Hi
In the kernel 4.9-rc1, the x32 support is seriously broken, a x32 process
is killed with SIGKILL after returning from any signal handler.
I use Debian sid x64-64 distribution with x32 architecture added from
debian-ports.
I bisected the bug and found out that it is caused by the patch
6846351052e685c2d1428e80ead2d7ca3d7ed913 ("x86/signal: Add
SA_{X32,IA32}_ABI sa_flags").
example (strace of a process after receiving the SIGWINCH signal):
epoll_wait(10, 0xef6890, 32, -1) = -1 EINTR (Interrupted system call)
--- SIGWINCH {si_signo=SIGWINCH, si_code=SI_USER, si_pid=1772, si_uid=0} ---
poll([{fd=4, events=POLLOUT}], 1, 0) = 1 ([{fd=4, revents=POLLOUT}])
write(4, "\0", 1) = 1
rt_sigreturn({mask=[INT QUIT ILL TRAP BUS KILL SEGV USR2 PIPE ALRM STKFLT TSTP TTOU URG XCPU XFSZ VTALRM IO PWR SYS RTMIN]}) = 0
--- SIGSEGV {si_signo=SIGSEGV, si_code=SI_KERNEL, si_addr=NULL} ---
+++ killed by SIGSEGV +++
Neopr?vn?n? p??stup do pam?ti (SIGSEGV)
Mikulas
On Wed, 19 Oct 2016, Mikulas Patocka wrote:
> Hi
>
> In the kernel 4.9-rc1, the x32 support is seriously broken, a x32 process
> is killed with SIGKILL after returning from any signal handler.
I should have said they are killed with SIGSEGV, not SIGKILL.
> I use Debian sid x64-64 distribution with x32 architecture added from
> debian-ports.
>
> I bisected the bug and found out that it is caused by the patch
> 6846351052e685c2d1428e80ead2d7ca3d7ed913 ("x86/signal: Add
> SA_{X32,IA32}_ABI sa_flags").
>
> example (strace of a process after receiving the SIGWINCH signal):
>
> epoll_wait(10, 0xef6890, 32, -1) = -1 EINTR (Interrupted system call)
> --- SIGWINCH {si_signo=SIGWINCH, si_code=SI_USER, si_pid=1772, si_uid=0} ---
> poll([{fd=4, events=POLLOUT}], 1, 0) = 1 ([{fd=4, revents=POLLOUT}])
> write(4, "\0", 1) = 1
> rt_sigreturn({mask=[INT QUIT ILL TRAP BUS KILL SEGV USR2 PIPE ALRM STKFLT TSTP TTOU URG XCPU XFSZ VTALRM IO PWR SYS RTMIN]}) = 0
> --- SIGSEGV {si_signo=SIGSEGV, si_code=SI_KERNEL, si_addr=NULL} ---
> +++ killed by SIGSEGV +++
> Neopr?vn?n? p??stup do pam?ti (SIGSEGV)
>
> Mikulas
BTW. when I take core dump of the killed x32 process, it shows:
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: CORE (Core file)
Machine: Intel 80386
^^^^^^^^^^^^^^^^^^^
So, the kernel somehow thinks that it is i386 process, not x32 process. A
core dump of a real x32 process shows "Class: ELF32, Machine: Advanced
Micro Devices X86-64".
Mikulas
2016-10-19 20:33 GMT+03:00 Mikulas Patocka <[email protected]>:
>
>
> On Wed, 19 Oct 2016, Mikulas Patocka wrote:
>
>> Hi
>>
>> In the kernel 4.9-rc1, the x32 support is seriously broken, a x32 process
>> is killed with SIGKILL after returning from any signal handler.
>
> I should have said they are killed with SIGSEGV, not SIGKILL.
>
>> I use Debian sid x64-64 distribution with x32 architecture added from
>> debian-ports.
>>
>> I bisected the bug and found out that it is caused by the patch
>> 6846351052e685c2d1428e80ead2d7ca3d7ed913 ("x86/signal: Add
>> SA_{X32,IA32}_ABI sa_flags").
