linux-kernel - Re: [musl] Re: [RFC PATCH] x86/vdso/32: Add AT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160312170040.GA1108@gmail.com>
Date:	Sat, 12 Mar 2016 18:00:40 +0100
From:	Ingo Molnar <mingo@...nel.org>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Rich Felker <dalias@...c.org>, Andy Lutomirski <luto@...nel.org>,
	the arch/x86 maintainers <x86@...nel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Borislav Petkov <bp@...en8.de>,
	"musl@...ts.openwall.com" <musl@...ts.openwall.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>
Subject: Re: [musl] Re: [RFC PATCH] x86/vdso/32: Add AT_SYSINFO cancellation
 helpers

* Linus Torvalds <torvalds@...ux-foundation.org> wrote:

> [...]
> 
> Because if that's the case, I wonder if what you really want is not "sticky 
> signals" as much as "synchronous signals" - ie the ability to say that a signal 
> shouldn't ever interrupt in random places, but only at well-defined points 
> (where a system call would be one such point - are there others?)

Yes, I had similar 'deferred signal delivery' thoughts after having written up the 
sticky signals approach, I just couldn't map all details of the semantics: see the 
'internal libc functions' problem below.

If we can do this approach then there's another advantage as well: this way the C 
library does not even have to poll for cancellation at syscall boundaries: i.e. 
the regular system call fast path gets faster by 2-3 instructions as well.

> So then you could make "pthread_setcanceltype()" just set that flag for the 
> cancellation signal, and just know that the signal itself will always be 
> deferred to such a synchronous point (ie system call entry).
>
> We already have the ability to catch things at system call entry (ptrace needs 
> it, for example), so we could possibly make our signal delivery have a mode 
> where a signal does *not* cause user space execution to be interrupted by a 
> signal handler, but instead just sets a bit in the thread info state that then 
> causes the next system call to take the signal.

Yes, so this would need a bit of work, to handle the problem mentioned by Rich 
Felker: "internal" libc APIs (such as name server lookups) may consist of a series 
of complex system calls - some of which might be blocking. It should still be 
possible to execute such 'internal' system calls undisturbed, even if a 'deferred' 
signal is sent.

One workable solution I think would be to prepare the internal functions for 
eventual interruption by the cancellation signal. They have to be restartable 
anyway, because the application can send other signals. As long as the 
interruption is only transient it should be fine.

And note that this approach would also be pretty fast on the libc side: none of 
the 'fast' cancellation APIs would have to do anything complex like per call 
signal blocking/unblocking or other complex signal operations. They would just 
activate a straightforward new SA_ flag and rely on its semantics.

Thanks,

	Ingo