This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
Re: [PATCH resend] MIPS: Allow FPU emulator to use non-stack area.
- From: Rich Felker <dalias at libc dot org>
- To: David Daney <david dot s dot daney at gmail dot com>
- Cc: David Daney <ddaney at caviumnetworks dot com>, Andy Lutomirski <luto at amacapital dot net>, David Daney <ddaney dot cavm at gmail dot com>, libc-alpha at sourceware dot org, linux-kernel at vger dot kernel dot org, linux-mips at linux-mips dot org, David Daney <david dot daney at cavium dot com>
- Date: Tue, 7 Oct 2014 07:11:02 -0400
- Subject: Re: [PATCH resend] MIPS: Allow FPU emulator to use non-stack area.
- Authentication-results: sourceware.org; auth=none
- References: <5433071B dot 4050606 at caviumnetworks dot com> <20141006213101 dot GA23797 at brightrain dot aerifal dot cx> <54330D79 dot 80102 at caviumnetworks dot com> <20141006215813 dot GB23797 at brightrain dot aerifal dot cx> <543327E7 dot 4020608 at amacapital dot net> <54332A64 dot 5020605 at caviumnetworks dot com> <20141007000514 dot GD23797 at brightrain dot aerifal dot cx> <543334CE dot 8060305 at caviumnetworks dot com> <20141007004915 dot GF23797 at brightrain dot aerifal dot cx> <54337127 dot 40806 at gmail dot com>
On Mon, Oct 06, 2014 at 09:50:47PM -0700, David Daney wrote:
> >>the out-of-line execution trick, but do it somewhere other than in
> >>stack memory.
> >How do you answer Andy Lutomirski's question about what happens when a
> >signal handler interrupts execution while the program counter is
> >pointing at this "out-of-line execution" trampoline? This seems like a
> >show-stopper for using anything other than the stack.
> It would be nice to support, but not doing so would not be a
> regression from current behavior.
It's not just "nice" to support, it's mandatory. Otherwise you will
execute essentially *random instructions* in this case, providing a
very nice attack vector that can almost certainly be elevated to
arbitrary code execution via timing of signals during floating point
code.
The current behavior in regards to this is correct: because you have a
*stack*, each trampoline is pushed onto the stack in its own context,
and popped when it's no longer needed. You can have arbitrarily many
such trampolines up to the stack size. Note that each nested signal
handler already requires sizeof(ucontext_t) in stack space, so these
trampolines are a negligible additional cost without major effects on
the number of signal handlers you can nest without overflowing the
stack.
> >>One way of doing this is to have the kernel magically generate
> >>thread local memory regions.
> >>
> >>Another option is to have userspace manage the out-of-line execution areas.
> >>
> >>As is often the case, each approach has different pluses and minuses.
> >Having the kernel magically do it would be better, but I'm doubtful
> >that solution works anyway due to the above signal handler/nesting
> >issue.
>
> So the perfect is the enemy of the good? No non-executable stack
> for you, MIPS.
No, regressions that make the situation worse than executable-stack
are not "good" to begin with, even if it weren't for the other design
issues and dumping everything on userspace for the sake of being lazy
in the kernel.
Rich