linux-kernel - Re: Test 73 Sig

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACT4Y+YVyJcqbR5j2fsSQ+C5hy78X+aobrUHaZKghFf0_NMv=A@mail.gmail.com>
Date:   Tue, 1 Feb 2022 11:03:59 +0100
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     john.garry@...wei.com, will@...nel.org
Cc:     acme@...nel.org, elver@...gle.com, gor@...ux.ibm.com,
        hca@...ux.ibm.com, leo.yan@...aro.org,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        linux-perf-users@...r.kernel.org, mark.rutland@....com,
        sumanthk@...ux.ibm.com, svens@...ux.ibm.com, tmricht@...ux.ibm.com
Subject: Re: Test 73 Sig_trap fails on arm64

On Mon, 31 Jan 2022 at 18:55, Dmitry Vyukov <dvyukov@...gle.com> wrote:
>
> > On 18/01/2022 12:43, Leo Yan wrote:
> >
> > Hi Will,
> >
> > Can you kindly check below the question from Leo on this issue?
> >
> > You were cc'ed earlier in this thread so should be able to find more
> > context, if needed.
>
> Hi Will, John,
>
> I wonder if PSTATE.D flag can be used to resolve this
> (similar to x86's use of EFLAGS.RF)?
> I naively tried to do:
>
> void OnSigtrap(int sig, siginfo_t* info, void* uctx) {
>   auto& mctx = static_cast<ucontext_t*>(uctx)->uc_mcontext;
>   mctx.pstate |= PSR_D_BIT;
> }
>
> But then I got a SIGSEGV from kernel.
> But I wasn't able to track yet what part of the kernel did
> not like setting of D bit.

I did a naive attempt of moving enabling of single-stepping from
watchpoint_handler() to rt_sigreturn(), so that we step over the
intended trapping instruction rather than first instruction of the
signal handler:
https://github.com/dvyukov/linux/commit/dfd6903d9c6538e3ad792c1df6ffbcce2072b12b
(the patch is just a prototype, wrong in lots of ways)

This almost worked:
 - we correctly did not enable single-stepping for the signal handler
 - rt_sigreturn correctly detected this case and enabled
single-stepping after restoring the original pr_regs

However, after re_sigreturn I got a call to single_step_handler() with
pt_regs pointing to the first instruction of the signal handler again.
I can't explain this, I am not sure how/where the signal handler PC
got into the picture again... we should have got single_step_handler()
with pt_regs pointing to the original trapping instruction (the next
instruction to be precise).





> > > On Tue, Jan 18, 2022 at 12:40:04PM +0100, Marco Elver wrote:
> > >
> > > [...]
> > >
> > >>> Both Arm and Arm64 platforms cannot support signal handler with
> > >>> breakpoint, please see the details in [1].  So I think we need
> > >>> something like below:
> > >>>
> > >>> static int test__sigtrap(struct test_suite *test __maybe_unused, int subtest __maybe_unused)
> > >>> {
> > >>>          ...
> > >>>
> > >>>          if (!BP_SIGNAL_IS_SUPPORTED) {
> > >>>                  pr_debug("Test not supported on this architecture");
> > >>>                  return TEST_SKIP;
> > >>>          }
> > >>>
> > >>>          ...
> > >>> }
> > >>>
> > >>> Since we have defined BP_SIGNAL_IS_SUPPORTED, I think we can reuse it at
> > >>> here.
> > >>>
> > >>> [1]https://lore.kernel.org/lkml/157169993406.29376.12473771029179755767.tip-bot2@tip-bot2/
> > >> Does this limitation also exist for address watchpoints? The sigtrap
> > >> test does not make use of instruction breakpoints, but instead just
> > >> sets up a watchpoint on access to a data address.
> > > Yes, after reading the code, the flow for either instrution breakpoint
> > > or watchpoint both use the single step [1], thus the signal handler will
> > > take the single step execution and lead to the infinite loop.
> > >
> > > I am not the best person to answer this question; @Will, could you
> > > confirm for this?  Thanks!
> > >
> > > Leo
> > >
> > > [1]https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/arm64/kernel/hw_breakpoint.c