mirrors/cosmopolitan
1
0
Fork 0
mirror of https://github.com/jart/cosmopolitan.git synced 2025-06-05 04:02:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Improve memory manager and signal handling

Browse source 
On Windows, mmap() now chooses addresses transactionally. It reduces the
risk of badness when interacting with the WIN32 memory manager. We don't
throw darts anymore. There is also no more retry limit, since we recover
from mystery maps more gracefully. The subroutine for combining adjacent
maps has been rewritten for clarity. The print maps subroutine is better

This change goes to great lengths to perfect the stack overflow code. On
Windows you can now longjmp() out of a crash signal handler. Guard pages
previously weren't being restored properly by the signal handler. That's
fixed, so on Windows you can now handle a stack overflow multiple times.
Great thought has been put into selecting the perfect SIGSTKSZ constants
so you can save sigaltstack() memory. You can now use kprintf() with 512
bytes of stack available. The guard pages beneath the main stack are now
recorded in the memory manager.

This change fixes getcontext() so it works right with the %rax register.
This commit is contained in:
Justine Tunney 2024-12-27 01:03:11 -08:00
parent 36e5861b0c
commit 379cd77078
No known key found for this signature in database
GPG key ID: BE714B4575D6E328
48 changed files with 834 additions and 570 deletions
Download patch file Download diff file Expand all files Collapse all files

2
test/libc/calls/getcontext_test.c
View file

@ -18,6 +18,7 @@
╚─────────────────────────────────────────────────────────────────────────────*/
#include "libc/calls/calls.h"
#include "libc/calls/struct/sigset.h"
#include "libc/calls/struct/ucontext.internal.h"
#include "libc/calls/ucontext.h"
#include "libc/runtime/runtime.h"
#include "libc/sysv/consts/sig.h"
@ -60,6 +61,7 @@ TEST(getcontext, canReadAndWriteSignalMask) {
ASSERT_EQ(0, getcontext(&context));
if (!n) {
n = 1;
context.uc_mcontext.RES0 = 0;
ASSERT_TRUE(sigismember(&context.uc_sigmask, SIGUSR1));
sigaddset(&context.uc_sigmask, SIGUSR2);
setcontext(&context);

7
test/libc/calls/sigaction_test.c
View file

@ -400,15 +400,16 @@ TEST(sigaction, ignoreSigSegv_notPossible) {
_Exit(pSegfault(0));
TERMS(SIGSEGV);
}
#endif
#if 0
// TODO(jart): Use sigsuspend() to make not flaky.
TEST(sigaction, killSigSegv_canBeIgnored) {
int child, ws;
if (IsWindows()) return; // TODO
sighandler_t old = signal(SIGSEGV, SIG_IGN);
ASSERT_NE(-1, (child = fork()));
while (!child) {
while (!child)
pause();
}
ASSERT_SYS(0, 0, kill(child, SIGSEGV));
EXPECT_SYS(0, 0, kill(child, SIGTERM));
EXPECT_SYS(0, child, wait(&ws));

13
test/libc/calls/sigaltstack_test.c
View file

@ -19,6 +19,9 @@
#include "libc/calls/struct/sigaltstack.h"
#include "libc/calls/calls.h"
#include "libc/errno.h"
#include "libc/mem/gc.h"
#include "libc/mem/mem.h"
#include "libc/runtime/sysconf.h"
#include "libc/sysv/consts/ss.h"
#include "libc/testlib/testlib.h"
@ -38,3 +41,13 @@ TEST(sigaltstack, disable) {
EXPECT_SYS(0, 0, sigaltstack(0, &ss));
EXPECT_EQ(SS_DISABLE, ss.ss_flags);
}
TEST(sigaltstack, size_requirement) {
struct sigaltstack ss;
EXPECT_SYS(0, 0, sigaltstack(0, &ss));
ss.ss_size = sysconf(_SC_MINSIGSTKSZ);
ss.ss_sp = gc(malloc(ss.ss_size));
ss.ss_flags = 0;
ASSERT_SYS(0, 0, sigaltstack(&ss, 0));
ASSERT_SYS(0, 0, sigaltstack(0, &ss));
}

