| Message ID | 5A54987B.6040305@arm.com |
|---|---|
| State | New |
| Headers | show |
| Series | [v3] aarch64: enforce >=64K guard size | expand |
On 09/01/18 10:24, Szabolcs Nagy wrote: > v3: > - more comment in allocate_stack. > - define ARCH_MIN_GUARD_SIZE explicitly for all targets. > - rebase on top of master. > v2: > - only change guard size on aarch64 > - don't report the inflated guard size > > There are several compiler implementations that allow large stack > allocations to jump over the guard page at the end of the stack and > corrupt memory beyond that. See CVE-2017-1000364. > > Compilers can emit code to probe the stack such that the guard page > cannot be skipped, but on aarch64 the probe interval is 64K instead > of the minimum supported page size (4K). > > This patch enforces at least 64K guard on aarch64 unless the guard > is disabled by its size to 0. For backward compatibility reasons > the increased guard is not reported, so it is only observable by > exhausting the address space or parsing /proc/self/maps on linux. > > On other targets the patch has no effect. > > The patch does not affect threads with user allocated stacks. > > 2018-01-09 Szabolcs Nagy <szabolcs.nagy@arm.com> > > * nptl/allocatestack.c (allocate_stack): Use ARCH_MIN_GUARD_SIZE. > * sysdeps/aarch64/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. > * sysdeps/alpha/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. > * sysdeps/arm/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. > * sysdeps/hppa/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. > * sysdeps/i386/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. > * sysdeps/ia64/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. > * sysdeps/m68k/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. > * sysdeps/microblaze/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. > * sysdeps/mips/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. > * sysdeps/nios2/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. > * sysdeps/powerpc/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. > * sysdeps/s390/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. > * sysdeps/sh/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. > * sysdeps/sparc/sparc32/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. > * sysdeps/sparc/sparc64/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. > * sysdeps/tile/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. > * sysdeps/x86_64/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. > meanwhile this passed a build-many-glibcs.py test is this ok for 2.27 ? $ grep '"FAIL"' build-state.json "compilers-m68k-linux-gnu-coldfire gcc-first build": "FAIL", "glibcs-hppa-linux-gnu check": "FAIL", "glibcs-m68k-linux-gnu-coldfire check-compilers": "FAIL", "glibcs-microblaze-linux-gnu check": "FAIL", "glibcs-microblazeel-linux-gnu check": "FAIL",
On 01/10/2018 12:48 PM, Szabolcs Nagy wrote: > meanwhile this passed a build-many-glibcs.py test > is this ok for 2.27 ? I don't think the GCC patch has been committed yet. I find it baffling what's going on there. Aren't the ARM maintainers interested in this feature? Thanks, Florian
On 11/01/18 09:32, Florian Weimer wrote: > On 01/10/2018 12:48 PM, Szabolcs Nagy wrote: >> meanwhile this passed a build-many-glibcs.py test >> is this ok for 2.27 ? > > I don't think the GCC patch has been committed yet. > > I find it baffling what's going on there. Aren't the ARM maintainers interested in this feature? > i don't know all the details on the gcc side, the original patch was identified to be both suboptimal and incorrect in some cases, however nobody had the time to fix it. however there is a commitment to 64k probe interval by default so even if gcc-8 only does 4k probing or no probing by default, i would still want the larger guard size in glibc (it is also safer with little cost).
