Bug 22685 - PowerPC: Static AT_SECURE binaries segfault with lock-elision and tunables
Summary: PowerPC: Static AT_SECURE binaries segfault with lock-elision and tunables
Status: RESOLVED FIXED
Alias: None
Product: glibc
Classification: Unclassified
Component: libc (show other bugs)
Version: 2.25
: P2 normal
Target Milestone: 2.27
Assignee: Tulio Magno Quites Machado Filho
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-01-09 15:49 UTC by Aurelien Jarno
Modified: 2018-03-31 12:36 UTC (History)
3 users (show)

See Also:
Host: powerpc*-linux-gnu
Target:
Build:
Last reconfirmed:
fweimer: security-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Aurelien Jarno 2018-01-09 15:49:51 UTC
Since the introduction of tunables in commit 67e58f39 (which is in 2.25) and when the GNU libc is configured with --enable-tunables --enable-lock-elision=yes the stdlib/tst-secure-getent test fails with segmentation fault. This is also true for elf/tst-env-setuid and elf/tst-env-setuid-tunables that has been added a few commits later.

Note that since glibc 2.26 tunables are enabled by default and since commit 07ed18d2 (which will be in 2.27) lock elision support is always compiled.

The issue comes from the use of __access_noerrno in maybe_enable_malloc_check in elf/dl-tunables.c to check for /etc/suid-debug. On PowerPC, transactions are aborted just before syscalls, by using this code from sysdeps/powerpc/sysdep.h:

#if !IS_IN(rtld)
# define ABORT_TRANSACTION \
  ({                                            \
    if (THREAD_GET_TM_CAPABLE ())               \
      __libc_tabort (_ABORT_SYSCALL);   \ 
  })
#else
# define ABORT_TRANSACTION
#endif

The problem is that on static binaries __thread_register is not yet initialized when maybe_enable_malloc_check is executed, causing a segmentation fault. Just removing the __access_noerrno test workarounds the issue.
Comment 1 Tulio Magno Quites Machado Filho 2018-01-12 13:18:20 UTC
Patch sent to libc-alpha.
Comment 2 Sourceware Commits 2018-01-19 13:10:00 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, master has been updated
       via  4612268a0ad8e3409d8ce2314dd2dd8ee0af5269 (commit)
      from  64f63cb4583ecc1ba16c7253aacc192b6d088511 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=4612268a0ad8e3409d8ce2314dd2dd8ee0af5269

commit 4612268a0ad8e3409d8ce2314dd2dd8ee0af5269
Author: Tulio Magno Quites Machado Filho <tuliom@linux.vnet.ibm.com>
Date:   Fri Jan 12 18:50:33 2018 -0200

    powerpc: Fix syscalls during early process initialization [BZ #22685]
    
    The tunables framework needs to execute syscall early in process
    initialization, before the TCB is available for consumption.  This
    behavior conflicts with powerpc{|64|64le}'s lock elision code, that
    checks the TCB before trying to abort transactions immediately before
    executing a syscall.
    
    This patch adds a powerpc-specific implementation of __access_noerrno
    that does not abort transactions before the executing syscall.
    
    Tested on powerpc{|64|64le}.
    
    	[BZ #22685]
    	* sysdeps/powerpc/powerpc32/sysdep.h (ABORT_TRANSACTION_IMPL): Renamed
    	from ABORT_TRANSACTION.
    	(ABORT_TRANSACTION): Redirect to ABORT_TRANSACTION_IMPL.
    	* sysdeps/powerpc/powerpc64/sysdep.h (ABORT_TRANSACTION,
    	ABORT_TRANSACTION_IMPL): Likewise.
    	* sysdeps/unix/sysv/linux/powerpc/not-errno.h: New file.  Reuse
    	Linux code, but remove the code that aborts transactions.
    
    Signed-off-by: Tulio Magno Quites Machado Filho <tuliom@linux.vnet.ibm.com>
    Tested-by: Aurelien Jarno <aurelien@aurel32.net>

