aboutsummaryrefslogtreecommitdiff
path: root/setjmp
diff options
context:
space:
mode:
authorH.J. Lu <hjl.tools@gmail.com>2017-11-30 04:49:25 -0800
committerH.J. Lu <hjl.tools@gmail.com>2017-11-30 04:58:01 -0800
commitf33632ccd1dec3217583fcfdd965afb62954203c (patch)
tree7f958d1ad9b8a1fa83bfbd11bc29289b466e1f52 /setjmp
parent34697694e8a93b325b18f25f7dcded55d6baeaf6 (diff)
downloadglibc-f33632ccd1dec3217583fcfdd965afb62954203c.zip
glibc-f33632ccd1dec3217583fcfdd965afb62954203c.tar.gz
glibc-f33632ccd1dec3217583fcfdd965afb62954203c.tar.bz2
x86: Make a space in jmpbuf for shadow stack pointer
To support Shadow Stack (SHSTK) in Intel Control-flow Enforcement Technology (CET) in setjmp/longjmp, we need to save shadow stack pointer in jmp_buf. The __saved_mask field in jmp_buf has type of __sigset_t. On Linux, __sigset_t is defined as #define _SIGSET_NWORDS (1024 / (8 * sizeof (unsigned long int))) typedef struct { unsigned long int __val[_SIGSET_NWORDS]; } __sigset_t; which is much bigger than expected by the __sigprocmask system call, which has typedef struct { unsigned long sig[_NSIG_WORDS]; } sigset_t; For Linux/x86, we can shrink __sigset_t used by __saved_mask in jmp_buf to add paddings for shadow stack pointer. As long as the new __sigset_t is not smaller than sigset_t expected by the __sigprocmask system call, it should work correctly. This patch adds an internal header file, <setjmpP.h>, to define __jmp_buf_sigset_t for __saved_mask in jmp_buf for Linux/x86 with a space to store shadow stack pointer. It verifies __jmp_buf_sigset_t has the suitable size for the __sigprocmask system call. A run-time test, tst-saved_mask-1.c, is added to verify that size of __jmp_buf_sigset_t is sufficient. If its size is too small, the test fails with rt_sigprocmask(SIG_SETMASK, strace: umoven: short read (4 < 8) @0x7fa8aa28effc 0x7fa8aa28effc, NULL, 8) = -1 EFAULT (Bad address) rt_sigprocmask(SIG_SETMASK, strace: umoven: short read (4 < 8) @0x7fa8aa28effc 0x7fa8aa28effc, NULL, 8) = -1 EFAULT (Bad address) rt_sigprocmask(SIG_SETMASK, NULL, 0x7fa8aa28effc, 8) = -1 EFAULT (Bad address) exit_group(1) = ? Tested with build-many-glibcs.py. * debug/longjmp_chk.c: Include <setjmpP.h> instead of <setjmp.h>. * setjmp/longjmp.c: Include <setjmpP.h> instead of <setjmp.h>. (__libc_siglongjmp): Cast &env[0].__saved_mask to "sigset_t *". * setjmp/sigjmp.c: Include <setjmpP.h> instead of <setjmp.h>. (__sigjmp_save): Cast &env[0].__saved_mask to "sigset_t *". * sysdeps/generic/setjmpP.h: New file. * sysdeps/unix/sysv/linux/x86/jmp_buf-ssp.sym: Likewise. * sysdeps/unix/sysv/linux/x86/setjmpP.h: Likewise. * sysdeps/unix/sysv/linux/x86/tst-saved_mask-1.c: Likewise. * sysdeps/unix/sysv/linux/x86/Makefile (gen-as-const-headers): Add jmp_buf-ssp.sym. (tests): Add tst-saved_mask-1.
Diffstat (limited to 'setjmp')
-rw-r--r--setjmp/longjmp.c5
-rw-r--r--setjmp/sigjmp.c4
2 files changed, 5 insertions, 4 deletions
diff --git a/setjmp/longjmp.c b/setjmp/longjmp.c
index 2453c2c..e144a87 100644
--- a/setjmp/longjmp.c
+++ b/setjmp/longjmp.c
@@ -16,7 +16,7 @@
<http://www.gnu.org/licenses/>. */
#include <stddef.h>
-#include <setjmp.h>
+#include <setjmpP.h>
#include <signal.h>
@@ -31,7 +31,8 @@ __libc_siglongjmp (sigjmp_buf env, int val)
if (env[0].__mask_was_saved)
/* Restore the saved signal mask. */
- (void) __sigprocmask (SIG_SETMASK, &env[0].__saved_mask,
+ (void) __sigprocmask (SIG_SETMASK,
+ (sigset_t *) &env[0].__saved_mask,
(sigset_t *) NULL);
/* Call the machine-dependent function to restore machine state. */
diff --git a/setjmp/sigjmp.c b/setjmp/sigjmp.c
index 30839ae..32b727f 100644
--- a/setjmp/sigjmp.c
+++ b/setjmp/sigjmp.c
@@ -16,7 +16,7 @@
<http://www.gnu.org/licenses/>. */
#include <stddef.h>
-#include <setjmp.h>
+#include <setjmpP.h>
#include <signal.h>
/* This function is called by the `sigsetjmp' macro
@@ -28,7 +28,7 @@ __sigjmp_save (sigjmp_buf env, int savemask)
{
env[0].__mask_was_saved = (savemask &&
__sigprocmask (SIG_BLOCK, (sigset_t *) NULL,
- &env[0].__saved_mask) == 0);
+ (sigset_t *) &env[0].__saved_mask) == 0);
return 0;
}