>>
>> example (strace of a process after receiving the SIGWINCH signal):
>>
>> epoll_wait(10, 0xef6890, 32, -1) = -1 EINTR (Interrupted system call)
>> --- SIGWINCH {si_signo=SIGWINCH, si_code=SI_USER, si_pid=1772, si_uid=0} ---
>> poll([{fd=4, events=POLLOUT}], 1, 0) = 1 ([{fd=4, revents=POLLOUT}])
>> write(4, "\0", 1) = 1
>> rt_sigreturn({mask=[INT QUIT ILL TRAP BUS KILL SEGV USR2 PIPE ALRM STKFLT TSTP TTOU URG XCPU XFSZ VTALRM IO PWR SYS RTMIN]}) = 0
>> --- SIGSEGV {si_signo=SIGSEGV, si_code=SI_KERNEL, si_addr=NULL} ---
>> +++ killed by SIGSEGV +++
>> Neoprávnìný pøístup do pamìti (SIGSEGV)
>>
>> Mikulas
>
> BTW. when I take core dump of the killed x32 process, it shows:
>
> ELF Header:
> Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
> Class: ELF32
> Data: 2's complement, little endian
> Version: 1 (current)
> OS/ABI: UNIX - System V
> ABI Version: 0
> Type: CORE (Core file)
> Machine: Intel 80386
> ^^^^^^^^^^^^^^^^^^^
>
> So, the kernel somehow thinks that it is i386 process, not x32 process. A
> core dump of a real x32 process shows "Class: ELF32, Machine: Advanced
> Micro Devices X86-64".
Thanks for catching, will check it today.
--
Dmitry
2016-10-19 20:33 GMT+03:00 Mikulas Patocka <[email protected]>:
>
>
> On Wed, 19 Oct 2016, Mikulas Patocka wrote:
>
>> Hi
>>
>> In the kernel 4.9-rc1, the x32 support is seriously broken, a x32 process
>> is killed with SIGKILL after returning from any signal handler.
>
> I should have said they are killed with SIGSEGV, not SIGKILL.
>
>> I use Debian sid x64-64 distribution with x32 architecture added from
>> debian-ports.
>>
>> I bisected the bug and found out that it is caused by the patch
>> 6846351052e685c2d1428e80ead2d7ca3d7ed913 ("x86/signal: Add
>> SA_{X32,IA32}_ABI sa_flags").
>>
>> example (strace of a process after receiving the SIGWINCH signal):
>>
>> epoll_wait(10, 0xef6890, 32, -1) = -1 EINTR (Interrupted system call)
>> --- SIGWINCH {si_signo=SIGWINCH, si_code=SI_USER, si_pid=1772, si_uid=0} ---
>> poll([{fd=4, events=POLLOUT}], 1, 0) = 1 ([{fd=4, revents=POLLOUT}])
>> write(4, "\0", 1) = 1
>> rt_sigreturn({mask=[INT QUIT ILL TRAP BUS KILL SEGV USR2 PIPE ALRM STKFLT TSTP TTOU URG XCPU XFSZ VTALRM IO PWR SYS RTMIN]}) = 0
>> --- SIGSEGV {si_signo=SIGSEGV, si_code=SI_KERNEL, si_addr=NULL} ---
>> +++ killed by SIGSEGV +++
>> Neoprávnìný pøístup do pamìti (SIGSEGV)
>>
>> Mikulas
>
> BTW. when I take core dump of the killed x32 process, it shows:
>
> ELF Header:
> Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
> Class: ELF32
> Data: 2's complement, little endian
> Version: 1 (current)
> OS/ABI: UNIX - System V
> ABI Version: 0
> Type: CORE (Core file)
> Machine: Intel 80386
> ^^^^^^^^^^^^^^^^^^^
>
> So, the kernel somehow thinks that it is i386 process, not x32 process. A
> core dump of a real x32 process shows "Class: ELF32, Machine: Advanced
> Micro Devices X86-64".
Hi Mikulas,
could you give attached patch a shot?
In about 10 hours I'll be at work and will have debian-x32 install,
but for now, I can't test it.
Thanks again on catching that.