On 10/01/18 11:48, Szabolcs Nagy wrote: > On 09/01/18 10:24, Szabolcs Nagy wrote: >> v3: >> - more comment in allocate_stack. >> - define ARCH_MIN_GUARD_SIZE explicitly for all targets. >> - rebase on top of master. >> v2: >> - only change guard size on aarch64 >> - don't report the inflated guard size >> >> There are several compiler implementations that allow large stack >> allocations to jump over the guard page at the end of the stack and >> corrupt memory beyond that. See CVE-2017-1000364. >> >> Compilers can emit code to probe the stack such that the guard page >> cannot be skipped, but on aarch64 the probe interval is 64K instead >> of the minimum supported page size (4K). >> >> This patch enforces at least 64K guard on aarch64 unless the guard >> is disabled by its size to 0. For backward compatibility reasons >> the increased guard is not reported, so it is only observable by >> exhausting the address space or parsing /proc/self/maps on linux. >> >> On other targets the patch has no effect. >> >> The patch does not affect threads with user allocated stacks. >> >> 2018-01-09 Szabolcs Nagy <szabolcs.nagy@arm.com> >> >> * nptl/allocatestack.c (allocate_stack): Use ARCH_MIN_GUARD_SIZE. >> * sysdeps/aarch64/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. >> * sysdeps/alpha/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. >> * sysdeps/arm/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. >> * sysdeps/hppa/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. >> * sysdeps/i386/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. >> * sysdeps/ia64/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. >> * sysdeps/m68k/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. >> * sysdeps/microblaze/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. >> * sysdeps/mips/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. >> * sysdeps/nios2/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. >> * sysdeps/powerpc/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. >> * sysdeps/s390/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. >> * sysdeps/sh/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. >> * sysdeps/sparc/sparc32/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. >> * sysdeps/sparc/sparc64/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. >> * sysdeps/tile/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. >> * sysdeps/x86_64/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. >> > > > meanwhile this passed a build-many-glibcs.py test > is this ok for 2.27 ? > ping. i'd like to have this patch independently of what gcc is doing. i only expect this to affect aarch64. (and new targets that will have to add ARCH_MIN_GUARD_SIZE) > $ grep '"FAIL"' build-state.json > "compilers-m68k-linux-gnu-coldfire gcc-first build": "FAIL", > "glibcs-hppa-linux-gnu check": "FAIL", > "glibcs-m68k-linux-gnu-coldfire check-compilers": "FAIL", > "glibcs-microblaze-linux-gnu check": "FAIL", > "glibcs-microblazeel-linux-gnu check": "FAIL", >
On 01/15/2018 05:59 PM, Szabolcs Nagy wrote:
> i'd like to have this patch independently of what gcc is doing.
This does not make sense to me. The sole purpose of this patch is to
support what GCC is doing, and things still aren't settled on the GCC side.
The patch looks backportable to a release branch to me, so there's no
rush. (I already backported the guard size accounting change.)
Thanks,
Florian
