[PATCH] linux: Enforce zero fill of siginfo_t

[Adhemerval Zanella Netto]

On 19/01/26 14:45, Florian Weimer wrote:
> * Adhemerval Zanella Netto:
> 
>> On 19/01/26 14:08, Florian Weimer wrote:
>>> * Adhemerval Zanella:
>>>
>>>> The glibc siginfo struct is larger than the kABI one, and the kernel
>>>> enforces that for an unknown si_code, all the extra bytes should be 0
>>>> (post_copy_siginfo_from_user).
>>>>
>>>> For armhf, gcc-15 is fully zero-filling the struct (it seems to be a
>>>> compiler issue, although I haven't found any already registered on
>>>> gcc bugzilla).
>>>>
>>>> In any case, to avoid false positives, force zero-filling on the
>>>> structure.
>>>>
>>>> Checked on arm-linux-gnueabihf.
>>>> ---
>>>>  sysdeps/unix/sysv/linux/tst-pidfd.c | 14 ++++++--------
>>>>  1 file changed, 6 insertions(+), 8 deletions(-)
>>>>
>>>> diff --git a/sysdeps/unix/sysv/linux/tst-pidfd.c b/sysdeps/unix/sysv/linux/tst-pidfd.c
>>>> index d50e36b18a..d65e3960ac 100644
>>>> --- a/sysdeps/unix/sysv/linux/tst-pidfd.c
>>>> +++ b/sysdeps/unix/sysv/linux/tst-pidfd.c
>>>> @@ -210,14 +210,12 @@ do_test (void)
>>>>    /* Wait for second sigtimedwait.  */
>>>>    support_process_state_wait (pid, support_process_state_sleeping);
>>>>    {
>>>> -    siginfo_t info =
>>>> -      {
>>>> -	.si_signo = SIGUSR2,
>>>> -	.si_errno = EAGAIN,
>>>> -	.si_code = -10,
>>>> -	.si_pid = ppid,
>>>> -	.si_uid = puid
>>>> -      };
>>>> +    siginfo_t info = { 0 };
>>>> +    info.si_signo = SIGUSR2;
>>>> +    info.si_errno = EAGAIN;
>>>> +    info.si_code = -10;
>>>> +    info.si_pid = ppid;
>>>> +    info.si_uid = puid;
>>>>      TEST_COMPARE (pidfd_send_signal (pidfd, SIGUSR2, &info, 0), 0);
>>>>    }
>>>
>>> Aren't those two equivalent?  Is the issue about padding?
>>
>> That is my understanding, but for some reason gcc-15 on armhf is *not*
>> zero-filling the remaining fields. That's why I stated in commit message
>> that this seems a compiler issue, although I haven't yet create a
>> more simple reproducer and open a bug report for this.
>>
>> I still think it would be valuable to avoid some false-positives on different
>> environments, from 2.43 release wiki [1] it seems that tst-pidfd also fails
>> for powerpc32 (PMacG4), openrisc, and  x86 (thinkpad t60).
>>
>> [1] https://sourceware.org/glibc/wiki/Release/2.43 
> 
> Hmm.  Please use memset then?
> 
> It's what sysdeps/unix/sysv/linux/sigqueue.c does:
> 
>   /* First, clear the siginfo_t structure, so that we don't pass our
>      stack content to other tasks.  */
>   memset (&info, 0, sizeof (siginfo_t));

Are you suggesting using memset on test or enforcing it the syscall wrapper?

> 
> The padding situation is sufficiently iffy that it's not clear if it's a
> compiler bug (it probably depends on the standards version).
> 
> We should find a way to make this work for user code, though.  Can we
> make all padding in siginfo_t explicit?  Or won't that work because of
> unions?

I think we already do it:

sysdeps/unix/sysv/linux/bits/types/siginfo_t.h

 51     union
 52       {
 53         int _pad[__SI_PAD_SIZE];
 54
 55          /* kill().  */
 56         struct
 57           {
 58             __pid_t si_pid;     /* Sending process ID.  */
 59             __uid_t si_uid;     /* Real user ID of sending process.  */
 60           } _kill;
 61
 62         /* POSIX.1b timers.  */

The '_pad' should already cover it, I think.

> 
> Thanks,
> Florian
>