public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Oleg Nesterov <oleg@redhat.com>
To: "H. Peter Anvin" <hpa@zytor.com>, Suresh Siddha <sbsiddha@gmail.com>
Cc: Al Viro <viro@ZenIV.linux.org.uk>,
	Bean Anderson <bean@azulsystems.com>,
	Fenghua Yu <fenghua.yu@intel.com>, Ingo Molnar <mingo@redhat.com>,
	Linus Torvalds <torvalds@linux-foundation.org>,
	x86@kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH v2 1/7] x86, fpu: shift drop_init_fpu() from save_xstate_sig() to handle_signal()
Date: Tue, 2 Sep 2014 19:57:13 +0200	[thread overview]
Message-ID: <20140902175713.GA21646@redhat.com> (raw)
In-Reply-To: <20140902175654.GA21626@redhat.com>

save_xstate_sig()->drop_init_fpu() doesn't look right. setup_rt_frame()
can fail after that, in this case the next setup_rt_frame() triggered
by SIGSEGV won't save fpu simply because the old state was lost. This
obviously mean that fpu won't be restored after sys_rt_sigreturn() from
SIGSEGV handler.

Shift drop_init_fpu() into !failed branch in handle_signal().

Test-case (needs -O2):

	#include <stdio.h>
	#include <signal.h>
	#include <unistd.h>
	#include <sys/syscall.h>
	#include <sys/mman.h>
	#include <pthread.h>
	#include <assert.h>

	volatile double D;

	void test(double d)
	{
		int pid = getpid();

		for (D = d; D == d; ) {
			/* sys_tkill(pid, SIGHUP); asm to avoid save/reload
			 * fp regs around "C" call */
			asm ("" : : "a"(200), "D"(pid), "S"(1));
			asm ("syscall" : : : "ax");
		}

		printf("ERR!!\n");
	}

	void sigh(int sig)
	{
	}

	char altstack[4096 * 10] __attribute__((aligned(4096)));

	void *tfunc(void *arg)
	{
		for (;;) {
			mprotect(altstack, sizeof(altstack), PROT_READ);
			mprotect(altstack, sizeof(altstack), PROT_READ|PROT_WRITE);
		}
	}

	int main(void)
	{
		stack_t st = {
			.ss_sp = altstack,
			.ss_size = sizeof(altstack),
			.ss_flags = SS_ONSTACK,
		};

		struct sigaction sa = {
			.sa_handler = sigh,
		};

		pthread_t pt;

		sigaction(SIGSEGV, &sa, NULL);
		sigaltstack(&st, NULL);
		sa.sa_flags = SA_ONSTACK;
		sigaction(SIGHUP, &sa, NULL);

		pthread_create(&pt, NULL, tfunc, NULL);

		test(123.456);
		return 0;
	}

Reported-by: Bean Anderson <bean@azulsystems.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Cc: <stable@kernel.org>
---
 arch/x86/kernel/signal.c |    5 +++++
 arch/x86/kernel/xsave.c  |    2 --
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index 2851d63..ed37a76 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -675,6 +675,11 @@ handle_signal(struct ksignal *ksig, struct pt_regs *regs)
 		 * handler too.
 		 */
 		regs->flags &= ~(X86_EFLAGS_DF|X86_EFLAGS_RF|X86_EFLAGS_TF);
+		/*
+		 * Ensure the signal handler starts with the new fpu state.
+		 */
+		if (used_math())
+			drop_init_fpu(current);
 	}
 	signal_setup_done(failed, ksig, test_thread_flag(TIF_SINGLESTEP));
 }
diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
index a4b451c..74b34c2 100644
--- a/arch/x86/kernel/xsave.c
+++ b/arch/x86/kernel/xsave.c
@@ -268,8 +268,6 @@ int save_xstate_sig(void __user *buf, void __user *buf_fx, int size)
 	if (use_fxsr() && save_xstate_epilog(buf_fx, ia32_fxstate))
 		return -1;
 
-	drop_init_fpu(tsk);	/* trigger finit */
-
 	return 0;
 }
 
-- 
1.5.5.1


  reply	other threads:[~2014-09-02 17:59 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-09-02 17:56 [PATCH 0/7] x86, fpu: misc fixes/cleanups, more to come Oleg Nesterov
2014-09-02 17:57 ` Oleg Nesterov [this message]
2014-09-02 22:18   ` [tip:x86/fpu] x86, fpu: shift drop_init_fpu() from save_xstate_sig() to handle_signal() tip-bot for Oleg Nesterov
2014-09-02 17:57 ` [PATCH v2 2/7] x86, fpu: __restore_xstate_sig()->math_state_restore() needs preempt_disable() Oleg Nesterov
2014-09-02 22:18   ` [tip:x86/fpu] x86, fpu: __restore_xstate_sig()-> math_state_restore() " tip-bot for Oleg Nesterov
2014-09-02 17:57 ` [PATCH v2 3/7] x86, fpu: change __thread_fpu_begin() to use use_eager_fpu() Oleg Nesterov
2014-09-02 22:19   ` [tip:x86/fpu] x86, fpu: Change " tip-bot for Oleg Nesterov
2014-09-02 17:57 ` [PATCH v2 4/7] x86, fpu: copy_process: avoid fpu_alloc/copy if !used_math() Oleg Nesterov
2014-09-02 22:19   ` [tip:x86/fpu] x86, fpu: copy_process: Avoid fpu_alloc/ copy " tip-bot for Oleg Nesterov
2014-09-02 17:57 ` [PATCH v2 5/7] x86, fpu: copy_process: sanitize fpu->last_cpu initialization Oleg Nesterov
2014-09-02 22:19   ` [tip:x86/fpu] x86, fpu: copy_process: Sanitize fpu-> last_cpu initialization tip-bot for Oleg Nesterov
2014-09-02 17:57 ` [PATCH v2 6/7] x86, fpu: shift "fpu_counter = 0" from copy_thread() to arch_dup_task_struct() Oleg Nesterov
2014-09-02 22:19   ` [tip:x86/fpu] x86, fpu: Shift "fpu_counter = 0" from copy_thread( ) " tip-bot for Oleg Nesterov
2014-09-02 17:57 ` [PATCH v2 7/7] x86: copy_thread: don't nullify ->ptrace_bps twice Oleg Nesterov
2014-09-02 22:19   ` [tip:x86/fpu] x86: copy_thread: Don't " tip-bot for Oleg Nesterov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20140902175713.GA21646@redhat.com \
    --to=oleg@redhat.com \
    --cc=bean@azulsystems.com \
    --cc=fenghua.yu@intel.com \
    --cc=hpa@zytor.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@redhat.com \
    --cc=sbsiddha@gmail.com \
    --cc=torvalds@linux-foundation.org \
    --cc=viro@ZenIV.linux.org.uk \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox