mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-01 14:44:12 +00:00
6c25da5ad5
This is a second attempt to make the improvements from c6f2062935
("x86/signal/64: Fix SS handling for signals delivered to 64-bit
programs"), which was reverted by 51adbfbba5c6 ("x86/signal/64: Add
support for SS in the 64-bit signal context").
This adds two new uc_flags flags. UC_SIGCONTEXT_SS will be set for
all 64-bit signals (including x32). It indicates that the saved SS
field is valid and that the kernel supports the new behavior.
The goal is to fix a problems with signal handling in 64-bit tasks:
SS wasn't saved in the 64-bit signal context, making it awkward to
determine what SS was at the time of signal delivery and making it
impossible to return to a non-flat SS (as calling sigreturn clobbers
SS).
This also made it extremely difficult for 64-bit tasks to return to
fully-defined 16-bit contexts, because only the kernel can easily do
espfix64, but sigreturn was unable to set a non-flag SS:ESP.
(DOSEMU has a monstrous hack to partially work around this
limitation.)
If we could go back in time, the correct fix would be to make 64-bit
signals work just like 32-bit signals with respect to SS: save it
in signal context, reset it when delivering a signal, and restore
it in sigreturn.
Unfortunately, doing that (as I tried originally) breaks DOSEMU:
DOSEMU wouldn't reset the signal context's SS when clearing the LDT
and changing the saved CS to 64-bit mode, since it predates the SS
context field existing in the first place.
This patch is a bit more complicated, and it tries to balance a
bunch of goals. It makes most cases of changing ucontext->ss during
signal handling work as expected.
I do this by special-casing the interesting case. On sigreturn,
ucontext->ss will be honored by default, unless the ucontext was
created from scratch by an old program and had a 64-bit CS
(unfortunately, CRIU can do this) or was the result of changing a
32-bit signal context to 64-bit without resetting SS (as DOSEMU
does).
For the benefit of new 64-bit software that uses segmentation (new
versions of DOSEMU might), the new behavior can be detected with a
new ucontext flag UC_SIGCONTEXT_SS.
To avoid compilation issues, __pad0 is left as an alias for ss in
ucontext.
The nitty-gritty details are documented in the header file.
This patch also re-enables the sigreturn_64 and ldt_gdt_64 selftests,
as the kernel change allows both of them to pass.
Tested-by: Stas Sergeev <stsp@list.ru>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Cyrill Gorcunov <gorcunov@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Pavel Emelyanov <xemul@parallels.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/749149cbfc3e75cd7fcdad69a854b399d792cc6f.1455664054.git.luto@kernel.org
[ Small readability edit. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
55 lines
2 KiB
C
55 lines
2 KiB
C
#ifndef _ASM_X86_UCONTEXT_H
|
|
#define _ASM_X86_UCONTEXT_H
|
|
|
|
/*
|
|
* Indicates the presence of extended state information in the memory
|
|
* layout pointed by the fpstate pointer in the ucontext's sigcontext
|
|
* struct (uc_mcontext).
|
|
*/
|
|
#define UC_FP_XSTATE 0x1
|
|
|
|
#ifdef __x86_64__
|
|
/*
|
|
* UC_SIGCONTEXT_SS will be set when delivering 64-bit or x32 signals on
|
|
* kernels that save SS in the sigcontext. All kernels that set
|
|
* UC_SIGCONTEXT_SS will correctly restore at least the low 32 bits of esp
|
|
* regardless of SS (i.e. they implement espfix).
|
|
*
|
|
* Kernels that set UC_SIGCONTEXT_SS will also set UC_STRICT_RESTORE_SS
|
|
* when delivering a signal that came from 64-bit code.
|
|
*
|
|
* Sigreturn restores SS as follows:
|
|
*
|
|
* if (saved SS is valid || UC_STRICT_RESTORE_SS is set ||
|
|
* saved CS is not 64-bit)
|
|
* new SS = saved SS (will fail IRET and signal if invalid)
|
|
* else
|
|
* new SS = a flat 32-bit data segment
|
|
*
|
|
* This behavior serves three purposes:
|
|
*
|
|
* - Legacy programs that construct a 64-bit sigcontext from scratch
|
|
* with zero or garbage in the SS slot (e.g. old CRIU) and call
|
|
* sigreturn will still work.
|
|
*
|
|
* - Old DOSEMU versions sometimes catch a signal from a segmented
|
|
* context, delete the old SS segment (with modify_ldt), and change
|
|
* the saved CS to a 64-bit segment. These DOSEMU versions expect
|
|
* sigreturn to send them back to 64-bit mode without killing them,
|
|
* despite the fact that the SS selector when the signal was raised is
|
|
* no longer valid. UC_STRICT_RESTORE_SS will be clear, so the kernel
|
|
* will fix up SS for these DOSEMU versions.
|
|
*
|
|
* - Old and new programs that catch a signal and return without
|
|
* modifying the saved context will end up in exactly the state they
|
|
* started in, even if they were running in a segmented context when
|
|
* the signal was raised.. Old kernels would lose track of the
|
|
* previous SS value.
|
|
*/
|
|
#define UC_SIGCONTEXT_SS 0x2
|
|
#define UC_STRICT_RESTORE_SS 0x4
|
|
#endif
|
|
|
|
#include <asm-generic/ucontext.h>
|
|
|
|
#endif /* _ASM_X86_UCONTEXT_H */
|