mirror of
https://sourceware.org/git/glibc.git
synced 2024-09-19 16:10:01 +00:00
89b53077d2
The current racy approach is to enable asynchronous cancellation
before making the syscall and restore the previous cancellation
type once the syscall returns, and check if cancellation has happen
during the cancellation entrypoint.
As described in BZ#12683, this approach shows 2 problems:
1. Cancellation can act after the syscall has returned from the
kernel, but before userspace saves the return value. It might
result in a resource leak if the syscall allocated a resource or a
side effect (partial read/write), and there is no way to program
handle it with cancellation handlers.
2. If a signal is handled while the thread is blocked at a cancellable
syscall, the entire signal handler runs with asynchronous
cancellation enabled. This can lead to issues if the signal
handler call functions which are async-signal-safe but not
async-cancel-safe.
For the cancellation to work correctly, there are 5 points at which the
cancellation signal could arrive:
[ ... )[ ... )[ syscall ]( ...
1 2 3 4 5
1. Before initial testcancel, e.g. [*... testcancel)
2. Between testcancel and syscall start, e.g. [testcancel...syscall start)
3. While syscall is blocked and no side effects have yet taken
place, e.g. [ syscall ]
4. Same as 3 but with side-effects having occurred (e.g. a partial
read or write).
5. After syscall end e.g. (syscall end...*]
And libc wants to act on cancellation in cases 1, 2, and 3 but not
in cases 4 or 5. For the 4 and 5 cases, the cancellation will eventually
happen in the next cancellable entrypoint without any further external
event.
The proposed solution for each case is:
1. Do a conditional branch based on whether the thread has received
a cancellation request;
2. It can be caught by the signal handler determining that the saved
program counter (from the ucontext_t) is in some address range
beginning just before the "testcancel" and ending with the
syscall instruction.
3. SIGCANCEL can be caught by the signal handler and determine that
the saved program counter (from the ucontext_t) is in the address
range beginning just before "testcancel" and ending with the first
uninterruptable (via a signal) syscall instruction that enters the
kernel.
4. In this case, except for certain syscalls that ALWAYS fail with
EINTR even for non-interrupting signals, the kernel will reset
the program counter to point at the syscall instruction during
signal handling, so that the syscall is restarted when the signal
handler returns. So, from the signal handler's standpoint, this
looks the same as case 2, and thus it's taken care of.
5. For syscalls with side-effects, the kernel cannot restart the
syscall; when it's interrupted by a signal, the kernel must cause
the syscall to return with whatever partial result is obtained
(e.g. partial read or write).
6. The saved program counter points just after the syscall
instruction, so the signal handler won't act on cancellation.
This is similar to 4. since the program counter is past the syscall
instruction.
So The proposed fixes are:
1. Remove the enable_asynccancel/disable_asynccancel function usage in
cancellable syscall definition and instead make them call a common
symbol that will check if cancellation is enabled (__syscall_cancel
at nptl/cancellation.c), call the arch-specific cancellable
entry-point (__syscall_cancel_arch), and cancel the thread when
required.
2. Provide an arch-specific generic system call wrapper function
that contains global markers. These markers will be used in
SIGCANCEL signal handler to check if the interruption has been
called in a valid syscall and if the syscalls has side-effects.
A reference implementation sysdeps/unix/sysv/linux/syscall_cancel.c
is provided. However, the markers may not be set on correct
expected places depending on how INTERNAL_SYSCALL_NCS is
implemented by the architecture. It is expected that all
architectures add an arch-specific implementation.
3. Rewrite SIGCANCEL asynchronous handler to check for both canceling
type and if current IP from signal handler falls between the global
markers and act accordingly.
4. Adjust libc code to replace LIBC_CANCEL_ASYNC/LIBC_CANCEL_RESET to
use the appropriate cancelable syscalls.
5. Adjust 'lowlevellock-futex.h' arch-specific implementations to
provide cancelable futex calls.
Some architectures require specific support on syscall handling:
* On i386 the syscall cancel bridge needs to use the old int80
instruction because the optimized vDSO symbol the resulting PC value
for an interrupted syscall points to an address outside the expected
markers in __syscall_cancel_arch. It has been discussed in LKML [1]
on how kernel could help userland to accomplish it, but afaik
discussion has stalled.
Also, sysenter should not be used directly by libc since its calling
convention is set by the kernel depending of the underlying x86 chip
(check kernel commit 30bfa7b3488bfb1bb75c9f50a5fcac1832970c60).
* mips o32 is the only kABI that requires 7 argument syscall, and to
avoid add a requirement on all architectures to support it, mips
support is added with extra internal defines.
Checked on aarch64-linux-gnu, arm-linux-gnueabihf, powerpc-linux-gnu,
powerpc64-linux-gnu, powerpc64le-linux-gnu, i686-linux-gnu, and
x86_64-linux-gnu.
[1] https://lkml.org/lkml/2016/3/8/1105
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
163 lines
5.7 KiB
C
163 lines
5.7 KiB
C
/* Copyright (C) 2002-2024 Free Software Foundation, Inc.
|
|
This file is part of the GNU C Library.
|
|
|
|
The GNU C Library is free software; you can redistribute it and/or
|
|
modify it under the terms of the GNU Lesser General Public
|
|
License as published by the Free Software Foundation; either
|
|
version 2.1 of the License, or (at your option) any later version.
|
|
|
|
The GNU C Library is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Lesser General Public License for more details.
|
|
|
|
You should have received a copy of the GNU Lesser General Public
|
|
License along with the GNU C Library; if not, see
|
|
<https://www.gnu.org/licenses/>. */
|
|
|
|
#include <errno.h>
|
|
#include <signal.h>
|
|
#include <stdlib.h>
|
|
#include "pthreadP.h"
|
|
#include <atomic.h>
|
|
#include <sysdep.h>
|
|
#include <unistd.h>
|
|
#include <unwind-link.h>
|
|
#include <cancellation-pc-check.h>
|
|
#include <stdio.h>
|
|
#include <gnu/lib-names.h>
|
|
#include <sys/single_threaded.h>
|
|
|
|
/* For asynchronous cancellation we use a signal. */
|
|
static void
|
|
sigcancel_handler (int sig, siginfo_t *si, void *ctx)
|
|
{
|
|
/* Safety check. It would be possible to call this function for
|
|
other signals and send a signal from another process. This is not
|
|
correct and might even be a security problem. Try to catch as
|
|
many incorrect invocations as possible. */
|
|
if (sig != SIGCANCEL
|
|
|| si->si_pid != __getpid()
|
|
|| si->si_code != SI_TKILL)
|
|
return;
|
|
|
|
/* Check if asynchronous cancellation mode is set or if interrupted
|
|
instruction pointer falls within the cancellable syscall bridge. For
|
|
interruptable syscalls with external side-effects (i.e. partial reads),
|
|
the kernel will set the IP to after __syscall_cancel_arch_end, thus
|
|
disabling the cancellation and allowing the process to handle such
|
|
conditions. */
|
|
struct pthread *self = THREAD_SELF;
|
|
int oldval = atomic_load_relaxed (&self->cancelhandling);
|
|
if (cancel_async_enabled (oldval) || cancellation_pc_check (ctx))
|
|
__syscall_do_cancel ();
|
|
}
|
|
|
|
int
|
|
__pthread_cancel (pthread_t th)
|
|
{
|
|
volatile struct pthread *pd = (volatile struct pthread *) th;
|
|
|
|
if (pd->tid == 0)
|
|
/* The thread has already exited on the kernel side. Its outcome
|
|
(regular exit, other cancelation) has already been
|
|
determined. */
|
|
return 0;
|
|
|
|
static int init_sigcancel = 0;
|
|
if (atomic_load_relaxed (&init_sigcancel) == 0)
|
|
{
|
|
struct sigaction sa;
|
|
sa.sa_sigaction = sigcancel_handler;
|
|
/* The signal handle should be non-interruptible to avoid the risk of
|
|
spurious EINTR caused by SIGCANCEL sent to process or if
|
|
pthread_cancel() is called while cancellation is disabled in the
|
|
target thread. */
|
|
sa.sa_flags = SA_SIGINFO | SA_RESTART;
|
|
__sigemptyset (&sa.sa_mask);
|
|
__libc_sigaction (SIGCANCEL, &sa, NULL);
|
|
atomic_store_relaxed (&init_sigcancel, 1);
|
|
}
|
|
|
|
#ifdef SHARED
|
|
/* Trigger an error if libgcc_s cannot be loaded. */
|
|
{
|
|
struct unwind_link *unwind_link = __libc_unwind_link_get ();
|
|
if (unwind_link == NULL)
|
|
__libc_fatal (LIBGCC_S_SO
|
|
" must be installed for pthread_cancel to work\n");
|
|
}
|
|
#endif
|
|
|
|
/* Some syscalls are never restarted after being interrupted by a signal
|
|
handler, regardless of the use of SA_RESTART (they always fail with
|
|
EINTR). So pthread_cancel cannot send SIGCANCEL unless the cancellation
|
|
is enabled.