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                                          |   11 +++++++++
 sysdeps/powerpc/powerpc32/sysdep.h                 |    5 ++-
 sysdeps/powerpc/powerpc64/sysdep.h                 |    5 ++-
 .../unix/sysv/linux/powerpc/not-errno.h            |   23 +++++++++++--------
 4 files changed, 30 insertions(+), 14 deletions(-)
 copy support/xsigaction.c => sysdeps/unix/sysv/linux/powerpc/not-errno.h (60%)
Comment 3 Tulio Magno Quites Machado Filho 2018-01-19 13:33:09 UTC
Fixed on glibc 2.27.
Backports for 2.25 and 2.26 will follow.
Comment 4 Sourceware Commits 2018-01-30 19:02:11 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, release/2.26/master has been updated
       via  bbabb868cd248763373d0db763bacd84ce27ede8 (commit)
       via  38e08dc3e00fc27d127701175018cac4ddaf998e (commit)
      from  a5db85df69dce7fcf793fefc60c764c684e0c272 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=bbabb868cd248763373d0db763bacd84ce27ede8

commit bbabb868cd248763373d0db763bacd84ce27ede8
Author: Tulio Magno Quites Machado Filho <tuliom@linux.vnet.ibm.com>
Date:   Fri Jan 12 18:50:33 2018 -0200

    powerpc: Fix syscalls during early process initialization [BZ #22685]
    
    The tunables framework needs to execute syscall early in process
    initialization, before the TCB is available for consumption.  This
    behavior conflicts with powerpc{|64|64le}'s lock elision code, that
    checks the TCB before trying to abort transactions immediately before
    executing a syscall.
    
    This patch adds a powerpc-specific implementation of __access_noerrno
    that does not abort transactions before the executing syscall.
    
    Tested on powerpc{|64|64le}.
    
    	[BZ #22685]
    	* sysdeps/powerpc/powerpc32/sysdep.h (ABORT_TRANSACTION_IMPL): Renamed
    	from ABORT_TRANSACTION.
    	(ABORT_TRANSACTION): Redirect to ABORT_TRANSACTION_IMPL.
    	* sysdeps/powerpc/powerpc64/sysdep.h (ABORT_TRANSACTION,
    	ABORT_TRANSACTION_IMPL): Likewise.
    	* sysdeps/unix/sysv/linux/powerpc/not-errno.h: New file.  Reuse
    	Linux code, but remove the code that aborts transactions.
    
    Signed-off-by: Tulio Magno Quites Machado Filho <tuliom@linux.vnet.ibm.com>
    Tested-by: Aurelien Jarno <aurelien@aurel32.net>
    (cherry picked from commit 4612268a0ad8e3409d8ce2314dd2dd8ee0af5269)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=38e08dc3e00fc27d127701175018cac4ddaf998e

commit 38e08dc3e00fc27d127701175018cac4ddaf998e
Author: Gabriel F. T. Gomes <gabriel@inconstante.eti.br>
Date:   Fri Nov 3 10:44:36 2017 -0200

    Provide a C++ version of iseqsig (bug 22377)
    
    In C++ mode, __MATH_TG cannot be used for defining iseqsig, because
    __MATH_TG relies on __builtin_types_compatible_p, which is a C-only
    builtin.  This is true when float128 is provided as an ABI-distinct type
    from long double.
    
    Moreover, the comparison macros from ISO C take two floating-point
    arguments, which need not have the same type.  Choosing what underlying
    function to call requires evaluating the formats of the arguments, then
    selecting which is wider.  The macro __MATH_EVAL_FMT2 provides this
    information, however, only the type of the macro expansion is relevant
    (actually evaluating the expression would be incorrect).
    
    This patch provides a C++ version of iseqsig, in which only the type of
    __MATH_EVAL_FMT2 (__typeof or decltype) is used as a template parameter
    for __iseqsig_type.  This function calls the appropriate underlying
    function.
    
    Tested for powerpc64le and x86_64.
    
    	[BZ #22377]
    	* math/Makefile [C++] (tests): Add test for iseqsig.
    	* math/math.h [C++] (iseqsig): New implementation, which does
    	not rely on __MATH_TG/__builtin_types_compatible_p.
    	* math/test-math-iseqsig.cc: New file.
    	* sysdeps/powerpc/powerpc64le/Makefile
    	(CFLAGS-test-math-iseqsig.cc): New variable.
    
    (cherry picked from commit c85e54ac6cef0faed7b7ffc722f52523dec59bf5)

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                                          |   21 +++++
 NEWS                                               |    2 +
 math/Makefile                                      |    2 +-
 math/math.h                                        |   72 +++++++++++++++-
 ...st-math-issignaling.cc => test-math-iseqsig.cc} |   92 ++++++++++----------
 sysdeps/powerpc/powerpc32/sysdep.h                 |    5 +-
 sysdeps/powerpc/powerpc64/sysdep.h                 |    5 +-
 sysdeps/powerpc/powerpc64le/Makefile               |    7 ++-
 .../unix/sysv/linux/powerpc/not-errno.h            |   23 +++--
 9 files changed, 164 insertions(+), 65 deletions(-)
 copy math/{test-math-issignaling.cc => test-math-iseqsig.cc} (52%)
 copy support/xsigaction.c => sysdeps/unix/sysv/linux/powerpc/not-errno.h (60%)
Comment 5 Sourceware Commits 2018-02-12 18:09:34 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, release/2.25/master has been updated
       via  71616d59ec97fe798b69f749e7fb424bd6d2432b (commit)
       via  e84db8f9eba9171fc04046014668cb66eba64d41 (commit)
      from  9331dbdcd7aa8e997eb4caa9b1b0cb6c804320c8 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=71616d59ec97fe798b69f749e7fb424bd6d2432b

