Re: [PATCH] x86: Add __sigsetjmp_cancel and __setjmp_cancel

["H.J. Lu" <hjl dot tools at gmail dot com>]

On Thu, Mar 29, 2018 at 1:09 PM, Florian Weimer <fw@deneb.enyo.de> wrote:
> * H. J. Lu:
>
>> On Thu, Mar 29, 2018 at 12:42 PM, Florian Weimer <fw@deneb.enyo.de> wrote:
>>> * H. J. Lu:
>>>
>>>> On Thu, Mar 29, 2018 at 10:34 AM, Florian Weimer <fw@deneb.enyo.de> wrote:
>>>>> * H. J. Lu:
>>>>>
>>>>>> Here is the updated patch.  OK for master?
>>>>>
>>>>> If you want to backport this into Fedora 28, you will have to avoid
>>>>> new symbol versions.
>>>>
>>>> Should we revisit my patch to extend struct pthread_unwind_buf:
>>>>
>>>> https://sourceware.org/ml/libc-alpha/2018-02/msg00291.html
>>>>
>>>> This patch doesn't introduce the new symbol version.
>>>
>>> That patch will require recompiling a subset of static libraries in
>>> Fedora 28 to avoid crashes once CET is enabled.  Which should be
>>> doable at a technical level, but takes resources away from other work,
>>> obviously.
>>
>> BOTH approaches NEED to recompile a subset of static libraries in Fedora
>> 28, as stated in
>>
>> https://sourceware.org/ml/libc-alpha/2018-03/msg00521.html
>
> That's just another suboptimal implementation, I think.
>
>> NB: Shared libraries built with glibc 2.27 or older are compatible with
>> glibc 2.28.  Relocatable objects compiled against glibc 2.27 or older
>> are incompatible with glibc 2.28 since they reference the older version
>> of __sigsetjmp.
>
> Understood.
>
>>> My preference still is a solution where we shift the stored signal
>>> mask to make room for the shadow stack data in CET mode (for maximum
>>> compatibility).  But I expect that Carlos will review your patch.
>>
>> As I have pointed out before
>>
>> Note: There is an unused pointer space in pthread_unwind_buf_data.  But
>> it isn't suitable for saving and restoring shadow stack register since
>> x32 is a 64-bit process with 32-bit software pointer and kernel may
>> place x32 shadow stack above 4GB.  We need to save and restore 64-bit
>> shadow stack register for x32.
>
> I thought you agreed that we do not need to unwind the shadow stack
> pointer?  Therefore, __sigsetjmp can override the other members, too.
> It's just a dead store, and __pthread_register_cancel will overwrite
> it.
>
> This will need a longjmp_cancel which does not restore the shadow
> stack pointer.  But that can be a GLIBC_PRIVATE symbol.

You need to make a choice.  You either don't introduce a new symbol
version or don't save shadow stack for thread cancellation.   You can't
have both.

-- 
H.J.