62
test/libc/calls/stackoverflow1_test.c
View file

@ -16,10 +16,14 @@
│ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR │
│ PERFORMANCE OF THIS SOFTWARE. │
╚─────────────────────────────────────────────────────────────────────────────*/
#include "libc/assert.h"
#include "libc/atomic.h"
#include "libc/calls/struct/rlimit.h"
#include "libc/calls/struct/sigaction.h"
#include "libc/calls/struct/sigaltstack.h"
#include "libc/calls/struct/siginfo.h"
#include "libc/calls/struct/ucontext.internal.h"
#include "libc/calls/ucontext.h"
#include "libc/dce.h"
#include "libc/intrin/kprintf.h"
#include "libc/limits.h"
@ -27,12 +31,15 @@
#include "libc/mem/mem.h"
#include "libc/runtime/runtime.h"
#include "libc/runtime/sysconf.h"
#include "libc/stdio/rand.h"
#include "libc/stdio/stdio.h"
#include "libc/stdio/sysparam.h"
#include "libc/sysv/consts/map.h"
#include "libc/sysv/consts/prot.h"
#include "libc/sysv/consts/rlimit.h"
#include "libc/sysv/consts/sa.h"
#include "libc/sysv/consts/sig.h"
#include "libc/sysv/consts/ss.h"
#include "libc/testlib/testlib.h"
#include "libc/thread/thread.h"
/**
@ -42,15 +49,17 @@
*/
jmp_buf recover;
volatile bool smashed_stack;
atomic_bool g_isdone;
atomic_bool smashed_stack;
void CrashHandler(int sig, siginfo_t *si, void *ctx) {
struct sigaltstack ss;
ASSERT_SYS(0, 0, sigaltstack(0, &ss));
ASSERT_EQ(SS_ONSTACK, ss.ss_flags);
kprintf("kprintf avoids overflowing %G %p\n", si->si_signo, si->si_addr);
unassert(!sigaltstack(0, &ss));
unassert(SS_ONSTACK == ss.ss_flags);
kprintf("kprintf avoids overflowing %G si_addr=%lx sp=%lx\n", si->si_signo,
si->si_addr, ((ucontext_t *)ctx)->uc_mcontext.SP);
smashed_stack = true;
ASSERT_TRUE(__is_stack_overflow(si, ctx));
unassert(__is_stack_overflow(si, ctx));
longjmp(recover, 123);
}
@ -63,7 +72,7 @@ void SetUp(void) {
struct rlimit rl;
getrlimit(RLIMIT_STACK, &rl);
rl.rlim_cur = MIN(rl.rlim_cur, 2 * 1024 * 1024);
ASSERT_SYS(0, 0, setrlimit(RLIMIT_STACK, &rl));
unassert(!setrlimit(RLIMIT_STACK, &rl));
}
// set up the signal handler and alternative stack
@ -72,7 +81,7 @@ void SetUp(void) {
ss.ss_flags = 0;
ss.ss_size = sysconf(_SC_MINSIGSTKSZ) + 8192;
ss.ss_sp = _mapanon(ss.ss_size);
ASSERT_SYS(0, 0, sigaltstack(&ss, 0));
unassert(!sigaltstack(&ss, 0));
sa.sa_flags = SA_SIGINFO | SA_ONSTACK; // <-- important
sigemptyset(&sa.sa_mask);
sa.sa_sigaction = CrashHandler;
@ -89,20 +98,39 @@ int StackOverflow(int d) {
return 0;
}
TEST(stackoverflow, standardStack_altStack_process_longjmp) {
void *innocent_thread(void *arg) {
atomic_long dont_clobber_me_bro = 0;
while (!g_isdone)
unassert(!dont_clobber_me_bro);
return 0;
}
int main() {
// libc/intrin/stack.c is designed so that this thread's stack should
// be allocated right beneath the main thread's stack. our goal is to
// make sure overflowing the main stack won't clobber our poor thread
pthread_t th;
unassert(!pthread_create(&th, 0, innocent_thread, 0));
SetUp();
int jumpcode;
if (!(jumpcode = setjmp(recover))) {
exit(StackOverflow(0));
}
ASSERT_EQ(123, jumpcode);
ASSERT_TRUE(smashed_stack);
if (!(jumpcode = setjmp(recover)))
exit(StackOverflow(1));
unassert(123 == jumpcode);
unassert(smashed_stack);
// join the thread
g_isdone = true;
unassert(!pthread_join(th, 0));
// here's where longjmp() gets us into trouble
struct sigaltstack ss;
ASSERT_SYS(0, 0, sigaltstack(0, &ss));
unassert(!sigaltstack(0, &ss));
if (IsXnu() || IsNetbsd()) {
ASSERT_EQ(SS_ONSTACK, ss.ss_flags); // wut
unassert(SS_ONSTACK == ss.ss_flags); // wut
} else {
ASSERT_EQ(0, ss.ss_flags);
unassert(0 == ss.ss_flags);
}
}

