[Bug nptl/17214] Expose a clone variant that shares stacks instead of jumping to a new one

["sstewartgallus00 at mylangara dot bc.ca" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=17214

--- Comment #15 from Steven Stewart-Gallus <sstewartgallus00 at mylangara dot bc.ca> ---
It occurs to me that maybe clone with vfork could be exposed in a safe manner
along the lines of the following (although GLibc would probably implement it in
assembly directly).

__attribute__((noinline)) __attribute__((noclone))
__attribute__((no_sanitize_address)) static pid_t safe_vfork(
    int (*volatile f)(void *), void *volatile arg)
{
    __atomic_signal_fence(__ATOMIC_SEQ_CST);

    pid_t child = vfork();
    if (0 == child)
        _Exit(f(arg));

    return child;
}

Aside from the weirdness of vfork this should be no less safer than something
along the lines of the following:

__attribute__((noinline)) __attribute__((noclone))
__attribute__((no_sanitize_address)) static pid_t safe_vclone(
    int volatile clone_flags, int (*volatile f)(void *), void *volatile arg)
{
    long maybe_page_size = sysconf(_SC_PAGE_SIZE);
    assert(maybe_page_size >= 0);

    long maybe_stack_min_size = sysconf(_SC_THREAD_STACK_MIN);
    assert(maybe_stack_min_size >= 0);

    size_t page_size = maybe_page_size;
    size_t stack_min_size = maybe_stack_min_size;

    /* We need an extra page for signals */
    size_t stack_size = stack_min_size + page_size;

    size_t stack_and_guard_size = page_size + stack_size + page_size;
    void *child_stack = mmap(
        0, stack_and_guard_size, PROT_READ | PROT_WRITE,
        MAP_PRIVATE | MAP_ANONYMOUS | MAP_GROWSDOWN | MAP_STACK, -1, 0);
    if (0 == child_stack)
        return -1;

    /* Guard pages are shared between the stacks */
    if (-1 == mprotect((char *)child_stack, page_size, PROT_NONE))
        goto on_err;

    if (-1 == mprotect((char *)child_stack + page_size + stack_size,
                       page_size, PROT_NONE))
        goto on_err;

    void *stack_start = (char *)child_stack + page_size + stack_size;

    __atomic_signal_fence(__ATOMIC_SEQ_CST);

    pid_t child =
        clone(f, stack_start, clone_flags | CLONE_VM | CLONE_VFORK, arg);
    if (-1 == child)
        goto on_err;

    munmap(child_stack, stack_and_guard_size);

    return child;

on_err:
    ;
    int errnum = errno;
    munmap(child_stack, stack_and_guard_size);
    errno = errnum;
    return -1;
}

-- 
You are receiving this mail because:
You are on the CC list for the bug.