--
Dmitry
On Thu, Oct 20, 2016 at 01:02:59AM +0300, Dmitry Safonov wrote:
> 2016-10-19 20:33 GMT+03:00 Mikulas Patocka <[email protected]>:
> > On Wed, 19 Oct 2016, Mikulas Patocka wrote:
> >> In the kernel 4.9-rc1, the x32 support is seriously broken, a x32 process
> >> is killed with SIGKILL after returning from any signal handler.
> >
> > I should have said they are killed with SIGSEGV, not SIGKILL.
> >
> >> I use Debian sid x64-64 distribution with x32 architecture added from
> >> debian-ports.
> >>
> >> I bisected the bug and found out that it is caused by the patch
> >> 6846351052e685c2d1428e80ead2d7ca3d7ed913 ("x86/signal: Add
> >> SA_{X32,IA32}_ABI sa_flags").
> >
> > So, the kernel somehow thinks that it is i386 process, not x32 process. A
> > core dump of a real x32 process shows "Class: ELF32, Machine: Advanced
> > Micro Devices X86-64".
>
> could you give attached patch a shot?
> In about 10 hours I'll be at work and will have debian-x32 install,
> but for now, I can't test it.
> Thanks again on catching that.
>
> From a546f8da1d12676fe79c746d859eb1e17aa4c331 Mon Sep 17 00:00:00 2001
> From: Dmitry Safonov <[email protected]>
> Date: Thu, 20 Oct 2016 00:53:08 +0300
> Subject: [PATCH] x86/signal: set SA_X32_ABI flag for x32 programs
>
> For x32 programs cs register is __USER_CS, so it returns here
> unconditionally - remove this check completely here.
>
> Fixes: commit 6846351052e6 ("x86/signal: Add SA_{X32,IA32}_ABI sa_flags")
>
> Reported-by: Mikulas Patocka <[email protected]>
> Signed-off-by: Dmitry Safonov <[email protected]>
> ---
> arch/x86/kernel/signal_compat.c | 3 ---
> 1 file changed, 3 deletions(-)
>
> diff --git a/arch/x86/kernel/signal_compat.c b/arch/x86/kernel/signal_compat.c
> index 40df33753bae..ec1f756f9dc9 100644
> --- a/arch/x86/kernel/signal_compat.c
> +++ b/arch/x86/kernel/signal_compat.c
> @@ -105,9 +105,6 @@ void sigaction_compat_abi(struct k_sigaction *act, struct k_sigaction *oact)
> /* Don't let flags to be set from userspace */
> act->sa.sa_flags &= ~(SA_IA32_ABI | SA_X32_ABI);
>
> - if (user_64bit_mode(current_pt_regs()))
> - return;
> -
> if (in_ia32_syscall())
> act->sa.sa_flags |= SA_IA32_ABI;
> if (in_x32_syscall())
> --
> 2.10.0
Works for me. Tested on general operation, a few by-hand checks and several
random package builds.
It'd be nice to check glibc's testsuite as well as it had recent regressions
caused by kernel changes on x32 (like https://bugs.debian.org/841240) but as
gcc-6 in sid is broken right now (fails to build kernel, glibc:amd64, etc),
I didn't bother that much.
Tested-by: Adam Borowski <[email protected]>
--
A MAP07 (Dead Simple) raspberry tincture recipe: 0.5l 95% alcohol, 1kg
raspberries, 0.4kg sugar; put into a big jar for 1 month. Filter out and
throw away the fruits (can dump them into a cake, etc), let the drink age
at least 3-6 months.
Commit-ID: 3b68db0c1f80c763213f07db60b4feda186345f5
Gitweb: http://git.kernel.org/tip/3b68db0c1f80c763213f07db60b4feda186345f5
Author: Dmitry Safonov <[email protected]>
AuthorDate: Thu, 20 Oct 2016 00:53:08 +0300
Committer: Thomas Gleixner <[email protected]>
CommitDate: Thu, 20 Oct 2016 11:17:12 +0200
x86/signal: Remove bogus user_64bit_mode() check from sigaction_compat_abi()
The recent introduction of SA_X32/IA32 sa_flags added a check for
user_64bit_mode() into sigaction_compat_abi(). user_64bit_mode() is true
for native 64bit processes and x32 processes.
