From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 35315 invoked by alias); 28 Dec 2018 22:26:09 -0000 Mailing-List: contact libc-stable-help@sourceware.org; run by ezmlm Precedence: bulk List-Post: List-Help: List-Subscribe: List-Archive: Sender: libc-stable-owner@sourceware.org Received: (qmail 35189 invoked by uid 89); 28 Dec 2018 22:26:09 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Checked: by ClamAV 0.100.2 on sourceware.org X-Virus-Found: No X-Spam-SWARE-Status: No, score=-25.9 required=5.0 tests=BAYES_00,GIT_PATCH_0,GIT_PATCH_1,GIT_PATCH_2,GIT_PATCH_3,KAM_LAZY_DOMAIN_SECURITY autolearn=ham version=3.3.2 spammy=3639 X-Spam-Status: No, score=-25.9 required=5.0 tests=BAYES_00,GIT_PATCH_0,GIT_PATCH_1,GIT_PATCH_2,GIT_PATCH_3,KAM_LAZY_DOMAIN_SECURITY autolearn=ham version=3.3.2 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on sourceware.org X-Spam-Level: X-HELO: hall.aurel32.net Received: from hall.aurel32.net (HELO hall.aurel32.net) (163.172.24.10) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Fri, 28 Dec 2018 22:26:06 +0000 Received: from [78.30.2.155] (helo=ohm.local) by hall.aurel32.net with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1gd0Zs-0007b8-OU; Fri, 28 Dec 2018 23:26:00 +0100 Received: from aurel32 by ohm.local with local (Exim 4.91) (envelope-from ) id 1gd0Zl-0004mr-NX; Fri, 28 Dec 2018 23:25:53 +0100 From: Aurelien Jarno To: libc-stable@sourceware.org Cc: Szabolcs Nagy Subject: [2.24 COMMITTED 1/5] [BZ #22637] Fix stack guard size accounting Date: Mon, 01 Jan 2018 00:00:00 -0000 Message-Id: <20181228222540.18325-1-aurelien@aurel32.net> X-Mailer: git-send-email 2.19.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-IsSubscribed: yes X-SW-Source: 2018-12/txt/msg00028.txt.bz2 From: Szabolcs Nagy Previously if user requested S stack and G guard when creating a thread, the total mapping was S and the actual available stack was S - G - static_tls, which is not what the user requested. This patch fixes the guard size accounting by pretending the user requested S+G stack. This way all later logic works out except when reporting the user requested stack size (pthread_getattr_np) or when computing the minimal stack size (__pthread_get_minstack). Normally this will increase thread stack allocations by one page. TLS accounting is not affected, that will require a separate fix. [BZ #22637] * nptl/descr.h (stackblock, stackblock_size): Update comments. * nptl/allocatestack.c (allocate_stack): Add guardsize to stacksize. * nptl/nptl-init.c (__pthread_get_minstack): Remove guardsize from stacksize. * nptl/pthread_getattr_np.c (pthread_getattr_np): Likewise. (cherry picked from commit 630f4cc3aa019ede55976ea561f1a7af2f068639) --- ChangeLog | 9 +++++++++ NEWS | 1 + nptl/allocatestack.c | 4 ++++ nptl/descr.h | 4 ++-- nptl/nptl-init.c | 5 +---- nptl/pthread_getattr_np.c | 7 +++++-- 6 files changed, 22 insertions(+), 8 deletions(-) diff --git a/ChangeLog b/ChangeLog index 988615f03b..7f37d678be 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,12 @@ +2018-01-08 Szabolcs Nagy + + [BZ #22637] + * nptl/descr.h (stackblock, stackblock_size): Update comments. + * nptl/allocatestack.c (allocate_stack): Add guardsize to stacksize. + * nptl/nptl-init.c (__pthread_get_minstack): Remove guardsize from + stacksize. + * nptl/pthread_getattr_np.c (pthread_getattr_np): Likewise. + 2018-05-23 Andreas Schwab [BZ #23196] diff --git a/NEWS b/NEWS index 13ac8dd911..f2e9b3bf9f 100644 --- a/NEWS +++ b/NEWS @@ -71,6 +71,7 @@ The following bugs are resolved with this release: [21609] x86-64: Align the stack in __tls_get_addr [21624] Unsafe alloca allows local attackers to alias stack and heap (CVE-2017-1000366) [21654] nss: Fix invalid cast in group merging + [22637] nptl: Fix stack guard size accounting [22644] string: memmove-sse2-unaligned on 32bit x86 produces garbage when crossing 2GB threshold (CVE-2017-18269) [22715] x86-64: Properly align La_x86_64_retval to VEC_SIZE diff --git a/nptl/allocatestack.c b/nptl/allocatestack.c index 7365ca606b..9aba97fe7c 100644 --- a/nptl/allocatestack.c +++ b/nptl/allocatestack.c @@ -484,6 +484,10 @@ allocate_stack (const struct pthread_attr *attr, struct pthread **pdp, /* Make sure the size of the stack is enough for the guard and eventually the thread descriptor. */ guardsize = (attr->guardsize + pagesize_m1) & ~pagesize_m1; + if (guardsize < attr->guardsize || size + guardsize < guardsize) + /* Arithmetic overflow. */ + return EINVAL; + size += guardsize; if (__builtin_expect (size < ((guardsize + __static_tls_size + MINIMAL_REST_STACK + pagesize_m1) & ~pagesize_m1), diff --git a/nptl/descr.h b/nptl/descr.h index bc92abf010..7e62c3cb23 100644 --- a/nptl/descr.h +++ b/nptl/descr.h @@ -363,9 +363,9 @@ struct pthread /* Machine-specific unwind info. */ struct _Unwind_Exception exc; - /* If nonzero pointer to area allocated for the stack and its - size. */ + /* If nonzero, pointer to the area allocated for the stack and guard. */ void *stackblock; + /* Size of the stackblock area including the guard. */ size_t stackblock_size; /* Size of the included guard area. */ size_t guardsize; diff --git a/nptl/nptl-init.c b/nptl/nptl-init.c index 48fab50c4e..4dabb64722 100644 --- a/nptl/nptl-init.c +++ b/nptl/nptl-init.c @@ -493,8 +493,5 @@ strong_alias (__pthread_initialize_minimal_internal, size_t __pthread_get_minstack (const pthread_attr_t *attr) { - struct pthread_attr *iattr = (struct pthread_attr *) attr; - - return (GLRO(dl_pagesize) + __static_tls_size + PTHREAD_STACK_MIN - + iattr->guardsize); + return GLRO(dl_pagesize) + __static_tls_size + PTHREAD_STACK_MIN; } diff --git a/nptl/pthread_getattr_np.c b/nptl/pthread_getattr_np.c index 32d7484bf8..c2dfa13fa9 100644 --- a/nptl/pthread_getattr_np.c +++ b/nptl/pthread_getattr_np.c @@ -57,9 +57,12 @@ pthread_getattr_np (pthread_t thread_id, pthread_attr_t *attr) /* The sizes are subject to alignment. */ if (__glibc_likely (thread->stackblock != NULL)) { - iattr->stacksize = thread->stackblock_size; + /* The stack size reported to the user should not include the + guard size. */ + iattr->stacksize = thread->stackblock_size - thread->guardsize; #if _STACK_GROWS_DOWN - iattr->stackaddr = (char *) thread->stackblock + iattr->stacksize; + iattr->stackaddr = (char *) thread->stackblock + + thread->stackblock_size; #else iattr->stackaddr = (char *) thread->stackblock; #endif -- 2.19.2