From: Aurelien Jarno <aurelien@aurel32.net>
To: libc-stable@sourceware.org
Cc: Szabolcs Nagy <szabolcs.nagy@arm.com>
Subject: [2.24 COMMITTED 1/5] [BZ #22637] Fix stack guard size accounting
Date: Mon, 01 Jan 2018 00:00:00 -0000 [thread overview]
Message-ID: <20181228222540.18325-1-aurelien@aurel32.net> (raw)
From: Szabolcs Nagy <szabolcs.nagy@arm.com>
Previously if user requested S stack and G guard when creating a
thread, the total mapping was S and the actual available stack was
S - G - static_tls, which is not what the user requested.
This patch fixes the guard size accounting by pretending the user
requested S+G stack. This way all later logic works out except
when reporting the user requested stack size (pthread_getattr_np)
or when computing the minimal stack size (__pthread_get_minstack).
Normally this will increase thread stack allocations by one page.
TLS accounting is not affected, that will require a separate fix.
[BZ #22637]
* nptl/descr.h (stackblock, stackblock_size): Update comments.
* nptl/allocatestack.c (allocate_stack): Add guardsize to stacksize.
* nptl/nptl-init.c (__pthread_get_minstack): Remove guardsize from
stacksize.
* nptl/pthread_getattr_np.c (pthread_getattr_np): Likewise.
(cherry picked from commit 630f4cc3aa019ede55976ea561f1a7af2f068639)
---
ChangeLog | 9 +++++++++
NEWS | 1 +
nptl/allocatestack.c | 4 ++++
nptl/descr.h | 4 ++--
nptl/nptl-init.c | 5 +----
nptl/pthread_getattr_np.c | 7 +++++--
6 files changed, 22 insertions(+), 8 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index 988615f03b..7f37d678be 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2018-01-08 Szabolcs Nagy <szabolcs.nagy@arm.com>
+
+ [BZ #22637]
+ * nptl/descr.h (stackblock, stackblock_size): Update comments.
+ * nptl/allocatestack.c (allocate_stack): Add guardsize to stacksize.
+ * nptl/nptl-init.c (__pthread_get_minstack): Remove guardsize from
+ stacksize.
+ * nptl/pthread_getattr_np.c (pthread_getattr_np): Likewise.
+
2018-05-23 Andreas Schwab <schwab@suse.de>
[BZ #23196]
diff --git a/NEWS b/NEWS
index 13ac8dd911..f2e9b3bf9f 100644
--- a/NEWS
+++ b/NEWS
@@ -71,6 +71,7 @@ The following bugs are resolved with this release:
[21609] x86-64: Align the stack in __tls_get_addr
[21624] Unsafe alloca allows local attackers to alias stack and heap (CVE-2017-1000366)
[21654] nss: Fix invalid cast in group merging
+ [22637] nptl: Fix stack guard size accounting
[22644] string: memmove-sse2-unaligned on 32bit x86 produces garbage when
crossing 2GB threshold (CVE-2017-18269)
[22715] x86-64: Properly align La_x86_64_retval to VEC_SIZE
diff --git a/nptl/allocatestack.c b/nptl/allocatestack.c
index 7365ca606b..9aba97fe7c 100644
--- a/nptl/allocatestack.c
+++ b/nptl/allocatestack.c
@@ -484,6 +484,10 @@ allocate_stack (const struct pthread_attr *attr, struct pthread **pdp,
/* Make sure the size of the stack is enough for the guard and
eventually the thread descriptor. */
guardsize = (attr->guardsize + pagesize_m1) & ~pagesize_m1;
+ if (guardsize < attr->guardsize || size + guardsize < guardsize)
+ /* Arithmetic overflow. */
+ return EINVAL;
+ size += guardsize;
if (__builtin_expect (size < ((guardsize + __static_tls_size
+ MINIMAL_REST_STACK + pagesize_m1)
& ~pagesize_m1),
diff --git a/nptl/descr.h b/nptl/descr.h
index bc92abf010..7e62c3cb23 100644
--- a/nptl/descr.h
+++ b/nptl/descr.h
@@ -363,9 +363,9 @@ struct pthread
/* Machine-specific unwind info. */
struct _Unwind_Exception exc;
- /* If nonzero pointer to area allocated for the stack and its
- size. */
+ /* If nonzero, pointer to the area allocated for the stack and guard. */
void *stackblock;
+ /* Size of the stackblock area including the guard. */
size_t stackblock_size;
/* Size of the included guard area. */
size_t guardsize;
diff --git a/nptl/nptl-init.c b/nptl/nptl-init.c
index 48fab50c4e..4dabb64722 100644
--- a/nptl/nptl-init.c
+++ b/nptl/nptl-init.c
@@ -493,8 +493,5 @@ strong_alias (__pthread_initialize_minimal_internal,
size_t
__pthread_get_minstack (const pthread_attr_t *attr)
{
- struct pthread_attr *iattr = (struct pthread_attr *) attr;
-
- return (GLRO(dl_pagesize) + __static_tls_size + PTHREAD_STACK_MIN
- + iattr->guardsize);
+ return GLRO(dl_pagesize) + __static_tls_size + PTHREAD_STACK_MIN;
}
diff --git a/nptl/pthread_getattr_np.c b/nptl/pthread_getattr_np.c
index 32d7484bf8..c2dfa13fa9 100644
--- a/nptl/pthread_getattr_np.c
+++ b/nptl/pthread_getattr_np.c
@@ -57,9 +57,12 @@ pthread_getattr_np (pthread_t thread_id, pthread_attr_t *attr)
/* The sizes are subject to alignment. */
if (__glibc_likely (thread->stackblock != NULL))
{
- iattr->stacksize = thread->stackblock_size;
+ /* The stack size reported to the user should not include the
+ guard size. */
+ iattr->stacksize = thread->stackblock_size - thread->guardsize;
#if _STACK_GROWS_DOWN
- iattr->stackaddr = (char *) thread->stackblock + iattr->stacksize;
+ iattr->stackaddr = (char *) thread->stackblock
+ + thread->stackblock_size;
#else
iattr->stackaddr = (char *) thread->stackblock;
#endif
--
2.19.2
next reply other threads:[~2018-12-28 22:26 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-01 0:00 Aurelien Jarno [this message]
2018-01-01 0:00 ` [2.24 COMMITTED 4/5] nptl/tst-minstack-throw: Compile in C++11 mode with GNU extensions Aurelien Jarno
2018-01-01 0:00 ` [2.24 COMMITTED 2/5] nptl: Open libgcc.so with RTLD_NOW during pthread_cancel [BZ #22636] Aurelien Jarno
2018-01-01 0:00 ` [2.24 COMMITTED 3/5] nptl: Add tst-minstack-cancel, tst-minstack-exit " Aurelien Jarno
2018-01-01 0:00 ` [2.24 COMMITTED 5/5] csu: Update __libgcc_s_init comment Aurelien Jarno
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181228222540.18325-1-aurelien@aurel32.net \
--to=aurelien@aurel32.net \
--cc=libc-stable@sourceware.org \
--cc=szabolcs.nagy@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).