mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-13 14:04:05 +08:00
558f9b2f94
GCC assumes that stack is aligned to 16-byte on call sites [1]. Since GCC 8, GCC began using 16-byte aligned SSE instructions to implement assignments to structs on stack. When CC_OPTIMIZE_FOR_PERFORMANCE is enabled, this affects os-Linux/sigio.c, write_sigio_thread: struct pollfds *fds, tmp; tmp = current_poll; Note that struct pollfds is exactly 16 bytes in size. GCC 8+ generates assembly similar to: movdqa (%rdi),%xmm0 movaps %xmm0,-0x50(%rbp) This is an issue, because movaps will #GP if -0x50(%rbp) is not aligned to 16 bytes [2], and how rbp gets assigned to is via glibc clone thread_start, then function prologue, going though execution trace similar to (showing only relevant instructions): sub $0x10,%rsi mov %rcx,0x8(%rsi) mov %rdi,(%rsi) syscall pop %rax pop %rdi callq *%rax push %rbp mov %rsp,%rbp The stack pointer always points to the topmost element on stack, rather then the space right above the topmost. On push, the pointer decrements first before writing to the memory pointed to by it. Therefore, there is no need to have the stack pointer pointer always point to valid memory unless the stack is poped; so the `- sizeof(void *)` in the code is unnecessary. On the other hand, glibc reserves the 16 bytes it needs on stack and pops itself, so by the call instruction the stack pointer is exactly the caller-supplied sp. It then push the 16 bytes of the return address and the saved stack pointer, so the base pointer will be 16-byte aligned if and only if the caller supplied sp is 16-byte aligned. Therefore, the caller must supply a 16-byte aligned pointer, which `stack + UM_KERN_PAGE_SIZE` already satisfies. On a side note, musl is unaffected by this issue because it forces 16 byte alignment via `and $-16,%rsi` in its clone wrapper. Similarly, glibc i386 is also unaffected because it has `andl $0xfffffff0, %ecx`. To reproduce this bug, enable CONFIG_UML_RTC and CC_OPTIMIZE_FOR_PERFORMANCE. uml_rtc will call add_sigio_fd which will then cause write_sigio_thread to either go into segfault loop or panic with "Segfault with no mm". Similarly, signal stacks will be aligned by the host kernel upon signal delivery. `- sizeof(void *)` to sigaltstack is unconventional and extraneous. On a related note, initialization of longjmp buffers do require `- sizeof(void *)`. This is to account for the return address that would have been pushed to the stack at the call site. The reason for uml to respect 16-byte alignment, rather than telling GCC to assume 8-byte alignment like the host kernel since commitd9b0cde91c
("x86-64, gcc: Use -mpreferred-stack-boundary=3 if supported"), is because uml links against libc. There is no reason to assume libc is also compiled with that flag and assumes 8-byte alignment rather than 16-byte. [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=40838 [2] https://c9x.me/x86/html/file_module_x86_id_180.html Signed-off-by: YiFei Zhu <zhuyifei1999@gmail.com> Fixes:1da177e4c3
("Linux-2.6.12-rc2") Reviewed-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: Richard Weinberger <richard@nod.at>
165 lines
3.7 KiB
C
165 lines
3.7 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* Copyright (C) 2002 - 2007 Jeff Dike (jdike@{addtoit,linux.intel}.com)
|
|
*/
|
|
|
|
#include <stdlib.h>
|
|
#include <unistd.h>
|
|
#include <errno.h>
|
|
#include <sched.h>
|
|
#include <linux/limits.h>
|
|
#include <sys/socket.h>
|
|
#include <sys/wait.h>
|
|
#include <kern_util.h>
|
|
#include <os.h>
|
|
#include <um_malloc.h>
|
|
|
|
struct helper_data {
|
|
void (*pre_exec)(void*);
|
|
void *pre_data;
|
|
char **argv;
|
|
int fd;
|
|
char *buf;