70
test/libc/calls/stackoverflow2_test.c
View file

@ -16,20 +16,26 @@
│ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR │
│ PERFORMANCE OF THIS SOFTWARE. │
╚─────────────────────────────────────────────────────────────────────────────*/
#include "libc/assert.h"
#include "libc/calls/struct/sigaction.h"
#include "libc/calls/struct/sigaltstack.h"
#include "libc/calls/struct/siginfo.h"
#include "libc/calls/struct/ucontext.internal.h"
#include "libc/calls/ucontext.h"
#include "libc/cosmo.h"
#include "libc/dce.h"
#include "libc/intrin/kprintf.h"
#include "libc/intrin/maps.h"
#include "libc/limits.h"
#include "libc/mem/gc.h"
#include "libc/mem/mem.h"
#include "libc/runtime/runtime.h"
#include "libc/runtime/stack.h"
#include "libc/runtime/sysconf.h"
#include "libc/stdio/stdio.h"
#include "libc/sysv/consts/sa.h"
#include "libc/sysv/consts/sig.h"
#include "libc/sysv/consts/ss.h"
#include "libc/testlib/testlib.h"
#include "libc/thread/thread.h"
/**
@ -38,17 +44,20 @@
* simple but it can upset kernels / libraries
*/
jmp_buf recover;
volatile bool smashed_stack;
sigjmp_buf recover;
atomic_bool is_done;
atomic_bool smashed_stack;
atomic_bool clobbered_other_thread;
void CrashHandler(int sig, siginfo_t *si, void *ctx) {
struct sigaltstack ss;
ASSERT_SYS(0, 0, sigaltstack(0, &ss));
ASSERT_EQ(SS_ONSTACK, ss.ss_flags);
kprintf("kprintf avoids overflowing %G %p\n", si->si_signo, si->si_addr);
unassert(!sigaltstack(0, &ss));
unassert(SS_ONSTACK == ss.ss_flags);
kprintf("kprintf avoids overflowing %G si_addr=%lx sp=%lx\n", si->si_signo,
si->si_addr, ((ucontext_t *)ctx)->uc_mcontext.SP);
smashed_stack = true;
ASSERT_TRUE(__is_stack_overflow(si, ctx));
longjmp(recover, 123);
unassert(__is_stack_overflow(si, ctx));
siglongjmp(recover, 123);
}
int StackOverflow(int d) {
@ -65,40 +74,51 @@ void *MyPosixThread(void *arg) {
struct sigaction sa, o1, o2;
struct sigaltstack ss;
ss.ss_flags = 0;
ss.ss_size = sysconf(_SC_MINSIGSTKSZ) + 4096;
ss.ss_size = sysconf(_SC_MINSIGSTKSZ) + 2048;
ss.ss_sp = gc(malloc(ss.ss_size));
ASSERT_SYS(0, 0, sigaltstack(&ss, 0));
unassert(!sigaltstack(&ss, 0));
sa.sa_flags = SA_SIGINFO | SA_ONSTACK; // <-- important
sigemptyset(&sa.sa_mask);
sa.sa_sigaction = CrashHandler;
sigaction(SIGBUS, &sa, &o1);
sigaction(SIGSEGV, &sa, &o2);
if (!(jumpcode = setjmp(recover))) {
exit(StackOverflow(0));
}
ASSERT_EQ(123, jumpcode);
if (!(jumpcode = sigsetjmp(recover, 1)))
exit(StackOverflow(1));
unassert(123 == jumpcode);
sigaction(SIGSEGV, &o2, 0);
sigaction(SIGBUS, &o1, 0);
// here's where longjmp() gets us into trouble
ASSERT_SYS(0, 0, sigaltstack(0, &ss));
unassert(!sigaltstack(0, &ss));
if (IsXnu() || IsNetbsd()) {
ASSERT_EQ(SS_ONSTACK, ss.ss_flags); // wut
unassert(SS_ONSTACK == ss.ss_flags); // wut
} else {
ASSERT_EQ(0, ss.ss_flags);
unassert(!ss.ss_flags);
}
return 0;
}
TEST(stackoverflow, standardStack_altStack_thread_longjmp) {
pthread_t th;
void *InnocentThread(void *arg) {
atomic_long dont_clobber_me_bro = 0;
while (!is_done)
if (dont_clobber_me_bro)
clobbered_other_thread = true;
pthread_exit(0);
}
int main() {
pthread_t th, in;
struct sigaltstack ss;
for (int i = 0; i < 2; ++i) {
is_done = false;
smashed_stack = false;
pthread_create(&th, 0, MyPosixThread, 0);
pthread_join(th, 0);
ASSERT_TRUE(smashed_stack);
// this should be SS_DISABLE but ShowCrashReports() creates an alt stack
ASSERT_SYS(0, 0, sigaltstack(0, &ss));
ASSERT_EQ(0, ss.ss_flags);
unassert(!pthread_create(&th, 0, MyPosixThread, 0));
unassert(!pthread_create(&in, 0, InnocentThread, 0));
unassert(!pthread_join(th, 0));
unassert(smashed_stack);
unassert(!sigaltstack(0, &ss));
unassert(ss.ss_flags == SS_DISABLE);
unassert(!clobbered_other_thread);
is_done = true;
unassert(!pthread_join(in, 0));
}
}