Due to that the function returns w/o setting the SA_X32_ABI flag for X32
processes. In consequence the kernel attempts to deliver the signal to the
X32 process in native 64bit mode causing the process to segfault.
Remove the check, so the actual check for X32 mode which sets the ABI flag
can be reached. There is no side effect for native 64bit mode.
[ tglx: Rewrote changelog ]
Fixes: 6846351052e6 ("x86/signal: Add SA_{X32,IA32}_ABI sa_flags")
Reported-by: Mikulas Patocka <[email protected]>
Tested-by: Adam Borowski <[email protected]>
Signed-off-by: Dmitry Safonov <[email protected]>
Cc: Dmitry Safonov <[email protected]>
Cc: Oleg Nesterov <[email protected]>
Cc: [email protected]
Cc: Cyrill Gorcunov <[email protected]>
Cc: Pavel Emelyanov <[email protected]>
Link: http://lkml.kernel.org/r/CAJwJo6Z8ZWPqNfT6t-i8GW1MKxQrKDUagQqnZ%2B0%2B697%[email protected]
Signed-off-by: Thomas Gleixner <[email protected]>
---
arch/x86/kernel/signal_compat.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/arch/x86/kernel/signal_compat.c b/arch/x86/kernel/signal_compat.c
index 40df337..ec1f756 100644
--- a/arch/x86/kernel/signal_compat.c
+++ b/arch/x86/kernel/signal_compat.c
@@ -105,9 +105,6 @@ void sigaction_compat_abi(struct k_sigaction *act, struct k_sigaction *oact)
/* Don't let flags to be set from userspace */
act->sa.sa_flags &= ~(SA_IA32_ABI | SA_X32_ABI);
- if (user_64bit_mode(current_pt_regs()))
- return;
-
if (in_ia32_syscall())
act->sa.sa_flags |= SA_IA32_ABI;
if (in_x32_syscall())
On Thu, 20 Oct 2016, Dmitry Safonov wrote:
> could you give attached patch a shot?
Can you please stop sending attached patches? It's a pain to look at them
and it makes it hard to reply inline.
I applied it and rewrote the changelog because the one liner you slapped
into it is more than useless. Ditto for the completely misleading subject
line. Please be more careful with that.
Thanks,
tglx
2016-10-20 12:24 GMT+03:00 Thomas Gleixner <[email protected]>:
> On Thu, 20 Oct 2016, Dmitry Safonov wrote:
>> could you give attached patch a shot?
>
> Can you please stop sending attached patches? It's a pain to look at them
> and it makes it hard to reply inline.
Sure, I've planned to resend it after get tested-by or when I test
on x32 by myself. Sorry about attaching and changelog.
> I applied it and rewrote the changelog because the one liner you slapped
> into it is more than useless. Ditto for the completely misleading subject
> line. Please be more careful with that.
Thanks, Thomas!
--
Dmitry
On Thu, 20 Oct 2016, Dmitry Safonov wrote:
> 2016-10-19 20:33 GMT+03:00 Mikulas Patocka <[email protected]>:
> >
> >
> > On Wed, 19 Oct 2016, Mikulas Patocka wrote:
> >
> >> Hi
> >>
> >> In the kernel 4.9-rc1, the x32 support is seriously broken, a x32 process
> >> is killed with SIGKILL after returning from any signal handler.
> >
> > I should have said they are killed with SIGSEGV, not SIGKILL.
> >
> >> I use Debian sid x64-64 distribution with x32 architecture added from
> >> debian-ports.
> >>
> >> I bisected the bug and found out that it is caused by the patch
> >> 6846351052e685c2d1428e80ead2d7ca3d7ed913 ("x86/signal: Add
> >> SA_{X32,IA32}_ABI sa_flags").