|
|
};
|
|
|
|
static int helper_child(void *arg)
|
|
{
|
|
struct helper_data *data = arg;
|
|
char **argv = data->argv;
|
|
int err, ret;
|
|
|
|
if (data->pre_exec != NULL)
|
|
(*data->pre_exec)(data->pre_data);
|
|
err = execvp_noalloc(data->buf, argv[0], argv);
|
|
|
|
/* If the exec succeeds, we don't get here */
|
|
CATCH_EINTR(ret = write(data->fd, &err, sizeof(err)));
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Returns either the pid of the child process we run or -E* on failure. */
|
|
int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv)
|
|
{
|
|
struct helper_data data;
|
|
unsigned long stack, sp;
|
|
int pid, fds[2], ret, n;
|
|
|
|
stack = alloc_stack(0, __cant_sleep());
|
|
if (stack == 0)
|
|
return -ENOMEM;
|
|
|
|
ret = socketpair(AF_UNIX, SOCK_STREAM, 0, fds);
|
|
if (ret < 0) {
|
|
ret = -errno;
|
|
printk(UM_KERN_ERR "run_helper : pipe failed, errno = %d\n",
|
|
errno);
|
|
goto out_free;
|
|
}
|
|
|
|
ret = os_set_exec_close(fds[1]);
|
|
if (ret < 0) {
|
|
printk(UM_KERN_ERR "run_helper : setting FD_CLOEXEC failed, "
|
|
"ret = %d\n", -ret);
|
|
goto out_close;
|
|
}
|
|
|
|
sp = stack + UM_KERN_PAGE_SIZE;
|
|
data.pre_exec = pre_exec;
|
|
data.pre_data = pre_data;
|
|
data.argv = argv;
|
|
data.fd = fds[1];
|
|
data.buf = __cant_sleep() ? uml_kmalloc(PATH_MAX, UM_GFP_ATOMIC) :
|
|
uml_kmalloc(PATH_MAX, UM_GFP_KERNEL);
|
|
pid = clone(helper_child, (void *) sp, CLONE_VM, &data);
|
|
if (pid < 0) {
|
|
ret = -errno;
|
|
printk(UM_KERN_ERR "run_helper : clone failed, errno = %d\n",
|
|
errno);
|
|
goto out_free2;
|
|
}
|
|
|
|
close(fds[1]);
|
|
fds[1] = -1;
|
|
|
|
/*
|
|
* Read the errno value from the child, if the exec failed, or get 0 if
|
|
* the exec succeeded because the pipe fd was set as close-on-exec.
|
|
*/
|
|
n = read(fds[0], &ret, sizeof(ret));
|
|
if (n == 0) {
|
|
ret = pid;
|
|
} else {
|
|
if (n < 0) {
|
|
n = -errno;
|
|
printk(UM_KERN_ERR "run_helper : read on pipe failed, "
|
|
"ret = %d\n", -n);
|
|
ret = n;
|
|
}
|
|
CATCH_EINTR(waitpid(pid, NULL, __WALL));
|
|
}
|
|
|
|
out_free2:
|
|
kfree(data.buf);
|
|
out_close:
|
|
if (fds[1] != -1)
|
|
close(fds[1]);
|
|
close(fds[0]);
|
|
out_free:
|
|
free_stack(stack, 0);
|
|
return ret;
|
|
}
|
|
|
|
int run_helper_thread(int (*proc)(void *), void *arg, unsigned int flags,
|
|
unsigned long *stack_out)
|
|
{
|
|
unsigned long stack, sp;
|
|
int pid, status, err;
|
|
|
|
stack = alloc_stack(0, __cant_sleep());
|
|
if (stack == 0)
|
|
return -ENOMEM;
|
|
|
|
sp = stack + UM_KERN_PAGE_SIZE;
|
|
pid = clone(proc, (void *) sp, flags, arg);
|
|
if (pid < 0) {
|
|
err = -errno;
|
|
printk(UM_KERN_ERR "run_helper_thread : clone failed, "
|
|
"errno = %d\n", errno);
|
|
return err;
|
|
}
|
|
if (stack_out == NULL) {
|
|
CATCH_EINTR(pid = waitpid(pid, &status, __WALL));
|
|
if (pid < 0) {
|
|
err = -errno;
|
|
printk(UM_KERN_ERR "run_helper_thread - wait failed, "
|
|
"errno = %d\n", errno);
|
|
pid = err;
|
|
}
|
|
if (!WIFEXITED(status) || (WEXITSTATUS(status) != 0))
|
|
printk(UM_KERN_ERR "run_helper_thread - thread "
|
|
"returned status 0x%x\n", status);
|
|
free_stack(stack, 0);
|
|
} else
|
|
*stack_out = stack;
|
|
return pid;
|
|
}
|
|
|
|
int helper_wait(int pid)
|
|
{
|
|
int ret, status;
|
|
int wflags = __WALL;
|
|
|
|
CATCH_EINTR(ret = waitpid(pid, &status, wflags));
|
|
if (ret < 0) {
|
|
printk(UM_KERN_ERR "helper_wait : waitpid process %d failed, "
|
|
"errno = %d\n", pid, errno);
|
|
return -errno;
|
|
} else if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) {
|
|
printk(UM_KERN_ERR "helper_wait : process %d exited with "
|
|
"status 0x%x\n", pid, status);
|
|
return -ECHILD;
|
|
} else
|
|
return 0;
|
|
}
|