|
|
In this case the target thread is set as 'cancelled' (CANCELED_BITMASK)
|
|
by atomically setting 'cancelhandling' and the cancelation will be acted
|
|
upon on next cancellation entrypoing in the target thread.
|
|
|
|
It also requires to atomically check if cancellation is enabled, so the
|
|
state are also tracked on 'cancelhandling'. */
|
|
|
|
int result = 0;
|
|
int oldval = atomic_load_relaxed (&pd->cancelhandling);
|
|
int newval;
|
|
do
|
|
{
|
|
again:
|
|
newval = oldval | CANCELED_BITMASK;
|
|
if (oldval == newval)
|
|
break;
|
|
|
|
/* Only send the SIGANCEL signal if cancellation is enabled, since some
|
|
syscalls are never restarted even with SA_RESTART. The signal
|
|
will act iff async cancellation is enabled. */
|
|
if (cancel_enabled (newval))
|
|
{
|
|
if (!atomic_compare_exchange_weak_acquire (&pd->cancelhandling,
|
|
&oldval, newval))
|
|
goto again;
|
|
|
|
if (pd == THREAD_SELF)
|
|
/* This is not merely an optimization: An application may
|
|
call pthread_cancel (pthread_self ()) without calling
|
|
pthread_create, so the signal handler may not have been
|
|
set up for a self-cancel. */
|
|
{
|
|
if (cancel_async_enabled (newval))
|
|
__do_cancel (PTHREAD_CANCELED);
|
|
}
|
|
else
|
|
/* The cancellation handler will take care of marking the
|
|
thread as canceled. */
|
|
result = __pthread_kill_internal (th, SIGCANCEL);
|
|
|
|
break;
|
|
}
|
|
}
|
|
while (!atomic_compare_exchange_weak_acquire (&pd->cancelhandling, &oldval,
|
|
newval));
|
|
|
|
/* A single-threaded process should be able to kill itself, since there is
|
|
nothing in the POSIX specification that says that it cannot. So we set
|
|
multiple_threads to true so that cancellation points get executed. */
|
|
THREAD_SETMEM (THREAD_SELF, header.multiple_threads, 1);
|
|
#ifndef TLS_MULTIPLE_THREADS_IN_TCB
|
|
__libc_single_threaded_internal = 0;
|
|
#endif
|
|
|
|
return result;
|
|
}
|
|
versioned_symbol (libc, __pthread_cancel, pthread_cancel, GLIBC_2_34);
|
|
|
|
#if OTHER_SHLIB_COMPAT (libpthread, GLIBC_2_0, GLIBC_2_34)
|
|
compat_symbol (libpthread, __pthread_cancel, pthread_cancel, GLIBC_2_0);
|
|
#endif
|
|
|
|
/* Ensure that the unwinder is always linked in (the __pthread_unwind
|
|
reference from __do_cancel is weak). Use ___pthread_unwind_next
|
|
(three underscores) to produce a strong reference to the same
|
|
file. */
|
|
PTHREAD_STATIC_FN_REQUIRE (___pthread_unwind_next)
|