Re: [PATCH] xen/x86: don't corrupt %eip when returning from a signal handler

[David Vrabel <david.vrabel@citrix.com>]

On 17/10/12 12:42, David Vrabel wrote:
> From: David Vrabel <david.vrabel@citrix.com>
> 
> In 32 bit guests, if a userspace process has %eax == -ERESTARTSYS
> (-512) or -ERESTARTNOINTR (-513) when it is interrupted by an event
> /and/ the process has a pending signal then %eip (and %eax) are
> corrupted when returning to the main process after handling the
> signal.  The application may then crash with SIGSEGV or a SIGILL or it
> may have subtly incorrect behaviour (depending on what instruction it
> returned to).

The following test program shows the bug.  It will receive the signal
when in the infinite loop and return to the preceeding int 3 instruction.

Big thanks to Frediano for producing the test program and the majority
of the effort in tracking down this bug.

David

8<--------------------------
#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <assert.h>
#include <sys/time.h>

static void handler(int sig)
{
	static unsigned count = 0;
	if (++count == 60 * 1000)
		exit(0);
}

int main(void)
{
	struct sigaction act;

	// set signal
	sigfillset(&act.sa_mask);
	act.sa_flags = 0;
	act.sa_handler = handler;

	int err = sigaction(SIGALRM, &act, NULL);
	assert(!err);

	// set timer
	struct itimerval ival = { { 0, 1000 }, { 0, 1000 } };
	err = setitimer(ITIMER_REAL, &ival, NULL);
	assert(!err);

#if !defined(__x86_64__) && !defined(__i386__)
# error This code work only on Intel architecture!
#endif

	// wait for a core !!
	asm(
#ifdef __x86_64__
"	mov	$-513, %rax\n"
#else
"	mov	$-513, %eax\n"
#endif
"	jmp	infinite\n"
"	int	$3\n"
"	int	$3\n"
"	int	$3\n"
"	int	$3\n"
"infinite:\n"
"	jmp	infinite\n"
);

	return 0;
}