On 15/01/18 17:05, Florian Weimer wrote: > On 01/15/2018 05:59 PM, Szabolcs Nagy wrote: >> i'd like to have this patch independently of what gcc is doing. > > This does not make sense to me. The sole purpose of this patch is to support what GCC is doing, and things > still aren't settled on the GCC side. > i think still think that the patch is useful even without any probing. i don't expect this to be settled in gcc-8. > The patch looks backportable to a release branch to me, so there's no rush. (I already backported the guard > size accounting change.) > ok, then i can wait. > Thanks, > Florian
On Thu, Jan 11, 2018 at 09:32:23AM +0000, Florian Weimer wrote: > On 01/10/2018 12:48 PM, Szabolcs Nagy wrote: > > meanwhile this passed a build-many-glibcs.py test > > is this ok for 2.27 ? > > I don't think the GCC patch has been committed yet. > > I find it baffling what's going on there. Aren't the ARM maintainers > interested in this feature? Last I saw in December, we were making some good progress towards a conclusion over here, which will guide the GCC support. Here is what I proposed then: https://sourceware.org/ml/libc-alpha/2017-12/msg00630.html Our proposal then, having spoken things through with the Arm engineers here, and taken in to consideration the opinions on this thread, is that we move to two "blessed" configurations of the GCC support for AArch64. One would assume 64k guard pages. This would work out-of-the-box on systems with a 64k page size, and would work with modifications to glibc (and other libraries as appropriate) on systems with a 4k (or other) page size. The performance impact will be low. If we take this approach, this will be the default configuration for GCC. The other would assume 4k guard pages. This would work everywhere, and as-good-as guarantee complete coverage. However, it would be inefficient on systems with a larger page size, or with a glibc upgraded to use 64k guard-pages. You replied: https://sourceware.org/ml/libc-alpha/2017-12/msg00635.html So if this is some sort of consensus proposal, as opposed to actual technical requirements which favor Option 2 in some deployments, I think that's not a good idea, and we should go with Option 1 instead. To which Szabolcs replied: https://sourceware.org/ml/libc-alpha/2017-12/msg00662.html well glibc can pretend that only Option 1 is available, my latest patch assumes 64k probe interval: https://sourceware.org/ml/libc-alpha/2017-12/msg00451.html however Option 1 requires generic code to be changed for aarch64 only (in the libc and elsewhere) and we cannot easily do that on all (non-glibc) systems. it seems to me if there are systems where Option 1 may not provide guaranteed trap on stack overflow then gcc should have Option 2 for those systems. Which to me would imply that, as Szabolcs has said, this patch is the correct thing to do regardless of what we do in GCC. The GCC requirements from non-glibc targets remain unclear to me. Rich said: https://sourceware.org/ml/libc-alpha/2017-12/msg00682.html For what it's worth, I would prefer having the assumed minimum guard size be 4k for musl targets. Even if we do increase the default guard to 64k for 64-bit archs (seems likely), applications that manually set it lower for whatever reason should still be handled safely. So, for me, that makes the GCC path clear - the compromise/consensus proposal to have two modes is the only way to unify the glibc and musl requirements. That goes against what Jeff would ideally like: https://sourceware.org/ml/libc-alpha/2017-12/msg00700.html Ideally we set the guard size now and never ever decrease it. I'd really like to remove the option to make it a compile-time configurable --param for GCC. ie, it's baked into the port and never changes. But