSZ auxv value is supposed to be a
> > suitable runtime value for MINSIGSTKSZ (sysconf(_SC_MINSIGSTKSZ)),
> > such that it's safe to pass as a size to sigaltstack. However, this is
> > not how the kernel actually implements it. At least on x86 and
> > powerpc, the kernel fills it via get_sigframe_size, which computes the
> > size of the sigcontext/siginfo/etc to be pushed and uses that
> > directly, without allowing any space for actual execution, and without
> > ensuring the value is at least as large as the legacy constant
> > MINSIGSTKSZ. This leads to two problems:
> >
> > 1. If userspace uses the value without clamping it not-below
> > MINSIGSTKSZ, sigaltstack will fail with ENOMEM.
> >
> > 2. If the kernel needs more space than MINSIGSTKSZ just for the signal
> > frame structures, userspace that trusts AT_MINSIGSTKSZ will only
> > allocate enough for the frame, and the program will immediately
> > crash/stack-overflow once execution passes to userspace.
> >
> > Since existing kernels in the wild can't be fixed, and since it looks
> > like the problem is just that the kernel chose a poor definition of
> > AT_MINSIGSTKSZ, I think userspace (glibc, musl, etc.) need to work
> > around the problem, adding a per-arch correction term to
> > AT_MINSIGSTKSZ that's basically equal to:
> >
> > legacy_MINSIGSTKSZ - AT_MINSIGSTKSZ as returned on legacy hw
> >
> > such that adding the correction term would reproduce the expected
> > value MINSIGSTKSZ.
> >
> > The only question is whether the kernel will commit to keeping this
> > behavior, or whether it would be "fixed" to include all the needed
> > working space when they eventually decide they want bigger stacks for
> > some new register file bloat. I think keeping the current behavior, so
> > we can just add a fixed offset, is probably the best thing to do.
>
> i think it makes sense that the kernel sets AT_MINSIGSTKSZ
> according to what the kernel needs (signal frame size)
> anything beyond that is up to userspace requirements (e.g.
> the kernel cannot know if the libc wraps signal handlers)
>
> it's up to the libc to adjust sysconf(_SC_MINSIGSTKSZ)
> according to posix or backward compat requirements.
I think this is a reasonable viea and means the aux key was just very
poorly named. It should have been called something like
AT_SIGFRAMESIZE to indicate to the userspace-side consumer that it's
not a suitable value for MINSIGSTKSZ, only a contributing term for it.
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
