lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 13 May 2020 22:51:53 -0400 (EDT)
From:   Mathieu Desnoyers <>
To:     Thomas Gleixner <>
Cc:     rostedt <>,
        linux-kernel <>,
        x86 <>, paulmck <>,
        Andy Lutomirski <>,
        Alexandre Chartre <>,
        Frederic Weisbecker <>,
        Paolo Bonzini <>,
        Sean Christopherson <>,
        Masami Hiramatsu <>,
        Petr Mladek <>,
        "Joel Fernandes, Google" <>,
        Boris Ostrovsky <>,
        Juergen Gross <>,
        Brian Gerst <>,
        Josh Poimboeuf <>,
        Will Deacon <>,
        Peter Zijlstra <>
Subject: Re: [patch V4 part 1 05/36] x86/entry: Flip _TIF_SIGPENDING and

----- On May 13, 2020, at 8:12 PM, Thomas Gleixner wrote:
>>> Mathieu Desnoyers <> wrote:
>>> Also, color me confused: is "do_signal()" actually running any user-space,
>>> or just setting up the user-space stack for eventual return to signal
>>> handler ?
> I'm surprised that you can't answer that question yourself. How did you
> ever make rseq work and how did rseq_signal_deliver() end up in
> setup_rt_frame()?
> Hint: Tracing might answer that question
> And to cut it short:
>    Exit to user space happnes only through ONE channel, i.e. leaving
>    prepare_exit_to usermode().


Yes, I'm very well aware of this. But the patch commit message states:

"Make sure task_work runs before any kind of userspace -- very much
including signals -- is invoked."

which seems to imply that "userspace" can be "invoked" before the task_work
runs. Which makes no sense whatsoever. Hence my confused state.

>>> Also, it might be OK, but we're changing the order of two things which
>>> have effects on each other: restartable sequences abort fixup for preemption
>>> and do_signal(), which also have effects on rseq abort.
>>> Because those two will cause the abort to trigger, I suspect changing
>>> the order might be OK, but we really need to think this through.
> That's a purely academic problem. The order is completely
> irrelevant. You have to handle any order anyway:

Yes indeed, whether either a signal handler frame fixup or return IP
fixup fires first (clearing the rseq_cs pointer in the process) is
irrelevant, because they will have the effect on the user-space program's
flow. And as you say, given it is run in a loop and can be preempted,
any order can happen here, so we have to be prepared for it. This loop
has caused me tons of headaches when stress-testing on NUMA machines by
the way.

> That said, even for the case Andy and Peter were looking at (MCE) the
> ordering is completely irrelevant.

Not sure about that, see Andy's follow up.



Mathieu Desnoyers
EfficiOS Inc.

Powered by blists - more mailing lists