commit 71616d59ec97fe798b69f749e7fb424bd6d2432b
Author: Tulio Magno Quites Machado Filho <tuliom@linux.vnet.ibm.com>
Date:   Fri Jan 12 18:50:33 2018 -0200

    powerpc: Fix syscalls during early process initialization [BZ #22685]
    
    The tunables framework needs to execute syscall early in process
    initialization, before the TCB is available for consumption.  This
    behavior conflicts with powerpc{|64|64le}'s lock elision code, that
    checks the TCB before trying to abort transactions immediately before
    executing a syscall.
    
    This patch adds a powerpc-specific implementation of __access_noerrno
    that does not abort transactions before the executing syscall.
    
    Tested on powerpc{|64|64le}.
    
    	[BZ #22685]
    	* sysdeps/powerpc/powerpc32/sysdep.h (ABORT_TRANSACTION_IMPL): Renamed
    	from ABORT_TRANSACTION.
    	(ABORT_TRANSACTION): Redirect to ABORT_TRANSACTION_IMPL.
    	* sysdeps/powerpc/powerpc64/sysdep.h (ABORT_TRANSACTION,
    	ABORT_TRANSACTION_IMPL): Likewise.
    	* sysdeps/unix/sysv/linux/powerpc/not-errno.h: New file.  Reuse
    	Linux code, but remove the code that aborts transactions.
    
    Signed-off-by: Tulio Magno Quites Machado Filho <tuliom@linux.vnet.ibm.com>
    Tested-by: Aurelien Jarno <aurelien@aurel32.net>
    (cherry picked from commit 4612268a0ad8e3409d8ce2314dd2dd8ee0af5269)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=e84db8f9eba9171fc04046014668cb66eba64d41

commit e84db8f9eba9171fc04046014668cb66eba64d41
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Mon Jul 17 18:11:12 2017 -0300

    tunables: Use direct syscall for access (BZ#21744)
    
    The function maybe_enable_malloc_check, which is called by
    __tunables_init, calls __access_noerrno.  It isn't problem when
    symbol is is in ld.so, which has a special version of __access_noerrno
    without stack protector.  But when glibc is built with stack protector,
    maybe_enable_malloc_check in libc.a can't call the regular version of
    __access_noerrno with stack protector.
    
    This patch changes how Linux defines the __access_noerrno to be an
    inline call instead and thus preventing defining different build
    rules for ld/static and shared.
    
    	H.J. Lu  <hongjiu.lu@intel.com>
    	Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    
    	[BZ #21744]
    	* elf/dl-tunables.c: Include not-errno.h header.
    	* include/unistd.h (__access_noerrno): Remove definition.
    	* sysdeps/unix/sysv/linux/access.c (__access_noerrno): Likewise.
    	* sysdeps/generic/not-errno.h: New file.
    	* sysdeps/unix/sysv/linux/not-errno.h: Likewise.
    
    (cherry picked from commit 95a73392580761abc62fc9b1386d232cd55878e9)

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                                   |   21 ++++++++++++++++
 NEWS                                        |    2 +
 elf/dl-tunables.c                           |    2 +
 include/unistd.h                            |    7 -----
 sysdeps/generic/not-errno.h                 |   19 ++++++++++++++
 sysdeps/powerpc/powerpc32/sysdep.h          |    5 ++-
 sysdeps/powerpc/powerpc64/sysdep.h          |    5 ++-
 sysdeps/unix/sysv/linux/access.c            |   15 -----------
 sysdeps/unix/sysv/linux/not-errno.h         |   35 +++++++++++++++++++++++++++
 sysdeps/unix/sysv/linux/powerpc/not-errno.h |   30 +++++++++++++++++++++++
 10 files changed, 115 insertions(+), 26 deletions(-)
 create mode 100644 sysdeps/generic/not-errno.h
 create mode 100644 sysdeps/unix/sysv/linux/not-errno.h
 create mode 100644 sysdeps/unix/sysv/linux/powerpc/not-errno.h