[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 12 Oct 2020 15:37:19 +0100
From: Dave Martin <Dave.Martin@....com>
To: Szabolcs Nagy <szabolcs.nagy@....com>
Cc: libc-alpha@...rceware.org, libc-coord@...ts.openwall.com
Subject: Re: [PATCH] sysconf: Add _SC_MINSIGSTKSZ/_SC_SIGSTKSZ [BZ #20305]
On Mon, Oct 12, 2020 at 03:12:38PM +0100, Szabolcs Nagy via Libc-alpha wrote:
> The 10/12/2020 12:04, Dave Martin wrote:
> > On Mon, Oct 12, 2020 at 08:53:32AM +0100, Szabolcs Nagy via Libc-alpha wrote:
> > > The 10/10/2020 05:19, H.J. Lu via Libc-alpha wrote:
> > > > Add _SC_MINSIGSTKSZ for the minimum signal stack size derived from
> > > > AT_MINSIGSTKSZ, which is the minimum number of bytes of free stack
> > > > space required in order to gurantee successful, non-nested handling
> > > > of a single signal whose handler is an empty function, and _SC_SIGSTKSZ
> > > > which is the suggested minimum number of bytes of stack space required
> > > > for a signal stack.
> > > >
> > > > If AT_MINSIGSTKSZ isn't available, sysconf (_SC_MINSIGSTKSZ) returns
> > > > MINSIGSTKSZ. On Linux/x86 with XSAVE, the signal frame used by kernel
> > > > is composed of the following areas and laid out as:
> > > >
> > > > ------------------------------
> > > > | alignment padding |
> > > > ------------------------------
> > > > | xsave buffer |
> > > > ------------------------------
> > > > | fsave header (32-bit only) |
> > > > ------------------------------
> > > > | siginfo + ucontext |
> > > > ------------------------------
> > > >
> > > > Compute AT_MINSIGSTKSZ value as size of xsave buffer + size of fsave
> > > > header (32-bit only) + size of siginfo and ucontext + alignment padding.
> > > >
> > > > If _SC_SIGSTKSZ_SOURCE is defined, MINSIGSTKSZ and SIGSTKSZ are redefined
> > > > as
> > > >
> > > > /* Default stack size for a signal handler: sysconf (SC_SIGSTKSZ). */
> > > > # undef SIGSTKSZ
> > > > # define SIGSTKSZ sysconf (_SC_SIGSTKSZ)
> > > >
> > > > /* Minimum stack size for a signal handler: SIGSTKSZ. */
> > > > # undef MINSIGSTKSZ
> > > > # define MINSIGSTKSZ SIGSTKSZ
> > > >
> > > > Compilation will fail if the source assumes constant MINSIGSTKSZ or
> > > > SIGSTKSZ.
> > > >
> > > > The reason for not simply increasing the kernel's MINSIGSTKSZ #define
> > > > (apart from the fact that it is rarely used, due to glibc's shadowing
> > > > definitions) was that userspace binaries will have baked in the old
> > > > value of the constant and may be making assumptions about it.
> > > >
> > > > For example, the type (char [MINSIGSTKSZ]) changes if this #define
> > > > changes. This could be a problem if an newly built library tries to
> > > > memcpy() or dump such an object defined by and old binary.
> > > > Bounds-checking and the stack sizes passed to things like sigaltstack()
> > > > and makecontext() could similarly go wrong.
> > >
> > >
> > > this looks reasonable to me.
> > >
> > > i added libc-coord on cc as it seems to be
> > > a useful generic api across targets.
> > >
>
> > >
> > > /* Return MAX (MINSIGSTKSZ, sysconf (_SC_MINSIGSTKSZ)) * 4. */
> > > this can be excessive for sigstksz,
> > > but reasonable on glibc given the
> > > overhead of libc internal signals
> > > and lazy binding.
> >
> > Interesting points. Can we put actual numbers on those?
> >
> > Code that tries to allocate correctly sized stacks would need this
> > information.
>
> that's not easy in general (and the user would
> also need to know the stack use of libc calls).
>
> i think libc internal sigframe and lazy binding
> are both roughly MINSIGSTKSZ (because they are
> dominated by the register state that has to be
> saved), i actually don't know if libc internal
> signals go to the user registered sigaltstack
> or not (if not then that's not an issue here,
> but still an issue for PTHREAD_STACK_MIN).
That seems a reasonable argument.
I think there could be some flexibility here in practice, since there
are often a lot of non-live registers when entring the lazy binding code.
For SVE, we know for example that all the SVE regs (apart from the low
bits of V8-V15 IIRC) are non-live, unless the function call conforms to
the SVE ABI -- the latter can be known at compile-time, so in theory
there could be separate lazy binding stubs for the two cases so that
much of the SVE register save/restore can be skipped when not needed.
For signal frames though, we don't know what code will run once we get
into the handler, so we have to plan for the worst case.
> (if libc internal signals could somehow always
> go to a libc internal sigaltstack that would be
> best probably, but there is no api for that)
Hmmm, true.
>
>
> > > does this decrease the size on any
> > > existing target?
> >
> > To avoid unpleasant surprises, I think we should explicitly clamp both
> > parameters to be no less than the value of the legacy #define. Then
> > the answer becomes "no" by construction. Allowing them to be smaller
> > will likely save little memory, so it's probably not worth the risk it.
> >
> > (The same rule doesn't apply to AT_MINSIGSTKSZ though, since that's a
> > new invention, and purely a property of the kernel. We yield the "true"
> > kernel value there, which can be less then MINSIGSTKSZ.)
>
> note that there is a posix conformance requirement
> on sigaltstack:
>
> The sigaltstack() function shall fail if:
>
> [ENOMEM]
> The size of the alternate stack area is less than MINSIGSTKSZ.
>
>
> if there are multiple different views on what
> MINSIGSTKSZ is then it's not clear what this
> requirement is about. i think glibc does not
> do any checks and leaves it to the kernel, but
> that may not be right if there is different
> MINSIGSTKSZ in userspace. and if libc tries to
> enforce a larger MINSIGSTKSZ than linux then
> using AT_MINSIGSTKSZ may unexpectedly fail.
>
> it is probably best not to enforce the failure
> in userspace for now, but that does not seem
> conforming.
I'd say the "obvious" intention here is to avoid people blindly
registering stacks that are too small. But unless the handler really
does nothing, MINSIGSTKSZ is likely to be insufficient anyway. This
rule gives LTP something to do, but I'm less than convinced it's
useful (or even harmless).
So I'd hope that we could assert that MINSIGSTKSZ is not always the
correct value here. A successful sigaltstack() doesn't mean the
stack is big enough, and an ENOMEM error from sigaltstack() has never
meant that the stack is too small (since MINSIGSTKSZ is rounded up on
most arches).
For arm64 we have an explicit opt-in for monster signal frames, so
we could apply a larger threshold in that case. In the interest of
compatibility we don't do this at present so, yes, you can register a
signal stack that is definitely too small today.
x86 has no explicit opt-in, so it might be tricker to raise the
threshold there.
Cheers
---Dave
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