seems to be the only sensible way to bridge the gap between what different C librarians and users expect. The GCC side conversation finished here just before I took a break for Christmas https://gcc.gnu.org/ml/gcc-patches/2017-12/msg01211.html I'll write a reply to Jeff soon and try to pin down what needs to happen next with the AArch64 GCC side. I do care about this feature, and would like it in GCC 8, there are a fair amount of competing requirements on the patch for AArch64. All that said, Szabolcs' patch over here looks correct, and makes a clear statement about what we can expect as we progress the glibc support. We still have a little time before the GCC 8 release, and the GCC patch will require slight rework around the SVE patch anyway. If we have agreement over here, we at least know what we're working towards. Is there some reason I'm missing that Szabolc's patch would be incorrect, regardless of what we do in GCC? If not, I'd suggest taking it. Thanks, James
On 01/16/2018 05:04 PM, James Greenhalgh wrote: > The GCC requirements from non-glibc targets remain unclear to me. Rich > said: > > https://sourceware.org/ml/libc-alpha/2017-12/msg00682.html > > For what it's worth, I would prefer having the assumed minimum guard > size be 4k for musl targets. Even if we do increase the default guard > to 64k for 64-bit archs (seems likely), applications that manually set > it lower for whatever reason should still be handled safely. > > So, for me, that makes the GCC path clear - the compromise/consensus proposal > to have two modes is the only way to unify the glibc and musl requirements. Currently, musl and glibc requirements are completely aligned: Both provide a 4 KiB guard region and thus require a 4 KiB probe interval and a caller/callee probing regime compatible with that. There is *nothing* in glibc which currently favors a 64 KiB guard region. 4 KiB is strongly preferred because that's how the ABI started out. Thanks, Florian
diff --git a/nptl/allocatestack.c b/nptl/allocatestack.c index b374f4794d0614ebc3af89edd857b798b7d9c6fd..39b9098a0921f2eef573dcdca016d2ea296bbef1 100644 --- a/nptl/allocatestack.c +++ b/nptl/allocatestack.c @@ -520,6 +520,7 @@ allocate_stack (const struct pthread_attr *attr, struct pthread **pdp, { /* Allocate some anonymous memory. If possible use the cache. */ size_t guardsize; + size_t reported_guardsize; size_t reqsize; void *mem; const int prot = (PROT_READ | PROT_WRITE @@ -530,8 +531,17 @@ allocate_stack (const struct pthread_attr *attr, struct pthread **pdp, assert (size != 0); /* Make sure the size of the stack is enough for the guard and - eventually the thread descriptor. */ + eventually the thread descriptor. On some targets there is + a minimum guard size requirement, ARCH_MIN_GUARD_SIZE, so + internally enforce it (unless the guard was disabled), but + report the original guard size for backward compatibility: + before POSIX 2008 the guardsize was specified to be one page + by default which is observable via pthread_attr_getguardsize + and pthread_getattr_np. */ guardsize = (attr->guardsize + pagesize_m1) & ~pagesize_m1; + reported_guardsize = guardsize; + if (guardsize > 0 && guardsize < ARCH_MIN_GUARD_SIZE) + guardsize = ARCH_MIN_GUARD_SIZE; if (guardsize < attr->guardsize || size + guardsize < guardsize) /* Arithmetic overflow. */ return EINVAL; @@ -743,7 +753,7 @@ allocate_stack (const struct pthread_attr *attr, struct pthread **pdp, /* The pthread_getattr_np() calls need to get passed the size requested in the attribute, regardless of how large the actually used guardsize is. */ - pd->reported_guardsize = guardsize; + pd->reported_guardsize = reported_guardsize; } /* Initialize the lock. We have to do this unconditionally since the diff --git a/sysdeps/aarch64/nptl/pthreaddef.h b/sysdeps/aarch64/nptl/pthreaddef.h index 32f729ada1d96054c9158c9fe165f60ecc967caf..da2c5de3172d0ccf4503c23368f7f85ee5a6de2c 100644 --- a/sysdeps/aarch64/nptl/pthreaddef.h +++ b/sysdeps/aarch64/nptl/pthreaddef.h @@ -19,6 +19,9 @@ /* Default stack size. */ #define ARCH_STACK_DEFAULT_SIZE (2 * 1024 * 1024) +/* Minimum guard size. */ +#define ARCH_MIN_GUARD_SIZE (64 * 1024) + /* Required stack pointer alignment at beginning. */ #define STACK_ALIGN 16 diff --git a/sysdeps/alpha/nptl/pthreaddef.h b/sysdeps/alpha/nptl/pthreaddef.h index f5055836005ac220c961bfcc1749bc39d1e65270..c0ad663f1c3612f3655bccf987adfda5dc591eca 100644 --- a/sysdeps/alpha/nptl/pthreaddef.h +++ b/sysdeps/alpha/nptl/pthreaddef.h @@ -18,6 +18,9 @@ /* Default stack size. */ #define ARCH_STACK_DEFAULT_SIZE (4 * 1024 * 1024) +/* Minimum guard size. */ +#define ARCH_MIN_GUARD_SIZE 0 + /* Required stack pointer alignment at beginning. The ABI requires 16. */ #define STACK_ALIGN 16 diff --git a/sysdeps/arm/nptl/pthreaddef.h b/sysdeps/arm/nptl/pthreaddef.h index f8d821d6f2800660b45153019c1f0e04475e0da1..22d128d75f182f524ef625da6121983bab86bc10 100644 --- a/sysdeps/arm/nptl/pthreaddef.h +++ b/sysdeps/arm/nptl/pthreaddef.h @@ -18,6 +18,9 @@ /* Default stack size. */ #define ARCH_STACK_DEFAULT_SIZE (2 * 1024 * 1024) +/* Minimum guard size. */ +#define ARCH_MIN_GUARD_SIZE 0 + /* Required stack pointer alignment at beginning. SSE requires 16 bytes. */ #define STACK_ALIGN 16 diff --git a/sysdeps/hppa/nptl/pthreaddef.h b/sysdeps/hppa/nptl/pthreaddef.h index cdb55687f531e83324a149daeeb461857cf89e4a..251513f60a353a55962054a2212985bd975a23fd 100644 --- a/sysdeps/hppa/nptl/pthreaddef.h +++ b/sysdeps/hppa/nptl/pthreaddef.h @@ -18,6 +18,9 @@ /* Default stack size. */ #define ARCH_STACK_DEFAULT_SIZE (8 * 1024 * 1024) +/* Minimum guard size. */ +#define ARCH_MIN_GUARD_SIZE 0 + /* Required stack pointer alignment at beginning. */ #define STACK_ALIGN 64 diff --git a/sysdeps/i386/nptl/pthreaddef.h b/sysdeps/i386/nptl/pthreaddef.h index deacd92edf2cea0540add4a4bcf44b487cf03abc..51e098dbcd83f271ca903673aad7e4afc36e1fce 100644 --- a/sysdeps/i386/nptl/pthreaddef.h +++ b/sysdeps/i386/nptl/pthreaddef.h @@ -19,6 +19,9 @@ /* Default stack size. */ #define ARCH_STACK_DEFAULT_SIZE (2 * 1024 * 1024) +/* Minimum guard size. */ +#define ARCH_MIN_GUARD_SIZE 0 + /* Required stack pointer alignment at beginning. SSE requires 16 bytes. */ #define STACK_ALIGN 16 diff --git a/sysdeps/ia64/nptl/pthreaddef.h b/sysdeps/ia64/nptl/pthreaddef.h index 09f9acf25c1a893e4a62f03dbaf61a75f3e768f0..2c5a2da3737008eb99b1d6ca616a6c971292aa8e 100644 --- a/sysdeps/ia64/nptl/pthreaddef.h +++ b/sysdeps/ia64/nptl/pthreaddef.h @@ -18,6 +18,9 @@ /* Default stack size. */ #define ARCH_STACK_DEFAULT_SIZE (32 * 1024 * 1024) +/* Minimum guard size. */ +#define ARCH_MIN_GUARD_SIZE 0 + /* IA-64 uses a normal stack and a register stack. */ #define NEED_SEPARATE_REGISTER_STACK diff --git a/sysdeps/m68k/nptl/pthreaddef.h b/sysdeps/m68k/nptl/pthreaddef.h index 68fc37a394f8c2c5da85852afde608958230a965..84092356e49a0eef487a12d5aa6e55109e991d23 100644 --- a/sysdeps/m68k/nptl/pthreaddef.h +++ b/sysdeps/m68k/nptl/pthreaddef.h @@ -19,6 +19,9 @@ /* Default stack size. */ #define ARCH_STACK_DEFAULT_SIZE (2 * 1024 * 1024) +/* Minimum guard size. */ +#define ARCH_MIN_GUARD_SIZE 0 + /* Required stack pointer alignment at beginning. */ #define STACK_ALIGN 16 diff --git