On Tue, Oct 15, 2024 at 12:41:16PM +0100, Will Deacon wrote:
> On Tue, Oct 15, 2024 at 10:59:11AM +0100, Joey Gouly wrote:
> > On Mon, Oct 14, 2024 at 06:10:23PM +0100, Will Deacon wrote:
> > > Looking a little more at this, I think we have quite a weird behaviour
> > > on arm64 as it stands. It looks like we rely on the signal frame to hold
> > > the original POR_EL0 so, if for some reason we fail to allocate space
> > > for the POR context, I think we'll return back from the signal with
> > > POR_EL0_INIT. That seems bad?
> >
> > If we don't allocate space for POR_EL0, I think the program recieves SIGSGEV?
> >
> > setup_sigframe_layout()
> > if (system_supports_poe()) {
> > err = sigframe_alloc(user, &user->poe_offset,
> > sizeof(struct poe_context));
> > if (err)
> > return err;
> > }
> >
> > Through get_sigframe() and setup_rt_frame(), that eventually hets here:
> >
> > handle_signal()
> > ret = setup_rt_frame(usig, ksig, oldset, regs);
> >
> > [..]
> >
> > signal_setup_done(ret, ksig, test_thread_flag(TIF_SINGLESTEP));
> >
> > void signal_setup_done(int failed, struct ksignal *ksig, int stepping)
> > {
> > if (failed)
> > force_sigsegv(ksig->sig);
> > else
> > signal_delivered(ksig, stepping);
> > }
> >
> > So I think it's "fine"?
>
> Ah, yes, sorry about that. I got confused by the conditional push in
> setup_sigframe():
>
> if (system_supports_poe() && err == 0 && user->poe_offset) {
> ...
>
> which gives the wrong impression that the POR is somehow optional, even
> if the CPU supports POE. So we should drop that check of
> 'user->poe_offset' as it cannot be NULL here.
I agree, we should remove this check as it's confusing.
> We also still need to resolve Kevin's concern, which probably means
> keeping the thread's original POR around someplace.
If we fail to allocate context for POR_EL0 (or anything else), we'll
deliver a SIGSEGV. I think it's quite likely that the SIGSEGV will also
fail to allocate context we end up with a fatal SIGSEGV. Not sure the
user can affect the allocation/layout, though it can change stack
attributes where the frame is written.
Assuming that the user tricks the kernel into failing to write the
context but allows it to succeed on the resulting SIGSEGV, POR_EL0
wouldn't have been reset and the SIGSEGV context will still have the
original value. I don't think we need to do anything here for 6.12.
However, in for-next/core, we have gcs_signal_entry() called after
resetting POR_EL0. If this fails, we can end up with a new POR_EL0 on
sigreturn (subject to the above user toggling permissions). I think this
needs to be fixed, POR_EL0 only reset when we know we are going to
deliver the signal.
--
Catalin