4
test/libc/calls/stackoverflow3_test.c
View file

@ -98,7 +98,7 @@ void *MyPosixThread(void *arg) {
struct sigaction sa;
struct sigaltstack ss;
ss.ss_flags = 0;
ss.ss_size = sysconf(_SC_MINSIGSTKSZ) + 4096;
ss.ss_size = sysconf(_SC_MINSIGSTKSZ) + 8192;
ss.ss_sp = gc(malloc(ss.ss_size));
ASSERT_SYS(0, 0, sigaltstack(&ss, 0));
sa.sa_flags = SA_SIGINFO | SA_ONSTACK; // <-- important
@ -106,7 +106,7 @@ void *MyPosixThread(void *arg) {
sa.sa_sigaction = CrashHandler;
sigaction(SIGBUS, &sa, 0);
sigaction(SIGSEGV, &sa, 0);
exit(StackOverflow(0));
exit(StackOverflow(1));
return 0;
}

4
test/libc/calls/stackoverflow4_test.c
View file

@ -58,7 +58,7 @@ void *MyPosixThread(void *arg) {
struct sigaction sa;
struct sigaltstack ss;
ss.ss_flags = 0;
ss.ss_size = sysconf(_SC_MINSIGSTKSZ) + 4096;
ss.ss_size = sysconf(_SC_MINSIGSTKSZ) + 1024;
ss.ss_sp = gc(malloc(ss.ss_size));
ASSERT_SYS(0, 0, sigaltstack(&ss, 0));
sa.sa_flags = SA_SIGINFO | SA_ONSTACK; // <-- important
@ -66,7 +66,7 @@ void *MyPosixThread(void *arg) {
sa.sa_handler = CrashHandler;
sigaction(SIGBUS, &sa, 0);
sigaction(SIGSEGV, &sa, 0);
exit(StackOverflow(0));
exit(StackOverflow(1));
return 0;
}