a/sysdeps/microblaze/nptl/pthreaddef.h b/sysdeps/microblaze/nptl/pthreaddef.h index 12fac81398e74949740b2d47cfeb5030e76ec229..377f751b5e13dd5ab5f011ec09a7a155c9562588 100644 --- a/sysdeps/microblaze/nptl/pthreaddef.h +++ b/sysdeps/microblaze/nptl/pthreaddef.h @@ -22,6 +22,9 @@ /* Default stack size. */ #define ARCH_STACK_DEFAULT_SIZE (2 * 1024 * 1024) +/* Minimum guard size. */ +#define ARCH_MIN_GUARD_SIZE 0 + /* Required stack pointer alignment at beginning. */ #define STACK_ALIGN 16 diff --git a/sysdeps/mips/nptl/pthreaddef.h b/sysdeps/mips/nptl/pthreaddef.h index 7b1283ae64b1d3b99ad6cf7a3db0331a3b919414..936e5175935c6343840181b122891a9a4c4414e4 100644 --- a/sysdeps/mips/nptl/pthreaddef.h +++ b/sysdeps/mips/nptl/pthreaddef.h @@ -18,6 +18,9 @@ /* Default stack size. */ #define ARCH_STACK_DEFAULT_SIZE (2 * 1024 * 1024) +/* Minimum guard size. */ +#define ARCH_MIN_GUARD_SIZE 0 + /* Required stack pointer alignment at beginning. */ #define STACK_ALIGN 16 diff --git a/sysdeps/nios2/nptl/pthreaddef.h b/sysdeps/nios2/nptl/pthreaddef.h index b70d1d17b3393ad77563048c2ddc16f8c065f617..34862beebffbc0e113efc407402cdbcda70fac6a 100644 --- a/sysdeps/nios2/nptl/pthreaddef.h +++ b/sysdeps/nios2/nptl/pthreaddef.h @@ -19,6 +19,9 @@ /* Default stack size. */ #define ARCH_STACK_DEFAULT_SIZE (2 * 1024 * 1024) +/* Minimum guard size. */ +#define ARCH_MIN_GUARD_SIZE 0 + /* Required stack pointer alignment at beginning. */ #define STACK_ALIGN 4 diff --git a/sysdeps/powerpc/nptl/pthreaddef.h b/sysdeps/powerpc/nptl/pthreaddef.h index 83416849eefd55d04a12a6d4c87a2137f180643b..e7f0617d516556c4425361c2d3b3680372df83a7 100644 --- a/sysdeps/powerpc/nptl/pthreaddef.h +++ b/sysdeps/powerpc/nptl/pthreaddef.h @@ -18,6 +18,9 @@ /* Default stack size. */ #define ARCH_STACK_DEFAULT_SIZE (4 * 1024 * 1024) +/* Minimum guard size. */ +#define ARCH_MIN_GUARD_SIZE 0 + /* Required stack pointer alignment at beginning. The ABI requires 16 bytes (for both 32-bit and 64-bit PowerPC). */ #define STACK_ALIGN 16 diff --git a/sysdeps/s390/nptl/pthreaddef.h b/sysdeps/s390/nptl/pthreaddef.h index 410ae7b8962f8bdb44bc13d42ff771d6289cc829..7aa0fc76179d04e5c531f617f6971fdc9696fa8d 100644 --- a/sysdeps/s390/nptl/pthreaddef.h +++ b/sysdeps/s390/nptl/pthreaddef.h @@ -18,6 +18,9 @@ /* Default stack size. */ #define ARCH_STACK_DEFAULT_SIZE (2 * 1024 * 1024) +/* Minimum guard size. */ +#define ARCH_MIN_GUARD_SIZE 0 + /* Required stack pointer alignment at beginning. SSE requires 16 bytes. */ #define STACK_ALIGN 16 diff --git a/sysdeps/sh/nptl/pthreaddef.h b/sysdeps/sh/nptl/pthreaddef.h index 97c7e07100430ade57c455717ad572456f86805b..8a295a991c3a5f52698409246ddd53efcd333eea 100644 --- a/sysdeps/sh/nptl/pthreaddef.h +++ b/sysdeps/sh/nptl/pthreaddef.h @@ -20,6 +20,9 @@ /* Default stack size. */ #define ARCH_STACK_DEFAULT_SIZE (2 * 1024 * 1024) +/* Minimum guard size. */ +#define ARCH_MIN_GUARD_SIZE 0 + /* Required stack pointer alignment at beginning. */ #define STACK_ALIGN 8 diff --git a/sysdeps/sparc/sparc32/pthreaddef.h b/sysdeps/sparc/sparc32/pthreaddef.h index 57fe5fd5143fc06e3758308f2c4fb82e38f15245..798c8837ea9141617611770293d32be9583b2042 100644 --- a/sysdeps/sparc/sparc32/pthreaddef.h +++ b/sysdeps/sparc/sparc32/pthreaddef.h @@ -18,6 +18,9 @@ /* Default stack size. */ #define ARCH_STACK_DEFAULT_SIZE (2 * 1024 * 1024) +/* Minimum guard size. */ +#define ARCH_MIN_GUARD_SIZE 0 + /* Required stack pointer alignment at beginning. */ #define STACK_ALIGN 16 diff --git a/sysdeps/sparc/sparc64/pthreaddef.h b/sysdeps/sparc/sparc64/pthreaddef.h index 62e2290b233ae9d72ced4fd755a7dfe7324026c5..b9f738f6a9afe11f5bb18b28b66a63f660bed048 