> >>
> >> example (strace of a process after receiving the SIGWINCH signal):
> >>
> >> epoll_wait(10, 0xef6890, 32, -1) = -1 EINTR (Interrupted system call)
> >> --- SIGWINCH {si_signo=SIGWINCH, si_code=SI_USER, si_pid=1772, si_uid=0} ---
> >> poll([{fd=4, events=POLLOUT}], 1, 0) = 1 ([{fd=4, revents=POLLOUT}])
> >> write(4, "\0", 1) = 1
> >> rt_sigreturn({mask=[INT QUIT ILL TRAP BUS KILL SEGV USR2 PIPE ALRM STKFLT TSTP TTOU URG XCPU XFSZ VTALRM IO PWR SYS RTMIN]}) = 0
> >> --- SIGSEGV {si_signo=SIGSEGV, si_code=SI_KERNEL, si_addr=NULL} ---
> >> +++ killed by SIGSEGV +++
> >> Neoprávnìný pøístup do pamìti (SIGSEGV)
> >>
> >> Mikulas
> >
> > BTW. when I take core dump of the killed x32 process, it shows:
> >
> > ELF Header:
> > Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
> > Class: ELF32
> > Data: 2's complement, little endian
> > Version: 1 (current)
> > OS/ABI: UNIX - System V
> > ABI Version: 0
> > Type: CORE (Core file)
> > Machine: Intel 80386
> > ^^^^^^^^^^^^^^^^^^^
> >
> > So, the kernel somehow thinks that it is i386 process, not x32 process. A
> > core dump of a real x32 process shows "Class: ELF32, Machine: Advanced
> > Micro Devices X86-64".
>
> Hi Mikulas,
>
> could you give attached patch a shot?
> In about 10 hours I'll be at work and will have debian-x32 install,
> but for now, I can't test it.
> Thanks again on catching that.
>
> --
> Dmitry
Yes, it fixes the bug.
Mikulas
Commit-ID: ed1e7db33c3354e4f8b594738c5e793690213b43
Gitweb: http://git.kernel.org/tip/ed1e7db33c3354e4f8b594738c5e793690213b43
Author: Dmitry Safonov <[email protected]>
AuthorDate: Thu, 20 Oct 2016 00:53:08 +0300
Committer: Ingo Molnar <[email protected]>
CommitDate: Thu, 20 Oct 2016 13:05:15 +0200
x86/signal: Remove bogus user_64bit_mode() check from sigaction_compat_abi()
The recent introduction of SA_X32/IA32 sa_flags added a check for
user_64bit_mode() into sigaction_compat_abi(). user_64bit_mode() is true
for native 64-bit processes and x32 processes.
Due to that the function returns w/o setting the SA_X32_ABI flag for X32
processes. In consequence the kernel attempts to deliver the signal to the
X32 process in native 64-bit mode causing the process to segfault.
Remove the check, so the actual check for X32 mode which sets the ABI flag
can be reached. There is no side effect for native 64-bit mode.
[ tglx: Rewrote changelog ]
Fixes: 6846351052e6 ("x86/signal: Add SA_{X32,IA32}_ABI sa_flags")
Reported-by: Mikulas Patocka <[email protected]>
Tested-by: Adam Borowski <[email protected]>
Signed-off-by: Dmitry Safonov <[email protected]>
Cc: Dmitry Safonov <[email protected]>
Cc: Oleg Nesterov <[email protected]>
Cc: [email protected]
Cc: Cyrill Gorcunov <[email protected]>
Cc: Pavel Emelyanov <[email protected]>
Link: http://lkml.kernel.org/r/CAJwJo6Z8ZWPqNfT6t-i8GW1MKxQrKDUagQqnZ%2B0%2B697%[email protected]
Signed-off-by: Thomas Gleixner <[email protected]>
Signed-off-by: Ingo Molnar <[email protected]>
---
arch/x86/kernel/signal_compat.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/arch/x86/kernel/signal_compat.c b/arch/x86/kernel/signal_compat.c
index 40df337..ec1f756 100644
--- a/arch/x86/kernel/signal_compat.c
+++ b/arch/x86/kernel/signal_compat.c
@@ -105,9 +105,6 @@ void sigaction_compat_abi(struct k_sigaction *act, struct k_sigaction *oact)
/* Don't let flags to be set from userspace */
act->sa.sa_flags &= ~(SA_IA32_ABI | SA_X32_ABI);
- if (user_64bit_mode(current_pt_regs()))
- return;
-
if (in_ia32_syscall())
act->sa.sa_flags |= SA_IA32_ABI;
if (in_x32_syscall())