2
test/libc/calls/stackoverflow5_test.c
View file

@ -44,7 +44,7 @@ int StackOverflow(int d) {
}
void *MyPosixThread(void *arg) {
exit(StackOverflow(0));
exit(StackOverflow(1));
return 0;
}

9
test/libc/intrin/BUILD.mk
View file

@ -59,6 +59,15 @@ o/$(MODE)/test/libc/intrin/%.dbg: \
$(TEST_LIBC_INTRIN_DEPS) \
o/$(MODE)/test/libc/intrin/%.o \
o/$(MODE)/test/libc/intrin/intrin.pkg \
$(LIBC_TESTMAIN) \
$(CRT) \
$(APE_NO_MODIFY_SELF)
@$(APELINK)
o/$(MODE)/test/libc/intrin/mmap_test.dbg: \
$(TEST_LIBC_INTRIN_DEPS) \
o/$(MODE)/test/libc/intrin/mmap_test.o \
o/$(MODE)/test/libc/intrin/intrin.pkg \
o/$(MODE)/test/libc/mem/prog/life.elf.zip.o \
$(LIBC_TESTMAIN) \
$(CRT) \

4
test/libc/intrin/mmap_test.c
View file

@ -95,7 +95,7 @@ TEST(mmap, pageBeyondGone) {
MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
ASSERT_NE(MAP_FAILED, p);
EXPECT_TRUE(testlib_memoryexists(p));
EXPECT_FALSE(testlib_memoryexists(p + 1)); // b/c kisdangerous
EXPECT_TRUE(testlib_memoryexists(p + 1));
EXPECT_FALSE(testlib_memoryexists(p + pagesz));
ASSERT_EQ(0, munmap(p, 1));
}
@ -184,7 +184,7 @@ TEST(mmap, smallerThanPage_mapsRemainder) {
ASSERT_NE(MAP_FAILED, map);
EXPECT_TRUE(testlib_memoryexists(map));
EXPECT_TRUE(testlib_pokememory(map + (pagesz - 1)));
EXPECT_TRUE(!testlib_memoryexists(map + (pagesz - 1)));
EXPECT_TRUE(testlib_memoryexists(map + (pagesz - 1)));
EXPECT_SYS(0, 0, munmap(map, 1));
EXPECT_FALSE(testlib_memoryexists(map));
EXPECT_FALSE(testlib_memoryexists(map + (pagesz - 1)));

9
test/libc/intrin/mprotect_test.c
View file

@ -16,6 +16,7 @@
│ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR │
│ PERFORMANCE OF THIS SOFTWARE. │
╚─────────────────────────────────────────────────────────────────────────────*/
#include "libc/assert.h"
#include "libc/calls/calls.h"
#include "libc/calls/struct/sigaction.h"
#include "libc/calls/ucontext.h"
@ -108,15 +109,15 @@ void SetUp(void) {
.sa_flags = SA_SIGINFO | SA_RESETHAND};
struct sigaction sasegv = {.sa_sigaction = OnSigSegv,
.sa_flags = SA_SIGINFO | SA_RESETHAND};
sigaction(SIGBUS, &sabus, old + 0);
sigaction(SIGSEGV, &sasegv, old + 1);
unassert(!sigaction(SIGBUS, &sabus, old + 0));
unassert(!sigaction(SIGSEGV, &sasegv, old + 1));
gotbusted = false;
gotsegv = false;
}
void TearDown(void) {
sigaction(SIGBUS, old + 0, 0);
sigaction(SIGSEGV, old + 1, 0);
unassert(!sigaction(SIGBUS, old + 0, 0));
unassert(!sigaction(SIGSEGV, old + 1, 0));
}
TEST(mprotect, testOkMemory) {