100644 --- a/sysdeps/sparc/sparc64/pthreaddef.h +++ b/sysdeps/sparc/sparc64/pthreaddef.h @@ -18,6 +18,9 @@ /* Default stack size. */ #define ARCH_STACK_DEFAULT_SIZE (4 * 1024 * 1024) +/* Minimum guard size. */ +#define ARCH_MIN_GUARD_SIZE 0 + /* Required stack pointer alignment at beginning. */ #define STACK_ALIGN 16 diff --git a/sysdeps/tile/nptl/pthreaddef.h b/sysdeps/tile/nptl/pthreaddef.h index a1c00620bf350a14efdf029c027266300b1fb09e..6e09ef6d5c7355283948427f14a182ed4125aceb 100644 --- a/sysdeps/tile/nptl/pthreaddef.h +++ b/sysdeps/tile/nptl/pthreaddef.h @@ -22,6 +22,9 @@ /* Default stack size. */ #define ARCH_STACK_DEFAULT_SIZE (2 * 1024 * 1024) +/* Minimum guard size. */ +#define ARCH_MIN_GUARD_SIZE 0 + /* Required stack pointer alignment at beginning. */ #define STACK_ALIGN 16 diff --git a/sysdeps/x86_64/nptl/pthreaddef.h b/sysdeps/x86_64/nptl/pthreaddef.h index 036deb577238b652bdbae9dfb93fd1e160d132e9..0188113fb71356a98e6fc919b3cf4848b3ae23e6 100644 --- a/sysdeps/x86_64/nptl/pthreaddef.h +++ b/sysdeps/x86_64/nptl/pthreaddef.h @@ -19,6 +19,9 @@ /* Default stack size. */ #define ARCH_STACK_DEFAULT_SIZE (2 * 1024 * 1024) +/* Minimum guard size. */ +#define ARCH_MIN_GUARD_SIZE 0 + /* Required stack pointer alignment at beginning. SSE requires 16 bytes. */ #define STACK_ALIGN 16
v3: - more comment in allocate_stack. - define ARCH_MIN_GUARD_SIZE explicitly for all targets. - rebase on top of master. v2: - only change guard size on aarch64 - don't report the inflated guard size There are several compiler implementations that allow large stack allocations to jump over the guard page at the end of the stack and corrupt memory beyond that. See CVE-2017-1000364. Compilers can emit code to probe the stack such that the guard page cannot be skipped, but on aarch64 the probe interval is 64K instead of the minimum supported page size (4K). This patch enforces at least 64K guard on aarch64 unless the guard is disabled by its size to 0. For backward compatibility reasons the increased guard is not reported, so it is only observable by exhausting the address space or parsing /proc/self/maps on linux. On other targets the patch has no effect. The patch does not affect threads with user allocated stacks. 2018-01-09 Szabolcs Nagy <szabolcs.nagy@arm.com> * nptl/allocatestack.c (allocate_stack): Use ARCH_MIN_GUARD_SIZE. * sysdeps/aarch64/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. * sysdeps/alpha/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. * sysdeps/arm/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. * sysdeps/hppa/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. * sysdeps/i386/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. * sysdeps/ia64/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. * sysdeps/m68k/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. * sysdeps/microblaze/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. * sysdeps/mips/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. * sysdeps/nios2/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. * sysdeps/powerpc/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. * sysdeps/s390/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. * sysdeps/sh/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. * sysdeps/sparc/sparc32/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. * sysdeps/sparc/sparc64/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. * sysdeps/tile/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define. * sysdeps/x86_64/nptl/pthreaddef.h (ARCH_MIN_GUARD_SIZE): Define.