linux-kernel - Re: sigaction's ucontext_t with incorrect stack reference when SA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1169530677.2995.8.camel@entropy>
Date:	Mon, 22 Jan 2007 21:37:57 -0800
From:	Nicholas Miell <nmiell@...cast.net>
To:	Xavier Roche <roche+kml2@...lead.com>
Cc:	Linux Kernel <linux-kernel@...r.kernel.org>
Subject: Re: sigaction's ucontext_t with incorrect stack reference when
	SA_SIGINFO is being used ?

On Mon, 2007-01-22 at 09:57 +0100, Xavier Roche wrote:
> Hi folks,
> 
> I have a probably louzy question regarding sigaction() behaviour when an
> alternate signal stack is used: it seems that I can not get the user
> stack reference in the ucontext_t stack context ; ie. the uc_stack
> member contains reference of the alternate signal stack, not the stack
> that was used before the crash.
> 
> Is this is a normal behaviour ? Is there a way to retrieve the original
> user's stack inside the signal callback ?
> 
> The example given below demonstrates the issue:
> top of stack==0x7fffff3d7000, alternative_stack==0x501010
> SEGV==0x7fffff3d6ff8; sp==0x501010; current stack is the alternate stack
> 
> It is obvious that the SEGV was a stack overflow: the si_addr address is
> just on the page below the stack limit.

POSIX says:
"the third argument can be cast to a pointer to an object of type
ucontext_t to refer to the receiving thread's context that was
interrupted when the signal was delivered."

so if uc_stack doesn't point to the stack in use immediately prior to
signal generation, this is a bug.

(In theory I should be able to pass the ucontext_t supplied to the
signal handler to setcontext() and resume execution exactly where I left
off -- glibc's refusal to support kernel-generated ucontexts gets in the
way of this, but the point still stands.)

I have no idea who to bother about i386 signal delivery, though. (And I
suspect this bug has probably been copied to other architectures as
well.)

-- 
Nicholas Miell <nmiell@...cast.net>

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/