On Mon, Oct 06, 2014 at 09:50:47PM -0700, David Daney wrote: > >>the out-of-line execution trick, but do it somewhere other than in > >>stack memory. > >How do you answer Andy Lutomirski's question about what happens when a > >signal handler interrupts execution while the program counter is > >pointing at this "out-of-line execution" trampoline? This seems like a > >show-stopper for using anything other than the stack. > It would be nice to support, but not doing so would not be a > regression from current behavior. It's not just "nice" to support, it's mandatory. Otherwise you will execute essentially *random instructions* in this case, providing a very nice attack vector that can almost certainly be elevated to arbitrary code execution via timing of signals during floating point code. The current behavior in regards to this is correct: because you have a *stack*, each trampoline is pushed onto the stack in its own context, and popped when it's no longer needed. You can have arbitrarily many such trampolines up to the stack size. Note that each nested signal handler already requires sizeof(ucontext_t) in stack space, so these trampolines are a negligible additional cost without major effects on the number of signal handlers you can nest without overflowing the stack. > >>One way of doing this is to have the kernel magically generate > >>thread local memory regions. > >> > >>Another option is to have userspace manage the out-of-line execution areas. > >> > >>As is often the case, each approach has different pluses and minuses. > >Having the kernel magically do it would be better, but I'm doubtful > >that solution works anyway due to the above signal handler/nesting > >issue. > > So the perfect is the enemy of the good? No non-executable stack > for you, MIPS. No, regressions that make the situation worse than executable-stack are not "good" to begin with, even if it weren't for the other design issues and dumping everything on userspace for the sake of being lazy in the kernel. Rich
