linux-kernel - Re: [musl] Re: [RFC PATCH] x86/vdso/32: Add AT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160311113914.GD29662@port70.net>
Date:	Fri, 11 Mar 2016 12:39:15 +0100
From:	Szabolcs Nagy <nsz@...t70.net>
To:	Ingo Molnar <mingo@...nel.org>
Cc:	Rich Felker <dalias@...c.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Andy Lutomirski <luto@...nel.org>,
	the arch/x86 maintainers <x86@...nel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Borislav Petkov <bp@...en8.de>,
	"musl@...ts.openwall.com" <musl@...ts.openwall.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>
Subject: Re: [musl] Re: [RFC PATCH] x86/vdso/32: Add AT_SYSINFO cancellation
 helpers

* Ingo Molnar <mingo@...nel.org> [2016-03-11 10:33:47 +0100]:
> * Rich Felker <dalias@...c.org> wrote:
> 
> > No, it doesn't work. Cancellability of the target thread at the time
> > of the cancellation request (when you would decide whether or not to
> > send the signal) has no relation to cancellability at the time of
> > calling the cancellation point. Consider 2 threads A and B and the
> > following sequence of events:
> > 
> > 1. A has cancellation enabled
> > 2. B calls pthread_cancel(A) and sets sticky pending signal
> > 3. A disables cancellation
> > 4. A calls cancellation point and syscall wrongly gets interrupted
> 
> As I (tried to!) describe it when describing the cancellation signal, if a 
> cancellation signal is in flight, it must be waited for in the unlikely event of 
> cancellation being disabled in the small window where the signal is sent.
> 
> So in your above example, it would do:
> 
> > 1. A has cancellation enabled
> > 2. B calls pthread_cancel(A) and sets sticky pending signal

blocking signals here is ok.

> > 3. A disables cancellation

blocking signals here is not ok. (libc changes cancelstate at
many places, there should be no syscall in that path.)

>   3b. Notices that cancellation request is pending and waits for it
>       and clears the sticky signal.

setcancelstate can be reentered between 'noticing' and 'waiting'
if interrupted by a signal.

the state change from expect-pending-signal to no-pending-signal
cannot be atomic wrt sigwaitinfo unless signals are blocked.

what i didnt think about yesterday is that it is ok and possible
to only block signals if there was a cancel.  (it is not trivial
since all the cancel related state changes have to be atomic and
there are at least canceled, signaled, cancelstate and canceltype,
which have to fit into 32bits and managed together.)

>   4. A calls cancellation point and syscall correctly executes
>   5. Once A enables cancellation again, the cancellation propagates.
> 
> So I still see no problem.
> 

i think the sticky signal design would work, but more
complex than what we have and adds some atomic rmw ops
into common code paths and not backward compatible.

not using vsyscalls for cancellation-points sounds easier.

> > This can be solved with more synchronization in pthread_cancel and 
> > pthread_setcancelstate, but it seems costly. [...]
> 
> An active signal round trip in itself is very costly (thousands of cycles), a 
> thread exit is tens of thousands of cycles, and this is a 'slow path' anyway, and 
> the window is small in any case.
> 
> It's just a correctness synchronization to make sure no sticky signal is pending, 
> not a real performance concern in practice.
> 
> Thanks,
> 
> 	Ingo