Adhemerval Zanella d40ac01cbb stdlib: Make abort/_Exit AS-safe (BZ 26275) ... The recursive lock used on abort does not synchronize with a new process creation (either by fork-like interfaces or posix_spawn ones), nor it is reinitialized after fork(). Also, the SIGABRT unblock before raise() shows another race condition, where a fork or posix_spawn() call by another thread, just after the recursive lock release and before the SIGABRT signal, might create programs with a non-expected signal mask. With the default option (without POSIX_SPAWN_SETSIGDEF), the process can see SIG_DFL for SIGABRT, where it should be SIG_IGN. To fix the AS-safe, raise() does not change the process signal mask, and an AS-safe lock is used if a SIGABRT is installed or the process is blocked or ignored. With the signal mask change removal, there is no need to use a recursive loc. The lock is also taken on both _Fork() and posix_spawn(), to avoid the spawn process to see the abort handler as SIG_DFL. A read-write lock is used to avoid serialize _Fork and posix_spawn execution. Both sigaction (SIGABRT) and abort() requires to lock as writer (since both change the disposition). The fallback is also simplified: there is no need to use a loop of ABORT_INSTRUCTION after _exit() (if the syscall does not terminate the process, the system is broken). The proposed fix changes how setjmp works on a SIGABRT handler, where glibc does not save the signal mask. So usage like the below will now always abort. static volatile int chk_fail_ok; static jmp_buf chk_fail_buf; static void handler (int sig) { if (chk_fail_ok) { chk_fail_ok = 0; longjmp (chk_fail_buf, 1); } else _exit (127); } [...] signal (SIGABRT, handler); [....] chk_fail_ok = 1; if (! setjmp (chk_fail_buf)) { // Something that can calls abort, like a failed fortify function. chk_fail_ok = 0; printf ("FAIL\n"); } Such cases will need to use sigsetjmp instead. The _dl_start_profile calls sigaction through _profil, and to avoid pulling abort() on loader the call is replaced with __libc_sigaction. Checked on x86_64-linux-gnu and aarch64-linux-gnu. Reviewed-by: DJ Delorie <dj@redhat.com>		2024-10-08 14:40:12 -03:00
..
bits/types
sys
allocrtsig.c
kill.c
killpg.c
libc_sigaction.c
Makefile	signal/Makefile: Split and sort tests	2024-07-01 13:47:27 +02:00
raise.c
sigaction.c	stdlib: Make abort/_Exit AS-safe (BZ 26275)	2024-10-08 14:40:12 -03:00
sigaddset.c
sigaltstack.c
sigandset.c
sigblock.c
sigdelset.c
sigempty.c
sigfillset.c
siggetmask.c
sighold.c
sigignore.c
sigintr.c
sigisempty.c
sigismem.c
signal.c
signal.h	Always define __USE_TIME_BITS64 when 64 bit time_t is used	2024-04-02 15:28:36 -03:00
sigorset.c
sigpause.c
sigpending.c
sigprocmask.c
sigqueue.c
sigrelse.c
sigreturn.c
sigset.c
sigsetmask.c
sigsetops.c
sigstack.c
sigsuspend.c
sigtimedwait.c
sigvec.c
sigwait.c
sigwaitinfo.c
sysv_signal.c
tst-minsigstksz-1.c
tst-minsigstksz-2.c
tst-minsigstksz-3.c
tst-minsigstksz-3a.c
tst-minsigstksz-4.c
tst-minsigstksz-5.c
tst-raise.c
tst-sigaction.c
tst-sigisemptyset.c
tst-signal.c
tst-sigset2.c	signal: Avoid system signal disposition to interfere with tests	2024-03-27 13:47:09 -03:00
tst-sigset.c
tst-sigsimple.c
tst-sigwait-eintr.c
Versions