From d40ac01cbbc66e6d9dbd8e3485605c63b2178251 Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella Date: Thu, 3 Oct 2024 15:41:10 -0300 Subject: stdlib: Make abort/_Exit AS-safe (BZ 26275) The recursive lock used on abort does not synchronize with a new process creation (either by fork-like interfaces or posix_spawn ones), nor it is reinitialized after fork(). Also, the SIGABRT unblock before raise() shows another race condition, where a fork or posix_spawn() call by another thread, just after the recursive lock release and before the SIGABRT signal, might create programs with a non-expected signal mask. With the default option (without POSIX_SPAWN_SETSIGDEF), the process can see SIG_DFL for SIGABRT, where it should be SIG_IGN. To fix the AS-safe, raise() does not change the process signal mask, and an AS-safe lock is used if a SIGABRT is installed or the process is blocked or ignored. With the signal mask change removal, there is no need to use a recursive loc. The lock is also taken on both _Fork() and posix_spawn(), to avoid the spawn process to see the abort handler as SIG_DFL. A read-write lock is used to avoid serialize _Fork and posix_spawn execution. Both sigaction (SIGABRT) and abort() requires to lock as writer (since both change the disposition). The fallback is also simplified: there is no need to use a loop of ABORT_INSTRUCTION after _exit() (if the syscall does not terminate the process, the system is broken). The proposed fix changes how setjmp works on a SIGABRT handler, where glibc does not save the signal mask. So usage like the below will now always abort. static volatile int chk_fail_ok; static jmp_buf chk_fail_buf; static void handler (int sig) { if (chk_fail_ok) { chk_fail_ok = 0; longjmp (chk_fail_buf, 1); } else _exit (127); } [...] signal (SIGABRT, handler); [....] chk_fail_ok = 1; if (! setjmp (chk_fail_buf)) { // Something that can calls abort, like a failed fortify function. chk_fail_ok = 0; printf ("FAIL\n"); } Such cases will need to use sigsetjmp instead. The _dl_start_profile calls sigaction through _profil, and to avoid pulling abort() on loader the call is replaced with __libc_sigaction. Checked on x86_64-linux-gnu and aarch64-linux-gnu. Reviewed-by: DJ Delorie --- debug/test-strcpy_chk.c | 6 +++--- debug/tst-fortify-wide.c | 4 ++-- debug/tst-fortify.c | 4 ++-- 3 files changed, 7 insertions(+), 7 deletions(-) (limited to 'debug') diff --git a/debug/test-strcpy_chk.c b/debug/test-strcpy_chk.c index 14b11ea62a..55f2cc8768 100644 --- a/debug/test-strcpy_chk.c +++ b/debug/test-strcpy_chk.c @@ -59,7 +59,7 @@ static int test_main (void); #include volatile int chk_fail_ok; -jmp_buf chk_fail_buf; +sigjmp_buf chk_fail_buf; static void handler (int sig) @@ -86,7 +86,7 @@ do_one_test (impl_t *impl, char *dst, const char *src, return; chk_fail_ok = 1; - if (setjmp (chk_fail_buf) == 0) + if (sigsetjmp (chk_fail_buf, 1) == 0) { res = CALL (impl, dst, src, dlen); printf ("*** Function %s (%zd; %zd) did not __chk_fail\n", @@ -214,7 +214,7 @@ do_random_tests (void) if (impl->test != 1) { chk_fail_ok = 1; - if (setjmp (chk_fail_buf) == 0) + if (sigsetjmp (chk_fail_buf, 1) == 0) { res = (unsigned char *) CALL (impl, (char *) p2 + align2, diff --git a/debug/tst-fortify-wide.c b/debug/tst-fortify-wide.c index 9c6f3af855..0f38e55e9c 100644 --- a/debug/tst-fortify-wide.c +++ b/debug/tst-fortify-wide.c @@ -26,7 +26,7 @@ static volatile int chk_fail_ok; static volatile int ret; -static jmp_buf chk_fail_buf; +static sigjmp_buf chk_fail_buf; static void handler (int sig) @@ -49,7 +49,7 @@ static wchar_t wbuf2[20] = L"%ls"; do { wprintf (L"Failure on line %d\n", __LINE__); ret = 1; } while (0) #define CHK_FAIL_START \ chk_fail_ok = 1; \ - if (! setjmp (chk_fail_buf)) \ + if (! sigsetjmp (chk_fail_buf, 1)) \ { #define CHK_FAIL_END \ chk_fail_ok = 0; \ diff --git a/debug/tst-fortify.c b/debug/tst-fortify.c index ae738ff10a..e12d538458 100644 --- a/debug/tst-fortify.c +++ b/debug/tst-fortify.c @@ -90,7 +90,7 @@ do_prepare (int argc, char *argv[]) static volatile int chk_fail_ok; static volatile int ret; -static jmp_buf chk_fail_buf; +static sigjmp_buf chk_fail_buf; static void handler (int sig) @@ -133,7 +133,7 @@ static int num2 = 987654; do { printf ("Failure on line %d\n", __LINE__); ret = 1; } while (0) #define CHK_FAIL_START \ chk_fail_ok = 1; \ - if (! setjmp (chk_fail_buf)) \ + if (! sigsetjmp (chk_fail_buf, 1)) \ { #define CHK_FAIL_END \ chk_fail_ok = 0; \ -- cgit v1.2.3